Hunter Biden's $LAPTOP: 4,075 fake tokens, one real one

01 — The order of eventsThe fake came first

On September 7, 2026, a Wall Street Journal report set off the news cycle: Hunter Biden was launching a memecoin called $LAPTOP. The details repeated across crypto media that afternoon were specific — a September 9 launch on Base, a total supply of one billion, 30% to founders on a six-month lock, and a 20% airdrop set aside for wallets that lost money on $TRUMP.

Two things about that package matter. It named a ticker, and it named a date. It named no contract address. That gap is the entire opportunity, and somebody was already standing in it.

Traders noticed. Within an hour of the news, one widely-read account was warning followers that until there is a single official contract address, every $LAPTOP on a screener should be assumed fake. That was the correct advice, and it misses the problem, because the fakes were the loudest thing on the board.

02 — The scale351 tokens, three chains, fourteen hours

We counted every distinct contract that traded under the LAPTOP ticker from 14:00 UTC on September 7 onward.

Three hundred and fifty-one contracts on the three chains we could count fully. Not one of them can be the real token, because the real token had not been deployed.

The reported volume is where it stops being funny. Across just the seven BNB Chain LAPTOP contracts that traded against USDT, the stablecoin side sums to $1,996,195,322. Two billion dollars, on tokens whose combined fully-diluted valuation never exceeded about $20 million, for a coin that has not launched.

That number is real in the narrow sense that the USDT rows are on the chain. It is not real in any sense a buyer would care about. Here is what it is made of.

03 — BNB ChainTwo addresses, and one of them is the pool

Take the largest of them, 0x1cb7e040aea75dfe0905562ba5f79270e6c9b727. Trackers showed it at roughly $199 million of 24-hour volume, near the top of every BNB Chain trending list. We ranked every address that traded it by USDT moved.

The market is one wallet trading against the pool it supplies, 6,247 times. Everyone else in the world put in about $6,900.

The USDT transfer log states it without guessing. The same few hundred thousand dollars went through the same pool for thirteen hours, and the gap between the two directions is fees and price impact.

Because the wallet and its pool hold most of the supply between them, most of those fees come back to the same hands that paid them.

That profile is the signature. Nearly 375,000 transfers across fewer than 200 counterparties is not a trader; it is a loop. And it is not running one token. Pull its inbound transfers for any single second of September 8 and you get all three of the top BNB Chain LAPTOP contracts at once — 0x1cb7e040aea75dfe0905562ba5f79270e6c9b727, 0x7848486268ec27056f7b8abfdbfbb534a9c7538a and 0x3cff2273159d7193d3ab069e8a45f0f6cc10df81 — each cycling against its own pool, mixed in the same blocks. Those three contracts are the source of most of the two billion.

The same address also runs tokens called ARC, MarsCoin and 🅿️ through the same loops. $LAPTOP was a job rather than a project.

04 — Base$23.7 million reported, $7,039 real

Base is where the real token is supposed to launch, so a fake that ranks well on Base is worth the most. The leading Base fake, 0x4fb636434b05c5dbcf0070f2e810f8e706277b07, was reported at $23,684,304 of volume on a single Uniswap V3 pool.

We summed the USDC side of every trade it made, directly.

Seven thousand dollars, at an average of fifty-six cents a trade, presented to the market as twenty-three million.

How it works shows up in a single pair of trades, six seconds apart.

Ending with nothing held is the counting mark of a pure wash loop.

05 — SolanaEight wallets, thirty seconds apart, one hub

The pattern repeats on Solana with better tradecraft. The largest Solana LAPTOP mint, Gha5SUvx3Xh1kyFn3LzgcRnfyp6gkcRzqnBEFwxsfok5, reported $27.4 million across 34,405 trades on a Pumpswap pool. The top eight traders look like this:

Eight wallets whose first trades land inside a thirty-second window, whose last trades land inside a ten-second window two hours later, each running within 2% of the same trade count and the same volume, each ending barely down by exactly the amount you would expect to lose to fees. That is one program with eight keys.

Their funding confirms it. All eight are fed by a single hub, 336BnVmmAT4yu7fjaEmz6cZ7XRvif4ZuMrbo4aychnfe, which has sent 5,656 transfers to 477 addresses — a dispatcher rather than a person.

And then the detail that says what this industry actually is. At 04:35 UTC on September 8, that same hub funded H4bvwuyQVczpfUsky4QtYA8sVW8sNRUUHVhtoLhhJY6Q — one of the eight LAPTOP wallets — with 81 million units of an entirely unrelated token, and the loop started again on a new ticker. The crew that made $27 million of $LAPTOP volume had packed up and moved to the next job roughly twenty-eight hours before the real $LAPTOP was due to launch.

We ran every address in this investigation through the label directory in Bitquery MCP. None of them carries a label — no exchange tag, no known entity, no scam flag. That is a meaningful negative: none of this is being done from an address anyone has already named.

06 — The victimsA thousand people, thirteen dollars each

If the volume is made, who is actually buying?

On BNB Chain we isolated every wallet that bought a LAPTOP token with fewer than 50 trades — the filter that separates a person from a loop. There are 1,144 of them, and between them they spent $15,511. An average of $13.56 each.

That is the honest shape of the damage so far, and it is worth being precise about it. Nobody has been cleaned out yet. These are small, curious bets by people who saw a ticker they recognised near the top of a screener and put in the price of lunch. The fake market has not yet had anything real to steal, because the event it is placed for has not happened.

07 — The pictureThe screener is the product

There are two findings here and they should be kept apart.

The first is that a fake market for a named token can now be built in under a minute and scaled to hundreds of contracts in under a day. The trigger was a news report that named a ticker and a date but not an address. That is a completely ordinary way to announce a token, and it is enough. Between the announcement and the launch there is a window in which the name has enormous value and no official referent, and that window is now automatically farmed.

The second is that the volume figures produced inside that window are close to empty, and they are empty in a direction that hurts. A buyer's fastest sanity check on a token is that it is trading heavily. Here, heavy trading is the cheapest thing to manufacture — cheaper than liquidity, cheaper than holders, cheaper than a website. The largest Base contract bought its $23.7 million headline with about seven thousand dollars of real money and a bot doing six-second round trips. Anyone using volume to tell the real token from the fake ones tomorrow will be reading a number that the fakes control and the real token does not.

The tell is not the volume. It is the ratio between the volume and the money: the stablecoin side, the count of distinct buyers, the average trade size. Thirteen buyers and a 56-cent average trade is not a market, whatever the headline says.

The real token had not been deployed. Two billion dollars of volume had already been reported in its name, and the crews that made it were on their way to the next ticker.

Bitquery Research

08 — The launchThe real token arrived, and the fakes stayed

Added after the launch. Sections 01 to 07 stand as first filed, two days earlier, before the token existed.

$LAPTOP opened for trading on Base at two minutes past noon UTC, just after the eight o'clock Eastern bell it had been given. The contract is a LayerZero omnichain token, source verified, carrying a Hacken audit from April. It is the genuine article, and it behaved the way these things behave: a violent opening hour, then a slide that has not stopped.

The argument in section 07 was that volume would be the wrong thing to read on launch morning. It held, and the scale was worse than we put it. When the genuine contract went live the fake market grew. We have watched the same reflex before, when the GTA VI leak became a token launch.

Ranked by the volume figure a screener would show for the nineteen hours after the bell, the real token came sixth. Five fakes printed more than it did.

The crews we named the day before had nothing to do with any of it. Every contract in the first count was dropped at or before the bell, which is what section 05 said the Solana wallets were already doing.

09 — The rented crowdFive and a half thousand buyers, one sender

The last of the four checks we set out below asks you to count distinct buyers and average trade size, on the idea that a loop of two wallets cannot fake a crowd. On BNB Chain that idea had already been beaten before we printed it.

Take the largest fake of launch day, 0x578a8a6ed08974554fc823daaf2d52dc90f17777. A screener reads it as a healthy market: nearly six thousand separate wallets traded it, at a median size well into five figures, spread over fifteen hours. Look at who paid the gas and it comes down to one address.

That one address signed all but 41 of the contract's trades and supplied all but 28 of its apparent buyers. The wallets are not drawn fresh each time either: the set is fixed and reused.

The book that farm has worked through in a week includes Arc Finance, MarsCoin, Stonks, FLORK, BEN, 4Stock and a dozen others. Section 03 named ARC, MarsCoin and 🅿️ as the other jobs the first engine was running. This address runs all three as well, which is either the same crew seen from the gas side or a service both of them rent.

On launch day it pointed that crowd at $LAPTOP six times over, opening a fresh contract every few hours as the previous one went quiet.

Six of them inside twenty-seven hours, close to half a billion dollars of reported volume, one crowd wearing six costumes. Whether a bought crowd pulls a real one in behind it is a question we tested on its own.

There is a second thing the launch exposed, and it cuts against the premise this piece opened with. We wrote that the news named a ticker and a date but no contract address, and that the gap was where the money was. The gap was smaller than that. The real contract was live and moving supply on Base from the seventh, and whoever was minting the fakes found it before the readers did.

That contract carries the ticker LAPTOP, and its token name is the string 0xB095274743941e953c746F9C228DA9c18Bb6ec29 — the real Base address, letter for letter, on a token that lives on another chain. It is bait for the reader who does the right thing, copies the official address out of a press report and pastes it into a search box.

10 — What to checkBefore you touch anything called $LAPTOP

Four checks, written before the launch and revised after it. All of them are questions about money rather than about volume, and all four can be run against any contract on any chain the moment it appears. The third one now needs a caveat it did not need on September 8.

11 — SourcesOff-chain sources

Everything about contracts, pools, trades, transfers and holders here is on-chain data queried through Bitquery MCP, against the DEX trades API for pools and swaps, the token holder API for holder counts, and the Base, BNB Chain and Solana chain APIs for transfers and funding. The announcement timeline relies on public posts, checked on September 8 and again on September 10, 2026. The same shape, one wallet minting many tokens into ready-made pools, turned up in an earlier token factory.

12 — Still openThreads we did not pull