A copycat token campaign on Base

The setup

A team launches a token. Within a day, a second contract appears on Base (0x…redacted) carrying the same name and symbol. To a user skimming a DEX or a search result, it's indistinguishable from the real thing. To us, the on-chain shape tells a different story.

What gave it away

• reused bytecode — the runtime code hashes near-identical to a clone token seen weeks earlier on another chain, down to the same owner-only functions.
• attacker-owned liquidity — the initial LP was funded from a wallet that also seeded prior clones; liquidity that can be pulled at will.
• owner controls — the contract kept a blacklist / sell-block path, so buyers can get in but not always out.
• brand + freshness — a contract using the client's exact symbol, deployed hours after the genuine launch, from a deployer with no prior legitimate history.

signal:      copycat token (brand abuse)
chain:       Base
clone of:    0x…redacted (real launch)
code match:  0.97 vs prior clone on chain X
lp funder:   0x…redacted (seeded 4 earlier clones)
owner path:  blacklist(), setFee(), pause()
confidence:  high

Most projects don't notice a clone until users are already in it. The whole point of monitoring is to move that discovery to the left.

How the pieces connect

On its own, “a token with the same name” is weak. The strength comes from joining it up: the clone's bytecode matches a known family, its liquidity traces to a wallet that seeded earlier clones, and the timing hugs a real launch. Each link carries a confidence level; together they clear the bar for a high-confidence brand-abuse alert.

What a team should do

1. Publish and pin the canonical contract address everywhere users look.
2. Report the clone to explorers, token lists and the DEX front-ends fast.
3. Watch the clone's deployer and LP funder — the next one is usually queued.
4. Warn your community with the specific fake address, not just “beware scams.”

Why we keep it careful

We label this “likely copycat / brand abuse,” show the code-match score and the funding link, and stop short of naming a person. Bytecode reuse and a shared funder are strong on-chain evidence of a campaign — not proof of who is behind it.