Original | NFTethics
Compiled by | Odaily Star Daily
If you are a Meme coin enthusiast, you must have heard of the hottest project this year, PEPE, and may have also heard of related wealth myths. For example, some so-called “SmartMoney” addresses bought PEPE for $100 at the beginning and never sold, eventually making tens of thousands of times in profits (on-chain data can confirm this).
Why can’t ordinary people be the first wave to get on board and grab the “thousand-fold coin”? Because the most profitable individuals in such projects are the manipulators, who can buy at the bottom and sell at the top; even the original intention of such Meme projects is only to help launder money.
- Arbitrum incentive program launched, Wintermute recommended 5 projects and reasons for support
- Bitcoin’s new proposal BitVM interpretation Bitcoin Turing complete without the need for fork
- Inventory of 16 Israeli concept coins worth paying attention to, with infrastructure and DeFi as the main force.
Recently, the user “NFTethics” on X platform (formerly Twitter) published multiple long articles, determining the true identity of the manipulator behind PEPE through meticulous on-chain analysis and various evidence.
To summarize the main points of his tweets:
1. In November 2021, the funds from the Rug Pull project AnubisDAO were laundered through the popular PEPE project, and the anonymous and well-known DeFi investor Sisyphus was behind the manipulation.
2. Sisyphus’s real identity is Kevin Lian Guaiwlak, the head of OpenSea Ventures, who now lives a luxurious life.
3. Sisyphus (i.e., Kevin Lian Guaiwlak) is the true mastermind behind the AnubisDAO project, who obtained the private key of the project manager through hacking and transferred the funds, successfully finding a scapegoat and evading punishment.
The latest news is that an OpenSea spokesperson responded to this matter: “Kevin Lian Guaiwlak resigned in June 2023. During his time at OpenSea, he had limited responsibilities and held a non-managerial position. We do not know if he was involved in the AnubisDAO Rug event. In addition, we have no connection or information about the related projects because they took place before he joined OpenSea.”
1. Anubis project used PEPE to launder Rug funds
Let’s go back to November 2021. AnubisDAO, a mimicry project of OlympusDAO (with token ANKH), raised 13,256.4 ETH (worth about $57 million at the time) through an LBP (Liquidity Bootstrapping Pool). However, the management team soon discovered that these funds had been transferred to another new address, while the LBP had been running for 20 hours and had not yet reached its end time.
What role does our protagonist Sisyphus play in AnubisDAO? On the surface, he is the project’s ambassador, but in secret, he is the mastermind (to be explained later).
The day before the AnubisDAO funds were taken away, Sisyphus was still vigorously promoting the project in the Discord community and claimed to have bought $420,000 (remember this fact, it’s important), and would buy more in the future. Moreover, to dispel everyone’s concerns, Sisyphus also stated that this project would never rug, even if development did not go smoothly, everyone would eventually get their initial investment back.
As a result, the project was really rug pulled the next day. Sisyphus immediately wrote a long essay to absolve himself of responsibility and claimed to have been in contact with law enforcement agencies in the United States and Hong Kong, calling on the hacker to return the money as soon as possible. After that, there was no more news from Sisyphus, and there were no more updates on AnubisDAO-related developments. It seems that $420,000 really was just a small amount of money.
Of course, the hacker did not return the stolen funds from AnubisDAO. Over the past two years, these stolen funds have been continuously transferred to various mixer platforms and platforms that do not require KYC for money laundering. One of the wallet addresses (Anubis Rug 3) interacts with FixedFloat, a non-KYC platform in Seychelles, for example, the gas for this wallet is sent by FixedFloat. As shown below:
Interestingly, the initial funding for PEPE project holders also came from the FixedFloat platform, such as Zach Testa (account: DegenHarambe) and Max Zim (account: SumFattyTuna). In particular, Zach Testa bought in just a few minutes after the PEPE token contract was released on April 14th, and then tweeted about the project. Three minutes later, Max Zim immediately retweeted the tweet and also bought PEPE. The whole process seemed very smooth, as if it had been rehearsed.
There is a close relationship between Sisyphus and Zach Testa and Max Zim. It is rumored that Zim was Sisyphus’ former roommate. Before the AnubisDAO rug pull, Sisyphus’ wallet had interacted with Zim for transfer transactions. Moreover, the two had also participated in a talk show interview together, with Sisyphus not appearing in person.
On April 17th, Sisyphus tweeted, “Someone used a token called ‘pepe’ to turn 0.02 ETH into 63 ETH over the weekend,” and posted an address starting with 0x5DD. Zim immediately responded to Sisyphus’ post, and the two interacted.
Interestingly, the address starting with 0x5DD received initial funding from the FixFloat platform on April 7th. In addition, on April 7th, another version of the “PEPE” token (referred to as aPEPE for distinction) was also launched, with the same contract and early batch holders as the current well-known version of PEPE. For example, Zim entered the market by purchasing aPEPE at the beginning of its release on April 7th, but he claimed in a later community interview that he had never heard of PEPE before. It seems that Zim knew from the beginning that PEPE coin was going to rise.
The coincidences go far beyond what is mentioned above. When the Anubis Rug 3 wallet transferred 3000 ETH, 2 minutes later, the Zim wallet address started interacting on the chain to buy PEPE. Investigation also found that when wallets associated with Anubis Rug were active in transferring funds, the Zim wallet seemed to be conducting operations related to PEPE.
In addition, Anubis primarily laundered its funds through platforms such as Stake. Wallet addresses associated with PEPE, on the other hand, transferred a large amount of funds to Stake after PEPE’s launch on April 14th, and then from Stake to FixFloat. Furthermore, the majority of the stolen funds from Anubis were transferred between March and July of this year, which coincides/synchronizes with the growth cycle of PEPE. There is a deep connection between the two, and the stolen funds may have been whitewashed through PEPE speculation.
Regarding the complete whereabouts of the stolen funds from Anubis, joint action from CEX and OTC platforms is needed. Some of the funds flowed into platforms that require KYC. More evidence is needed to verify whether there is a connection between the stolen funds from Anubis and the speculation around PEPE.
Adding a detail, in August of this year, there was an internal conflict within the PEPE team, and several former members privately deleted multi-signature permissions and sold the tokens. Finally, the official released a vague announcement.
II. Sisyphus Leading Anubis and Designing its Own Rug
Blogger “NFTethics” obtained internal chat logs of the team members of Anubis a few days before their funds were stolen.
According to the investigation and reasoning, Sisyphus seems to be the true leader behind the project. Almost everything requires his approval and signature, including the exact wording of each tweet and every technical/financial issue. Moreover, the project’s rug pull seems to be orchestrated by Sisyphus himself, successfully pinning the blame on another member, “Beerus”.
In the team division chart, Sisyphus positioned himself as “responsible for external public relations and helping to unite DAO members,” but in reality, he is the one in charge of giving orders.
Team member “AureliusBTC” said in the chat, “None of us really understand LBP (Liquidity Bootstrapping Pool), but as long as Sisyphus understands, it’s fine.” When another member, “Beerus,” made a post announcing the addition of new members to Anubis, Sisyphus immediately instructed him to delete the tweet, and Beerus complied. Furthermore, Sisyphus also mentioned in the chat logs that he had connections with Alameda Research (a cryptocurrency company under SBF) and that they also purchased Anubis’ token, ANKH.
Let’s focus on the issue of Anubis losing liquidity. After the incident, Sisyphus claimed that “DAO members agreed to let Beerus deploy LBP because they either had no time or didn’t want to take responsibility.” However, there is no evidence to support this claim in internal chats. In fact, Sisyphus initially mentioned that they were using the “best multisig ever,” but later in the chat, they said they couldn’t sign the authorization. Therefore, it is speculated that they may have changed the original multisig to be solely responsible for Beerus, setting the stage for the subsequent attack. The timeline of the story is as follows:
- Late on October 28th, Sisyphus mentioned that they were going to sleep and planned to sleep for 6 hours. The last message was at 00:16;
- The next morning, when they joined the chat, it was 07:18 in the morning, and they answered a few questions in the group;
- At 07:20, “Beerus,” who had LBP management permissions, received an email from Sisyphus’ email address, which contained a PDF with SAFT (Simple Agreement for Future Tokens) – Beerus mentioned after the incident that this PDF contained a Trojan virus that damaged his computer and stole LBP management permissions;
- At 07:26, Sisyphus communicated with Beerus for a while and reminded him to stay awake until the end of LBP. They continued to communicate until 07:44, with 4 hours remaining until the end of LBP;
- At 07:48, LBP funds were depleted, and all ETH was withdrawn from the management account to a new address, leaving only a worthless pile of ANKH tokens.
According to the investigation afterwards, neither the Copper platform nor Balancer’s smart contracts were breached or damaged. In other words, either Beerus’s wallet account, as claimed, was invaded, or it was a self-directed act. Sisyphus claimed that his email address never sent that email.
Who is lying? We can infer from some circumstantial information. First, not only Beerus received the email, but other VC contacts also received it – the difference is that Beerus received the PDF email at 07:20 in the morning, while others received it half an hour later, and some even several hours later. One possible explanation is that the attacker sent mass emails to confuse the targets and also reserved time for Beerus to open the PDF and attack the computer.
Furthermore, when analyzing the other received PDFs afterwards, there were no visible anti-spoofing warnings. SPF does not mark Gmail addresses unless the address is not actually from Gmail. According to the photo, it is highly likely that the address did send actual emails. In other words, these emails were indeed sent from Sisyphus’s real email address – and Sisyphus adamantly claimed that they did not send the email and even asked innocently in the group chat, “What does this mean?”
In addition, analysis of other people’s emails found that no Trojan virus was loaded – in fact, only Beerus may have the virus. Afterwards, he also submitted his computer to the Hong Kong police to prove his innocence (there is currently no latest progress, and the incident seems to have ended).
The question is, how did the attacker know that Beerus had LBP management authority? Apart from some insiders, no one knows that Beerus is the (only) person with control. In fact, Convex, a member of the Anubis team, mentioned this in the group chat: “Why would Beerus even receive malicious software? It doesn’t make sense for him to be a target. It is well known that aureliusBTC and I are the developers, and it is more like we have control of the private keys. Outsiders have no idea about Beerus’s specific situation.”
Interestingly, Sisyphus also asked Beerus, “Hey, what did you click on?” At this time, Beerus had not yet revealed to everyone that he had clicked on that malicious email PDF. No one else knew, so how did Sisyphus know?
After the LBP funding pool was drained, Sisyphus accused Beerus of implementing a Rug on the project and said, “You ruined my reputation.” Furthermore, Sisyphus also revealed the IP address of the attacker and mentioned that it came from Hong Kong where Beerus lives – in fact, this IP address comes from a third-party VPS provider that can rent servers in different regions and is not of reference value. Later, Beerus’s real identity was revealed by investors, and he turned out to be the son of a well-known figure in the Hong Kong horse racing industry, Zhang Shunzheng, at the age of 19.
There is another detail. Max Zim, mentioned earlier as an early participant in PEPE, also participated in Anubis’s sale this time. Afterwards, he defended Sisyphus on Twitter, as the two have a close relationship.
III. Sisyphus opens another account, real identity is Kevin LianGuaiwlak, the head of OpenSea Ventures
As we mentioned earlier, Sisyphus, who claimed to have invested $420,000 in the Anubis project, was not at all disappointed after the Rug incident. After posting a short essay to absolve himself of responsibility, he no longer paid attention to the progress.
On November 6th (one week after the attack), Sisyphus opened another account on Twitter under the alias “0xMagallan” (now deactivated). This account has been unusually active in the past two years, with over 5,000 tweets, participating in various project marketing. The account includes two wallet addresses, ferdinand-magellan.eth and ukrainedonations.eth.
In fact, there are many controversial aspects to Sisyphus (Kevin LianGuaiwlak). For example, he once purchased the expensive NFT Etherrock 72 and fragmented it into PEBBLE tokens through the NFT fractionalization protocol Fractional, and sold it at a high premium. In terms of ETH, the PEBBLE token has experienced a drop of over 99% from its peak. The project has been shut down in 2023, ending all operations, and the official website of PEBBLE, pebble.xyz, has also expired and is in the selling phase.
It seems that no one has ever seen the true identity of Sisyphus and 0xMagallan, and there is no relevant information online. However, “NFTethics” has confirmed their true identity through various on-chain information and multiple sources, and they are Kevin LianGuaiwlak, the head of OpenSea Ventures.
Kevin LianGuaiwlak
First of all, the timestamps on LianGuaiwlak.eth and sisyphus.eth addresses match completely. On-chain data shows that they both minted Zorbs (ZORB) within a 1-minute interval, and they also minted sismo.eth DAO (SDAO) within a 10-minute interval. The intervals between other on-chain operations are also short, and the accounts are active at a similar frequency.
Interestingly, Kevin LianGuaiwlak also often uses the alias “Sisyphus” to post some critical posts about OpenSea – perhaps to put pressure on them to launch a project that benefits him the most, or maybe just to vent.
More people, including TheBlock journalist Tim Copeland, have confirmed that Sisyphus’ true identity is indeed Kevin LianGuaiwlak – in fact, his identity is well-known in small circles. Now, he has renamed his wallet to LianGuaiwlak.eth. The wallet address is: 0xBB5BB336d1Db8471B77F936C210B15fa2A5b3cbb.
Kevin LianGuaiwlak is very intelligent and was a semifinalist in the Intel Science Talent Search. He has a degree in chemical engineering and wants to become a surgeon/scientist. However, people who know him mention his dark side: ruthless, unethical, antisocial, and capable of lying without conscience or remorse.
In October of last year, Kevin LianGuaiwlak purchased another property in New York for $3.3 million. According to sources, he recently bought a Rolls-Royce and a Lamborghini in France (worth over $1 million) and privately flaunted his wealth and luxurious lifestyle.
Currently, Kevin LianGuaiwlak (Sisyphus) has not responded directly to external doubts. If there are any latest developments, Odaily Star Daily will be the first to report on them.
Like what you're reading? Subscribe to our top stories.
We will continue to update Gambling Chain; if you have any questions or suggestions, please contact us!
