Solana Wallet Clusters: What Connected Token Holders Really Mean
By the MemeAssist Research Desk · Published 2026-08-26 · Updated 2026-08-26 · 6 min read
A Solana wallet cluster is a group of addresses connected by funding, token transfers or coordinated transaction patterns. It can reveal one insider splitting supply across many wallets, but it can also reflect exchange withdrawals, routers or ordinary transfers. Verify the source and timing, then total the cluster's supply as one effective holder. Common funding immediately before synchronized launch buys is the strongest bundled-supply warning.
Key Learnings
- A wallet cluster is evidence of on-chain relationships, not automatic proof that one person controls every address.
- For risk measurement, connected wallets with common funding and coordinated timing should be added together as one effective holder.
- In 3,779 tracked outcomes, top-10 concentration at 65%+ carried a 70.6% 24-hour death rate; one wallet at 30%+ carried a 60.4% rate.
What is a wallet cluster?
A wallet cluster is a set of addresses linked by observable on-chain behaviour: one wallet funds the others, tokens move between them, they buy within the same short window, or they repeatedly trade as a group. Tools can visualize these relationships as a bubble map or calculate an effective-holder score automatically.
Clustering matters because a holder table can show ten wallets at 4% each while one operator actually controls all 40%. The token appears distributed; the sell decision is concentrated.
The three cluster patterns worth checking
Common funding before launch
One source wallet sends SOL to many fresh wallets, which then buy the same token within seconds or minutes. When the funding happens immediately before launch and the buy sizes are similar, this is strong evidence of a bundled launch or coordinated insider group.
Creator-to-holder token transfers
The creator receives or mints supply and distributes it among addresses that later appear as independent top holders. This can be legitimate allocation or concealed insider inventory. Check whether the allocation was disclosed, vested and kept out of circulating-supply claims.
Coordinated selling
Connected wallets sell in sequence or into the same burst of retail demand. This is stronger behavioural evidence than a historic transfer alone because the group is acting together at the moment risk becomes real.
When a cluster is probably a false positive
- Known exchange funding: many unrelated users withdraw SOL from the same exchange hot wallet.
- Routers and trading infrastructure: program and aggregator interactions connect addresses without implying common ownership.
- Liquidity and treasury operations: a project may move supply among disclosed operational wallets.
- Old incidental transfers: a single transfer long before launch is weaker than fresh funding followed by synchronized buys.
Label the hub address in Solscan or another explorer, compare timestamps and look for repeated coordination. Never call a token rugged from one line on a map.
The right unit of risk is not the wallet. It is the group of wallets that can plausibly act as one.
How to score a cluster's actual danger
- Add every plausibly controlled wallet's token balance.
- Exclude confirmed pools, burn addresses, exchanges and program accounts.
- Divide the remaining cluster balance by circulating supply.
- Compare the result with the creator's history and the group's selling behaviour.
- Judge exit power: estimate how much liquidity the cluster could remove by selling.
Our tracked holder-concentration study found a sharp risk cliff: tokens with 65%+ in the top 10 wallets died within 24 hours at 70.6%, and one wallet above 30% carried a 60.4% rate. A linked cluster should be treated as one wallet when applying those boundaries.
Wallet clusters vs sniper wallets
A sniper wallet is defined by timing: it buys in the first blocks or seconds. A cluster is defined by relationships. Independent snipers can be unconnected, while an insider cluster may buy later. The dangerous overlap is many early buyers funded by one source. See what sniper wallets mean for the timing side.
How to check clusters before buying
Use a visual map when you want to inspect and share the relationships; our bubble-map guide gives the step-by-step process. Use a scored report when you need the cluster combined with creator history, contract permissions, liquidity and trading behaviour. MemeAssist turns those six signal categories into four named outputs: Overall Health Score, Rug Risk Rating, AI Verdict and Detailed Risk Breakdown.
Frequently asked questions
Do connected Solana wallets belong to the same person?
Not necessarily. Connections show on-chain interaction, not identity. Shared funding immediately before synchronized buys is strong evidence; a common exchange funding source or old incidental transfer is much weaker.
What is a bundled Solana token?
A bundled token has launch supply bought or distributed across multiple wallets that are coordinated or controlled together, often to hide insider concentration. The wallets may look independent in a normal holder table but form one effective cluster.
How do I calculate a wallet cluster's concentration?
Add the token balances of plausibly linked wallets, exclude confirmed pools, burns, exchanges and program accounts, then divide the cluster total by circulating supply. Treat that percentage as one effective holder.
What cluster size is dangerous?
There is no universal line, but our tracked Solana outcomes found a 70.6% 24-hour death rate when the top 10 wallets held 65%+ of supply and 60.4% when one wallet held 30%+. Apply the single-wallet threshold to a strongly linked cluster.