Sniper & Bundle Forensics: See the Launch Behind the Launch

Before you buy anything, one question decides your risk: how much of the supply did the team quietly grab in the first block? A “bundle” is a coordinated first-block buy that looks like organic demand but is one entity holding the float — and the wallets that can dump on you. It’s all readable on-chain.

What a bundle actually is

A bundle uses an atomic transaction group (typically a Jito bundle — see Transaction Landing) so the creator and a set of buy wallets land in the same block, before the public. The chart looks like instant organic interest; in reality a handful of related wallets own a large slice of supply at the floor.

Step 1 — Pull the first trades

Get the earliest signatures on the token’s bonding curve account (paginate to the oldest). The creation tx plus the first cluster of buys is your evidence set.

const [bc] = PublicKey.findProgramAddressSync(
  [Buffer.from("bonding-curve"), mint.toBuffer()],
  new PublicKey("6EF8rrecthR5Dkzon8Nwu78hRvfCKubJ14M5uBEwF6P")
);
// paginate getSignaturesForAddress(bc, { before }) back to the oldest page
// the first block of buys after creation = your candidate bundle

Step 2 — Cluster by funding source

For each first-block buyer, trace the incoming SOL that funded it. Wallets funded from a common source (or in a fan-out pattern from one wallet) are almost certainly one operator. This funding graph is the single most powerful de-anonymizing tool on Solana.

async function funder(wallet: string): Promise<string | null> {
  const sigs = await conn.getSignaturesForAddress(new PublicKey(wallet), { limit: 1000 });
  const oldest = sigs.at(-1)?.signature;              // first thing that ever touched it
  const tx = await conn.getParsedTransaction(oldest!, { maxSupportedTransactionVersion: 0 });
  // find the SystemProgram.transfer that first funded this wallet → return its source
}
// Group first-block buyers by funder(). Same funder = same entity.

Step 3 — Measure the bundle

Sum the token balances of the clustered wallets and divide by supply. That percentage is the number that matters:

Using it live

• Automate the check into a pre-buy gate: reject anything over your bundle-% threshold.
• Watch the clustered wallets after entry — the first coordinated sell from the cluster is your exit signal.
• Cross-reference the dev wallet’s history (next lesson): serial bundlers repeat the pattern.

FAQ