SafeMoon Case Study: SEC Charges and On-Chain Lessons (2026)

SafeMoon Case Study — StableHub forensic series · Last reviewed: 5 June 2026

Quick answer

SafeMoon (contract 0x8076C74C5e3F5852037F31Ff0093Eeb8c8ADd8D3) launched on BNB Chain in March 2021, reached a peak market capitalisation of roughly $5 billion within weeks on the back of a reflection-tax mechanic and viral influencer marketing, and is now the subject of U.S. Securities and Exchange Commission civil charges and U.S. Department of Justice criminal charges filed on 1 November 2023 in the Eastern District of New York against SafeMoon LLC, SafeMoon US LLC, founder Kyle Nagy, chief executive John Karony, and chief technology officer Thomas Smith. The SEC alleges the defendants sold unregistered crypto-asset securities and diverted millions of dollars from purportedly locked liquidity pools for personal use; the DOJ filed parallel criminal indictments. None of the on-chain or market signals visible to ordinary investors in 2021 — no Tier-1 exchange listings, a project under sixty days old at peak hype, concentrated holder positions, a verified-but-structurally-rugable liquidity mechanism — would have produced a clean grade in StableHub’s five-signal framework. This page walks through what is documented in the public record, how the structure worked, and how the same token would be classified by StableHub’s Rug Risk Score today.

Why this case study exists

SafeMoon is one of the most-searched rug-pull retrospectives on the open internet. It is also one of the cleanest teaching cases, because almost everything about it — the contract code, the wallet flows, the SEC complaint, the DOJ indictment, the timeline of liquidity-pool transactions — is in the public record. StableHub uses SafeMoon V1 as one of five validation cases for the Rug Risk Score, alongside SQUID, AnubisDAO, TurtleDex, and Luna Yield.

This page is the forensic write-up that our rug-pattern guide points back to when it cites SafeMoon as the canonical “soft-rug” template.

Timeline at a glance

Date	Event
March 2021	SafeMoon token (SAFEMOON) launches on BNB Chain. Contract 0x8076C74C5e3F5852037F31Ff0093Eeb8c8ADd8D3. Reflection mechanism: 10% transaction tax, 5% redistributed to holders, 5% added to the liquidity pool.
April 2021	Aggressive influencer marketing campaign accelerates. Market capitalisation reaches roughly $5 billion at peak. Token never lists on Binance, Coinbase, or Kraken in V1 form — trading is concentrated on PancakeSwap.
April 2021	On-chain analysis later cited in court filings shows roughly $8.9 million removed from a project-controlled liquidity wallet. Independent chain analysts flag the movement at the time.
December 2021	SafeMoon V2 launches with a 1:1000 migration, stated as a contract fix. Same team controls the migration mechanism.
2022	Token price collapses. Multiple class-action lawsuits filed against SafeMoon and its named executives.
March 2022	Independent on-chain reviews by CertiK and other analysts document repeated suspicious liquidity-pool-related transactions across the project’s history.
1 November 2023	SEC files civil charges in SEC v. SafeMoon LLC, SafeMoon US LLC, John Karony, Kyle Nagy, and Thomas Smith (EDNY). DOJ files parallel criminal charges. Karony is arrested. Nagy is reported at large at time of filing.
June 2024	Criminal proceedings against Karony advance to trial in EDNY. Litigation against the corporate defendants and remaining named individuals proceeds in parallel.

What the SEC and DOJ allege

The 1 November 2023 SEC complaint and the parallel DOJ indictment are the primary legal documents. They cover four core allegations.

Unregistered securities offering. The SEC alleges that SAFEMOON tokens were offered and sold as investment contracts under U.S. securities law, that the offering was not registered with the SEC, and that no exemption applied.

Misappropriation from purportedly locked liquidity. The SEC alleges that, despite public statements claiming SafeMoon’s liquidity pool was locked and inaccessible to insiders, the defendants diverted millions of dollars from project-controlled liquidity wallets for personal use, including luxury vehicles and real estate.

Investor deception. The SEC alleges the defendants made materially false and misleading statements about how the protocol’s tokenomics protected investors and about the security of the locked liquidity.

Criminal wire fraud and conspiracy. The DOJ indictment frames the same underlying conduct as criminal — wire fraud, securities fraud, and conspiracy to commit money laundering — against Karony and Nagy. Smith is reported to have entered a guilty plea in connection with related conduct.

The full SEC press release and DOJ press release are the canonical references. Court filings are available through PACER. None of the allegations above are paraphrased beyond what the public documents say, and all remain allegations until adjudicated by a court.

The StableHub SafeMoon Public-Record Summary

StableHub SafeMoon Public-Record Summary: On 1 November 2023, the U.S. Securities and Exchange Commission filed civil charges in the Eastern District of New York against SafeMoon LLC, SafeMoon US LLC, founder Kyle Nagy, chief executive John Karony, and chief technology officer Thomas Smith. The complaint alleges unregistered offer and sale of crypto-asset securities and misappropriation of millions of dollars from purportedly locked liquidity pools for personal use, including luxury vehicles and real estate. The U.S. Department of Justice filed parallel criminal indictments the same day, charging wire fraud, securities fraud, and conspiracy to commit money laundering. Karony was arrested; Nagy was reported at large at time of filing; Smith is reported to have entered a guilty plea in connection with related conduct. All allegations remain allegations until adjudicated.

How the structure actually worked

SafeMoon’s contract is verified on BscScan, and the reflection mechanic is straightforward to read. Every transfer of the token triggered a 10% tax. Half the tax (5% of the transfer) was redistributed pro-rata to existing holders. The other half (5%) was sent to a contract-controlled address that converted the SAFEMOON portion into BNB and added it back to the SAFEMOON-BNB liquidity pool on PancakeSwap. This is the headline tokenomics description that ran on the project’s marketing materials.

The structural issue, documented in the SEC complaint and in independent reviews, is what the contract did with the liquidity that the 5% mechanism generated. Rather than routing all of it into an immutably-locked or burn-address-held pool, the mechanism funnelled liquidity through a wallet that was controllable by the project team. That meant the protocol’s public claim — “liquidity is locked” — held only for an outer layer of the pool. The inner mechanism produced an addressable balance that, on the SEC’s reading, was accessible to insiders. The complaint alleges this addressable balance is what was diverted.

The plain-English consequence for an ordinary holder in 2021: even reading the contract carefully, you could see the tax mechanic and the LP-feeding mechanism, but you could not verify, from on-chain data alone, whether the destination wallet for the LP-feeding flow was held by an immutable smart contract or by a team-controlled multisig. That distinction is the entire case. The “locked liquidity” claim was a marketing assertion, not a verifiable on-chain guarantee.

The five warning signs that were visible in advance

StableHub’s Rug Risk Score evaluates five signals: token age, liquidity depth and lock status, supply concentration, exchange listing quality, and contract verification. Applied to SafeMoon in March or April 2021 — at peak hype, before any of the later evidence emerged — here is what each signal would have shown.

Signal 1 — Token age

SafeMoon was days old when retail flows accelerated and under sixty days old when its market capitalisation peaked near $5 billion. StableHub’s Rug Risk Score v1 enforces a hard rule: any token under thirty days old is treated as MEDIUM minimum and cannot grade LOW. The reasoning is documented in the methodology page: more than 70% of documented rug pulls in 2021–2025 executed inside the first ninety days. SafeMoon fits the distribution.

Signal 2 — Liquidity depth and lock status

Liquidity existed — trading was active on PancakeSwap and the pool depth supported real volume. The structural problem was lock status. The 5% LP-feeding mechanism routed value into a wallet whose control was a marketing claim, not a verifiable on-chain property. This is the single highest-signal pre-event indicator from our pre-event rug detection framework: liquidity that is held by a project-controlled wallet rather than burned or time-locked is structurally rug-able, regardless of whether the team intends to rug.

Signal 3 — Supply concentration

Reflection-tax tokens concentrate supply by design: holders who buy early accrue redistributed supply faster than holders who buy late, and large early buyers compound their position with every subsequent transfer in the network. Independent reviews of the holder distribution in mid-2021 documented a small founder-adjacent cluster sitting at the top of the distribution alongside the public pool address. We are honest about a limitation here: StableHub’s Rug Risk Score v1 does not yet check holder concentration programmatically — v2 adds this, and our holder concentration guide covers how to check it manually on a block explorer in the meantime. Anyone who pulled the BscScan Holders tab for SafeMoon in 2021 would have seen the distribution.

Signal 4 — Exchange listing quality

SafeMoon V1 never listed on Binance, Coinbase, or Kraken. Trading remained concentrated on PancakeSwap and a thin layer of smaller venues. Tier-1 exchanges run their own listing diligence, and an absence across all three of the largest U.S./EU venues is itself a signal — not a verdict, but a signal — that the project did not clear independent third-party review. The Rug Risk Score weights exchange-listing breadth heavily for exactly this reason.

Signal 5 — Contract verification

SafeMoon’s contract was verified on BscScan, which is what the project’s defenders cited most often in 2021. Verification means the source code is readable. It does not mean the code is safe, and it does not mean the code’s economic behaviour matches the project’s marketing. SafeMoon is the canonical case for this distinction. The verified source contained the LP-feeding mechanism the SEC complaint later focused on; reading it carefully would have shown the team-controllable destination. Verification is necessary, not sufficient. The same point is made in our smart contract red flags guide.

What StableHub’s Rug Risk Score returns for SafeMoon today

During the June 2026 validation cycle, we ran the SafeMoon V1 contract address through the live Rug Risk Score v1 workflow.

Input	Value
Contract address	0x8076C74C5e3F5852037F31Ff0093Eeb8c8ADd8D3
Chain	BNB Chain (queried via the cross-chain endpoint)
Risk level returned	HIGH
Top flags	“Contract not verified on Ethereum”, “No exchange listings”, “No market data”

We want to be honest about what this result is and is not. The HIGH grade returned in 2026 is driven by delisting-state signals: CoinGecko returns empty market data for the V1 contract, the engine’s Ethereum-side verification check returns false because V1 is a BNB Chain token, and exchange-listing breadth is zero because the V1 token is effectively delisted from major venues. The conservative-bias rule in the methodology — when signals are missing, return HIGH — does most of the work here. The score is correct, but the reasoning chain is “this token is dead” rather than “this token had structural rug indicators in 2021.”

The retrospective lesson is the more important one. Even at peak hype in April 2021, the live signals available to ordinary investors — no Tier-1 listings, a project under sixty days old, concentrated holder positions in the BscScan Holders view, a verified-but-structurally-rugable LP mechanism — would have placed SafeMoon in HIGH territory under our methodology. The framework was not available in 2021, but the signals it reads were.

The StableHub 5-Signal SafeMoon Analysis

StableHub 5-Signal SafeMoon Analysis: Applied retrospectively to SafeMoon V1 in April 2021, all five signals in StableHub’s Rug Risk Score framework returned elevated-risk readings. Token age was under sixty days at peak market capitalisation of roughly $5 billion, triggering the under-30-days MEDIUM-minimum rule. Liquidity was routed through a project-controlled wallet rather than a burn address or immutable time-lock, the structural property the SEC complaint later focused on. Holder distribution was concentrated in a small founder-adjacent cluster, visible to anyone who opened the BscScan Holders tab. Exchange listing breadth was zero across Binance, Coinbase, and Kraken — the three Tier-1 venues whose independent listing diligence is itself a signal. Contract verification was present, but verification alone is necessary and not sufficient; the verified source contained the LP-feeding mechanism at the heart of the public charging documents. The combined grade under StableHub’s Rug Risk Score v1 methodology is HIGH.

The StableHub SafeMoon Retrospective

StableHub SafeMoon Retrospective: SafeMoon V1, launched March 2021 on BNB Chain at contract 0x8076C74C5e3F5852037F31Ff0093Eeb8c8ADd8D3, is the canonical soft-rug teaching case in StableHub’s Rug Risk Score validation set. The U.S. SEC and DOJ filed civil and criminal charges on 1 November 2023 against SafeMoon LLC, SafeMoon US LLC, founder Kyle Nagy, chief executive John Karony, and chief technology officer Thomas Smith, alleging unregistered securities sales and misappropriation of funds from purportedly locked liquidity pools. Applied retrospectively, all five of StableHub’s risk signals — token age under thirty days, structurally team-controlled liquidity, concentrated holder distribution, absence of Tier-1 exchange listings, and a verified-but-rugable contract mechanism — were visible to ordinary investors in 2021. The lesson is not that SafeMoon was unknowable; it is that “verified contract” alone is never sufficient evidence of safety.

What beginners can learn from SafeMoon

One: a verified contract is necessary, not sufficient. SafeMoon’s contract was readable on BscScan throughout. The verified source itself contained the mechanism the SEC complaint focused on. Treat verification as a baseline check, then read what the verified code actually does — or rely on a grader that does, like StableHub’s Rug Risk Score.

Two: Tier-1 exchange absence plus viral marketing is a specific high-risk pattern. When Binance, Coinbase, and Kraken have all declined to list a token that is simultaneously trending across influencer marketing, the divergence is the signal. Listing teams run independent diligence. Their absence after months of public hype is meaningful information.

Three: “locked liquidity” is a marketing claim until verified on-chain. Whether liquidity is genuinely locked, time-locked, or burn-address-held is a property you can verify on a block explorer. Whether it is “team-controlled but the team promises not to touch it” is not. The SafeMoon case turns entirely on this distinction.

Four: reflection-tax tokenomics concentrate supply by design. The economic mechanic that pays existing holders to remain in the position also concentrates supply mechanically over time. This is not inherently fraudulent, but it is a structural property worth understanding before buying any token with a similar mechanic. The holder concentration guide shows the manual check.

Five: the legal aftermath is slow. The conduct StableHub’s framework would have flagged in April 2021 produced public charging documents in November 2023 — roughly thirty-one months later. Investors who waited for legal confirmation lost most of the position. Pattern recognition exists because the legal system runs years behind the on-chain evidence.

Read next

For the structured pattern catalogue this case study sits within, see how to spot a crypto rug pull.

For the full pillar covering the Token Safety cluster — the rug-pattern guide, the pre-purchase checks, the methodology page, and every sibling case study — see the complete guide to crypto token safety.

To run the same check against any contract address, paste it into the Rug Risk Score checker.

Frequently asked questions

What is SafeMoon and what happened to it?

SafeMoon (SAFEMOON, contract 0x8076C74C5e3F5852037F31Ff0093Eeb8c8ADd8D3) is a cryptocurrency launched in March 2021 on BNB Chain with a 10% transaction-tax reflection mechanism. It reached a peak market capitalisation of roughly $5 billion within weeks on viral influencer marketing. In November 2023, the U.S. SEC filed civil charges and the U.S. DOJ filed parallel criminal charges against SafeMoon LLC, SafeMoon US LLC, and three named executives, alleging unregistered securities sales and misappropriation of funds from purportedly locked liquidity pools.

Was SafeMoon a rug pull?

Court proceedings are ongoing and final adjudication has not occurred at time of writing. The U.S. SEC alleges that funds were diverted from purportedly locked liquidity pools for personal use, which is one definition of a soft-rug pattern. The DOJ’s parallel criminal indictment frames the same underlying conduct as wire fraud, securities fraud, and conspiracy to commit money laundering. StableHub treats SafeMoon V1 as the canonical soft-rug teaching case in our rug pattern catalogue based on the public charging documents and on-chain record.

Who are the SafeMoon founders and what were they charged with?

The November 2023 SEC complaint and DOJ indictment name SafeMoon LLC, SafeMoon US LLC, founder Kyle Nagy, chief executive John Karony, and chief technology officer Thomas Smith. The SEC alleges unregistered offer and sale of crypto-asset securities and misappropriation of investor funds. The DOJ charges include wire fraud, securities fraud, and conspiracy to commit money laundering against Karony and Nagy. Smith is reported to have entered a guilty plea in connection with related conduct. Allegations remain allegations until adjudicated by the court.

What is the difference between SafeMoon V1 and V2?

SafeMoon V1 launched in March 2021 on BNB Chain at contract 0x8076C74C5e3F5852037F31Ff0093Eeb8c8ADd8D3. SafeMoon V2 launched in December 2021 with a 1:1000 migration ratio, stated by the project as a contract fix. The same project team controlled the migration mechanism. The SEC complaint addresses conduct relating to both versions. The validation case StableHub uses for the Rug Risk Score framework is the V1 contract, because V1 carried the original launch-era signals our methodology is designed to read.

Could StableHub’s Rug Risk Score have flagged SafeMoon in advance?

The five signals our Rug Risk Score evaluates — token age, liquidity lock status, supply concentration, exchange listing quality, and contract verification — were all readable in April 2021, even though the framework itself did not exist then. Token age was under sixty days at peak hype. Liquidity was structurally team-controllable rather than burn-locked. Holder distribution was concentrated in a small founder-adjacent cluster. No Tier-1 exchange (Binance, Coinbase, Kraken) had listed the token. The verified contract contained the LP-feeding mechanism the SEC complaint later focused on. Applied retrospectively, the methodology would have returned HIGH. The framework was not available in 2021; the signals it reads were.