← All news

AXIS: simulated liquidity drained with a hidden balance function

On 21 October 2026 the owner of AXIS called a function that multiplies any address balance by 2,000,000 without events, then sold the invented tokens into its own PancakeSwap pool and received 1,235,445 USDT, 61 seconds later. The pool was not funded by outside buyers: the owner and its bot made 99.8% of the swaps and outside buyers put in 110 USDT. The same owner controls 27 tokens ending in 7777 with the same function. 26 pools are drained and one shows liquidity now.

Token

AXIS (Axis Robotics), 18 decimals, supply 1,000,000,000

Contract

0xb3a30fbaecc17da5711d6dfcdc04280dbb967777

Open the current rating on the radar

1. Summary

AXIS is the latest of 27 tokens created between 9 and 21 October 2026 that share one final owner wallet. Its contract hides an owner-only function that rewrites the balance of any address without emitting an event or changing totalSupply(). On 21 October the owner used it on its own address, sold the result into the AXIS/USDT pool and took the pool's USDT.

The rating of AXIS is a separate matter from the money: the figures below show that the liquidity that disappeared was almost entirely the owner's own capital, and that outside buyers lost very little. The risk to anyone buying these tokens is real. The amount lost so far, in the cases we reconstructed, is small.

• The hidden function (0xaaeccdcf) multiplies the balance of an address by amount / 1,000,000,000. It was called with amount = 2,000,000,000,000,000, a factor of 2,000,000. The owner balance went from 730,019,450 to 1,460,038,900,126,003 tokens, against a declared supply of 1,000,000,000.
• The sale followed 61 seconds later. The owner swapped 1.46×10¹⁵ AXIS in the pool and received 1,235,445.39 USDT. The pool fell from 1.24 million USDT to 0.07 USDT.
• No liquidity was withdrawn. The liquidity tokens were locked (PinkLock V2 according to the radar) before the first hour had passed and were not touched. A "liquidity locked" check passes on this token.
• 8,776 of the 8,797 swaps in the pool (99.8%) were made by the owner wallet or its bot contract. Gross volume was about 300 million USDT. Ten outside wallets bought for a total of 110.39 USDT and none ever sold.
• The owner USDT balance was 1,873,456.83 before launch and 1,873,567.14 after the drain, a difference of 110.31 USDT. The pool liquidity was the owner's capital going in and coming out.
• The same owner wallet controls 27 tokens ending in 7777, created from 9 October, all with the same function. 26 of their pools are drained. In the five most recent cycles, analysed in full, each new token was created 54 to 150 seconds after the previous drain.
• Across those five pools, outside buyers put in 1,509.77 USDT in total, from at most 53 wallets, and withdrew nothing.
• At 17:30 UTC on 21 October the 27th token, also named AXIS, showed 1,358,061 USDT in its pool. See section 11.

2. Scope and method

Every figure comes from public BNB Chain data read at exact blocks from an archive node: contract bytecode and storage, transaction receipts, Swap, Sync, Mint and Transfer logs of the pool, and balanceOf at chosen blocks. Times are UTC. Last block read: 128,978,411 (21 October 2026, 17:30).

The source code of the AXIS contract is not verified on BscScan. The function descriptions come from the deployed bytecode, 6,467 bytes. Where a role is inferred rather than shown by a transaction, the text says so. No wallet is attributed to a person.

This analysis started from the radar page for AXIS, which reports a SCAM rating, a 100% liquidity fall about 778 minutes after launch and insiders selling into the pool. Those statements are correct. This report adds the mechanism and shows who funded the liquidity.

3. Addresses involved

4. The night of 20-21 October

5. The hidden function

The contract exposes the usual ERC-20 functions plus eight that are not part of the standard. The one that matters has selector 0xaaeccdcf and takes an address and a number. It is restricted to the owner (it checks the caller against storage slot 0 and fails with "Ownable: caller is not the owner"). It then does this:

balance[address] = balance[address] * amount / 1,000,000,000

In all five calls we found, amount is 0x71afd498d0000, that is 2×10¹⁵, so the balance is multiplied by 2,000,000. The function emits no Transfer event and does not change totalSupply(). Holder lists, event scanners and supply checks show nothing. The inflated balance is visible only by calling balanceOf().

Balance before and after the call

Values read at blocks 128,888,018 (before) and 128,888,019 (after) on the AXIS token:

6. The other six functions

All six are owner-only. Their role is inferred from how transfer reads the data they write. It is not confirmed by source code.

Transfers toward the pool also check that the pool is the pair of this token and fail with the message "777" otherwise. That string matches the suffix shared by all the token addresses in this series.

7. The 61 seconds

1. 06:12:56. One transaction of 29,556 gas, no events. The owner balance is multiplied by 2,000,000.
2. 06:13:57. The owner sends 1.46×10¹⁵ AXIS to a router (execute selector 0x3593564c), which swaps them in the AXIS/USDT pool.
3. Same block. 1,235,445.39 USDT leave the pool for the owner. The pool formula pays almost the whole USDT reserve to whoever delivers an enormous quantity of tokens.
4. 06:13:58. Pool reserves: 0.069 USDT against 1.25×10¹⁵ AXIS. The residual value is $0.14 counting both sides.

The liquidity lock plays no part. The liquidity tokens stayed where they were. The pool was emptied from the other side, by selling tokens that did not exist.

Standard checks do not catch this. Liquidity is 100% locked. Buy and sell taxes are 0%. A buy and sell simulation passes with a clean wallet. Ownership is not renounced, but with no verified source there is nothing readable to inspect. The call produces no log.

8. Volume and who made it

The pool recorded 8,797 swaps. The owner wallet or its bot contract (0xf9ffcdc55376c811ee88c18d1e2d425b4db985dd) made 8,776. Outside wallets made 21 swaps from 10 recipient addresses, for 110.39 USDT in total, and no outside wallet ever sold.

The bot works in two ways: thousands of 1 USDT purchases, and single transactions with series of purchases and sales of 1 million USDT each. The gross volume, about 150 million USDT bought and 150 million sold, shows in any tracker as real activity.

Outside holders were simulated at the block before the hidden call, for each of the five tokens. 26 wallets with a balance tried to move tokens. None could: a transfer to the pool fails with error "g" and a transfer to an ordinary address fails with an empty error. On AXIS, 6 of the 10 outside wallets had a non-zero value in the per-address mapping of slot 5, the one compared with the block number. The owner, its bot and a clean test wallet had zero. Two outside wallets, which bought for 7 and 9 USDT, had the allow flag of slot 2 instead. We do not know who sets that value or when.

This is a simulation with eth_call, not a real sale, and we did not reconstruct the exact condition. It matches the facts: in five pools, no outside wallet sold.

9. Five cycles in a row

The five most recent tokens analysed in full follow each other. Each drain is followed, 54 to 150 seconds later, by the creation of the next token. The capital that returns from a drain pays for the seed and the operations of the next pool.

Seed is the USDT the owner added when the pool was created. Sampled peak is the highest value found by sampling every 2,000 blocks. The AXIS peak measured on every event is 1,544,496 USDT. The five drains returned 4,828,437 USDT to the owner wallet, which is the owner's own capital coming back.

Liquidity of the five pools

Liquidity of the five latest analysed tokens, from the creation of each pool to its drain. The sampling is coarse, so the peaks are understated.

10. The same owner, 27 tokens

Searching for OwnershipTransferred events to the owner wallet from block 126,500,000 returns 27 tokens, created between 9 and 21 October. All end in 7777, all contain selector 0xaaeccdcf, and 26 have a drained pool, with a token reserve hundreds of thousands of times above the supply. Each is distributed by a different deployer wallet which then hands ownership to the main wallet.

The deployers we met are 0x0a22…bd2b (pPOLY), 0xee88…cff7 (startupSI), 0xb833…c13e (PEARL), 0xe9d0…a58d (AXIS no. 1), 0xc356…0737 (AXIS) and 0x8e7a…df75 (the live AXIS). All appear among the linked wallets listed on the radar page for AXIS. A throwaway deployer explains why the creator history of AXIS shows no earlier launches while the linked network shows many.

11. Where the money went

In a pool that starts from nothing and ends at nothing, what the owner gains equals what outside buyers lose. For AXIS the owner USDT balance reads:

The difference is +110.31 USDT, in line with the 110.39 USDT spent by outside wallets. Across the five pools outside buyers put in 1,509.77 USDT (AXIS 110.39, pPOLY 14.77, startupSI 40.69, PEARL 46.76, AXIS no. 1 1,297.16) and withdrew none. That is the documented loss.

After the drain, 1,000,000 USDT went to 0x7a813657019d9a14c77a3ecfc11209f881f2639a (block 128,888,534) and the wallet held 614,466 USDT at the last reading. We do not know what that address is.

12. A token live at the time of writing

The 27th token is also named AXIS: 0xd3901b360b03469e4f12481745196f5f88107777, created on 21 October at 08:07 UTC by deployer 0x8e7abc787233e29c2d58c8e78c258cbae6c7df75. At 17:30 UTC its pool (0xcbd4b453e9a705fa1f9526b26fab8a8bc7b9915e) held 1,358,061 USDT. The owner is the same wallet and holds 738 million tokens, below the supply, so the hidden function does not appear to have been used yet. Its liquidity tokens are in the same locker.

This is the state read from the chain at that time. It is not a forecast. There are three tokens named AXIS in this series, at 0xad4f…7777, 0xb3a3…7777 and 0xd390…7777: a name is not an identity.

13. What this means

• Compare balanceOf(owner) with totalSupply(). If a balance exceeds the supply, or balances do not add up to it, do not buy.
• A "liquidity locked" badge says the liquidity tokens cannot be withdrawn. It does not stop a pool being drained by selling tokens that were created by the owner.
• High volume and liquidity on a token a few hours old can be the owner trading with itself. Here it was 99.8% of the swaps.
• An unverified contract with owner-only functions that write balances is already a warning, whatever the checks on taxes and ownership say.
• For scanners and lists: flag owner-only functions that change balances without a Transfer event, compare the balances of main wallets with the supply, and link deployers through the final owner. A throwaway deployer hides history. The final owner does not.

14. Limitations

• The purpose of the operation is unknown. It spends gas and fees to build volume and liquidity and gains about 1,500 USDT across five cycles. Possible explanations include volume and liquidity for ranking tables, a test of the mechanism or an activity that pays for volume. None is shown.
• We did not trace where the 1.87 million USDT held by the owner before AXIS came from.
• The roles of six of the eight custom functions are inferred from bytecode. The effect of 0xaaeccdcf is established by a real call and by balances.
• The locker is identified as PinkLock V2 by the radar. For the live token the lock expires on 31 October 2027. We did not read the lock terms of the five earlier cycles.
• For 22 of the 27 tokens we have only the current state of the pool, not the flows. The number of people who lost money over the twelve days is therefore a lower bound.
• Whether the live token will be drained in the same way is an expectation based on 26 earlier cases, not a fact.

Appendix A. Transactions of the five cycles

Appendix B. The 27 tokens of the owner

Appendix C. How to reproduce

• Inflated balance: eth_call of balanceOf(owner) on the AXIS token at blocks 128,888,018 and 128,888,019.
• Hidden call: transaction 0xadf202a881a172afbb2a79ea20d122445080e9e422c585f586d486b6a489c222, input 0xaaeccdcf + owner address + 0x71afd498d0000.
• Sale: transaction 0x6286faa0f09b5ce695a4f5be75b887a533b36f2624fec764bf3471bd46c11fee, logs Transfer of 1.46×10¹⁵ AXIS from the owner to the pool and 1,235,445.39 USDT from the pool to the owner.
• Owner balances in USDT: balanceOf(owner) on the USDT contract at blocks 128,784,404, 128,784,406, 128,888,155 and 128,888,157.
• Network of tokens: OwnershipTransferred logs with the owner wallet as new owner, from block 126,500,000.
• Outside swaps: Swap logs of the pool with a recipient other than the owner wallet.

Sources

• AXIS token on BscScan
• AXIS/USDT pool
• Owner wallet
• Bot contract
• Hidden function call (balance multiplied)
• Sale and drain
• Liquidity locker
• Token live at the time of writing
• Archalis methodology

Ratings are automated assessments of structural risk from public blockchain data, not investment advice. Methodology.