The Luke Parker Dero Bug Market Manipulation Fraud

Disclosing a bug you didn't find yourself, only after your sponsor is done dumping 400K Dero

New evidence has emerged strongly suggesting that an unkown entity, that bought 400K Dero coins from Kucoin after the delisting and sold them on Coinex, already knew about the bug prior to Luke’s disclosure and that Luke Parker’s disclosure came in alignment with their best interest.

Kucoin

In August 2023 Kucoin abruptly delisted Dero. The original announcement can be found here and as it can be seen there, the withdrawal service was to be closed on February 28th 2024. For coins not withdrawn by that date, users are deemed to have given up the funds and will have no rights to claim back the funds. Today we know that ~400K Dero coins were left in Kucoin and not withdrawn by the February 28th deadline. Now let’s look at what happened to those coins.

Source: Derolytics

Coinex

From chain analysis conducted by an account that has been exploiting the bug to deanonymize Dero transactions, we know that the ~400k Kucoin coins changed hands on March 8th and were moved to an intermediary wallet that differently from Kucoin does not include any messages in their transactions (Kucoin used to put “send” in every transaction).* This entity deposited their coins on Coinex March 11th 2024.**

As seen in the user screenshot above from the time deposits were closed, the same day ~400K Dero were deposited on Coinex, Coinex put its Dero wallet in maintenance making it impossible for other people to deposit and sell Dero there. The reason why this strongly suggests a case of market manipulation is that Dero experienced significant appreciation in the first week of March as its price rallied from $2.4 to $5.4. So Coinex, by putting their wallet in maintenance, made sure whoever was selling the 400K Kucoin coins got all the liquidity during this pump.

Bug Disclosure

Now here is where things get interesting and strongly point towards collusion between Luke Parker and the 400k Dero seller. Coinex re-opened Dero deposits after almost 2 months, on May 8th.

This suggests that on May 8th the seller was likely done selling at the best price possible for the market conditions at the time. Interestingly, the Dero bug was disclosed to the public on May 18th. In the disclosure timeline in his article, Luke claims that the bug was actually found on May 14th. Luke Parker claims he did not opt for responsible disclosure because “I was not willing to have users continue to be endangered for weeks further once I was aware of the issues present.” Interestingly, however, his disclosure is perfectly aligned with the interests of the big Dero whale that also seems to have colluded with Coinex. It’s clear Luke learned about the bug in the few days after May 8th, but did Luke find the bug himself or was he tipped about it? The coordination strongly suggests that contrary to what Luke claims, he did not find the bug himself but perhaps was tipped about the existing bug by the entity that had just finished liquidating 400K Dero. This would explain why Luke appears to have “found” the bug right after the Kucoin whale was done selling on Coinex.

Conclusion

The sequence of events strongly suggests that the entity that bought 400K Dero coins from Kucoin (coins forfeited by users) triggered an exit pump and likely colluded with Coinex who put their wallet in maintenance for 2 months after the pump started (limiting sell side competition for the 400K whale). This same entity shows to have likely known about the bug in advance and strategically timed its disclosure. Because only after this entity was done selling did the bug come to surface through a public disclosure by Luke Parker on May 18th. The coordination in the sequence of events strongly suggests the following:

1. the bug was known in advance to at least one entity

2. this entity bought off Kucoin 400K Dero coins

3. sold them on Coinex

4. fed the bug to Luke Parker giving him full permissions to publish it as his own finding and probably encouraging him to opt for immediate public disclosure.

*TXIDs of transactions from Kucoin to the intermediary wallet (source Derolytics): 795b4f9218d564970825aabe095c1ec7aec1da6baa1dea0b07e22be608979a6a, 23de5f8f461cd6a600a215c8144e924661fc640645a03eac3e5c31943d6f1c6d, 1eceb13219b37b3fd9358f5fb9d156e73c01e00bbac383fdddc1fb9ed903fa13.

**TXIDs of movements from the intermediary wallet to Coinex (source Derolytics): eb1ff5c366200dc34f2eb85955d694771f6a5943d49916783aa567c6f7b67e3e, 146185351e4656e12a7fc8eade8876de807f4b570b16a328e3320763e996b093, 71516365dd942c3f163fd26ba20045463364e3dbabef03164d4901f478081699.