Holding a certain AI concept token, among the top 10 holders, 6 are flagged by wallet platforms as "suspected phishing addresses." That moment felt like being at a high-end wine tasting, only to be pulled aside by the host and told—half of the guests in the room are professional pickpockets.



**What exactly are on-chain tags?**

Actually, these risk labels are not final judgments but more like warning lights. Platforms typically assign tags to addresses based on two main clues. One is abnormal behavior—such as frequent small test transfers, fake address patterns, etc., that match phishing characteristics. The other is association with blacklists—funds moving between the wallet and known scam accounts or clustering features.

But algorithms can also be misled. Project-controlled addresses that frequently perform test transactions might be mistakenly flagged; large holders sometimes deliberately "disguise" their activity as retail traders to protect privacy.

**What does the ICNT case tell us?**

Looking through the ICNT holder rankings, the flagged "phishing addresses" share a clear pattern: all built up positions intensively from October to November this year, with each transaction amount roughly the same (around $5,000 to $8,000).

What does this resemble? Most likely, the same organization split their funds into multiple accounts to evade monitoring. But on-chain algorithms see this highly similar behavior pattern and automatically infer it as a "phishing gang operation."

Even if it's not phishing, the problem becomes more serious—the top 10 addresses already lock over 40% of the circulating supply. The risk of market manipulation is now very real.
ICNT-1.09%
View Original
This page may contain third-party content, which is provided for information purposes only (not representations/warranties) and should not be considered as an endorsement of its views by Gate, nor as financial or professional advice. See Disclaimer for details.
  • Reward
  • 10
  • Repost
  • Share
Comment
Add a comment
Add a comment
GasFeeDodger
· 2025-12-21 18:36
Oh dear, this is what I hate, the Algorithm one-size-fits-all labeling, it can’t distinguish whether it's institutions liquidating positions or real fishing, and as a result, we retail investors have become the ones being played for suckers.
View OriginalReply0
BlockImposter
· 2025-12-21 14:37
Now I understand, the trick of ICNT is that the market maker disperses the build a position and is mistaken for fishing by the algorithm, anyway, controlling the market trend is all a matter of course.

I should have looked at this data earlier; in October, the build a position concentrated between 5000-8000 dollars is basically the same, a solid chain.

Regardless of whether it's real fishing or not, the fact that 40% of the circulating supply is locked up is the real killer, what's the point of buying anything.
View OriginalReply0
BearMarketMonk
· 2025-12-20 22:00
Ah... this is the real-world version of our common "survivor bias" and "cyclical recurrence." Algorithms can be wrong, and human nature can be wrong too, but the fact that 40% of the circulation is held by ten addresses is a hard flaw no matter how you explain it. I've seen too many projects like this before, and in the end, they either fade away or become the dealer's cash machine.
View OriginalReply0
Blockblind
· 2025-12-20 09:32
Now, this is crazy. Half of the top ten holders are phishing addresses? So what does my position count as...

Wait, 40% of the circulating supply is locked? Controlling the market is truly unbeatable.

Is this real or is the algorithm messing up?

Intensive accumulation from October to November... Bro, this does seem a bit suspicious.

Whether or not it's phishing, I need to think about what to do with this coin.
View OriginalReply0
ClassicDumpster
· 2025-12-18 21:50
40% of the circulating supply is locked in these addresses, which is really outrageous. This is clearly a pure money-grapping scheme.
View OriginalReply0
ForkTongue
· 2025-12-18 21:50
No, no, I need to re-examine this investment logic... Six out of the top ten are fishing scams, how can I hold on?

Now I really can't sleep or eat, feeling like I'll be cut tomorrow

Forget it, forget it, if it's time to cut losses, just cut losses. Don't wait to be harvested like a leek
View OriginalReply0
MetaverseMortgage
· 2025-12-18 21:50
Oh no, six phishing addresses in the top ten? How shady is that?

---

Controlling 40% of the circulating supply, is it a misjudgment by the algorithm or is there really something fishy? Anyway, it's all a scam.

---

Half of the people at the cocktail party are pickpockets—this analogy is perfect. Now I have to think twice before investing in any coin.

---

Splitting positions to avoid monitoring and being mistaken for a phishing gang—this organization is really amateur.

---

I shouldn't have touched AI concept coins in the first place; there's too much behind-the-scenes manipulation.

---

On-chain tags are just probability theory, but the fact that 40% of the circulating supply is involved is undeniable.

---

What does the ICNT incident tell us? Big players are playing with fire.

---

How are there still people willing to take on this kind of pump? It's basically gambling with their lives.
View OriginalReply0
screenshot_gains
· 2025-12-18 21:50
Wow, 6 out of the top 10 are phishing addresses? That's so outrageous, it just discourages people from investing.

This tagging system is really just relying on algorithms to guess randomly, how is the misjudgment rate so high?

40% of the circulating supply is locked, controlling the market is even more frustrating than phishing, really.

How crazy is this coin? Didn't you read the details carefully before buying?

It feels like the more transparent the on-chain data is, the more unsettling it becomes. It's all a minefield.
View OriginalReply0
GamefiHarvester
· 2025-12-18 21:44
Damn, six phishing addresses in the top ten... how outrageous is that... No wonder the price isn't going up

---

40% of the circulating supply is locked, that's the real horror

---

Whether it's algorithm tricks or splitting positions, retail investors are always the last bagholders

---

The analogy of a high-end wine tasting is perfect, I am now the fool pointed out by the host

---

It seems that it's not phishing but even worse, this is called market manipulation

---

In October and November, they built positions intensively with the same amount, clearly a tactic by institutions

---

Fake or real, I’ve already learned how to cut losses

---

On-chain tags are just a reference; the real issue is that the top ten addresses hold 40% of the circulating supply

---

Another project got liquidated, this is my investment history

---

So who is actually phishing now, or are they all phishing
View OriginalReply0
GateUser-a5fa8bd0
· 2025-12-18 21:36
Oh my god, isn't this a typical market maker tactic... Locking 40% of the circulating supply in the top 10, players are about to be completely wiped out.
View OriginalReply0
View More
  • Pin