South Korea Prosecutes First DEX Rug Pull
The Seoul Southern District Prosecutors’ Office has arrested and indicted five individuals in South Korea’s first criminal case targeting a rug pull executed on a decentralized exchange (DEX). The charges, brought under the Virtual Asset User Protection Act, which took effect in July 2024, cover market manipulation and fraud. The scheme resulted in 256 investors losing a combined 900 million won ($600,000) after liquidity was drained from the CATFI token pool.
This case marks the first time South Korean authorities have applied the Act’s unfair-trading provisions to a DEX-based scheme, explicitly framing it as “the first legal prosecution of a crypto crime executed through a DEX.”
The suspects were arrested on May 11, 2026, and formally indicted on May 27, 2026.
Details of the CATFI Scheme
The main suspect, identified by the surname Park, operated online as the influencer “Eth Father,” a fabricated persona used to generate artificial community interest in CATFI. Park and his associates launched the meme coin on a Solana-based DEX, pre-loading wallets with a significant token position before the public promotion campaign began.
Using circular trading and coordinated wash trades across multiple wallets, the group inflated CATFI’s price 1,001-fold within 26 hours, attracting retail buyers before completely withdrawing liquidity. The organizers profited approximately 400 million won ($260,000), leaving 256 investors with worthless holdings.
Two suspects were arrested and indicted for market manipulation. One was indicted without detention, while two others were charged with assisting the main suspect in evading authorities. One of these individuals allegedly spent three months in disguise to avoid arrest.
Regulatory Implications
DEXs have historically operated with limited regulatory oversight in most jurisdictions. The CATFI case represents a shift, as South Korean authorities are now applying the Virtual Asset User Protection Act’s unfair-trading clauses to on-chain DEX conduct.
Prosecutors did not pursue charges under unregistered exchange or token-listing statutes. Instead, they relied on traditional fraud and market-manipulation provisions within the User Protection Act, arguing that circular trading, fake influencer promotion, and deliberate misrepresentation of insider token control constitute “fraudulent means, plans, or techniques” in digital asset trading. This legal approach means prosecutors do not require a registered entity or a centralized platform to bring charges; on-chain conduct is sufficient.
The Seoul Southern District prosecutors emphasized their commitment to addressing actions that disrupt the digital asset market and undermine public trust.
Broader Context
The CATFI case is part of a broader trend in South Korea. The country introduced new regulations in 2026, including five-minute reconciliation requirements and automated kill switches for crypto platforms, alongside a new Digital Asset Act mandating a 100% reserve requirement for stablecoins. Authorities also signaled a reconsideration of the country’s long-standing ban on spot Bitcoin ETFs.
Against the backdrop of $110 billion in crypto outflows through 2025, regulators have been systematically closing the gap between DeFi activity and formal oversight. South Korea’s enforcement posture is increasingly setting the pace for DeFi-specific cybercrime prosecution as global crypto regulatory frameworks evolve.
Investigative Techniques
Investigators built the CATFI case using wallet clustering to map insider token concentration, circular trading pattern analysis to identify wash-trade coordination across linked addresses, and off-ramp KYC intersection, the point at which pseudonymous wallets convert to fiat at a centralized exchange with identity verification requirements.
The off-ramp exposure point is the structural vulnerability in every DEX-based rug pull. While operators can obscure their identity on-chain, converting proceeds to fiat requires passing through a regulated gateway.
Online investigators initially identified the suspect wallets and filed complaints, but authorities temporarily closed the case after the group claimed they had been hacked. The Financial Services Commission later re-referred the matter, prompting a renewed forensic investigation that brought in both financial and tax authorities to complete the chain of evidence. The FSC’s re-referral was the turning point that unlocked the full forensic reconstruction.
Analysts view the case as signaling the end of DEXs as an enforcement blind spot, noting that authorities are now integrating on-chain behavior, social promotion, and market manipulation into conventional prosecutorial theories. Modern blockchain forensics and KYC off-ramp tracing render pseudonymous branding and multi-wallet setups ineffective.
DeFi regulation in South Korea has shifted from exchange oversight to on-chain conduct, sending a clear message to Solana meme coin operators who believed decentralization offered immunity.
Leave a Reply