Scams and safety on Robinhood Chain

A new chain gets old attacks. Three patterns are documented on Robinhood Chain so far: tokens that cannot be sold, impersonation of Robinhood itself, and fake Stock Tokens with a real ticker and a wrong contract address. This page covers what happened, what protects you, and what does not.

Last verified: 2026-08-25

Pattern 1: the vanishing token

On 9 July 2026, Relay Protocol publicly warned of a rise in scam tokens on the newly launched chain that were designed to remove themselves after purchase. The mechanism is a honeypot with a twist. Hidden storage mappings inside the token contract bypass the standard ERC-20 checks a screener looks at, so the token buys normally and then cannot be sold, or the balance transfers itself away to the attacker. One reported victim lost funds on a token called "World".

The important detail is that a superficial contract read does not catch this. The token looks like an ordinary ERC-20 from outside. Total supply is right, the transfer function exists, the pool has liquidity. The block on selling lives in state that only executes when a sell is attempted. This is why a simulated sell, rather than a code skim, is the only check that reliably finds it.

Pattern 2: impersonation and hijacked accounts

On 23 July 2026, Robinhood CEO Vlad Tenev's account on X was compromised. The attackers posted that a token called VLAD, sometimes reported as "Vladhood", was the official mascot of Robinhood Chain and would be listed in the Robinhood app. Neither was true. The token changed hands roughly 1,868 times before the post came down, and reported attacker proceeds were around 650 ETH, in the region of $1.2 to $1.3 million. A similar scheme had hit the Coinbase chief executive's account earlier in the same month.

The lesson is not "be sceptical of announcements". It is narrower and more useful: an authentic account is not an authentic message. Account compromise is common enough that a token contract address must be verified against an official on-chain source, not against a social post, however blue the check mark.

Pattern 3: the fake Stock Token

Robinhood's own developer documentation states the risk plainly: a token with a matching name or ticker but a different contract address is not a Robinhood Stock Token. Anyone with ETH for gas can deploy an ERC-20 on this chain and call it whatever they like, including the exact ticker of a real tokenised equity. The defence is the canonical contract registry in Robinhood's documentation. Check the address, not the name.

The same shape shows up on listing sites. We noticed two separate entries for the CASHCAT name on CoinMarketCap, one of them tied to an external domain. We found no evidence that either is fraudulent and we are not calling it a scam. We mention it because the pattern — a name that breaks out, followed by near-identical listings — is the moment impersonation becomes profitable, and it is worth recognising before you click the second result.

What locked liquidity does not protect

Every token from pools.trade has permanently locked liquidity. Uniswap states the tokens sit in a protocol-held pool the creator cannot remove. That is real, and it eliminates the classic liquidity rug.

It eliminates nothing else. Locked LP does not stop:

• Sell-blocking code in the token contract. The Relay Protocol pattern above works perfectly well against a pool with locked liquidity.
• Owner-only functions such as mint, pause, or blacklist, if the contract has them.
• Hidden buy or sell taxes routed to an address the creator controls.
• A developer selling a separately held allocation. The pool is locked; the creator's own tokens are not. Selling a large share of a 1-billion supply into a locked pool takes the price down exactly as effectively as pulling liquidity would have.

Uniswap says as much itself. Its own material warns that assets on pools.trade are extremely volatile and may go to zero, and states that it has not independently reviewed or verified any token displayed on the platform. Robinhood's developer documentation carries an equivalent disclaimer about every third-party tool it lists: inclusion is not an endorsement, partnership, affiliation, sponsorship, or warranty, and Robinhood is not responsible for third-party sites or the financial risks of using them. Take both at face value. The infrastructure is not vouching for the tokens.

Approval hygiene

A token approval is a standing permission you grant a smart contract to move a specific token out of your wallet, without asking for your key again. It is what makes a DEX swap work, and it is also the single mechanism most drainer contracts rely on. An unlimited approval to a malicious contract is a key to that token, valid until you revoke it.

Four habits cover most of the risk:

1. Use a separate wallet for launchpad trading. Not the wallet holding your Stock Tokens or your long-term balances. This is the highest-value single change on the list, and it costs nothing.
2. Read the approval prompt. Note which contract is being approved and for what amount. An unlimited approval to an address you have never seen is a decision, not a formality.
3. Revoke approvals you no longer need. Tools such as revoke.cash list and revoke live approvals; its free tier covers one chain with a small per-batch fee, with $99 and $199 annual tiers above it. We could not confirm that it supports chain 4663, so check before relying on it, and be ready to revoke by calling approve(spender, 0) directly if it does not.
4. Never sign a message you do not understand. A signature request that is not a transaction can still authorise a transfer. HoodTape will never ask you to connect a wallet or sign anything, and any site claiming otherwise in our name is not us.

How a honeypot check actually works

A honeypot check simulates a buy and then a sell, without broadcasting anything. It builds both transactions and runs them through eth_call against a recent block. Nothing is signed, no funds move, no gas is spent. If the simulated buy succeeds and the simulated sell reverts, the token is a honeypot. If the sell succeeds but returns far less value than the buy consumed, the difference is the hidden tax.

The HoodTape checker does exactly that, free, against the public RPC. It is read-only by construction: it holds no key, signs nothing, and never asks you to connect a wallet. It reports three things — whether a simulated sell succeeds, the effective round-trip tax, and the supply concentration among the top holders derived from the transfer log. That third number is usually the one that matters most on a locked-LP chain, for the reason set out above.

Two chain-specific alternatives exist and are worth running alongside it. Robinhood Checker is free and covers honeypot behaviour, mintable, blacklist and pausable functions, taxes, LP lock share, holder concentration, and repeat-offender deployers. DexsAlertBot gives two free checks a day per network, with sell simulation, liquidity lock status, contract verification, impersonation detection, and deployer launch history, and charges $45 a month for unlimited use. The general-purpose tool honeypot.is uses the same simulation method but does not cover this chain.

Every one of these tools, ours included, carries the same limitation, and honeypot.is states it best: the check is not foolproof, and a token that is not a honeypot now may become one later. Contract logic and owner permissions can change after you check. A green result is a snapshot, not a warranty.

A short checklist

1. Get the contract address from an official source or from the pool itself. Never from a social post.
2. Run a sell simulation. If it fails, stop.
3. Look at holder concentration. A few wallets holding most of a 1-billion supply is the main risk on this chain, not the LP.
4. Check whether the contract is verified on Blockscout, and whether it has mint, pause, or blacklist functions.
5. Check the deployer's history. Serial launchers are visible on-chain and the checkers flag them.
6. Trade from a wallet you would not mind losing, and revoke the approval afterwards.