PEOPLE WITH… VISION?

🧱 THE LORE: SOCIAL ENGINEERING SCAM EXPOSED 💥

@MaronzioVance, a Twitter user with over 7,000 followers known for his humorous, relatable persona (bio: "Somewhere talking to a brick wall"), became the face of a memecoin launch on Pump.fun around late October 2025. The coin, seemingly themed around his "People" or "Maronzio" branding (as seen in trade screenshots showing massive ROIs like +558% on quick flips), appeared to be a community-driven project. However, it was a sophisticated scam orchestrated by @Felixonchain (Felix), a self-proclaimed developer and crypto influencer. This involved classic social engineering tactics: building trust, providing "helpful" tools, and isolating the victim during execution. Below, I'll break it down step by step, based on public X posts, wallet traces, and livestream admissions.

Step 1: Building Trust and Offering "Help"

Felix approached MaronzioVance privately, positioning himself as a knowledgeable dev/KOL (key opinion leader) experienced in Solana memecoin launches on Pump.fun. Pump.fun is a popular platform for quick, low-barrier token creations, where creators earn ~0.5-1% fees on all buys/sells during the bonding curve phase (before hitting Raydium DEX).

To "assist" with the launch, Felix provided MaronzioVance with a pre-configured private key for the Pump.fun creator profile/wallet. This key linked the coin's fees directly to a wallet Felix controlled. MaronzioVance, likely inexperienced in crypto tech, trusted this as a shortcut—common in the fast-paced memecoin space where "devs" offer turnkey solutions.

MaronzioVance was positioned as the "CTO" (community takeover) figurehead: the public face to hype the coin via livestreams, drawing in his followers for authenticity. He wasn't the actual coder; Felix handled the backend, making MaronzioVance look like the lead without technical involvement.

This mirrors broader Pump.fun scams where "devs" leak or hijack keys via GitHub repos or shared tools, but here it was direct social engineering—no code leaks, just misplaced trust.

Step 2: The Livestream Setup and Isolation

MaronzioVance announced and went live on Pump.fun (e.g., posts like "I’m thinking of going live on pump fun. I have so many questions" on Oct 31, 2025), streaming to promote the coin. Livestreams on Pump.fun boost visibility, as trades generate real-time fees for the creator—turning hype into direct profit.

During the stream, the coin pumped hard (e.g., from $9K market cap), fueled by snipes and community buys. The provided screenshot shows a classic snipe: buying low (5.95 SOL at $39.4M cap? Wait, likely a display error for early bonding curve) and selling high for +33 SOL ($6K) profit in 9 hours. This was one of Felix's side wallets exploiting the pump.

Felix controlled the livestream chat, banning users who tried to warn MaronzioVance about the scam (e.g., "Don't give your private key!" or "Fees are being drained!"). This isolated MaronzioVance, preventing real-time alerts. Community members later reported failed DMs to MaronzioVance, blocked by Felix's influence.

MaronzioVance admitted on-stream he had "no idea how much money was involved" in fees, confirming he lacked wallet access or understanding.

Step 3: Draining the Fees and Covering Tracks

As trades surged, Pump.fun funneled ~1 SOL per $2K in volume to the creator wallet (Felix's). He claimed fees in batches: early big transfers (e.g., 27 SOL to his Kraken wallet for "untraceability"), then smaller ones (0.1-2 SOL) to side wallets.

Felix also sniped the coin early with multiple alt accounts, netting 100+ SOL (~$20K+) before farming fees post-pump. Total haul: Likely 50-100+ SOL, per wallet traces shared publicly.

Post-exposure (via threads like @justyogurt_'s breakdown), Felix went quiet but continued small drains. Even after MaronzioVance's relaunch attempts (e.g., Nov 2 posts: "I’m going to fix this. Community"), the original wallet address remained tied to Felix, allowing ongoing theft unless Pump.fun support intervenes.

Why This Worked: Social Engineering Breakdown

Tactic	How It Was Used	Why Effective
Authority/Expertise	Felix posed as a "pro dev" offering free launch help.	Newbies like MaronzioVance (non-technical) defer to "experts" in high-pressure crypto.
Reciprocity	Free private key + setup in exchange for MaronzioVance's promo.	Creates obligation; victims feel they "owe" the helper.
Isolation	Chat bans + DM blocks during live.	Prevents external validation; echo chamber reinforces trust.
Urgency/Scarcity	"Quick launch before trend dies!"	Memecoins move fast; delays feel like missed gains.
Obfuscation	Fees auto-claim to hidden wallet; no immediate red flags.	Victim sees hype/success, not backend theft.

Aftermath and Lessons

MaronzioVance, realizing the betrayal, tried CTO/relauches (e.g., Nov 3: "I’m live on pump fun" with confused posts about Binance memes featuring him). Community urged Pump.fun support takeover, but Felix's wallet lingers.

Broader impact: Followers lost thousands (one reported their "monthly salary"); eroded trust in Pump.fun lives.

Protect Yourself: Never use provided private keys—generate your own via Phantom/Solflare. Verify wallets pre-launch. Stream questions live, ignore DM "help." Tools like RugCheck.xyz flag suspicious devs.

Key Tweet from the Drama:

If CCM is real @a1lon9 than OG meme maker is going to livestream - @pumpdotfun intern post the news article that @MaronzioVance is a creator trying to capitalize on his meme

DyRAaLJMT7MbJE3HVxjTsUo186yDgwGkSWpiTmdzpump

— 👳🏽‍♂️Akhi (@MiaMi_Z17) October 31, 2025

Direct Video Embed (Crucial Footage from OG Meme Maker):

Binance's Brick Wall Meme Feature (Nov 3, 2025):

Dear algorithm, show the gm post to my 14.9M followers, please.

— Binance (@binance) November 3, 2025