> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mobula.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Detecting Snipers & Bundlers

> Understanding how to identify snipers, bundlers, and insider traders in memecoin launches

# Detecting Snipers & Bundlers

When a new token launches, certain actors use automated tools and coordinated strategies to gain unfair advantages. Understanding these patterns is crucial for evaluating token health and avoiding manipulated launches.

<Info>
  **Why it matters**: Tokens with high sniper/bundler activity often indicate coordinated manipulation. Detecting these patterns helps traders avoid rug pulls and identify legitimate organic trading.
</Info>

***

## The Terminology

### Sniper

A **sniper** is a wallet that purchases tokens within the first few blocks (typically 0-3 blocks) after a token launches. They use:

* **MEV bots** to front-run other buyers
* **Private RPCs** to get faster transaction inclusion
* **Pre-signed transactions** ready to fire the moment the token deploys

**Why it's a red flag**: Snipers often acquire large positions at the lowest prices, then dump on retail traders. A launch with 50%+ supply held by snipers is highly likely to experience a coordinated dump.

### Bundler

A **bundler** coordinates multiple wallets to buy in the same block or even the same transaction. This is done to:

* **Bypass max wallet limits** set by the token contract
* **Create artificial demand** by making it look like many people are buying
* **Distribute tokens** across wallets for a coordinated later dump

**How to spot them**: Multiple wallets funded from the same source, all buying the exact same block, often with similar amounts.

### Insider

An **insider** has privileged access to information about the token before public launch:

* Funded directly by the deployer wallet
* Has transaction history with the dev team
* Bought tokens before any public announcement

**Why it matters**: Insiders often have information about planned marketing, exchange listings, or know the dev won't rug. They profit from asymmetric information.

### Dev (Deployer)

The **dev** tag marks the wallet that deployed the token contract. Tracking dev holdings is critical:

* **Dev selling early** = major red flag
* **Dev holding** = aligned incentives (but not always)
* **Dev wallet transferring to new wallets** = potential stealth dump preparation

***

## How Detection Works

### Sniper Detection

We identify snipers by analyzing the **timing and context** of early buys:

| Signal                   | What We Check                                            |
| ------------------------ | -------------------------------------------------------- |
| **Block proximity**      | Did the buy happen within 0-3 blocks of token creation?  |
| **Transaction position** | Was it in the same block as deployment or the very next? |
| **Wallet age**           | Was the wallet created recently (fresh wallet)?          |
| **Funding pattern**      | Was it funded just before the launch?                    |
| **Gas behavior**         | Did it use high priority fees or MEV bundles?            |

A wallet matching multiple signals gets tagged as a sniper.

### Bundler Detection

Bundlers are detected through **cluster analysis** of related wallets:

| Signal                | What We Check                                               |
| --------------------- | ----------------------------------------------------------- |
| **Same transaction**  | Multiple distinct wallets buying in one atomic transaction  |
| **Common funder**     | All wallets received ETH/SOL from the same source           |
| **Identical timing**  | All buys in the exact same block                            |
| **Similar amounts**   | Buy amounts within a tight range (e.g., all buying 0.5 SOL) |
| **Transfer patterns** | Tokens later consolidated to a single wallet                |

When we find a cluster of 3+ wallets with these patterns, all get tagged as bundlers.

### Insider Detection

Insiders are identified through **on-chain relationship analysis**:

| Signal                  | What We Check                                    |
| ----------------------- | ------------------------------------------------ |
| **Deployer connection** | Direct transactions with the deployer wallet     |
| **Pre-launch activity** | Bought before any public announcement            |
| **Funding source**      | Received funds from dev or known insider wallets |
| **Timing correlation**  | Activity patterns matching team wallets          |

***

## Reading the Data

### Holder Concentration Metrics

We calculate how concentrated token ownership is:

| Metric                 | What It Means                              |
| ---------------------- | ------------------------------------------ |
| **Top 10 Holdings %**  | Percentage held by the 10 largest wallets  |
| **Top 50 Holdings %**  | Percentage held by the 50 largest wallets  |
| **Top 100 Holdings %** | Percentage held by the 100 largest wallets |
| **Dev Holdings %**     | Percentage still held by the deployer      |

**Healthy ranges**:

* Top 10: \< 30% (excluding liquidity pools)
* Dev: \< 5% or locked/burned

### Tag Distribution

For any token, you can see the breakdown of holder types:

```json theme={null}
{
  "holdersCount": 1542,
  "taggedHolders": {
    "sniper": 23,
    "bundler": 45,
    "insider": 3,
    "dev": 1
  },
  "taggedHoldingsPercentage": {
    "sniper": 12.5,
    "bundler": 18.2,
    "insider": 4.1,
    "dev": 2.3
  }
}
```

***

## Risk Assessment Framework

### Green Flags 🟢

* No snipers in top 20 holders
* Zero bundler activity detected
* Dev wallet has \< 3% and hasn't sold
* Organic distribution across many wallets
* Top 10 holds \< 25%

### Yellow Flags 🟡

* 1-2 snipers in top 20 (common, not always bad)
* Small bundler cluster (\< 5% total holdings)
* Dev slowly selling (\< 10% sold)
* Top 10 holds 25-40%

### Red Flags 🔴

* Multiple sniper wallets holding > 20% combined
* Large bundler networks (10+ wallets)
* Snipers haven't sold (coordinated dump incoming)
* Dev wallet transferring to fresh wallets
* Insiders holding significant amounts
* Top 10 holds > 50%

***

## Practical Examples

### Example 1: Clean Launch

```
Token: $ORGANIC
Holders: 2,341
Snipers: 2 (holding 1.2% combined, already sold)
Bundlers: 0
Top 10: 18%
Dev: 0% (renounced)
```

**Assessment**: Very healthy. Snipers took small positions and exited. No coordination. Organic distribution.

### Example 2: Suspicious Launch

```
Token: $SKETCHY
Holders: 892
Snipers: 8 (holding 34% combined, none sold)
Bundlers: 12 wallets (holding 22% combined)
Top 10: 67%
Dev: 5% (no sales)
```

**Assessment**: High risk. Snipers and bundlers control 56% combined and haven't sold. Likely coordinated dump incoming.

### Example 3: Insider Activity

```
Token: $CONNECTED
Holders: 1,203
Snipers: 3 (holding 8%)
Bundlers: 0
Insiders: 4 (holding 15%, all funded by dev pre-launch)
Top 10: 31%
Dev: 2%
```

**Assessment**: Medium risk. Insider allocation suggests team/friends got early access. Watch for insider selling patterns.

***

## API Access

### Get Holder Positions with Labels

Use the holder-positions endpoint to get holders with their tags (sniper, bundler, insider, etc.):

```bash theme={null}
# Get all holder positions for Fartcoin
curl -X GET "https://demo-api.mobula.io/api/2/token/holder-positions?blockchain=solana&address=9BB6NFEcjBCtnNLFko2FqVQBq8HHM13kCyYcdQbgpump&limit=50" \
  -H "Authorization: YOUR_API_KEY"

# Filter by label (snipers only)
curl -X GET "https://demo-api.mobula.io/api/2/token/holder-positions?blockchain=solana&address=9BB6NFEcjBCtnNLFko2FqVQBq8HHM13kCyYcdQbgpump&label=sniper" \
  -H "Authorization: YOUR_API_KEY"

# Filter by label (bundlers only)
curl -X GET "https://demo-api.mobula.io/api/2/token/holder-positions?blockchain=solana&address=9BB6NFEcjBCtnNLFko2FqVQBq8HHM13kCyYcdQbgpump&label=bundler" \
  -H "Authorization: YOUR_API_KEY"
```

Response:

```json theme={null}
{
  "data": [
    {
      "chainId": "solana:solana",
      "walletAddress": "7xK9...",
      "tokenAddress": "9BB6NFEcjBCtnNLFko2FqVQBq8HHM13kCyYcdQbgpump",
      "tokenAmount": "1000000",
      "pnlUSD": "5420.50",
      "buys": 1,
      "sells": 0,
      "volumeBuyUSD": "2500.00",
      "volumeSellUSD": "0",
      "avgBuyPriceUSD": "0.0025",
      "labels": ["sniper", "proTrader"],
      "firstTradeAt": "2024-12-01T00:01:15.000Z"
    }
  ]
}
```

### Get Token Details with Holdings Stats

For aggregated stats (top 10%, sniper %, bundler %), use token-details:

```bash theme={null}
# Get Wojak token details including holder distribution
curl -X GET "https://demo-api.mobula.io/api/2/token/details?blockchain=solana&address=8J69rbLTzWWgUJziFY8jeu5tDwEPBwUz4pKBMr5rpump" \
  -H "Authorization: YOUR_API_KEY"
```

Response includes:

* `top10HoldingsPercentage`, `top50HoldingsPercentage`, `top100HoldingsPercentage`
* `devHoldingsPercentage`
* `snipersHoldingsPercentage`
* `bundlersHoldingsPercentage`
* `insidersHoldingsPercentage`

### WebSocket Stream

Subscribe to real-time holder updates:

```javascript theme={null}
const ws = new WebSocket('wss://general-api-v2.mobula.io');

ws.send(JSON.stringify({
  type: 'holders',
  authorization: 'YOUR_API_KEY',
  payload: {
    tokens: [{ 
      address: '9BB6NFEcjBCtnNLFko2FqVQBq8HHM13kCyYcdQbgpump', 
      chainId: 'solana:solana' 
    }]
  }
}));
```

<Info>
  For detailed WebSocket documentation, see [Holders Stream](/indexing-stream/stream/websocket/holders-stream).
</Info>

***

## Combining Signals

The most powerful analysis combines holder tags with other data:

### With Trading Fees

High sniper activity + high platform fees = likely bot trading through aggregators like Axiom/GMGN. See [Understanding Trade Fees](/almanac/understanding-trade-fees).

### With Bonding Curve Progress

Snipers buying before 50% bonded = trying to get lowest prices. Snipers buying after 80% bonded = anticipating Raydium migration momentum. See [Bonding Curves](/almanac/bonding-curves).

### With Volume Patterns

Sudden volume spike + no new snipers = organic interest.
Sudden volume spike + new bundler cluster = coordinated pump.

***

## Summary

| Tag         | Detection Method                  | Risk Implication               |
| ----------- | --------------------------------- | ------------------------------ |
| **Sniper**  | Early blocks + timing analysis    | First to dump, watch for sells |
| **Bundler** | Cluster analysis + funding traces | Coordinated manipulation       |
| **Insider** | Deployer connection mapping       | Asymmetric information         |
| **Dev**     | Contract deployment tracking      | Aligned incentives (monitor)   |

Understanding these patterns gives you an edge in evaluating whether a token launch is organic or orchestrated.