---
name: moonkey-alon-claim
description: On-chain verdict (17 Sep 2026) on the claim that Alon (pump.fun) bought $MOONKEY, plus the reusable "dusted wallet fakes a famous buy" detection method. Read whenever a DexScreener or GMGN card shows a famous wallet "Entered" a token, or when a thesis rests on a named person having bought.
sources: [cowork]
aliases: [moonkey, MOONKEY, alon moonkey, a1lon9 moonkey, OsitoLimaX moonkey, dusted buy]
---

## Verdict: FAKED. Alon never bought MOONKEY.

Token: moonkey, Solana mint `BRZ5aeJCDuruA42V1CntqKvofa2G7DS3yyxx1pZEpump`, created 16 Jul 2026 19:45:36 UTC (17 Jul 02:45 Bangkok), bonding curve `4g7j6NjsDAQ6QsvGe2G9YyeXBw93Je3UoHzPWbdYsSCM`, pool `D5ZQf8GFSDxDKo3t3gejCfnrTMttU16Dv2BHK3TNYatp`, creator `4o9u1sAmGAs9Myr8TDbeu33LczcQByQHDQH7LKwUJUNB`, ATH market cap $2,189,642 on 26 Aug 2026, market cap at check $639,117.

The DexScreener card ("alonalon", Position $11.31, Net PnL +$11.16, +7385.3%, Spent $0.2, 2 transactions, $0.15 volume) resolves to wallet `6DtEedWf9Wk5hA7Xth82Eq441yf5DA4aGLqaQAVfDokm` (1,402.49 SOL, about $139,600). Its two "entries" match on chain exactly: 16,317.45 tokens at 19:45:39 UTC and 3,195.98 tokens at 19:51:00 UTC, $0.0748 each, $0.1496 total.

**Neither was signed by that wallet.** Full transaction list for his moonkey token account `4ACskpR2mnxT2BRbxpUeXKGHCAjmgyWduyLFpXpD2U22` is five transactions and he signed none of them:

| UTC | signer (NOT Alon) | what | amount |
|---|---|---|---|
| 16 Jul 19:45:39 | `F1UvWnWgbKCw847jyNMgycw2FHeXiYnW5fbFexSrtB7m` | bonding-curve buy, tokens routed to Alon | 16,317.45 |
| 16 Jul 19:51:00 | `9UXQSJ4Fut1BjvQ2knx1BTouPFD4kJHt2pnYiwaANLUX` | bonding-curve buy, tokens routed to Alon | 3,195.98 |
| 30 Aug 07:06:30 | `6VHGjVxbzTwx7h9AuuPFerzBjsA9Y5uRAV2LWqBnA5en` | plain SPL transfer | 2,000 |
| 4 Sep 02:22:32 | `CB6uMtY2TM8T1DqqUqXZbNnR5WHqm9QeW2pd3LCQZy3D` | plain SPL transfer | 15,000 |
| 17 Sep 01:15:23 | `DaJbRftdefchFxrJyDGUb8eaLfNjj51bSoRxuy4xh9oc` | plain SPL transfer | 2,000 |

Current balance 38,513.44 moonkey, every unit of it a gift. The last three arrived AFTER @OsitoLimaX's 29 Aug thread made the Alon story the thesis, so people kept topping the wallet up to keep the card alive. @TheArsonDragon's 30 Aug reply ("I do believe @a1lon9's purchases were faked") is CONFIRMED by the chain.

## The mechanism, and how to detect it anywhere

The two July buys used third-party program `proVF4pMXVaYqmy4NjniPh4pqKNfMmsihgd4wdkCX3u`, which wraps a pump.fun buy (inner `6EF8rrecthR5Dkzon8Nwu78hRvfCKubJ14M5uBEwF6P`) and sends the output to an address the signer chooses. In moonkey's first eleven minutes it fired 29 times, each for exactly $0.0748, each from a DIFFERENT burner signer, each delivering to a different well-known wallet (recipients seen include `CyaE1VxvBrahnPWkqm5VsdCvyS2QmNht2UFrKJHga54o`, `G6fUXjMKPJzCY1rveAE6Qm7wy5U3vZgKDJmN1VPAdiZC`, `J23qr98GjGJJqKq9CBEnyRhHbmkaVxtTJNNxKu597wsA`, `DNfuF1L62WWyW3pNakVkyGGFzVVhj4Yr52jSmdTyeBHm`, `2fg5QD1eD7rzNNCsvnhmXFm5hqNgwTTG8p7kQ6f3rx6f`). It is a paid service for manufacturing "smart money is in" cards on launch.

**STANDING RULE, applies to every screen from now on: a DexScreener or GMGN "Entered / Bought" row is an attribution, not a signature.** Before any thesis rests on a named wallet having bought, run this three-step check:

1. Pull the token's early trades from `https://swap-api.pump.fun/v2/coins/{mint}/trades?limit=200&cursor=<slotIndexId>-<timestampMs>`. The cursor's TIMESTAMP half is all that matters, so any junk slotIndexId plus a target epoch-ms jumps straight to that moment. Match the card's token COUNT and market cap, not its dollar value.
2. `getTransaction` each matching signature and read `transaction.message.accountKeys` for `signer:true`. If the claimed buyer is not a signer, the buy is not his.
3. `getSignaturesForAddress` on his ASSOCIATED TOKEN ACCOUNT for that mint (not the wallet, which is too noisy) gives the complete list of times that position ever moved, usually under ten rows. Check every one for signer and for whether it is a swap or a bare SPL transfer.

Tells that mean "dusted, not bought": the dollar size is cents; the same exact dollar amount repeats across many wallets; the signer has zero SOL left and a burner history; the "buy" instruction sits under a non-pump.fun program; the token account's history is transfers rather than swaps.

## Source that failed on this run

twitterapi.io returned HTTP 402 Payment Required on 17 Sep 2026 02:52 Bangkok, so the X side of this (the FUD thread, the pump.fun verification claim, the CoinGecko listing claim) was NOT audited. Same key the X alert bots on the kookwatch droplet use, so that feed is dark until it is topped up.