Evidence cutoff: 9 November 2026 UTC. Balances are dated observations, not live balances. The 15 November WEAVE token-launch date is the announced schedule recorded in this evidence, not a guarantee that trading will begin then.

The Hens Rug: Following the Money to a Known Chikn Whale

In the early hours of October 24, the wallets behind the launch of the Hens crypto project began pulling their money out. Within a day the project's token had collapsed, its social accounts had gone dark, and the team had walked away with roughly $96,000.

Hens launched on Robinhood Chain with collectible Hen NFTs and its own token, HEGG. It had been live for less than a month. A review of its blockchain records, its code and the projects connected to it leads to one place: the wallet network of Ice Station Zebra, a longtime member of the Chikn community.

The connections are direct. Zebra's main wallet gave the Hens admin wallet gas money minutes before the admin's main setup session. A wallet that got its first money from Zebra bankrolled the two wallets that led the dump. And a trading-bot project Zebra publicly claimed as their own lists the Hens liquidity wallet as one of its operators. The linked wallet network appears connected to another token, announced for a November 15, 2026 token launch.

Zebra funded the Hens administrator

On October 15, Zebra's main wallet sent the Hens admin wallet gas money. Thirteen minutes later, the admin wallet began its main session setting up the project's contracts.

It is the most direct link in the record: Zebra's wallet funds the admin wallet's gas, and the admin wallet immediately goes to work on Hens.

The insiders sold first

The Hens liquidity wallet held about a third of the liquidity in HEGG's main trading pool. The developer built a private contract that fed a share of the project's fees into that wallet's position, and no one else's, and the liquidity wallet approved it.

At 05:57 UTC on October 24, that wallet withdrew its entire position. Later that day it sold its HEGG, cutting the price almost in half in a single trade. Selling alongside it was the top HEGG seller, a wallet the liquidity wallet had funded itself. Together the two accounted for about 80% of all HEGG sold during the dump. HEGG ultimately fell more than 97% from its price before the insider selloff.

Selling the dream until the end

Hens sold its NFTs on promises that went far beyond earning tokens. In the project's own words, each Hen would become "her own business bank": real-world assets and crypto under one roof, liquidity drawn across chains, even tools to launch your own tokens. "HEGG remains central to that direction," the team wrote.

The pitch ran right up to the exit. With the mint still open, the project's X account advertised "Two Hens. A free Cornerstone. The foundations of your own bank." On October 23, the day before the liquidity was pulled, a Hens admin told the Discord that "anyone mints this round gets a Cornerstone dropped plus that cornerstone is auto upgraded to the final piece."

Then the money left. The admin wallet had deployed the Hens sale contract with a payee wallet written into its code. That payee wallet bridged nearly 32 ETH, about $74,000 of mint proceeds, off Robinhood Chain as the dump unfolded. The project's X account and Discord, which had made those promises, were deleted, and buyers were left holding NFTs for a project that had been abandoned.

Zebra's money behind the dump

The financial ties run deeper than a single payment. In October 2025, Zebra's main wallet sent the first funds to a brand-new funding wallet. Within minutes, tens of thousands of dollars arrived in it from Binance and Bybit. Over the following year that wallet financed both the Hens liquidity wallet, which received about $30,000, and the top HEGG seller.

Zebra kept it running. In October 2026, Zebra emptied their own balance into the funding wallet mid-trade; the funding wallet's next transaction followed 48 seconds later.

The financial links between these wallets continued after the rug. On November 8, Zebra's main wallet sent HYPE to a brand-new wallet. Within seven minutes, the main wallet of the Weave family and Zebra's funding wallet had both sent funds there too. The transfers show that these wallet networks remained financially linked two weeks after HEGG collapsed.

Zebra appeared to move with the insiders

When the Hens liquidity wallet pulled its money, most holders had no idea anything was wrong, but Zebra appeared to have inside knowledge. Thirty-two minutes after the withdrawal, Zebra's wallet began selling their Hens NFTs and kept going until it held none. Two minutes after its last sale, a second Zebra wallet then sold six more to the same buyer.

The rest of the market was quiet. In the hours between the withdrawal and the community raising the alarm, Zebra's wallets sold 40 Hens, about half of all the Hens that holders sold in that window. The next most active seller sold four. Zebra appeared to be moving with the insiders before the community reacted.

Cable: Zebra's project, Hens' wallet

In February, Zebra's account in the Chikn Discord (nickname ISZ, username choogiewoogie, formerly kaankaant) told the community they had built Cable, a crypto platform offering copy-trading bots.

Cable's own website code names the wallets that run its bots. One of them is the Hens liquidity wallet.

Zebra's funding wallet paid for it. On March 12 it sent the Hens liquidity wallet its starting money, alongside three other Cable bot wallets, and within half an hour the liquidity wallet had opened the trading vault behind Cable's "Berserker" bot.

Zebra's public identity, Zebra's own project and the wallet at the center of the Hens dump all sit in the same small circle.

The Hens code leads back to Boxheds

Part of HEGG's code carried the GitHub author name Boxhedlecky, an account whose history points back to Zebra's network. It was created on February 20, 2024, the day Zebra's wallets launched Boxheds on Avalanche. Zebra's network had already released a BoxHeds NFT collection in 2023 and registered boxheds.avax.

The commit bearing the Boxhedlecky name is dated 14 minutes before HEGG’s first trade. That timestamp is not proof of when the code was published.

The commit’s unsigned author metadata does not establish who wrote or pushed it, who controlled the account, or involvement in the later exit. Possible explanations include a shared developer, reused author settings, copied history or deliberately assigned attribution. None is established or ruled out by this clue alone; a shared developer would not by itself prove involvement in the exit.

Pinpointing southeastern Australia

Both Hens code accounts recorded their computer's time zone, and both match southeastern Australia's daylight-saving region on their dates: UTC+10 for the HEGG code in late September, and UTC+11 for the other Hens code in October, after clocks shifted in cities such as Sydney and Melbourne. These are two accounts, each observed on one side of the daylight-saving change; they do not demonstrate a single clock switching. The observations support a regional hypothesis, not proof of location or common control. Zebra's wallets show a compatible activity pattern: across southeastern Australia's daylight-saving changes, their daily schedule moved by about an hour in the direction that clock predicts.

The wallets point to the same place. Zebra's wallets and every hand-operated Hens team wallet consistently go quiet during the same hours, which fall overnight in that region. Of 76 other active Hens players, only three share that pattern. In the Chikn Discord, Zebra has also referred to Australia as their home.

The timing points to one person running many wallets: Zebra's top-up was spent 48 seconds after it landed. Zebra, the Hens developer and the liquidity wallet also run the same smart-account software, which only about 1.2% of Hens addresses use. A small team in the same area also remains possible.

Not their first launch

Hens was not the first token to come out of Zebra's network. Over three years, Zebra-linked wallets launched Hotdog Eating Races, the Astroturf token, the BoxHeds NFTs, the Boxheds token, Big Dog and Burgs. They also deployed a token called Brojak five times without ever trading it.

In 2023, Astroturf followed the same arc as Hens. A week after launch its developer sold out and the project's socials vanished, and the developer's money later moved through wallets funded by Zebra's network.

The pattern continued into 2026. In August, Zebra's funding wallet sent money through two intermediate wallets to the launcher of GLIZZY, which went live about ten minutes later. A wallet that traded funds back and forth with the Hens liquidity wallet launched BILL and CAMBODIA in the weeks before Hens.

The significance is the pattern: the same network of funders and dev wallets, launching project after project for years.

The Answers in Private Hands

The public record ends where the money enters centralized companies that keep private books. The Hens developer, the top HEGG seller, Zebra's funding wallet and the NFT sale payee all cashed out to HitBTC accounts. The bulk of the NFT proceeds went through a one-time order address at ChangeHero, an instant-swap service whose private order record, which law enforcement can request, shows where that money came out. Zebra's network moved earlier funds through Binance, Bybit and a single Kraken account.

Those companies keep records on their customers. So do GitHub, X, Discord, GoDaddy and Vercel, which hold the accounts behind Boxhedlecky, @stationofzebra, the Discord user choogiewoogie and the Hens and Cable websites. Law enforcement can request all of those records.

Tracking the NFT money

Some of the Hens money is still sitting in the team's wallets. The NFT mint money took a harder route to follow. It left through a hidden ChangeHero order: about $74,000 went in, and the payout comes back out from a wallet with no ChangeHero name on it. To find it, we pulled every transfer worth $73,000 to $74,700 sent in the hour after the order, a range wide enough to allow for swap fees, across 18 blockchains.

One candidate stands out. Eighteen minutes after the order, a brand-new wallet received 30.98 ETH, the order amount minus a normal swap fee. It came from a HitBTC-funded payout wallet. ChangeHero says it trades through HitBTC. The new wallet swapped the ETH for about 71,300 USDC, and its wallet cluster has since paid about 49,700 of it, a few thousand at a time, into a single payment service.

The payments point to Australia again. Converted at the service's rate, the payments land on round Australian-dollar figures, such as A$4,900 or A$2,500, while the US dollar amounts drift with the exchange rate. The service's pricing matches Living Room of Satoshi, an Australian service that turns crypto into payments to Australian bank accounts. More tellingly, the company's public feed shows at least five USDC payments matching the expected Australian-dollar amounts and approximate times of Hens-linked deposits. The feed does not identify senders, but those matches strongly point to Living Room of Satoshi.

The suspected NFT cash-out now connects to a much wider wallet network. Zebra's network and Cable Alpha Leader, the Hens liquidity wallet, the top HEGG seller, and the suspected NFT payout cluster all sent funds through separate deposit addresses into the same collection wallet. The liquidity wallet used the service before the rug. Weeks later, Hens-linked wallets were still paying into it within minutes of one another, with amounts matching round Australian-dollar payments. Together with Living Room of Satoshi's public-feed matches, the shared route supports further investigation of the suspected NFT proceeds and the Hens/Zebra wallet network. Use of the same commercial payment service does not by itself establish a shared customer, common control, an Australian-dollar settlement, or the identity of a beneficiary. The Living Room of Satoshi attribution and the candidate exchange payouts remain inferences pending private records.

The next launch

The Hens team's cash-outs may not have stopped at the exchange. The Hens developer sent ETH into HitBTC, as did the NFT sale wallet. About seven minutes after each deposit, separate Binance transfers sent slightly smaller amounts to the same new wallet. A third likely match links the top HEGG seller's deposit to another wallet in the family. The timing and amounts suggest an instant-swap route, but exchange records are needed to confirm the links.

The suspected developer-linked payout arrived in a new wallet that received the suspected NFT sale-wallet payout less than three minutes later. Both of these new wallets are part of a family that is building a new crypto project called Weave. One of the family's wallets created the launch contract for its token, WEAVE, which was announced to start trading on Robinhood Chain on November 15, 2026, with a fifth of the supply set aside for four "founder" wallets.

The family's main wallet is the same one that paid into the new wallet on November 8 alongside Zebra's main wallet and the funding wallet, and it runs the same uncommon wallet setup as Zebra and the Hens team. Weave's white paper carries an eastern-Australian time-zone stamp, its website was registered five days before the Hens rug with the same email setup as the Hens site, and the Weave developer wallets were active within a minute of Zebra's funding wallet, as if one person were switching between them.

The documented wallet links warrant scrutiny of WEAVE’s relationship to Hens. The candidate exchange payouts remain unconfirmed, and the evidence does not establish who controls the founder wallets.

Who is behind Zebra?

There is also a second identity to uncover. In April 2024 Zebra announced they were "logging out of Zebra Station for good" and would see followers "on my main." Our research has not turned up that main account. Unfortunately, the names Zebra uses are not unique to them: Ice Station Zebra is a film title, and both of their Discord usernames echo Australian songs, kaankaant by a Sydney punk band and choogiewoogie from an Australian cartoon.

The money trail, the code history and the links between projects are already public. What remains is to put a name to the operator, find the main account they post from, and hold them accountable.

Editor's note: We contacted Zebra directly and gave them 48 hours to respond. We also publicly announced that we were seeking comment from people we suspect were involved. Zebra did not respond within that period.

The connections at a glance

The full evidence package, including the report, every transaction ID with explorer links, the raw blockchain records and the zoomable wallet map, is at the evidence archive.

Reporting by @_lilrag. You can support our investigators with donations to 0x08A8f3F517B8B0e4B60295AE22dB0D9833AD5460.