A Sold-Out AI Token Presale That Quietly Drained Its Own Liquidity

01How the trap was built

Nexora Labs presented itself as an AI-infrastructure startup with a polished whitepaper, a doxxed “advisory board” of stock-photo headshots, and a presale hosted on a launchpad called PrimePad. The claimant found it through a paid post in a developer subreddit that linked to an audit badge from a firm that, on inspection, did not exist.

The presale page showed a live “raised” counter climbing past $2M and a countdown timer. Allocation was capped per wallet, which created the usual scarcity pressure. The claimant contributed 14.2 ETH across two transactions and received NXR tokens locked under a “vesting” contract that, critically, only the deployer could modify.

02Where it broke

NXR listed on a decentralized exchange with a small seeded liquidity pool. For roughly forty minutes the price rose and early Telegram members posted gains. Then the deployer called removeLiquidity, swapped the paired ETH out, and disabled transfers through a hidden owner function. The chart went vertical-down to zero.

Our on-chain review showed the classic signature: liquidity was never locked despite a “locked LP” claim, and the contract retained an owner-only setTradingEnabled switch. The pulled ETH moved through a bridge to Arbitrum, was split across nine wallets, and consolidated again before entering a mixing service.

I am a developer. I read the contract. I just did not understand that “renounced ownership” on the website meant nothing if the code on-chain still had an owner.

03How we recovered part of it

1. 01
   Captured the evidence. We reconstructed the deployer address, the liquidity-removal transaction, and the per-wallet split into a timestamped flow graph the claimant could file with IC3 and his exchange.
2. 02
   Tagged the off-ramps. Two of the nine split wallets cashed out at a centralized exchange before reaching the mixer. We identified the deposit addresses and the exchange operating them.
3. 03
   Filed a preservation request. Through that exchange’s law-enforcement portal, and with the claimant’s police report number, we requested a freeze on the two flagged deposit accounts.
4. 04
   Documented the pre-mixer trail. For the funds already mixed, we produced a probabilistic trace report establishing the path up to the mixer entry — useful for the insurance and tax-loss claim, not for direct recovery.
5. 05
   Supported the claim to conclusion. The frozen balance on the two exchange accounts was returned after a 19-week review. The mixed remainder was written off with documentation.

04Threat indicators

• A “locked liquidity” claim with no on-chain lock you can independently verify on the LP token.
• A contract that says ownership is renounced on the website but still exposes owner-only functions on-chain.
• An audit badge that links to a firm with no real, searchable track record.
• A per-wallet allocation cap and a live “raised” counter engineered to manufacture urgency.
• Vesting controlled entirely by the deployer, with no third-party escrow.