Exposed: “Ramarxyz” Sniped 70% of $WET Presale With 1,000+ Wallets – Then Demanded Refund

A chaotic token launch on Solana has placed decentralized finance platform HumidiFi and Jupiter Exchange under intense scrutiny after blockchain investigators linked a single actor to the mass botting of the $WET public presale, capturing the majority of the allocation within seconds.

According to a detailed on-chain investigation published by Bubblemaps, one entity operating under the alias “Ramarxyz” used more than 1,000 wallets to claim roughly 70% of the $WET public presale allocation.

The sale, which took place through Jupiter’s Decentralized Token Formation (DTF) launchpad, sold out in just two seconds before most retail participants could interact.

HumidiFi Confirms Bot Attack as Blockchain Data Traces Sale to One Actor

HumidiFi later confirmed that a large bot farm had overwhelmed the public sale. Bubblemaps found that at least 1,100 of the 1,530 participating addresses were controlled by the same actor.

The wallets followed a repetitive funding pattern, with each receiving exactly 1,000 USDC from centralized exchanges shortly before the sale.

One wallet allegedly broke the pattern by receiving funds from a private address that could be traced to the Twitter handle @ramarxyz through previous public blockchain activity.

Rather than acknowledging the activity, the individual later publicly suggested that HumidiFi should refund the sniper’s allocation, despite being linked to the exploit.

Shortly afterward, HumidiFi confirmed that all suspected bot allocations had been canceled and that legitimate presale participants would instead receive a prorated airdrop.

A separate on-chain analysis by trader Gautam Mgg showed that 4% of the public allocation went to just 10 wallets, with four wallets alone committing 40% of the entire public sale supply using bots.

The wallets were publicly listed using Solana explorers. Gautam also blamed Jupiter Exchange for failing to introduce basic bot protection measures, such as CAPTCHA or last-minute address rotation.

Jupiter had earlier announced that the $WET token sale was fully completed, raising $5.57 million across its Wetlist, JUP stakers, and public sale phases.

The public phase offered 30 million tokens at $0.069 per token, capped at $1,000 USDC per wallet. The token is scheduled to become claimable on December 9 alongside the launch of liquidity pools.

HumidiFi to Reissue Token After Aborting Disrupted $WET Launch

Following the incident, HumidiFi announced it would abandon the compromised launch and create a new token instead.

The protocol said all legitimate Wetlist and JUP staker participants would receive a pro-rata airdrop under a newly deployed contract that has been audited. A new public sale is now scheduled.

HumidiFi launched in mid-2025 and has grown into one of Solana’s most active decentralized exchanges, processing over $1 billion in daily trading volume and often accounting for more than one-third of all spot trading on the network.

According to DefiLlama, its Dex volume currently sits close to $30 billion over 30 days, while its cumulative volume sits at over $122 billion.

The $WET token was introduced as the protocol’s staking and fee-rebate asset and was promoted as a community-driven distribution using Jupiter’s DTF platform.

The incident has revived broader concerns over token distribution fairness across launchpads.

In September, Bubblemaps also flagged a separate Sybil attack linked to the MYX token airdrop, where roughly 100 newly created wallets claimed nearly $170 million in tokens after being funded simultaneously from OKX.

That case similarly raised questions about identity controls and launch design weaknesses.

Jupiter DTF was introduced as a transparent, trust-minimized alternative to traditional token launches, combining curation and on-chain verification. The $WET sale was its first live deployment, making the failure a major test for the model.

Neither Jupiter Exchange nor the individuals accused have issued a detailed technical breakdown of what failed at the infrastructure level.