L2DAO Investigation: Summary

🔍Monitoring
,
2

This is the second part of a series detailing the activities of Layer2DAO’s use of 300,000 in OP granted to them by Optimism Governance last year. These posts reveal a pattern of now three attempts by Layer2DAO to sell and move Optimism grant funds contrary to their stated intentions, Optimism Governance rules and norms, as well as their misuse after sale.

  • Timeline of original sale and bridging of Optimism grant funds here
  • Original post establishing L2DAO’s ownership of multisigs here

In part one, I detailed how L2DAO directed 55,000 $OP to two multisigs (ostensibly NFTEarth and LFGROW) under the pretext of ecosystem grants. Onchain evidence and the team’s own statements confirmed that these wallets were in fact actually controlled by the Layer2DAO. That is, the team granted itself the funds before dumping them to USDC and distributing to individual wallets, violating the no-sale policy.
image

This post will outline what happened to these funds post-sale and transfer. Research has uncovered a remarkably labyrinthine network of short-term wallets moving the proceeds from grant tokens among them. It’s going to take some time to uncover and catalogue all of this, as there is simply too much to distill in one post. I encourage others outside Optimism to take up this work. For now, I will focus on the transactions and flow of funds originating from the purported LFGROW multisig, which is identical in composition to the NFTEarth multisig which and is controlled by L2DAO principals.

Beyond the violation of the no-sale clause, on-chain findings suggest funds were not used in accordance with the stated purpose of the governance proposal behind this grant, which was to “create a new DAO focused exclusively on educational and tooling solutions for L2 NFT creators, artists and owners.” I can find no evidence of this DAO existing in any form.

Rather, after selling much of the OP for USDC, this multisig directly distributes the entirety of the grant’s value in several thousands of USDC and OP to 20 wallets, many of which are connected to other L2DAO/NFTEarth associated wallets and at least one of which belongs to a known NFTEarth team member, milkywave.

Wallets funded by this multisig engage in activities such as:

  • Depositing at least five figures of value directly into a Coinbase deposit wallet used by westonnelson.eth
  • Taking unusual action to obfuscate wallets, duplicating actions across several wallets and using contract integrations that make flow tracking more burdensome
  • Buying up large amounts of NFTE and then exiting these positions at a profit using Uniswap v3 LP positions in a low-liquidity pool
  • Engaging in activities such as pulling liquidity before buying up more NFTE and manipulating price upwards only to re-exit the positions later through liquidity pulling
  • Ultimately pull nearly all liquidity out of the token, sending it to close to zero, its current value, mostly after after public evidence of misuse was surfaced
  • Participating in the exchanging and wash trading of NFTs on NFTEarth between them, obscuring value exchange and juicing NFTEarth stats highlighted in public comms

Every single transaction on this multisig (and likely that of NFTEarth) is signed by the same two wallet addresses: westonnelson.eth and a second address that evidence suggests is likely also owned by westonnelson.eth.

In short, funds quickly leave the purported LFGROW multisig and are distributed to individual wallets with no observable value generated that aligns with the stated goals of LFGROW grant; rather, value is primarily extracted directly to a Coinbase account used by westonnelson.eth.

LFGROW Multisig: Major Findings

Overview: This multisig distributes funds to 20 different wallets, some apparently belonging to team members for personal use, contrary to the governance proposal’s claim.

Relevant Wallets:

L2DAO Multisig 1: 0xaf5a0068f5465260a1a88a6264d0dce4469609cf

  • Recipient of original OP Grant

L2DAO Multisig 2 - 0x79ff559431891cfa36fa1e7589c845f2b8831201

  • Owner of L2DAO Velodrome veNFT

LFGrow Multisig - 0x5a711a7aae4a270c05fb9d67544ddcd2694bdc2c

NFTEarth Multisig 1 - 0x56d02ede412b7a786e0662219676439757794fb4

NFTEarth Multisig 2 - 0x78ed254b9c140c1a2be10d2ad32c65b5f712f54b

  • Same signers as NFTEarth Multisig + LFGrow Multisig

General Observations

All transactions on NFTEarth and LFGGrow 2/5 multisigs are signed exclusively by two parties: westonnelson.eth and a second signer.

  • Weston Nelson: 0xD131F1BcDd547e067Af447dD3C36C99d6be9FdEB
  • Second Signer: 0xa2f0F2265DbB5636Ca2dE35a2E4A01b518d5c620

It seems highlighly likely the second signer is the same person as westonnelson.eth as his address was the first and most frequent sender of funds to the second wallet address, including initial gas deposits. 1 westonnelson.eth also transferred/sold several NFTs to the second signer’s wallet, which is a common practice in individuals seeking to book tax losses in a calendar year.

In short, not only did L2DAO control the two multisigs that they granted, but there is strong evidence to suggest Weston Nelson had total control over the grant funds contained within them. This also aligns with the evidence that a significant portion of the sold funds made their way back (via multiple wallets) to a Weston Nelson-used Coinbase address.

LFGROW Multisig

This is the multisig managing the second 27,500 OP distribution, ostensibly to a DAO created to focus “exclusively on educational and tooling solutions for L2 NFT creators, artists and owners NFTs on L2.” We now know that the multisig address is in fact controlled by Layer2Dao principals if not Weston Nelson himself. The NFTEarth team refuses to disclose who is on this multisig, claiming even the anonymous identities of second signer and non-Weston members are “private”.

It is worth noting that L2DAO community members publicly raised concerns about this grant prior to its vote:

image
image1905Ă—542 195 KB

Below is timeline of key events:

Feb 2

Feb 3

  • Swaps ~3k OP for ~10k USDC in two transactions 1, 2

Feb 14

Distribution to several fresh wallets. We’re going to have to describe each of them below.

Feb 15

Feb 16

Feb 22

Feb 25

Feb 26

Believed Team Wallets

Wallet A

0xd155f38a8e8de6ff51981ad1af3d524794544f1b

Mostly a relay wallet.

Receives two 250 USDC distributions from LFGROW multisig and one 100 OP distro from NFTEarth multisig

Gas funded by 0xa8fd40f305ae7802d07051da9ee3c2d947f3be9f

Receives 800 USDC from Alternate NFTEarth Multisig

2/24 Swaps 100 OP for USDC

Sends 1600 USDC back to 0xa8FD40f305AE7802D07051Da9eE3C2D947F3bE9f

Receives another 800 USDC 0x78ed254b9c140c1a2be10d2ad32c65b5f712f54b and immediately relays to Binance deposit address 0xc563939d59620f6ddc9e64f5a9f4bf94c3ce689a.

Wallet B

0x533efe4be8ac3db73ace6a9693e32d9eb9766ada

Gets gas from 0x7d3e5dd617eaf4a3d42ea550c41097086605c4af, ryuzaki01.eth

Likely dev payout, paid from both NFTEarth and LFGROW multisigs

Funds still there

Wallet C

0xe080cca10d375face1bdcc8529dbb58bfa90cfda

Funded by Binance wallet

Sends everything to what looks like cold wallet: https://debank.com/profile/0x68fb45903efe31c296a88ce2de5a26dc91aa5547/history

Also paid by alternate NFTEarth multisig https://debank.com/profile/0x78ed254b9c140c1a2be10d2ad32c65b5f712f54b

Wallet D

Apparent dev wallet; does not do anything with funds.

https://debank.com/profile/0xaf416b6310840e372da03994ea778a118b7b844f

Funding wallets:

0xe2665358fcd9ecd3f40fe4d1d87d473236180202

0x390e263d1734e3997dd5f61ace3ffffc66ab0b34

500 USDC from Multisig 2

100 OP from Multisig 1

Also receives 3700 USDC from Alternative NFTE multisig 1,2,3,4,5

Wallet E

0x8cb2c246264fe4106edea4b86120d9555caa5d31

Connected to a large network of wallets that all seem to do the same actions - enter the NFTE market through LP and swaps, and moving NFTs.

Connected wallets:

0xdf23b8510848b1fa707980136f7cb7864186004e

0xe5f6c1d3ab1c0d4fce14975717541f8f4fad2b26

0x79ff169de4b6e4259c03e7e2a12c4f1d814b35a5

Network of wallets that seem to do the same things, as though they sibyl activities

Wallet F

0x9581c5df8ea9a0aa84e52f40a378d7339bedccc3

5000 OP from LFG multisig

All swapped to USDC and ETH within hours 1, 2, 3, 4, 5

https://debank.com/profile/0x9581c5df8ea9a0aa84e52f40a378d7339bedccc3/history

2/17

EXAMPLE OF LAUNDERING OP THROUGH NFT SALES

Buys up chads and L2stateofmind NFTs from Wallet G 0x4e9df8fb6b266d7ca430fab6e8a2e8c8f0170595#tokentxns (funded by 0x81ad206d5438e6d0b368812d90ee5a00a18ac0da swaps all for NFTE and sends most received funds to Wallet L

The rest is sent to 0xd004bd8490b761202f3c0a139d446be7153e03c7

Bridges 2 eth to Arbitrum to wash trade NFTs 1,2 (smolbrain sold to 0x4e9df8fb6b266d7ca430fab6e8a2e8c8f0170595)

In general:
early buyer of

There are just too many instances to count but I’ll just tally up related wallets

0x7b91FA01Dc8Cb3bC55E1781163f5aEaed6747d10

  • westonnelson.eth connected wallet — has multiple transactions

There are simply too many transactions here to recount but in summary:

Too many tx’s to count so refer to https://debank.com/profile/0x9581c5df8ea9a0aa84e52f40a378d7339bedccc3

Wallet G

0x4e9df8fb6b266d7ca430fab6e8a2e8c8f0170595

Wallet H

0xFA6461Bb191D63854A995b9a20c9e751B426dAff

Basically the same as Wallets F and G, trade NFTs, swap for NFTE and send to Wallet L

Wallet F

0xcab9f6c96f7e404f5a6799b795feb10231c1c71b

750 USDC from Multisig 2

Mostly used for onchain speculation

Wallet G

0x903d7cca2c906992a3580a274431f1c8c718e987

Confirmed Milkywave’s wallet.

Jan 25 - Sent 250 OP from Multisig 1

Feb 3 - Sent 50 OP from Multisig 1

Feb 15 - Sent 1000 USDC from Multisig 2

Also receives Llamapay from Thales:

https://optimistic.etherscan.io/tx/0xab48c2532b951b15db742a40bfa082a61814696ef45616c8d38c1684e7472f27

And receives milkywave.lens

Wallet H

0x065625c463b857013da7f1a7267d56d317f7a8c2

Feb 22

Feb 25

Feb 27

  • Buys back NFTE

Mar 3

Mar 19

Wallet I

0x49a9561f5631db7a062b3048740939ed62391892

Feb 22

Feb 23

Feb 25

Wallet J

0x337c57c361e7eec6153524b615e2109a23752162

gas eth funded by Wallet I

Feb 22

Wallet K

0x8c7e0268dea8603b6e9a09b593d8e9056c371cda

3500 USDC funded by Multisig 2

USDT to ETH, Eth swaps to NFTE with some LPing and trading

Wallet L

0x8acd4ee46a97be6e483dcfcc99263915abde996a

aka, the base wallet of the sibyl network

There’s so much stuff happening on this wallet that it really needs its own post

Highlights:

Sends at the time 150k USDC worth of NFTE to four wallets

Sends to 0x73dbdd23279e92015d4fa983f9f05adea549855f

Following start of allegations, moves funds to new wallet 0x5422a41174b5bbc639f82352dc1ac33c6b256eab/history which has been taking ETH and buying up NFTE with hit.

Wallet M

0x54d65f117b5496ccdc155208048fc15334ae0dec

7000 USDC funded from LFGROW wallet

ETH from 0xf8d6ae551667887180ddbc4a5b8a652f11e8bc11, which itself is funded by Wallet L

CEX deposit addresses:

Coinbase deposit 0x106e04a17f7462967b7df788ea29018cdc59ca4b

14 Likes