The honeypot a test sell can’t catch: 45 of 46 buyers frozen
One wallet bought into 9 launches by the same group, a few dollars each time. It was frozen 9 times, 7 of them 12 seconds after it bought, and it never sold once.
The tokens this Ethereum group launched from 4 September 2026 to 1 November 2026 pass a test sell. Then, seconds after a real buy, the group puts the buyer’s wallet on the token’s blacklist. The wallet can still buy, but it can never sell or move the token again. We traced all 21 launches block by block: 45 of the 46 outside buys were frozen, 30 of them in the very next block.
The short answer
- A test sell from a fresh wallet passes, because the freeze only lands after a real buy, in a later block. A checker bot’s one-transaction test went through on 20 of the 21 tokens.
- Every freeze came from the group’s one freeze wallet; 40 of the 45 landed within two minutes.
- Outside buyers put 0.3599 ETH into these tokens. When the 20 drained pools were emptied they held 212.31 ETH, almost all of it the group’s own money.
- Our own rug checker rated the live one neutral until 3 November 2026. It now marks every token from this group as a honeypot from launch.
How the freeze works
| When | What happens |
|---|---|
| Block N | You buy. The pool sends you the tokens. A sell right now would go through. |
| Block N + 1 (12 seconds later) | The group’s freeze wallet sends one transaction to its own contract, which writes your address into the token’s blacklist. |
| From then on | Every sell or transfer from your wallet fails. You can still buy more. |
Only the group can write that list. Every token stores the group’s contract as its admin (21 of 21) and carries a blacklist(address,bool) function (21 of 21). When anyone else calls it, nothing changes (we tried it on hao123). The freezes come from one wallet, 0xaa89…f443, through one contract, 0x3cb0…8d91. The group’s own wallets trade through that same contract, and it refuses every other caller, so there is no way to buy the way they do.
The contracts are not verified on Etherscan, so none of this is readable from source code. It shows in the storage: a frozen wallet’s entry in the blacklist mapping turns on after its buy, usually in the very next block.
Why a test sell can’t catch it
A honeypot check usually buys a little of the token from a fresh wallet and sells it straight back. On these tokens that always works, because the wallet doing the test has not been frozen yet. One checker bot, 0x9d8a…da0c, did exactly that on 20 of the 21 tokens: it bought and sold inside a single transaction and passed every time. A freeze lands in a later block, so a test inside one transaction can never see it.
On 3 November 2026 we asked two free checkers about hao123, the one token in this study still trading:
| Checker | Rating | What it says |
|---|---|---|
| Honeypot.is | HONEYPOT DETECTED | A high amount of users cannot sell their tokens. · The source code is not available, allowing for hidden functionality. · its test trade: buy tax 0%, sell tax 0% · 3 of 25 holders it tested cannot sell |
| GoPlus | 1 risky, 0 attention | risky: closed source · honeypot: not reported · cannot sell all: no · blacklist: not reported |
| Unhosted, until 3 November | Neutral | “Can you sell? Yes: a test sell went through.” |
| Unhosted, now | Honeypot | Buyers’ wallets are frozen seconds after they buy. |
Honeypot.is and GoPlus read the way their own sites read them, the same rules as our rug checker test.
Honeypot.is gets there because it also replays sells from real holders’ wallets, and by now several of them fail. Its own test trade still passes. That works only once buyers are already frozen. GoPlus rates the token risky because its code is not published, a flag it puts on every unverified contract, and reports no honeypot and nothing that stops a sell. Our checker read a stored test sell and said it was fine. We make one of these tools, and it missed this too.
All 21 launches
| Launched | Token | Outside buys | Frozen | Fastest | Slowest | Drained |
|---|---|---|---|---|---|---|
| 4 Sept | 0x507f…3b5f | 4 | 4 | 12 seconds | 60 seconds | 8 Sept · 10.5 ETH |
| 8 Sept | 0x85fa…3ece | 11 | 11 | 12 seconds | 33 hours | 11 Sept · 6.7 ETH |
| 11 Sept | 0x1698…7bff | 0 | 0 | — | — | 13 Sept · 5.8 ETH |
| 13 Sept | 0xd929…e64f | 5 | 5 | 12 seconds | 12 seconds | 16 Sept · 7 ETH |
| 16 Sept | 0x8511…e9fb | 2 | 2 | 12 seconds | 12 seconds | 18 Sept · 17.5 ETH |
| 18 Sept | 0xdbd3…8d99 | 1 | 1 | 12 seconds | 12 seconds | 21 Sept · 9 ETH |
| 21 Sept | 0x8c26…24c0 | 1 | 1 | 2 minutes | 2 minutes | 23 Sept · 5.4 ETH |
| 23 Sept | 0x77f4…e98d | 2 | 2 | 5 minutes | 45 minutes | 26 Sept · 17.2 ETH |
| 26 Sept | 0x442c…dcef | 2 | 1 | 12 seconds | 12 seconds | 29 Sept · 13.2 ETH |
| 29 Sept | 0x404c…6541 | 3 | 3 | 12 seconds | 24 seconds | 2 Oct · 12.1 ETH |
| 2 Oct | 0x37e8…7168 | 2 | 2 | 12 seconds | 12 seconds | 4 Oct · 12.5 ETH |
| 4 Oct | 0x1897…a242 | 2 | 2 | 12 seconds | 12 seconds | 7 Oct · 9.1 ETH |
| 7 Oct | 0xa3df…c937 | 2 | 2 | 12 seconds | 12 seconds | 11 Oct · 5.9 ETH |
| 11 Oct | 0xdbd1…b842 | 1 | 1 | 12 seconds | 12 seconds | 14 Oct · 16.3 ETH |
| 14 Oct | 0x4bc6…6f72 | 0 | 0 | — | — | 17 Oct · 14.9 ETH |
| 17 Oct | 0xc510…b579 | 3 | 3 | 12 seconds | 24 seconds | 20 Oct · 12.4 ETH |
| 20 Oct | 0x1bf2…d436 | 0 | 0 | — | — | 22 Oct · 5.6 ETH |
| 22 Oct | 0x6c19…8941 | 0 | 0 | — | — | 26 Oct · 5.5 ETH |
| 26 Oct | 0x3f45…9571 | 2 | 2 | 24 seconds | 36 seconds | 27 Oct · 10.3 ETH |
| 27 Oct | 0xf0f9…bf51 | 0 | 0 | — | — | 1 Nov · 15.3 ETH |
| 1 Nov | 0x93c7…9732 | 3 | 3 | 12 seconds | 24 seconds | still trading |
Outside buys exclude the group’s own wallets and 20 buys that were sold back inside the same transaction (tests). "Drained": the day the group emptied the pool, and the ETH it held.
The tokens rarely draw many outside buyers: 46 buys in two months, from 35 wallets, most of them a few dollars. The charts look busy because the group does nearly all the buying itself.
The buys, block by block
| Token | Wallet | Bought | Frozen after | Sold for | |
|---|---|---|---|---|---|
| The largest buy that was frozen | LAPTOP | 0x340e…6219 | 0.0995 ETH | 24 seconds | never |
| hao123, still trading | hao123 | 0xa6f3…e168 | 0.0013 ETH | 24 seconds | never |
| The slowest freeze | LAPTOP | 0xb83d…e142 | 0.0197 ETH | 33 hours | never |
| Sold in the block it bought, before its freeze | LAPTOP | 0x1f2f…f387 | 0.0922 ETH | 12 seconds | 0.0926 ETH |
| Never frozen: a dust buy before the launch took off | JUMP | 0xddbf…361e | 0.000037 ETH | never | 0.000036 ETH |
Each buy and freeze links to its transaction on Etherscan. Every row is in the dataset below.
The wallet that kept coming back, 0xd525…4b10, bought through the Uniswap router, usually within minutes of a launch, 0.019 ETH in all. It was frozen every time, at most 5 minutes after a buy. Copying this group’s buys, by hand or with a bot, ends the same way.
Two outside buys got any ETH back. A bot bought 0.0922 ETH of LAPTOP and sold it in the same block, before its freeze landed in the next one. A wallet that bought 0.000037 ETH of JUMP, about eight cents, before the launch took off was never frozen and sold it back minutes later. Nobody who held a real position got out.
How to spot it before you buy
| Check | Why |
|---|---|
| Has anyone outside a few wallets ever sold? | On these tokens, 2 of 46 outside buys ever got ETH back. A checker that tests real holders’ sells (Honeypot.is does) shows it, once enough people are frozen. |
| Is the contract verified, and can the owner blacklist? | Unverified code with a blacklist(address,bool) function means someone can freeze your wallet at will. |
| Who is buying? | A pool that grows by tens of ETH with only a handful of outside buyers is being pumped by its own team. |
| Paste the address into a checker that knows the group | Unhosted’s rug checker now marks every token from this group as a honeypot from launch. |
Check a token in the rug checker, or read how four rug checkers compare on the same tokens.
How we measured it
| Launches | All 21 launches by the group from 4 September 2026 to 1 November 2026; we follow the wallets it launches with |
| Buys | Every transfer out of the token’s Uniswap V2 pool in a transaction with a swap, followed to the wallet that kept the tokens |
| Outside buyer | Not one of the group’s wallets and not routed through its contract; buys sold back inside the same transaction counted apart as tests |
| Window | From the block the pool was created to the block before the drain, or to the day we measured for the one still trading |
| Frozen | The wallet’s entry in the token’s blacklist mapping (storage slot 13) is set; first block found by archive reads, with the transaction that set it |
| When | Measured 3 November 2026 from a public archive node |
We also bought hao123 ourselves on 3 November 2026, 0.003 ETH through a swap app. The freeze landed in the next block, 12 seconds later; a sell simulated right after the buy, before the freeze, went through. That buy is not in the dataset.
Limits: we only count buys straight from each token’s main pool, so tokens that reached a wallet another way are not in it. Launches before September use an older version of the same contract and are not measured here. ETH amounts are what each swap paid into the pool.
Questions
Why can’t I sell a token I just bought?
If the sell fails while other tests of the token pass, your wallet may have been put on the token’s blacklist. Some tokens let their owner block any single wallet from selling or transferring, while it can still buy. In the launches we traced, the group behind the token did this to almost every outside buyer within seconds of the buy.
What is a blacklist honeypot?
A token whose contract keeps a list of wallets that are not allowed to sell or transfer it, and whose owner adds buyers to that list after they buy. Unlike a token that blocks every sell, it passes a test sell from a fresh wallet, because that wallet has not been listed yet.
Can a honeypot checker detect it?
A test sell cannot: it runs from a fresh wallet that has not been frozen yet. A checker bot bought and sold inside one transaction on 20 of these 21 tokens and passed every time. Checkers that also test real holders’ sells, such as Honeypot.is, flag the token once enough buyers have been frozen, which means after people are already trapped. Unhosted’s rug checker now marks every token from this group as a honeypot from the minute we see it launch.
I bought one and can’t sell. What can I do?
Nothing on-chain: only the group can take your wallet off the list. Do not spend more gas on sell attempts, and do not pay anyone who offers to unfreeze it, which is a common follow-up scam. Revoke any token approvals you gave the swap if you no longer trust it.