Case File · GEI-2026-0414 · ICO presale rug-pull

Liquidity Gone by Morning: Anatomy of a Presale Rug-Pull

The NimbusChain presale had an audit badge, a roadmap, and a launchpad behind it. A Singapore contractor put in across two rounds. Eleven days after the token listed, the team removed the liquidity and the chat went silent.

Vector
ICO / presale rug-pull (NMBS via the StakeForge launchpad)
Instrument
On-chain presale contribution
Reported loss
SGD 86,000 (BNB, USDC)
File opened
14 April 2026
Funds recovered
34%
Claimant
Software contractor, Singapore
About this case file. This is an illustrative, dramatized composite based on patterns GEInvestigator works in the field. Names of firms, platforms, and people are fictional and any resemblance to a real entity is coincidental. Figures and outcomes are representative; recovery is never guaranteed and depends on the facts of each case.

IntakeHow the subject made contact

He found NimbusChain through a Telegram “alpha” group and the StakeForge launchpad. The project showed an audit badge — which, on closer inspection later, linked to a PDF rather than a named auditor’s site.

Reassured by the launchpad listing and a live countdown, he contributed BNB and USDC across two presale rounds and waited for the listing.

Point of compromiseWhere control was lost

The token listed, traded briefly, then the deployer pulled the liquidity pool and dumped the team allocation. Proceeds were routed across a cross-chain bridge to a second chain.

The contract told the rest of the story: ownership was never renounced and a mint function remained callable — structural red flags the “audit” had never covered.

“Everything looked verified. There was an audit, a launchpad, a countdown. I never thought to ask who actually held the keys.”Field interview · Case GEI-2026-0414

Evidence chainHow the recovery was built

EX-01

Read the contract first

Confirmed the un-renounced owner and an unguarded mint function — the structural tell the badge never addressed.

EX-02

Mapped the liquidity removal

Timestamped the LP pull and the team-wallet dump and tied both to a single deployer-controlled address.

EX-03

Followed the bridge hops

Traced proceeds across a cross-chain bridge to the destination chain and into two consolidation wallets.

EX-04

Targeted the cash-out point

One consolidation wallet deposited to a centralised exchange; we filed the trace with that exchange’s fraud desk.

EX-05

Recovered the exchange-side share

The deposited tranche was frozen and partially returned; funds left in self-custody and across the bridge stayed out of reach.

DispositionWhat came back

34%
Funds returned to claimant

SGD 29,200 of SGD 86,000 was returned from the one tranche that touched a regulated exchange. Rug-pull proceeds that stay in self-custody or move through bridges are traceable but rarely recoverable — this file landed where the money briefly stopped.

IndicatorsFraud signals on this file

  • An “audit” that is a PDF or an image rather than a link to a named auditor’s site.
  • Contract ownership not renounced, or a mint function the team can still call.
  • Allocations that depend on a countdown and a constant stream of new buyers.
  • A team reachable only through a chat channel that can be deleted in seconds.

Seeing the same pattern in your own case?

GEInvestigator opens a file, traces the funds, and tells you honestly what can be recovered.

Open a Case →
By Case Studies