How to check a Solana token for bundled wallets and snipers

November 7, 2026 · 4 min read · by the Rugsight team

A new Solana token can pass every classic check (mint and freeze authority revoked, liquidity burned, no top wallet over 5%) and still be controlled by one person. The trick is bundling: the creator buys a large share of supply at launch from many fresh wallets, so the holder list looks spread out. Snipers are related: bots or insiders that buy in the first seconds and sell into the first wave of real buyers. This guide explains both, shows how to spot them by hand in about five minutes, and is honest about what no automated score can see yet.

If you haven't run the basic checks, start with how to check a Solana token for rug-pull risk. For pump.fun coins, see the pump.fun guide.

What a bundled launch is

On Solana, several transactions can be submitted together so they land in the same block, one after another (for example through Jito bundles). A creator can use that to create the token and immediately buy from many wallets before anyone else can trade. The wallets are usually:

• Fresh: no history before the launch.
• Funded from one source shortly before, often in equal amounts.
• Similar in size: each holds a modest share, for example 1% to 3%.

Twenty wallets with 2% each don't trip a "one wallet over 20%" rule. Together they are one person holding 40%.

Bundling isn't always malicious; some teams use it to stop bots from front-running their own launch. But on an anonymous memecoin, a large bundled share means a small group can exit at once.

What snipers are

Snipers are wallets that buy in the first block or first few seconds after a pool or bonding curve opens. Some are independent bots chasing any new launch; some are insiders. Either way, they hold cheap supply and tend to sell as soon as there is profit, which is often the first buying wave from real users.

A launch where snipers took a large share of early supply and haven't sold yet carries a predictable overhang.

Why holder lists miss this

Holder concentration (even done properly, with pools and programs removed; see why "top 10 holders" is often wrong) measures wallets, not people. It can't tell that 30 wallets share one funder. That needs transaction history: who funded each wallet, and when each one bought.

How to check by hand

You need the full mint address and a block explorer such as Solscan or Solana Explorer. Bubble-map style tools make some of these steps visual.

1. Open the earliest transactions

On the token's page, sort transactions oldest first. Find the creation (or the pool / bonding curve creation) and look at the next buys.

• Many buys in the same block (slot) as the creation, or within the first few seconds, from different wallets: strong sign of a bundle or sniper cluster.
• A normal launch usually has a short gap, then scattered buys of different sizes.

2. Check those early buyers' wallets

Open five to ten of the earliest buyer wallets.

• Account age: created minutes or hours before the launch?
• Activity: did they do anything except receive SOL and buy this token?
• Funding: look at the first incoming SOL transfer. If several came from the same address (or from addresses that themselves share a funder), treat them as one holder.

3. Add up the cluster

Sum what the linked wallets still hold. Compare it with what the creator wallet holds. "Dev holds 2%" means little if the dev's funded wallets hold another 35%.

4. Watch what they do next

Check whether early wallets have already sold, are selling in steps, or are moving tokens to new wallets (a common way to hide a cluster). Synchronized sells across many wallets at the same time are the clearest signal of all.

5. Check the creator's history

The creator wallet's past launches tell you a lot. On pump.fun the profile lists previous coins; on an explorer you can follow where SOL went after earlier launches. A wallet with dozens of short-lived tokens is showing you its business model.

Red flags

• More than a handful of buys in the creation block from fresh wallets.
• Early buyers funded by the same address in similar amounts.
• Many wallets of near-identical size near the top of the holder list.
• Creator holds little, but linked wallets hold a lot.
• Tokens moving from early buyers to brand-new wallets right before a pump.
• Coordinated sells across several wallets in the same minute.

What Rugsight checks, and what it doesn't

Rugsight runs the on-chain checks you can verify from current state: mint and freeze authority, Token-2022 extensions, real-wallet holder concentration with pools, programs and burn addresses removed, liquidity, main-pool LP burn and verified lockers, and pool age.

It does not currently detect bundled launches, sniper clusters, wallet funding links or creator history. A good Rugsight grade means the technical traps and obvious concentration are absent, not that the holders are independent. Use the manual steps above for anything you plan to put real money into.

The free score is on the site or at /api/score/<MINT_ADDRESS>. Fresh launches are checked every 30 minutes on /new, and you can run /check <mint> in our Telegram bot.

Related guides

• Full rug-risk checklist
• How to check if a pump.fun token is a rug
• Why "top 10 holders own 90%" is often wrong on Solana
• What "mint authority renounced" means on Solana

Rugsight is an automated technical tool. Nothing here is financial advice.