- Treat Soldrift, Telegram @devbeast5775, and related aliases as a severe security-risk cluster unless independently cleared by forensic audit.
- Any connected tool requesting PRIVATE_KEY, seed phrase, funded wallet, RPC credentials, GRPC_TOKEN, exchange API access, server administrator access, encrypted bot execution, or wallet export capability should be considered unsafe.
- The risk is elevated because the public tool categories involve high-speed Solana trading, HFT, sniping, arbitrage, MEV, volume automation, copy trading, wallet tracking, and exchange-linked automation.
- All timestamps in this report should be recorded in UTC. Local time assumptions should be avoided unless independently verified.
USER-REPORTED SCAM WARNING · UTC OSINT INDEX
Soldrift / devbeast5775
Security Warning and OSINT Index
A dense public security-warning report about Soldrift, Telegram @devbeast5775, related GitHub traces, Solana HFT/sniper/arbitrage tooling, wallet/private-key exposure, phishing-tool risk, KuCoin-linked Solscan wallet leads, and public evidence preservation.
overview
Executive warning
identity
Identity and alias index
Primary online identifierSoldriftMain name used in public GitHub and report context.
Key contact identifierTelegram @devbeast5775Primary handle emphasized for search, OSINT matching, and user warning.
Telegram URLt.me/devbeast5775Public contact trail requiring archival capture.
Related public tracewhistledev411 / @whistle / @soldriftPossible alias, migration, clone-path, or rebranding cluster to monitor.
Wallet leadEfwJn8cXCYhcGrsavxWSDbUFHPrCK9gvdCr6AVywFBPgSolscan account lead submitted by the complainant.
Exchange-linked label observedKuCoin 2Visible in the submitted Solscan screenshot as a transaction counterparty label.
Time standardUTC onlyUse UTC for all event, commit, transaction, screenshot, and archive timestamps.
evidence
Submitted exhibits
- Exhibit A and Exhibit B are submitted profile/avatar records for identity-context documentation.
- Exhibit C is a submitted Solscan screenshot showing account EfwJn8cXCYhcGrsavxWSDbUFHPrCK9gvdCr6AVywFBPg, a high SOL balance at capture time, and recent transfer rows involving KuCoin 2.
- The submitted wallet screenshot is a tracing lead, not standalone proof of wallet ownership, KuCoin API use, HFT operation, bot profit, or criminal intent.
- Every exhibit should be archived with a UTC timestamp, source URL, screenshot hash if available, and a redaction note for private keys, API keys, personal data, and unrelated information.
github
GitHub and tool-cluster index
- Public GitHub traces associated with Soldrift show a broad Solana/Web3 bot portfolio pattern including Pump.fun, PumpSwap, Raydium, Meteora, Orca, Jupiter, sniper, bundler, volume, arbitrage, MEV, copy-trading, wallet-tracking, and exchange-linked tooling.
- whistledev411, @whistle, and @soldrift should be monitored as possible alias, migration, clone-path, contact-label, or rebranding traces because related repository themes and contact patterns may overlap.
- Repository deletion, private conversion, 404 status, renaming, locking, clone-path movement, or account migration should be treated as unresolved risk rather than evidence that the issue is resolved.
- A GitHub account with many repositories and high follower count can create credibility, but it does not prove that private-key software is safe. Wallet-related code must be independently audited.
Tool-category matrix
| Launch tools | Pump.fun, PumpSwap, launch automation, bundler, first-buy, 0-block claims | High risk when combined with private keys or funded wallets. |
| Trading bots | HFT, sniper, arbitrage, MEV, copy-trading, wallet tracking | High risk when combined with live execution and hidden networking. |
| Volume tools | Raydium volume, Dexscreener trending, maker bots, multi-wallet automation | May indicate market-manipulation-like or abusive activity. |
| Exchange-linked tools | KuCoin API, exchange routing, arbitrage execution | Requires exchange key exposure; must be independently verified. |
| Phishing-like tools | Wallet connection, private-key input, casino/gambling bots, Axiom/Polymarket claims | Severe risk when secrets or funds are requested. |
wallet
Solscan wallet and KuCoin-linked lead
- The Solscan account lead is EfwJn8cXCYhcGrsavxWSDbUFHPrCK9gvdCr6AVywFBPg.
- The complainant alleges that visible KuCoin-linked transfer patterns may indicate KuCoin API-based high-performance arbitrage or HFT activity generating significant profit.
- This report records that allegation as an investigative lead only. The screenshot does not independently prove who controls the wallet, whether KuCoin API was used, whether the activity is HFT, or whether any profit came from a bot.
- Recommended lawful OSINT steps: preserve transaction hashes, compare UTC timestamps, map exchange deposit/withdrawal patterns, archive counterparties, and avoid doxxing, account intrusion, or unauthorized access.
threat
Threat model and suspected monetization path
- Suspected monetization path: credibility building through public GitHub repositories, followed by private Telegram sales of high-demand Solana trading tools.
- Potential exposure path: user runs a tool that requests PRIVATE_KEY, RPC keys, GRPC_TOKEN, exchange API access, or server administrator access.
- Potential persistence path: tool installs background services, PM2 processes, crontabs, systemd units, hidden startup scripts, webhooks, remote logging, or encrypted packages.
- Potential rebranding path: after exposure, the operator may rotate Telegram handles, GitHub usernames, repository names, clone URLs, profile images, or README language.
- Potential profit path alleged by the complainant: exchange-linked HFT/arbitrage execution, KuCoin-linked transfer flow, Solana bot automation, and high-frequency wallet activity. This requires independent verification.
redflags
Technical red flags
- PRIVATE_KEY or seed phrase request
- Funded wallet request
- KuCoin or exchange API key request
- RPC key, GRPC_ENDPOINT, or GRPC_TOKEN request
- Server root/admin access request
- Encrypted or obfuscated bot package
- Compiled binary without reproducible build instructions
- Hidden outbound network request
- Telegram or Discord webhook
- Remote logging endpoint
- Wallet export or key-transfer logic
- Guaranteed profit, guaranteed speed, first-buy, or 0-block claim
- Dexscreener trending or volume manipulation claim
- Raydium volume or maker manipulation claim
- Polymarket win-rate or prediction-market manipulation claim
- Axiom trading advantage claim
- Casino, gambling, wallet-drainer, or phishing-like bot claim
asia
Asia-Pacific caution notice
- Activity windows and broken-English usage may be OSINT notes, but they do not prove Korean, Asian, or any specific nationality.
- Because the reported contact pattern, Telegram sales, GitHub activity, and Solana bot offers may overlap Asia-Pacific users and time zones, Asian crypto communities should treat this identity cluster as high risk.
- Users in Korea, Japan, China, Southeast Asia, and the broader Asia-Pacific region should be especially cautious with Telegram-based HFT, sniper, arbitrage, private-key, and wallet automation offers connected to this cluster.
- This warning is directed at risk prevention, not ethnicity, nationality, or regional profiling.
tracking
Reverse-tracking search index
Soldrift devbeast5775Telegram @devbeast5775devbeast5775 Telegramt.me/devbeast5775Soldrift GitHubwhistledev411@whistle@soldriftSolana HFT bot warningSolana sniper bot warningSolana arbitrage bot warningSolana MEV bot warningSolana wallet tool scamSolana phishing tool warningKuCoin API arbitrage botKuCoin Solana arbitrageRaydium volume botDexscreener volume botDexscreener trending botPolymarket botPolymarket win-rate botAxiom trading botcasino phishing botwallet drainer warningJito bundler botYellowstone gRPC sniper botGRPC_TOKEN Solana botPRIVATE_KEY Solana botVPS root access developer scam
actions
Immediate security actions
- Do not run any related bot on a funded machine.
- Do not paste a valuable private key into any .env file, website, Telegram bot, dashboard, compiled binary, encrypted package, or VPS.
- Use only a disposable sandbox machine and an empty test wallet.
- Rotate all exposed API keys, RPC keys, gRPC tokens, GitHub tokens, server passwords, and wallet keys.
- Remove unknown SSH keys, PM2 processes, crontabs, systemd services, hidden startup scripts, and unexpected background services.
- Search the codebase for outbound requests, webhooks, base64 blobs, dynamic execution, wallet export logic, private-key storage, and remote logging.
- Archive public evidence with UTC timestamps and report suspicious repositories through proper platform channels.
preservation
Evidence preservation protocol
- Preserve public repository URL, owner name, README text, repository description, topics, commit timestamps, release files, package names, screenshots, demo links, and fork relationships.
- Preserve Telegram handle, displayed contact addresses, public payment wallets, transaction hashes, Solscan pages, exchange labels, and UTC screenshot timestamps.
- Do not publish private keys, seed phrases, API keys, unrelated private messages, private addresses, phone numbers, or unsupported personal information.
- Use correction-friendly wording. Separate user-confirmed experience from court-confirmed legal conclusions.
- Record each update with UTC date, source URL, short description, and whether the evidence is screenshot-based, repository-based, blockchain-based, or user-submitted.
sources