# #2150 wlink: are 0x1a9493 / 0x2ac761 a rug cluster? (research, 12 Oct)
Script: research/rug2/wc.py (early buyers = tx.from of buys in first 180 s of fee-100 pools; v3live + v3hist + dataeng v3tx).

Answer: not proven a rug cluster, but 0x1a9493 is a bad "winner": a frequent sniper, not a selective one. No bait operator is visible in the data we hold.

| wallet | early-buy pools | pools with swap data | pulled (liq <10% of peak in 6 h) | runner >=1M |
|---|---|---|---|---|
| 0x1a9493 | 22 | 22 | 13 (59%) | 2 (9%) |
| 0x2ac761 | 30 | 3 | 0 | 0 |
| 0xf7d439 | 16 | 2 | 0 | 0 |
| 0x409598 | 24 | 3 | 0 | 0 |
| all early-buy pools (base) | 1609 | | 709 (44%) | |

- 0x1a9493: pull rate 59% vs 44% base (13/22, roughly +1 sigma, weak). Only 2 of 22 pools it bought were runners, yet it counts as a "winner" because of those 2. Appears in the signal of both rugged live pools and in paper's pre-entry dead pools (noprint rows).
- The other three have 16-30 early-buy pools but swap data for only 2-3 of them (they buy pools outside our v3live/v3hist coverage), so their pull/runner rates cannot be judged. Their frequency alone (16-30 pools) marks them as snipers/bots.
- Paper signal sets are heavily collinear: groups of ~20 wallets always appear together (same 8/19 pulls, same mean 2.53), i.e. a few bot bundles supply most signals. Pull share by group varies 3/18 to 10/17, so some bundles are much worse than others.
- Funder / LP-owner link not tested: no free address-history endpoint; cfund.db covers pool creators only, not these buyers.

Recommendations
1. Winner definition: drop wallets that bought early in >=15 pools (sniper bots, "infra" cut is >=30 today). Re-run the replay with cut 15 and with 1a9493 excluded; if the mean holds, it is a cheap gate. I can run this next if testmgr2 wants it.
2. Keep the pause N=1 rug rule (see wlink-rug-replay-12oct.md); this adds no new evidence for it.
3. testmgr2: add per-wallet pull stats to the sig_wallets column (already present) once more forward data exists.