The "OpenAI" NEA Rug Pull: 22 Copycat Tokens and Where the BNB Went

In late December 2023 a token called "OpenAI NEA" appeared on PancakeSwap, the largest exchange on BNB Chain. It had nothing to do with OpenAI. Within a week the wallet that created it had pulled the money out of its trading pool, and the token could no longer be sold for anything. We traced it again in October 2026 with the Bitquery MCP server. Each step shows the question we gave the AI and the tool it called. All times are UTC.

Role	Address
NEA token	0x53393cca968afa39215e5dd38abd48a17f1d87e1
NEA deployer	0xAcF8E368F2d72303cAa337a0cAbECa405a8604Aa
NEA/WBNB pool on PancakeSwap	0x5870a9895471cbc6d0ab0c08b3d8f98d94dc028c
Wallet that funded the deployer	0x9cc2fde608c658a840fd7145c206baac9a2b3d1d

Key findings

• The pool took about 479 BNB from buyers and paid back about 3. 112 wallets bought NEA between 27 December 2023 and 2 January 2024.
• The deployer put 60 BNB in and took 535.8 BNB out, in 12 withdrawals. Its gain, about 476 BNB, was worth roughly $150,000 at the time.
• NEA was one of 22 tokens. The deployer and the wallet that funded it created 22 tokens between 19 November 2023 and 1 January 2024. Every deployment used the same amount of gas, 5,365,227 or within ten of it, which points to the same code each time.
• About 325,000 USDT left through a bridge. After the last withdrawal, the money was split across three wallets, swapped to USDT and sent into the Socket cross-chain bridge. None of the wallets on that path carries an exchange label.

How the pool was drained

We asked: "Who created the NEA token, and when?" The AI used bsc_contract_creator. The deployer created NEA on 27 December 2023 at 05:04. Two minutes later it added 170,000 NEA and 60 BNB to a new PancakeSwap pool, which set the starting price.

We asked: "How much BNB went into and out of the NEA pool, and who took it out?" The AI used bsc_transfers_raw_sql on the pool's own transfers, then bsc_tx_transfers on each withdrawal.

What the ledger shows	BNB
Starting liquidity from the deployer, 27 Dec 05:06	60.0
Paid in by buyers, 27 Dec to 2 Jan	about 479
Paid out to sellers	about 3.1
Taken out by the deployer in 12 withdrawals	535.8

The deployer did not pull everything at once. It started removing liquidity seven hours after launch, at 11:59 on 27 December, and kept going in pieces of 10 to 75 BNB over the next three days, while buyers kept paying in. The last large withdrawal, 224.2 BNB at 07:53 on 2 January 2024, emptied the pool. The final NEA transfer on record came seven minutes later.

A withdrawal takes both tokens out of the pool in proportion, so it does not move the price by itself. It leaves less BNB behind, so each later sale pushes the price down further. Only 3 of the 112 buyer wallets ever sold NEA, in 5 sales that returned about 3 BNB in total. The ledger does not show why the rest never sold. Once the 2 January withdrawal emptied the pool, there was nothing left to sell into.

The same token, 22 times

We asked: "What else did this deployer create, and who funded it?" The AI used bsc_contract_creator with the deployer as creator, then bsc_first_funder.

The NEA deployer created 11 tokens between 21 December 2023 and 1 January 2024. They include "OpenAI KEGA", three separate tokens all called "BWL COIN", "KENEX FINANCE", "ONEXIS TECH", "LIBERX Finance", "SODE TECH", "SLY OpenSystem" and "STAND TECH". The wallet received its first BNB, 120 BNB, at 07:32 on 21 December from 0x9cc2…3d1d, and created its first token five minutes later.

That funding wallet had done the same thing before. It created 11 tokens of its own between 19 November and 21 December 2023, and the PancakeSwap router paid it 2,049.7 BNB over its life. Its last token was created at 07:33 on 21 December, one minute after it funded the NEA deployer. Then it stopped launching tokens and the new wallet carried on. A fresh wallet for each batch of tokens keeps an old wallet's history off the new token's page on a block explorer.

Where the BNB went

We asked: "Where did the deployer send its BNB after 2 January, and what are those wallets?" The AI used bsc_flows_between, then labels_for_addresses.

Step	What the ledger shows
2 Jan 2024, 08:29 to 08:33	The deployer sends 1,621.6 BNB to three new wallets: 0x8289…0b71, 0x5b74…71a4 and 0x2e4b…c190
2 Jan to 14 Feb	The three wallets swap 1,320 BNB through PancakeSwap's smart router
3 Jan to 25 Jan	The three wallets send 325,000 USDT to the Socket Gateway, a bridge to other chains

The 1,621.6 BNB is more than NEA alone produced, because the same wallet also ran the other ten tokens. Bitquery's labels name PancakeSwap and Socket on this path, and nothing else: none of the three wallets, the funder or the funder's own funder is marked as an exchange. An earlier version of this post said the money reached Binance and Bybit; we could not confirm that on the ledger.

One more detail stands out. From mid-January, 0x5b74…71a4 sent tokens that call themselves "USDT", but are not Tether's USDT, to groups of addresses that end in the same characters: 0xe47f…7f1d638e and 0x5f83…7f1d638e, for example. One of those fake tokens went out 919 times to a single address. That is the pattern of address poisoning, a scam that plants look-alike addresses in a victim's history in the hope that the victim copies the wrong one later.

Warning signs that were visible

• A famous name with no link to the company. OpenAI has not issued a token.
• A deployer wallet minutes old. The NEA deployer was funded and launching tokens within five minutes of its first transaction.
• Liquidity the deployer could remove at will. Its liquidity-pool tokens stayed in its own wallet rather than being locked or burned, so it could withdraw at any moment.
• Copies of the same contract. Twenty-two tokens with near-identical deployment gas in six weeks is a production line.

Each of these can be checked before buying. Ask an AI connected to the MCP server who deployed a token, what else that wallet created, and whether the pool's liquidity tokens are still in the deployer's hands.

Trace it yourself

Connect the Bitquery MCP server to your AI client with one URL: https://mcp.bitquery.io. Tracing and labels sit on the AI Investigation MCP plan, at $149 per month on our pricing page. The setup guide covers each client.

Who deployed BNB Chain token 0x53393cca968afa39215e5dd38abd48a17f1d87e1,
and what other tokens did that wallet deploy?

How much BNB did the deployer add to and remove from the token's
PancakeSwap pool, and when?

Where did the deployer send its BNB after the last withdrawal?
Label every address.

If you lost money in a token like this, report it to the police and, in the US, to the FBI at ic3.gov. Bitquery's crypto investigation service can help build the evidence.

Frequently asked questions

Was the NEA token connected to OpenAI?

No. OpenAI has not issued a token. The name was borrowed to attract buyers.

How much did NEA buyers lose?

112 wallets paid about 479 BNB into the NEA pool and got about 3 BNB back. The deployer's gain on NEA was about 476 BNB, roughly $150,000 at the time.

How can I tell if a new token is a rug pull?

Check who deployed it and what else that wallet created, whether its liquidity is locked, and whether the name copies a famous company. A fresh deployer with a string of similar tokens and unlocked liquidity is a strong warning.

Related reading

• Crypto rug pulls: how they work
• How to identify duplicate tokens and scam contracts
• Crypto money laundering: how it works and how it is traced

---

First published in January 2024 by Matej. Rewritten on 16 October 2026: the trace was run again with the Bitquery MCP server. The claims that the price fell to zero in 15 minutes and that the money reached Binance and Bybit were removed because the ledger does not support them, and AI tools helped run the queries and draft the text. Bitquery sells the MCP server and the investigation service named above.

The information in this article is published for educational and informational purposes only. It gives no legal, financial, audit, accounting or investment advice, and rests on public blockchain data and the author's own analysis. Naming a token, wallet or service does not imply any endorsement or affiliation, and it does not accuse any person of a crime. Readers should do their own research and consult qualified professionals before acting on it. Bitquery is not liable for any loss or damage arising from the use of this material.