How Scienter would have flagged LIBRA twenty-one minutes before the announcement

What this is, and what it is not

This is a backtested forensic reconstruction. We rebuilt the LIBRA launch from Solana mainnet after the fact; we were not watching the chain on 14 February 2025 and we did not warn anybody. Nothing below is a record of a live call.

What it does establish is narrower and, for a diligence desk, more useful: exactly which facts were on-chain, and at exactly which second, before the promotion that brought retail in. Every figure carries the transaction signature it came from. The reproduction commands are at the foot of the page, so you do not have to take our word for a single number.

The receipt

The subject is the SPL mint Bo9jh3wsmcC2AjakLWzNmKJ3SgtZmXEcSaW7L2FAvUsU, symbol LIBRA, six decimals, supply 999,983,680.427382. The deployer is DefcyKc4yAjRsCLZjdxWuSUzVohXtLna9g22y3pBCm2z — the full string behind the DefcyKc… prefix published by Bubblemaps, resolved here from the mint's own dev field.

We paginated the deployer's entire signature history to exhaustion: 4,491 transactions, and the pagination returns empty before February 2025. The wallet has no earlier life. Its first transaction is its funding:

Elapsed from an empty wallet to a live market: three minutes and thirty-seven seconds. The promotional post that drove the token to a multi-billion-dollar valuation is reported at 19:01 Argentine time — 22:01 UTC. The pool had been open for roughly twenty-one minutes before it.

Three things were therefore legible on-chain before any retail buyer arrived.

The deployer had no history. Not a thin history — none. A counterparty score computed at 21:40:24 would have been scoring an address three and a half minutes old, funded exactly once. The funding wallet's own behaviour — durable-nonce withdrawals fanned out to unrelated destinations, transfer+closeAccount deposit sweeps consolidating into a single collector, 16,235 SOL on hand, still transacting today — is characteristic of centralised-exchange withdrawal infrastructure rather than of an individual. We did not establish which operator it belongs to, and it matters less than what it implies: the capital arrived through a venue that performs identity checks.

Supply was never distributed. At 21:38:02 one account held 100% of it. Not a majority — all of it.

Eighteen addresses were enumerated before the market existed. Two identical transactions, in the same second, touching the same 18 addresses with 100 lamports apiece. At 0.0000001 SOL, that is not funding; it is a list being written down. It was written two minutes and seventeen seconds before the pool opened.

The T-3d scorecard the brief asked for does not exist

We were asked for the composite scorecard at T-minus-three-days. We cannot produce one, and the reason is the finding: at T-3d there was no deployer, no mint, and no pool. The wallet's genesis and the market's opening are 217 seconds apart. There was never a three-day window in which a daily-cadence review could have looked at this token, because for all but 24 minutes of its pre-announcement life it did not exist.

Reconstructed against Scienter's published risk-card schema, at the moment the market opened:

One correction to the record, because it cuts against the easy version of this story: the mint and freeze authorities both read null today. They were not null at launch — minting the supply at 21:38:02 required a live mint authority. We did not locate the revocation transaction and make no claim about when it was surrendered. The consequence stands either way: a scanner run today reports revoked authorities and no freeze authority, which is to say a token-contract check returns clean. The risk was never in the contract.

Outcome

Public reporting is the source for everything in this section; none of it is our measurement. The token reached a peak valuation reported between $4bn and $4.5bn and fell roughly 89% within three hours, and by more than 96% from peak. TRM Labs traced approximately $90m in SOL and USDC to consolidation addresses; Bubblemaps attributed $87m withdrawn inside a single hour, and describes the same address cluster launching further tokens afterwards. Argentine authorities opened an investigation and the promotional post was deleted within about five hours.

On-chain today, the mint that was worth billions carries a market capitalisation near $7.1m across 21,850 holders.

What this means for institutions

The uncomfortable part is not that the signals were subtle. They were blunt: zero-history deployer, 100% creator share, a pre-written list of 18 addresses. The problem is the clock. Every one of those facts existed inside a 217-second window, and the window closed 21 minutes before the promotion.

That has three consequences for anyone running counterparty diligence.

Token-contract screening is the wrong instrument. LIBRA's authorities read clean today. A checklist that asks "is the mint authority revoked?" returns a pass on this token. The information that mattered was never in the contract — it was in the deployer's age, the supply's concentration, and a set of addresses that had been enumerated before there was a market to trade in.

Daily cadence is not a cadence. A review that runs nightly, or even hourly, would have seen nothing at every scheduled moment before the announcement, and a fully-formed market afterwards. Launch forensics is an event-driven problem or it is nothing.

The counterparty is the unit of analysis, not the asset. The asset was under three minutes old at the moment its market opened, and had no history to analyse. The deployer had no history either — and *that*, expressed as a score rather than an absence, is the signal. Scienter's position is that you underwrite the address, and that a wallet with no past is a finding rather than a missing data point.

We publish our own failures on the same terms: our first signal engine returned a Sharpe of −0.14 over a 90-day backfill, and we wrote that up in full. Apply the same scepticism to this page that we are asking you to apply to a counterparty.

Reproduce this yourself

Every number above came from the public Solana JSON-RPC endpoint and a public token API. No key, no vendor, no account. Run these and check our work:

# 1. The mint: supply, decimals, and today's authority state.
curl -s https://api.mainnet-beta.solana.com -X POST \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"getAccountInfo",
       "params":["Bo9jh3wsmcC2AjakLWzNmKJ3SgtZmXEcSaW7L2FAvUsU",
                 {"encoding":"jsonParsed"}]}'

# 2. The genesis transaction: who funded the deployer, and with how much.
curl -s https://api.mainnet-beta.solana.com -X POST \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"getTransaction",
       "params":["vUeUPovHSLwQaLVeq9NYYpCXdeZoz2xmNS8jsieAZoHR9qmSsAWPHeWzQAxHGm3ZiHh5hLf28q5yVYucFCugJBg",
                 {"encoding":"jsonParsed","maxSupportedTransactionVersion":0}]}'

# 3. The whole-supply mint to a single account.
curl -s https://api.mainnet-beta.solana.com -X POST \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"getTransaction",
       "params":["3Wbtz4JR9L3Dt8YJA5dHN9tKgSzqBt5ndhvo1SSRvQk789tBArAUAu7KHvHPwHbRpv8gAAhEZ5Akz3oqorHQdv24",
                 {"encoding":"jsonParsed","maxSupportedTransactionVersion":0}]}'

To confirm the deployer has no history before 14 February 2025, page getSignaturesForAddress on DefcyKc4yAjRsCLZjdxWuSUzVohXtLna9g22y3pBCm2z with before until it returns an empty array. It terminates after 4,491 signatures.

If you want this run against your own counterparties rather than a token from last year, that is the Forensic Sprint — we run the stack against your real exposures and hand back the queries behind every figure. The wallet surface is at /wallets.

The eighteen addresses

Enumerated at 21:38:07 UTC, before the pool existed, in txs 3QeAFjdShoFV… and 48kPh3hyRS2z…:

FyHzuYhDEcJ7kzppJoMqfWS6oAWqscDzhMAA9hbnZN2C
HjSLMVBQZCATmSpyW98mYvFpqbLdqdg6JW29Yt1CgtRA
2kpZe9sH4H98VPi42nG8c57MouYVJ76LeYHCz1zLWnJ2
7JnstWHVGcQMSZWWPs4dwZQhQuwruUzzYa48HdLnZdjh
DefcyKc4yAjRsCLZjdxWuSUzVohXtLna9g22y3pBCm2z
5jepzRCDiu39mozX1s86ATDoALpEK5kHWSzm1k3zggv8
8CsYSthyktBVtWsro9XxQstyWrmXzVgoCjiaNGFZQURK
4nCj3HLTZXqjBSmLnPtkbKtRT7GzzmGhH8HpL3q13uHK
6S4JqLcpdU2xaLfq5PjanqGbpvnuogKezu5hx9GivHsF
HCtZQUZBeCxoGDNukZPpadxrnLHGL1oAjxwx5j2EFr8a
2JMujnvSSEUbhxnQoUKaUheERELrHeVuEaSxZpc3GhWf
DUZ7XdioPGwuTJnrHBxJGz5zthjJdhLWN2xdpXSdPVph
BQyLn3RpvF41Bap2CiaHHjPrHdfycwiaE26sxJcqbdBR
Ezd76MUN33kt7aJtPiTmv38LD5L9mzXq2dCYDBTjQq5r
FMAXGYcpmQeFKWQQXNVCLJU8RYb2NQADbTXgwBjqRr4c
39UUBUwWCsuLrcSY9Zp4t2j4E8TL1W3uLwUggSceLC4g
HnZPB1BUWfQb5JGT1CMWBsBBeeAvmXW1AgUkX9NiivmX
DVXQ3Lrr6SQ9SszS3MkfMbh3ignS2meGEGErzVes8SYV

An address appearing in that list is a statement about what the deploying wallet did — it wrote to these addresses — and not a statement about the people or purposes behind them. We have not established who controls any of them, and we do not allege anything about their conduct.

Sources and method

Chain data was read from the public Solana JSON-RPC endpoint api.mainnet-beta.solana.com on 2 September 2026; token name, symbol, deployer and holder count from the public Jupiter token API. Timestamps are blockTime in UTC. The announcement time is from press reporting, not from chain, and is the one figure on this page we did not measure ourselves.

Secondary reporting, cited where used and not independently verified by us: TRM Labs on the flow of funds to consolidation addresses, and Bubblemaps on the $87m hour and the cluster's later launches.