Detecting Snipers & Bundlers

When a new token launches, certain actors use automated tools and coordinated strategies to gain unfair advantages. Understanding these patterns is crucial for evaluating token health and avoiding manipulated launches.

Why it matters: Tokens with high sniper/bundler activity often indicate coordinated manipulation. Detecting these patterns helps traders avoid rug pulls and identify legitimate organic trading.

The Terminology

Sniper

A sniper is a wallet that purchases tokens within the first few blocks (typically 0-3 blocks) after a token launches. They use:

MEV bots to front-run other buyers
Private RPCs to get faster transaction inclusion
Pre-signed transactions ready to fire the moment the token deploys

Why it’s a red flag: Snipers often acquire large positions at the lowest prices, then dump on retail traders. A launch with 50%+ supply held by snipers is highly likely to experience a coordinated dump.

Bundler

A bundler coordinates multiple wallets to buy in the same block or even the same transaction. This is done to:

Bypass max wallet limits set by the token contract
Create artificial demand by making it look like many people are buying
Distribute tokens across wallets for a coordinated later dump

How to spot them: Multiple wallets funded from the same source, all buying the exact same block, often with similar amounts.

Insider

An insider has privileged access to information about the token before public launch:

Funded directly by the deployer wallet
Has transaction history with the dev team
Bought tokens before any public announcement

Why it matters: Insiders often have information about planned marketing, exchange listings, or know the dev won’t rug. They profit from asymmetric information.

Dev (Deployer)

The dev tag marks the wallet that deployed the token contract. Tracking dev holdings is critical:

Dev selling early = major red flag
Dev holding = aligned incentives (but not always)
Dev wallet transferring to new wallets = potential stealth dump preparation

How Detection Works

Sniper Detection

We identify snipers by analyzing the timing and context of early buys:

Signal	What We Check
Block proximity	Did the buy happen within 0-3 blocks of token creation?
Transaction position	Was it in the same block as deployment or the very next?
Wallet age	Was the wallet created recently (fresh wallet)?
Funding pattern	Was it funded just before the launch?
Gas behavior	Did it use high priority fees or MEV bundles?

A wallet matching multiple signals gets tagged as a sniper.

Bundler Detection

Bundlers are detected through cluster analysis of related wallets:

Signal	What We Check
Same transaction	Multiple distinct wallets buying in one atomic transaction
Common funder	All wallets received ETH/SOL from the same source
Identical timing	All buys in the exact same block
Similar amounts	Buy amounts within a tight range (e.g., all buying 0.5 SOL)
Transfer patterns	Tokens later consolidated to a single wallet

When we find a cluster of 3+ wallets with these patterns, all get tagged as bundlers.

Insider Detection

Insiders are identified through on-chain relationship analysis:

Signal	What We Check
Deployer connection	Direct transactions with the deployer wallet
Pre-launch activity	Bought before any public announcement
Funding source	Received funds from dev or known insider wallets
Timing correlation	Activity patterns matching team wallets

Reading the Data

Holder Concentration Metrics

We calculate how concentrated token ownership is:

Metric	What It Means
Top 10 Holdings %	Percentage held by the 10 largest wallets
Top 50 Holdings %	Percentage held by the 50 largest wallets
Top 100 Holdings %	Percentage held by the 100 largest wallets
Dev Holdings %	Percentage still held by the deployer

Healthy ranges:

Top 10: < 30% (excluding liquidity pools)
Dev: < 5% or locked/burned

Tag Distribution

For any token, you can see the breakdown of holder types:

{
  "holdersCount": 1542,
  "taggedHolders": {
    "sniper": 23,
    "bundler": 45,
    "insider": 3,
    "dev": 1
  },
  "taggedHoldingsPercentage": {
    "sniper": 12.5,
    "bundler": 18.2,
    "insider": 4.1,
    "dev": 2.3
  }
}

Risk Assessment Framework

Green Flags 🟢

No snipers in top 20 holders
Zero bundler activity detected
Dev wallet has < 3% and hasn’t sold
Organic distribution across many wallets
Top 10 holds < 25%

Yellow Flags 🟡

1-2 snipers in top 20 (common, not always bad)
Small bundler cluster (< 5% total holdings)
Dev slowly selling (< 10% sold)
Top 10 holds 25-40%

Red Flags 🔴

Multiple sniper wallets holding > 20% combined
Large bundler networks (10+ wallets)
Snipers haven’t sold (coordinated dump incoming)
Dev wallet transferring to fresh wallets
Insiders holding significant amounts
Top 10 holds > 50%

Practical Examples

Example 1: Clean Launch

Token: $ORGANIC
Holders: 2,341
Snipers: 2 (holding 1.2% combined, already sold)
Bundlers: 0
Top 10: 18%
Dev: 0% (renounced)

Assessment: Very healthy. Snipers took small positions and exited. No coordination. Organic distribution.

Example 2: Suspicious Launch

Token: $SKETCHY
Holders: 892
Snipers: 8 (holding 34% combined, none sold)
Bundlers: 12 wallets (holding 22% combined)
Top 10: 67%
Dev: 5% (no sales)

Assessment: High risk. Snipers and bundlers control 56% combined and haven’t sold. Likely coordinated dump incoming.

Example 3: Insider Activity

Token: $CONNECTED
Holders: 1,203
Snipers: 3 (holding 8%)
Bundlers: 0
Insiders: 4 (holding 15%, all funded by dev pre-launch)
Top 10: 31%
Dev: 2%

Assessment: Medium risk. Insider allocation suggests team/friends got early access. Watch for insider selling patterns.

API Access

Get Holder Positions with Labels

Use the holder-positions endpoint to get holders with their tags (sniper, bundler, insider, etc.):

# Get all holder positions for Fartcoin
curl -X GET "https://demo-api.mobula.io/api/2/token/holder-positions?blockchain=solana&address=9BB6NFEcjBCtnNLFko2FqVQBq8HHM13kCyYcdQbgpump&limit=50" \
  -H "Authorization: YOUR_API_KEY"

# Filter by label (snipers only)
curl -X GET "https://demo-api.mobula.io/api/2/token/holder-positions?blockchain=solana&address=9BB6NFEcjBCtnNLFko2FqVQBq8HHM13kCyYcdQbgpump&label=sniper" \
  -H "Authorization: YOUR_API_KEY"

# Filter by label (bundlers only)
curl -X GET "https://demo-api.mobula.io/api/2/token/holder-positions?blockchain=solana&address=9BB6NFEcjBCtnNLFko2FqVQBq8HHM13kCyYcdQbgpump&label=bundler" \
  -H "Authorization: YOUR_API_KEY"

Response:

{
  "data": [
    {
      "chainId": "solana:solana",
      "walletAddress": "7xK9...",
      "tokenAddress": "9BB6NFEcjBCtnNLFko2FqVQBq8HHM13kCyYcdQbgpump",
      "tokenAmount": "1000000",
      "pnlUSD": "5420.50",
      "buys": 1,
      "sells": 0,
      "volumeBuyUSD": "2500.00",
      "volumeSellUSD": "0",
      "avgBuyPriceUSD": "0.0025",
      "labels": ["sniper", "proTrader"],
      "firstTradeAt": "2024-12-01T00:01:15.000Z"
    }
  ]
}

Get Token Details with Holdings Stats

For aggregated stats (top 10%, sniper %, bundler %), use token-details:

# Get Wojak token details including holder distribution
curl -X GET "https://demo-api.mobula.io/api/2/token/details?blockchain=solana&address=8J69rbLTzWWgUJziFY8jeu5tDwEPBwUz4pKBMr5rpump" \
  -H "Authorization: YOUR_API_KEY"

Response includes:

top10HoldingsPercentage, top50HoldingsPercentage, top100HoldingsPercentage
devHoldingsPercentage
snipersHoldingsPercentage
bundlersHoldingsPercentage
insidersHoldingsPercentage

WebSocket Stream

Subscribe to real-time holder updates:

const ws = new WebSocket('wss://general-api-v2.mobula.io');

ws.send(JSON.stringify({
  type: 'holders',
  authorization: 'YOUR_API_KEY',
  payload: {
    tokens: [{ 
      address: '9BB6NFEcjBCtnNLFko2FqVQBq8HHM13kCyYcdQbgpump', 
      chainId: 'solana:solana' 
    }]
  }
}));

For detailed WebSocket documentation, see Holders Stream.

Combining Signals

The most powerful analysis combines holder tags with other data:

With Trading Fees

High sniper activity + high platform fees = likely bot trading through aggregators like Axiom/GMGN. See Understanding Trade Fees.

With Bonding Curve Progress

Snipers buying before 50% bonded = trying to get lowest prices. Snipers buying after 80% bonded = anticipating Raydium migration momentum. See Bonding Curves.

With Volume Patterns

Sudden volume spike + no new snipers = organic interest. Sudden volume spike + new bundler cluster = coordinated pump.

Summary

Tag	Detection Method	Risk Implication
Sniper	Early blocks + timing analysis	First to dump, watch for sells
Bundler	Cluster analysis + funding traces	Coordinated manipulation
Insider	Deployer connection mapping	Asymmetric information
Dev	Contract deployment tracking	Aligned incentives (monitor)

Understanding these patterns gives you an edge in evaluating whether a token launch is organic or orchestrated.

Memecoin

Spot Markets

Detecting Snipers & Bundlers

Detecting Snipers & Bundlers

The Terminology

Sniper

Bundler

Insider

Dev (Deployer)

How Detection Works

Sniper Detection

Bundler Detection

Insider Detection

Reading the Data

Holder Concentration Metrics

Tag Distribution

Risk Assessment Framework

Green Flags 🟢

Yellow Flags 🟡

Red Flags 🔴

Practical Examples

Example 1: Clean Launch

Example 2: Suspicious Launch

Example 3: Insider Activity

API Access

Get Holder Positions with Labels

Get Token Details with Holdings Stats

WebSocket Stream

Combining Signals

With Trading Fees

With Bonding Curve Progress

With Volume Patterns

Summary

Memecoin

Spot Markets

​Detecting Snipers & Bundlers

​The Terminology

​Sniper

​Bundler

​Insider

​Dev (Deployer)

​How Detection Works

​Sniper Detection

​Bundler Detection

​Insider Detection

​Reading the Data

​Holder Concentration Metrics

​Tag Distribution

​Risk Assessment Framework

​Green Flags 🟢

​Yellow Flags 🟡

​Red Flags 🔴

​Practical Examples

​Example 1: Clean Launch

​Example 2: Suspicious Launch

​Example 3: Insider Activity

​API Access

​Get Holder Positions with Labels

​Get Token Details with Holdings Stats

​WebSocket Stream

​Combining Signals

​With Trading Fees

​With Bonding Curve Progress

​With Volume Patterns

​Summary

Detecting Snipers & Bundlers

The Terminology

Sniper

Bundler

Insider

Dev (Deployer)

How Detection Works

Sniper Detection

Bundler Detection

Insider Detection

Reading the Data

Holder Concentration Metrics

Tag Distribution

Risk Assessment Framework

Green Flags 🟢

Yellow Flags 🟡

Red Flags 🔴

Practical Examples

Example 1: Clean Launch

Example 2: Suspicious Launch

Example 3: Insider Activity

API Access

Get Holder Positions with Labels

Get Token Details with Holdings Stats

WebSocket Stream

Combining Signals

With Trading Fees

With Bonding Curve Progress

With Volume Patterns

Summary