Hunter Biden's LAPTOP coin report, checked against the blockchain

01 · The disputeWho sold LAPTOP?

Hunter Biden says his team never sold a single LAPTOP coin. On 7 October he posted the proof. He blamed the crash on two trading firms his team had hired to keep the market steady. Hours later, an on-chain sleuth hit back. The founders' wallet, the sleuth said, was one of seven. Some of the others had been sending tokens to exchanges.

LAPTOP is Hunter Biden's crypto coin, a meme coin with no business behind it that trades on hype. He launched it on 9 September on Base, Coinbase's blockchain network. Part of the supply was airdropped, given away free, to readers of his Substack and to people who had lost money on Donald Trump's own meme coin, $TRUMP. Within two minutes of the first trade, the price ran from 5 cents to about $317. Within the hour it had lost 98% of that.

A month later the team posted its side of the story. It had paid Groom Lake, a firm that digs through blockchain data, to write a report on the launch. The report makes two points. The founders' tokens never moved. And the market makers, the trading firms paid to quote both sides so the price moves smoothly, came out ahead, one of them after leaving almost nothing to trade at launch. Hunter Biden wrote that the one he blames most "should buy it all back and burn it."

The reply came from @dethective, a crypto sleuth with about 40,000 followers on X. It agreed the founders had not sold. But it argued that the same keys control six more team wallets. Three of them, it said, moved more than 50 million LAPTOP to exchanges in the two weeks before the report, and both market makers profited on tokens the team handed them. It posted the market makers' addresses and left their names for readers to look up.

Bitquery indexes every transaction on Base, so we followed all one billion LAPTOP from the moment they were minted. We checked who controls each team wallet and matched every wallet to the team's own token disclosure. Then we traced every token that left, and our address labels named both market makers. Both sides turn out to be partly right, and each leaves out facts that hurt its own story. One question stays open, and it matters. Public records do not show which of two team wallets is the treasury and which is the charity fund, and the answer changes how to read 25 million tokens. The fake LAPTOP tokens that flooded the launch are covered in our earlier LAPTOP investigation.

02 · The team's storyA thin pool and two market makers

Start with the team's version. The report covers the first 36 hours of trading, and its key finding is about the launch pool, the pot of tokens and dollars that traders swap against on a DEX. Liquidity providers choose the price ranges where their tokens sit. So a pool can hold plenty of cash and still have almost nothing to sell near the current price. LAPTOP's main pool opened with about $35,700 but fewer than 30,000 tokens, a sliver of a billion.

That made LAPTOP far easier to pump than to sell. By the report's count, a few dollars of buying moved the price as much as thousands of dollars of selling, a gap more than 30 times wider than the most lopsided of 668 other launches it checked. A pool that thin can print a price nobody could ever sell at. We have seen thin pools used the other way, to fake trading volume on Base.

Then the report times the moment the exit liquidity vanished. Eighty-four seconds after the peak, the wallet it ties to market maker 1 pulled an LP position, a block of tokens or dollars parked at a chosen price range. The cash left for sellers near the price dropped to zero. The report also puts both market makers ahead on their trading, and dates market maker 2's first standalone sale to 12:15:51 UTC, after the crash had started.

The report checks one team wallet, the founders'. It says nothing about the others, and it never says how much money left the pool in that withdrawal. That gap is where the sleuth came in.

03 · The scorecardWho got what right

We tested every claim we could check, from the team's report, Hunter Biden's thread and the sleuth's reply. Most hold up. The ones that fail mostly turn on what a transfer means rather than whether it happened.

To see why, start with who controls the wallets.

04 · The team's walletsSeven wallets, one set of keys

Every LAPTOP token was minted in April into a single wallet, which split the billion seven ways on 1 and 8 September. All seven are Safes, multisig wallets that need two keys to sign anything. Six of them, the founders' wallet included, share the exact same three keys. The seventh shares two of the three.

The wallet sizes match the allocation table in the team's disclosure, which tells us what each one is for. The sleuth's list of seven team wallets had nine addresses, and one of them is market maker 1's own Safe, with keys the team does not hold.

The founders' Safe has never sent a token, and the predictions Safe has only sent tokens to a burn address, which nobody can spend from. The two airdrop Safes and the liquidity Safe were always meant to move.

Three team Safes did send tokens toward exchanges in the two weeks before the report, about 48 million in all: the day 1 airdrop Safe, the liquidity Safe and one of the two 50 million Safes, which we call wallet F. That is the sleuth's strongest point, and most of it has a paper trail.

The day 1 airdrop Safe sent its share to Bitpanda, Bitvavo and Gate. The disclosure says 2% of the supply goes to people who lost money on $TRUMP through exchanges that take part, so those transfers fit a public plan. The same Safe sent 80 million to the claim contract, the app Substack readers collect their tokens from. Only about 1 million, roughly 1%, has been claimed. In 35 large airdrops this year, the median pot paid out 87%, as we found in where airdrop tokens go.

The liquidity Safe sent out 62.5 million. The disclosure reserves it for exchanges and market makers, and that is where most of it went: about 30 million ended up with addresses our labels tie to GSR and 2.1 million with one our labels tie to Wintermute. On the day the report is dated, it also sent 10 million to a Gate deposit address, the kind of address an exchange gives one customer. That address had already received LAPTOP from an address Wintermute's had funded. About 20 million more went through new addresses that spread tokens across exchanges and pulled some back out of Kraken, which is how market makers move stock between exchanges.

Wallet F is the one that does not fit. It got 50 million at the split and is either the treasury or the charity fund. At 12:06 UTC on launch day, three and a half minutes after trading opened, it sent 30 million to a fresh address. Most came back eight days later, and about 5 million ended up with GSR. Then on 18 September, 25 million left through two more addresses into deposit accounts at KuCoin, Gate and Kraken.

Nothing else in this story sends tokens to those three accounts. Depositing tokens on an exchange does not prove they were sold, and only the exchanges' records can show that. Which brings us to the firms on the other side of the launch.

05 · The market makersGSR and Wintermute

Hunter Biden says his contract stops him from naming the market makers. The team's own disclosure already does. It lists token loans totalling 37.5 million to three firms: G20, GSR and Wintermute. Our labels match the report's two market makers to two of them.

Market maker 1 matches GSR. The report ties it to a Safe that needs two of 14 keys, none of them a team key. On launch morning, 9 million LAPTOP reached that Safe, through one hop, from a wallet our labels identify as GSR's. Five days earlier, the liquidity Safe had sent 15.5 million to an address whose gas fees GSR's wallet had paid three hours before, and that address forwarded them to GSR's main wallet about an hour later. Two separate label sources agree on the GSR name.

In the same second that trading opened, the market maker 1 Safe placed three LP positions in the pool. Together they held $5,244 in USDC, a dollar stablecoin, and 29,885 LAPTOP. That token count is the report's figure for the whole pool. Every token buyers could grab at the open came from this one Safe.

The chart also settles the sleuth's sharpest charge: that the report cites market maker 1's $5,200 and leaves out the $650,000 it pulled three minutes later. The sleuth pairs a $5,000 deposit with a $649,000 withdrawal. Both transactions are real, but they belong to different positions. The $5,000 position was never traded against and came back whole. The $649,000 came out of the third position, which held only LAPTOP when it opened. Buyers took nine in ten of those tokens on the way up, and their dollars were what came out. Across its first four minutes, the Safe's positions took out about $672,000 more in dollars than they put in, for about 27,000 tokens.

Market maker 2 matches Wintermute. The report times its first standalone sale to the second, and the address the sleuth named made its first sale at exactly that moment. That address got all 810,000 of its tokens from a wallet our labels identify as Wintermute's, which got them from the team's liquidity Safe one hop earlier. It sold three quarters of them, nearly all through KyberSwap, for $2.34 million in under two hours, and sent the rest back to Wintermute's wallet that afternoon. We have met Wintermute's wallets before, settling 37% of the trades in Coinbase's tokenized stocks.

Counting the addresses our labels tie to GSR and an exchange deposit address they share, 35.0 million reached GSR, 17.3 million of it straight to its main wallet. With Wintermute's share the total is 37.1 million, close to the 37.5 million in loans the disclosure lists. The sleuth called these tokens free. The disclosure calls them loans, and the report says the loan terms hand the team the trading fees the positions earned.

06 · The first hourThe launch, minute by minute

Put together, the launch hour looks like this. The chart shows the median price paid each minute in the main pool. The report's peak is the pool's quoted price, a separate measure, so the line sits below it. Prices swung hard around these medians in the busiest minutes.

07 · Open questionsWhat we could not settle

Is wallet F the charity fund or the treasury? The disclosure gives the charity fund nothing at launch and a 36-month release schedule. The treasury is unlocked from day one and may be sold to pay running costs, with any profit left over going to TTM Media Group, a company the founders own. If wallet F is the charity fund, moving 55 million in its first ten days breaks the published schedule. If it is the treasury, selling would have been allowed, and any leftover profit would reach the founders' company. One detail leans toward the treasury reading. About 5 million from the liquidity flow reached wallet F through the same fresh address, a few hours before its 25 million went to exchanges, and the disclosure says tokens clawed back from liquidity go to the treasury. The team's papers do not say which wallet is which.

Who runs the addresses that move tokens between exchanges? They behave like a market maker topping up stock. G20, the third firm in the disclosure, has no label in our data and could be behind them.

Where is the custody firm? The disclosure says the predictions, charity and treasury tokens are held with Coinbase Custody. On-chain they sit in Safes run by the same keys as the founders' Safe. One of those keys may belong to the custody firm; nothing on-chain shows it.

So who is right? The founders did not sell, as Hunter Biden says, and the market makers came out ahead on tokens the team lent them, as both sides say. What the team has not explained is the 25 million tokens one of its own Safes sent to exchanges.

08 · MethodHow we checked

Every transfer comes from Bitquery's Base data, through 8 October. We read each Safe's balance and keys straight from the chain, and every balance matches the transfers we counted. The price chart shows the median price paid in each minute, leaving out transactions that only add or remove liquidity. Market maker and exchange names come from Bitquery's address labels; two deposit addresses with no label are named by where they forward tokens. The same data is available through the Base API, and the full history of Base transfers is also sold as files in the Bitquery Data Store, with our address labels dataset. Any wallet here can be followed further with the Bitquery MCP server; we used the same approach to measure fake trading across six chains.

09 · The recordAddresses behind this story

FAQ

What is the LAPTOP coin?

LAPTOP is a meme coin that Hunter Biden launched on Base, Coinbase's blockchain network, on 9 September 2026. One billion tokens exist. Part of the supply was given away to his Substack readers and to people who lost money on Donald Trump's meme coin.

Did Hunter Biden's team sell LAPTOP?

The founders' Safe still holds all 300 million of its tokens and has never sent one. Other team Safes did send tokens to exchanges, mostly for airdrops and market making, which the team's disclosure allows. One Safe that is either the treasury or the charity fund sent 25 million to exchange accounts, and the public record does not show whether they were sold.

How much did Hunter Biden make from the LAPTOP coin?

The public record shows no sales from the founders' Safe, which holds all 300 million of its tokens and is locked for six months. The disclosure lets the project's foundation sell treasury tokens to pay costs and pass leftover profit to a company the founders own. A team Safe that is either the treasury or the charity fund sent 25 million tokens to exchanges; whether they were sold is not public.

Who are the LAPTOP market makers?

The team's disclosure names three firms with token loans: G20, GSR and Wintermute. Bitquery's address labels match the report's market maker 1 to GSR and market maker 2 to Wintermute.

Why did the LAPTOP coin crash?

The launch pool held very few tokens near the opening price, so buying pushed the price from 5 cents to about $317 within two minutes. When sellers arrived there was little cash to sell into, and a market maker pulled a position during the fall. The price lost 98% of its peak inside the first hour.

Was LAPTOP a rug pull?

A rug pull usually means a team drains the launch pool or dumps its own tokens. The founders' Safe has not sold, and the tokens in the launch pool came from market maker 1's Safe rather than a team Safe. One team Safe's 25 million in exchange deposits is still unexplained.

Who is Groom Lake?

Groom Lake is the firm the LAPTOP team hired to review the launch. Its report covers the first 36 hours of trading and the founders' Safe.