1. Every ~22 s the rig breaches a fresh pump.fun launch. It hears every launch straight from the chain, waits until the coin has holders, then reads the dev wallet, who funded it (two hops back), every other coin that dev launched, the top holders and who bought in the launch slot.
2. A judge decides. With an OpenRouter key, Jev answers with probabilities: clean, sniped, bundled, serial launcher or concentrated. Sniped is a caution (bots take the first block of most launches, and those coins usually fade); the other three are red flags. Next to it sits a rug risk: the chance the coin is dumped on its buyers within the hour, from what similar coins did. Without one, the code rules decide, and the judge pane says so. Counts and ages are always worked out in code first.
3. Then the scorecard checks it. Every breached coin is looked at again after 15 min, 1 h and 24 h. Did it rug, survive or graduate? The scorecard shows how often red-flagged, sniped and clean coins rugged or faded, so you can see whether the verdicts hold up.
4. Buy $NULL and you're next. Your wallet gets traced within seconds and joins the botnet; your clearance is your buy size, and it weighs your vote for the next priority breach. Sell out and your node goes offline.

+3 min: priority breach (the most-voted coin, else the hottest on pump.fun). +2 h: botnet roll call. +12 h: most wanted, the five riskiest devs breached again. A dev who sells after being breached shows up in the log at once.

Theatre. Nothing here is hacked: every byte is public Solana data, read and laid out like an intrusion. A flag is what the data shows, not an accusation. Not affiliated with pump.fun, TypeSafe or OpenRouter. Not financial advice.