---
name: paid-usepaid
description: Full screen of PAID / UsePaid (usepaid.app, @UsePaid) on Solana, 21 Sep 2026, run as six iterations after Ben asked "is there coordinated dumping, is this a scam". The fee-flow audit that found the Binance deposit, the corrections to my own first answer, and every wallet in the money trail. Read before any PAID, UsePaid, X Money fee-routing or creator-fee-launchpad question.
sources: [cowork]
aliases: [PAID, UsePaid, usepaid.app, X Money fees, paid token, creator fee launchpad]
---
Method: [[onchain-forensics]]. Sibling copycats in [[stonkfun-registry]]. Screen row in [[screen-log-9]].

# THE OBJECT
- **PAID**, mint `98kfF7rmsg1QDUEoCqNE7g7M1FdrTt92TEp2CLzypump`, pump.fun launch **16 Sep 2026 02:20 BKK**, pumpswap pool `6e3jZLtf4tQbWZm3f7A66jF8tfZn6MRQVrbDFgcNWarA` (quote SOL, liq ~$636k).
- Product: **usepaid.app** points a token's creator fees at any X handle and pays it through **X Money**. 80% to the handle, 20% to buyback and burn; changed 20 Sep to 100% of PAID's own fees to buyback.
- Path: launch to **$19.6M in 5 hours**, ATH **$37.8M on 18 Sep 22:11 BKK**, **$12.4M now = -67% in 2.5 days**. 33,729 holders.

# VERDICT: NOT A SCAM, NOT A COORDINATED DUMP. The problem is the money trail, not the token.

## Contract and cohort, all clean
- Mint authority **None**, freeze authority **None**, no tax, no transfer hook, not closable, balance not mutable (RPC `getAccountInfo` parsed, plus GoPlus).
- **Zero isDev / isSniper / isBundler flags in the top 50** (pump `advanced-api-v2/coins/top-holders`). Top holder 4.34%. Top 50 = 42.6% including the pool itself.
- Dev wallet `6RKsroTt2NgJvyUyhUcKqANrpHwDw6eE52X9TMBsQ7WC` holds **599,029 PAID = 0.06%**. No team bag to dump.
- Earliest top-50 entry is **02:26, six minutes after launch**, and entries spread over hours. No same-block bundle.

## The "coordinated dump" was ONE whale, and he paid for his coins
- `F6xcfMtkMj2R8Ex2Fu5mgEsu1ikDYnL9SLHpPnA7kVZP`: **19 buys 16-17 Sep for ~1,056 SOL (~$243k)**, then **6 sells in three minutes, 20 Sep 23:26-23:29 BKK, for ~1,299 SOL (~$299k)**. Now holds zero. That single exit is the 20 Sep 23:00 candle that wicked the cap to $9.85M.
- **No fleet.** Top 8 sellers' wallets were first seen Oct 2024, Jul 2025, Aug 2026, Sep 2026 (x2), with **different funders and no shared parent**, and clip sizes spread $1.7k to $24k. Two of them have 6,000+ transactions and are both top buyers AND top sellers, i.e. market-making churn.
- **6 of the top 8 sellers now hold exactly zero**, so that specific supply is finished.
- Flow in the 21 hours to 21 Sep 08:32 BKK: **sells $1.37M against buys $0.75M, net -$620k.**

# ⚠ THE FINDING THAT MATTERS: THE FEE MONEY DOES NOT GO WHERE THEY SAY IT GOES
Their published pipeline (16 Sep 05:48 post): "creator fees claimed on chain -> SOL deposited to **Kraken** -> Kraken API sells for USD -> ACH to X Money". On 20 Sep 13:21 they added "**100% of $PAID creator fees will now go to buyback and burn**".
What the chain shows, **21 Sep 05:47 BKK, sixteen hours after that promise**:
1. Dev wallet received **1,462.124 SOL (~$335k)** from an unwrapped WSOL account `EFikfamGR5RwvVXWAgekcpcNEZnccmgAQjWASYnNSzG`, and **forwarded 1,461 SOL out in the same minute**.
2. To `3bQD6TWvGSbCTnzzE2iHVWVSRsKio47vEmgDwvnLocmZ`, a wallet with **5 transactions, all created that morning**. It kept exactly half (**730.5 SOL, still sitting there**) and sent the other half on.
3. `5tNXmLdWCY58mjGVn6a6hTxLqyDntKAetwWcLaphRnL` (4 txs, same morning) kept 124.2 SOL and forwarded **606.31 SOL**.
4. To `ETzjWyHEMit92UaG42wGFBCbWRyPtv8XMfaWMaQ87zXm`, which at **06:12 BKK sent all 606.31 SOL to `5tzFkiKscXHK5ZXCGbXZxdw7gTjjD1mBwuoFbhUvuAi9`**.
- **That destination holds 1,238,036 SOL and clears 1,000 transactions per 63 minutes. Solscan labels it "Binance 2".** So it is Binance, not Kraken.
- **`ETzjWyHE...` is a personal exchange deposit address in use since 3 March 2026**, six months before UsePaid existed, with 165 prior deposits all forwarded to the same Binance wallet.
- **So ~$139k of PAID creator fees went to a personal Binance account, and another ~$167k is parked in a one-day-old wallet, on the same morning the token traded at -67%.**
- Fair reading, both ways: selling SOL at an exchange IS a necessary step in their fiat pipeline and $433k is genuinely owed to recipients, so this can be the payout conversion. But it is **the wrong exchange, through a private deposit address older than the company, in 50/50 splits, with half not moving at all.** That is not what "every payout public, every receipt on file" describes.

# THEIR OWN ANALYTICS PAGE (usepaid.app/analytics, read 21 Sep)
| figure | value |
|---|---|
| Total fees claimed, all time | **$1,611,727.69** |
| Paid to recipients | $856,032.34 (53%) |
| **Owed to recipients, unpaid** | **$433,239.53 (27%)** |
| Bought and burnt | $315,508.90 (20%), **3,078.268 SOL, 20.58M PAID** |
| Protocol revenue | $322,475.86 |
Top recipients: @elonmusk $124,314, @solana $86,986, @vladtenev $59,993, @nikitabier $42,929, @kevinnbass $34,429, @mayemusk $30,201.

## ⚠ CORRECTION TO MY OWN FIRST ANSWER
I told Ben "**39,469,266 tokens burned (3.95%, about $538k), the buyback is real**". **Wrong split.** Supply IS 960,530,734 against the 1,000,000,000 pump standard, but only **20.58M of that (2.06%, $315,509) is the buyback**; the remaining ~18.9M is the ordinary pump.fun graduation burn of leftover curve tokens. **Rule: a supply below 1B on a pump coin is not evidence of a buyback until you separate the migration burn from it.**

# THE OPERATOR
- Dev wallet was funded 0.55 SOL on **15 Sep 07:23**, one day before launch, by **`8N6bnw5wY4FShg587VJUsLEyUq6pK5GrjLXCt39EehGP`**, an ops hub first seen 14 Sep that funds and drains about a dozen wallets.
- **None of those ops wallets hold any PAID**, so there is no hidden team bag in them. Two are live fee-claim workers: **`78nPA3tUEH4b2jZjH1JKdqXjykYWzA7Az37CeKj1tTcg` (2,751 SOL, ~$630k)** and **`A94kWuB2jQjS8uvgHQMgpEThPAkXAVuFDLCoHVU313kc` (519 SOL)**, both firing a dozen small swap/claim transactions per minute.
- Team is **anonymous**. @UsePaid has 19,955 followers, posts public payout receipts continuously, and @metaversejoji (265k) is actively vouching and confirming a payment landed.

# RISKS THAT ARE REAL (none of them are "it is a honeypot")
- **Single point of failure is X Money plus a bank rail.** If X cuts them off the product stops. Chatter about being blocked is unverified.
- **$433k owed and unpaid** while fee SOL moves to a private exchange account.
- **They changed the deal on day four**: creator fees that fed the "creators get paid" story now feed buyback and team hiring.
- Buyback is ~$60-70k a day of bids against $10-20M of daily volume, so it cannot hold the price; a single whale exit outweighs a week of burns.

# REUSABLE METHOD FROM THIS SCREEN
- **Audit the fee wallet, not just the token.** The token contract was clean in every test; the only real finding in six passes came from following the creator-fee SOL hop by hop.
- **A peel chain of same-day wallets ending at an exchange is not automatically a rug**, but the age of the deposit address is the tell: one created that morning is the project, one used since March is a person.
- **A wallet with ~1,000 signatures per hour and a seven-figure SOL balance is an exchange hot wallet.** Check the label before naming it, Solscan's page title carries it.
- **Buys > sells while price falls is distribution**, and here it was literally one wallet: check the single largest seller's cost basis before calling a dump coordinated.

# PASSES 6-10, 21 Sep 2026 08:40-09:10 BKK. [stated] Ben: "check everything 5 more times."

## Pass 6: the Binance deposit address is a PERSON's account, and today dwarfed its whole history
`ETzjWyHEMit92UaG42wGFBCbWRyPtv8XMfaWMaQ87zXm`: 165 txs since 3 Mar 2026. **27 inbound deposits Mar to 20 Sep, each from a DIFFERENT wallet, 0.8 to 370 SOL, ~289 SOL in total**, every one forwarded to Binance. Then **606.31 SOL on 21 Sep 06:00, more than twice its entire prior lifetime.** That is the profile of one person's occasional cash-out account, not a corporate treasury rail.
- UsePaid's own 18 Sep post names **@krakenfx** as their payment partner. The fee SOL still went to **Binance**.

## Pass 7: the buyback is live, but running far below the promise
- Supply **960,530,734.25 at 08:38:20 BKK -> 960,516,203.64 at 09:06:26 BKK = 14,531 tokens in 28.1 minutes**, i.e. ~31,026 tokens/hour, **~$405/hour, ~$9.7k/day** at $0.01305.
- Their analytics implies ~$63k/day on average over five days ($315,509). **Today's measured pace is about one sixth of that.** One 28-minute window can straddle an hourly batch, so treat this as an order of magnitude.
- On 20 Sep they promised **100% of PAID's own creator fees to buyback, "all fees accrued while backend is completed will be included"**. The accrued fees claimed this morning (1,462 SOL) are the exact money that went ~half to Binance and ~half into a parked wallet.
- **The parked `3bQD6TWvGSbCTnzzE2iHVWVSRsKio47vEmgDwvnLocmZ` still held exactly 730.500 SOL at 09:02, untouched since 05:59.** It could still become buybacks. The Binance half cannot, without a withdrawal.

## Pass 8: the top of the book is ACCUMULATING, not dumping (new, and it cuts against the dump thesis)
Two top-50 pulls ~35 minutes apart: holders 33,729 -> 33,707, top-50 share **42.62% -> 42.79%**, one wallet out and one in. **The #1 holder `Gc5hVCBydc6k3Z7oc2cQEW4GThFQi2Fqk5HfKABqa2q8` ADDED 1,421,103 tokens**, `EjTLLhayt7s5F9iA143PsCbb9UzvzqG7Q3Q1KJTiLmWh` added 645,015. The only notable top-50 seller was `GAsnqm4XkNkPVgrAofNQ65jWf8f3tKCLHhE9ZqSy2AP1`, -1,210,156.

## Pass 9: ⚠ CORRECTION, "PAID OUT" DOES NOT MEAN "RECEIVED"
I told Ben "$856k really paid out, to Elon ($124k), Solana ($87k), Vlad Tenev ($60k)". **Overstated.** The figure counts money SENT through X Money to handles that may never claim it; @mwx_ai (92.7k): "Recipients never opted in"; unclaimed payments return to the protocol after ~14 days and feed the buyback; @slingoorio (107.7k, a listed recipient) says his was misrouted and he left it unclaimed. **Elon almost certainly never claimed his $124k.**
- **Real, confirmed receipts do exist, just smaller**: @BBlackBarbie (15.1k) "thanks for $712", @SamBTC5150 (5.0k) "Thanks again for the payout", @AlexMasmej (43.2k) "Thanks Paid", @luckyyleww (17.1k) "claimed my $PAID".
- **Rule: on any "we paid X people" claim, separate SENT from CLAIMED. Headline names are almost always the unclaimed ones.**

## Pass 10: live numbers re-verified, 21 Sep 09:04 BKK
mcap **$12,541,851**, liq **$616,421**, **-66.8% off the $37.77M ATH**, h24 -33.8%, h1 -7.57% but m5 +2.6%, h1 txns 758 buys vs 540 sells, h24 volume $10.08M. All consistent with the first pass.

## VERDICT AFTER TEN PASSES
**Not a honeypot, no coordinated dump, top holder buying.** The real issue is the **money trail**: this morning's ~$335k fee claim went ~$139k to a personal Binance account and ~$167k into an idle wallet, while the promised 100% buyback is running at roughly $10k/day, and the "$856k paid" headline includes big unclaimed names.

# PASSES 11-15, 21 Sep 2026 09:10-11:05 BKK. [stated] Ben: "do 5 more iterations."

## ⚠⚠ PASS 11: I DOUBLED EVERY DOLLAR FIGURE. SOL IS $111.53, NOT ~$229.
CoinGecko 21 Sep: **SOL $111.53**. I had converted SOL to USD at roughly $229 all morning without fetching a price. **Every SOL-denominated dollar figure in passes 1-10 was ~2x too high.** Corrected:
| item | SOL | I said | real (~$111.5) |
|---|---|---|---|
| PAID creator-fee claim, 21 Sep 05:47 | 1,462.12 | ~$335k | **~$163k** |
| leg that reached Binance | 606.31 | ~$139k | **~$67.6k** |
| parked in `3bQD6TWv...` | 730.50 | ~$167k | **~$81.5k** |
| whale `F6xcfMtk...` cost / exit | ~1,056 / ~1,299 | $243k / $299k | **~$118k / ~$145k** (profit ~$27k) |
| fee worker `78nPA3tU...` | 2,751 | ~$630k | **~$307k** |
**It was also internally inconsistent**: my own GeckoTerminal seller table priced the whale's exit at $141,950 while my prose said ~$300k. **RULE, MECHANICAL: fetch the SOL price in the same script that converts, and cross-check one converted figure against a USD figure a data source already printed. Never convert from memory.** Conclusions did not change; magnitudes halved. USD figures quoted from their analytics page ($1.61M claimed, $433k owed, $315k burned) were never affected.
- Also verified in pass 11: the 1,462 SOL is **PAID's OWN creator fees**. The inflow tx `2HwJVxgKy1qp7U2B6BTuJWpxrCJmWAcnyNvChFjUtt919GHWeRxcMWDQhtu1RV92YrFa2RV7fC372HYvZTuYu6QM` is signed by the dev, invokes the pump program `6EF8rrecthR5Dkzon8Nwu78hRvfCKubJ14M5uBEwF6P` and pumpswap `pAMMBay6oceH9fJKBRHGP5D4bD4sWpmSwMn52FMfXEA`, moves WSOL from the creator vault `EFikfamGR5RwvVXWAgekcpcNEZnccmgAQjWASYnNSzG` (authority `HGBJMtxiFXSkZRk838n5mmHwvRtribAUdCAT1gyoYzSd`) plus 0.839 SOL from `GZAh3E8F1nY9qum3TUjnyA91kDbB4bgy5aMi79PnYrna`, then closes the WSOL account. A creator-fee collection, exactly the money promised 100% to buyback.

## Pass 12: the parked 730.5 SOL is still untouched at ~10:40 BKK (last tx 05:59).

## Pass 13: no hidden team bags in the top 50
The 13 top-50 holders with no pump "enteredAt" are mostly aggregator buyers (pump only attributes its own program). `C4DKn6oqmJE8cZgPDU3X8N2S9MPFSjFSnUjv7WJCGxHh` (0.96%) **bought with $250,000 USDC in 7 clips, 17 Sep 10:23-10:31 BKK**, still holding, roughly -50% now. `9v8yLZHp1PanJxMdhUB98RYtPBc1XcGUbPGMuYXPGjRT` received 10,000 PAID free from `GpEwrxCm3NdjnJaTLTf2ZT4NgCHzkuLaFLW7p2nvDjmG` on 18 Sep, immaterial.

## ✅ Pass 14: THE BUYBACK IS VERIFIED ON CHAIN, AND IT CRASHED FOR THREE HOURS
- Official burn worker **`PaidybYx1q4xTYXMgHq1PTAsFkPsdJf6XG7KC1NUSJ8`**. **All 40 of 40 txs linked from usepaid.app/analytics decode, all signed by it, all contain a real SPL burn of PAID: 4,196,451 tokens between 19 Sep 19:36 and 21 Sep 10:38 BKK.** Runs hourly at :38.
- **My 28-minute measurement of 14,531 tokens was EXACTLY the 08:38 batch**, so the method was right but the sample landed in a trough.
- Hourly batches: 01:38 **345,981** · 02:38 99,761 · 03:38 358,929 · 04:38 381,114 · 05:38 201,746 · 06:38 **384,494** · then **07:38 44,083 · 08:38 14,531 · 09:38 16,739** · 10:38 62,208.
- ⚠ **CORRECTION: my "$9.7k/day" was the trough, not the rate.** Before 07:38 it was ~350-385k tokens/hour (~$4.6-5k/hour, ~$110k/day). It then fell ~90% for three hours, starting ~two hours after the 05:47 fee claim was sent to Binance and the parked wallet, and was recovering by 10:38. **Coincident in time, not proven cause.**
- The burn worker is topped up in ~1 SOL drips from **`FfLpuH4WPn2MR8Lqn1MpwQc1HtAPPqL3qvMWZjnFHGpv`** (the protocol's 20% side), held 17.27 SOL at 11:02. **None of the 1,462 SOL of PAID's own creator fees reached it.**

## Pass 15, the verdict after fifteen passes
- Token: **clean**. No honeypot, no fleet dump, no hidden team bag, top holder adding, a $250k USDC believer still in.
- Buyback: **real and on chain**, but funded by the 20% protocol cut, not by PAID's own fees as promised on 20 Sep.
- PAID's own creator fees this morning (**~$163k**): ~$68k to a personal Binance account in use since March, ~$81k parked and idle, ~$14k left in a mid-hop wallet.
- **What would settle it**: the parked `3bQD6TWvGSbCTnzzE2iHVWVSRsKio47vEmgDwvnLocmZ` either funding `PaidybYx...` (promise kept, late) or reaching an exchange (promise broken).

# 21 Sep 2026 ~14:00 BKK. [stated] Ben said yes to an alert on the parked wallet. OUTCOME: THE PARKED HALF WAS ALREADY CASHED OUT.
- **11:34:49 BKK**: `3bQD6TWvGSbCTnzzE2iHVWVSRsKio47vEmgDwvnLocmZ` swapped **730.00 SOL -> 80,496.44 USDC** through a DEX route (program `DF1ow4tspfHX9JwWJsAb9epbkA8hmpSEAtxXy1V27QBH`, pool account owned by BisonFi `BiSoNHVpsVZW2F7rx2eQ59yQwKxzU5NvBcmKshCSUypi`). Not a PAID buyback.
- **11:35:27 BKK**: all **$80,496.44 USDC** sent to `7bnp7SDB63bDvFKaMuALBpNiJRzjzwyHSk7gA1NAUfJW`, an **exchange deposit address** (instantly forwards; sweeps into `6LY1JzAFVZsP2a2xKrtU6znQMQ5h4i7tocWdgrkZzkzF`, which holds **267,339 SOL and $101.5M USDC**, 1,000 txs per 1.8 h, exchange not labelled on Solscan, do NOT guess which).
- ⚠ **The same deposit address took $200,300 USDC on 19 Sep 03:34 BKK from `FYas5ha9g2PypxQJT51os5YrENWLqMoA39oW7Zro3ues`, a wallet funded by the PAID ops hub `8N6bnw5wY4FShg587VJUsLEyUq6pK5GrjLXCt39EehGP`.** So this is the team's established cash-out rail, used twice.
- **Net result for the 21 Sep PAID creator-fee claim (1,462 SOL, ~$163k): ~$68k to Binance, ~$80.5k to a second exchange, ~$14k (124 SOL) still in `5tNXmLdWCY58mjGVn6a6hTxLqyDntKAetwWcLaphRnL`, $0 to buyback.** The 20 Sep "100% of PAID creator fees to buyback and burn" promise was not kept for this claim.
- The two tiny USDC inbounds after the swap (0.0001 and 0.001) are address-poisoning dust. Ignore.
- ⚠ My first alert classifier called the BisonFi pool "an exchange-style wallet" because it was busy. Wrong reasoning: a program-owned account is a pool, not an exchange. Fixed in paidwatch (program owner check + USDC tracking).

## paidwatch, live since 21 Sep 14:04 BKK
`/opt/paidwatch/paidwatch.py`, unit `paidwatch` (enabled), config 600 (Helius + public RPC copied from ghostsol, Telegram creds copied from rh-tracker, so it posts on **@bk_rhwatch_bot** until Ben gives it its own bot: `setbot.py paidwatch` target exists). Watches the dev wallet (new fee claims), the parked wallet and the mid-hop wallet; alerts on SOL moves >= 1, swaps to USDC/USDT, dollar transfers >= $1,000; auto-follows any new non-exchange hop >= 50 SOL (cap 25 wallets). Classifies destinations as burn wallet (good), exchange (red flag), pool/program, or wallet. Seeds on start (no replay). In watchdog UNITS. Dry run verified against the real 05:58, 06:00, 11:34 and 11:35 events before going live.