Field manual 03 · Hermes Legion University
Wallet Forensics
Follow funding, timing, and control
Study meme coin holder concentration, creator history, wallet funding links, clusters, snipers, and signals of hidden common control.
Short answer
Wallet forensics asks whether apparently separate addresses may share funding, timing, counterparties, or control. Begin with the creator and earliest buyers, label known pool and program accounts, trace initial funding, and compare transaction patterns. Wallet links are evidence for a hypothesis—not automatic proof of identity or ownership.
Top-holder lists are only the start
Related wallets can split supply to appear decentralized. Study funding sources, transaction timing, common counterparties, creation patterns, and coordinated behavior. Treat clustering as a hypothesis that needs evidence.
Creator history matters
Review prior launches, funding history, early sells, supply movements, and whether disclosures match onchain behavior. A new wallet is not automatically a new actor.
Snipers change the distribution
Early automated buyers can capture supply before ordinary users react. Record how much supply was acquired, whether wallets appear linked, and how rapidly positions moved or sold.
Practical field note
Turn a cluster into a testable hypothesis
Suppose five early wallets were funded within minutes from the same upstream address and bought in a similar sequence. Record the funding transactions, creation times, trade sizes, and later destinations. That pattern supports further investigation, but it does not identify a person. Continue watching whether the wallets transfer together, sell together, or share cash-out routes.
Common mistakes
Calling every link proof
Shared services and exchanges can create common counterparties without common ownership.
Ignoring infrastructure accounts
Pools and programs can distort concentration when treated as ordinary holders.
Looking only at current balances
A wallet that distributed or sold earlier may appear harmless in a present-day snapshot.
Field checklist
- Record top-holder concentration
- Exclude known pool and program accounts correctly
- Trace creator and early-wallet funding
- Look for linked timing and transaction patterns
- Separate evidence from ownership guesses
Common questions
Frequently asked questions
What holder concentration is too high?+
There is no universal cutoff. Context matters: exclude verified infrastructure, examine who controls the remainder, and compare concentration with liquidity and expected selling pressure.
Does a wallet cluster prove common ownership?+
No. Common funding and synchronized behavior can be strong evidence, but services, exchanges, bots, and shared counterparties can create misleading links.
Is a newly created creator wallet a clean record?+
Not necessarily. A fresh address can be funded by an older wallet or used to separate a new launch from previous activity. Trace the funding path.
Continue learning
Related guides
Narrative & Attention
Learn how to judge a meme coin narrative, separate organic attention from coordinated promotion, and define measurable catalysts.
pump.fun Bonding Curves
Understand how a pump.fun bonding curve quotes meme coin prices, how trade size changes price impact, and what graduation to PumpSwap means.
Solana Token Authorities
Understand Solana mint authority, freeze authority, metadata controls, delegates, and Token-2022 extensions when researching a meme coin.
Primary documentation
Interfaces, fees, and routing systems change. Confirm current behavior in official documentation before acting.