TrustDex › Guides › Sniper bots & bundled launches
Sniper bots & bundled launches — reading a token's first block
By the time a launch chart looks exciting, the important part is already over. The wallets that loaded up in the opening block decided who holds the cheap supply — and whether the "demand" you're seeing was ever real.
Most token due diligence looks at the present: today's holders, today's liquidity, today's chart. Launch forensics looks at the past — specifically the first block or two of a token's existence — because that tiny window fixes the power structure for everything that follows. Two actors dominate it: sniper bots racing to buy the instant trading opens, and bundlers who script the opening themselves. Learning to tell their fingerprints apart, and both apart from genuine buyers, is one of the highest-value skills in evaluating young tokens.
Check a launch's early footprint
Enter a mint address — concentration and risk flags reveal what the first buyers left behind.
Snipers: the race to the opening block
A sniper bot monitors the chain for the birth of tradable markets — a pool being created, a curve going live — and fires a pre-built buy transaction the moment one appears, paying priority fees to land as early as possible. On fast chains this is a same-block or next-block affair; human reflexes aren't in the running. The sniper's thesis is purely structural: launches that attract any attention rally briefly, so the earliest entry can be sold into the crowd minutes later regardless of what the token is.
Snipers are best understood as a toll, not a scam. They extract value from every visible launch indiscriminately, tax the humans who arrive after them, and usually exit fast. Their presence tells you a launch was noticed, nothing more. The reason they matter for risk reading is different: their behavior is the camouflage that a far worse actor hides inside.
Bundles: when the deployer plays both sides
A bundled launch inverts the picture. Here the deployer (or a partner) pre-arranges a set of wallets and lands their buys at the moment of launch — commonly grouped with or immediately behind the pool-creation transaction itself, inside the same block. To an observer, the token explodes out of the gate with a dozen eager buyers. In reality one operator just sold a large chunk of the supply to themselves at the floor price, using the crowd's arrival as the exit plan. The launch's apparent demand was manufactured by the only party who knew the exact starting gun.
The bundle's purpose is disguise. A single wallet buying a third of the supply in the first second would be an instant red flag on any dashboard. The same third split across fifteen unremarkable wallets slides under every naive holder-list check — each address holds a small, unalarming percentage, and the ownership concentration has been laundered into apparent breadth.
Funding trails: how the disguise unravels
What bundlers can't easily fake is history. Every wallet in the bundle had to get its SOL or gas from somewhere, and the supply lines usually converge: a batch of fresh addresses, created shortly before launch, each funded from the deployer's wallet or from one common parent — sometimes with a hop or two in between, occasionally through an exchange withdrawal used as a mixer. Trace the funding edges backward and the fifteen "independent" buyers collapse into one entity.
Timing is the second seam. Bundled buys cluster with mechanical precision — same block, adjacent positions, similar amounts — because they were submitted together. Organic early interest, even bot-heavy interest, straggles: different blocks, uneven sizes, wallets with prior lives and unrelated histories. The deeper craft of grouping wallets by origin is covered in reading holder distribution; launch analysis is that craft pointed at minute zero.
The core question for any young token: of the supply bought in the first block, how much traces back — through funding, timing, or behavior — to the team that launched it? That single number reframes everything else on the dashboard.
First-minutes distribution is destiny
Why obsess over a few opening seconds? Because a token's early ledger is a seating chart for the game that follows: it records who holds cheap supply in size, and therefore who is capable of dumping on whom. If bundled insiders hold a large share at near-zero cost, every later buyer is their exit liquidity, and the only open question is when the unwind starts — slow-dripped to keep the chart alive, or all at once into a spike. No roadmap, meme, or community energy changes that arithmetic; sell pressure at insider scale beats organic buying almost every time.
A launch where the first minutes distributed supply widely — many unlinked wallets, none dominant — can still fail, but it fails honestly, from lack of interest. A bundled launch carries its ending in its opening block. This is the same logic that makes copy-trading rugs work: the operator controls both the signal and the supply, and followers arrive pre-positioned to be sold to.
What bundle detection actually looks for
Scanner heuristics for bundles are conceptually simple even when the implementations are elaborate. The signals stack roughly like this:
| Signal | Organic pattern | Bundle pattern |
|---|---|---|
| Buy timing | Spread over minutes, ragged | Same block, machine-tight |
| Wallet age | Mixed, many with history | Fresh, made pre-launch |
| Funding source | Diverse, unrelated | Converges on one parent |
| Buy sizing | Uneven, human-random | Uniform or scripted |
| Later behavior | Independent decisions | Synchronized exits |
No single row convicts — snipers also use fresh wallets, and coincidences happen in fast markets. Detection is about convergence: when timing, funding, sizing, and subsequent behavior all point at one operator, the "organic" story stops being credible. Treat any tool's bundle percentage as a probabilistic read on exactly these signals, useful and fallible in proportion to how gameable each input is.
The "0% dev holding" illusion
One stat deserves its own warning label. Dashboards love to display the deployer's remaining balance, and scammers love to zero it: transfer or sell the deployer wallet's tokens, screenshot the 0%, and let the number imply a fair launch. But if the real allocation was bundled into sibling wallets at minute zero, the deployer's own balance was never where the supply lived. The stat is true, narrow, and completely beside the point — a clean answer to the wrong question.
The honest version of the question is aggregate: what does the position look like across every wallet that launch-time evidence links to the team? A bundled launch can show a spotless deployer and still have effective insider control of a third of the float. When a scan's concentration read and a site's "dev holds nothing" badge disagree, believe the concentration read — it's measuring the thing that can actually hurt you.
Look past the surface stats
Concentration, authority flags, and risk level in one dated report — before the first block's winners cash out on you.
Frequently asked
What is a sniper bot in token trading?
Automated software that watches for new pools or curve launches and submits a buy in the same instant trading opens — often in the very first block. Its goal is the cheapest possible entry before any human can react, positioning the bot to sell into the demand that arrives afterward.
What is a bundled launch?
A launch where the deployer or an ally lands coordinated buys from multiple wallets at or immediately after pool creation, frequently within a single block. The chart shows what looks like a burst of independent demand, but one operator quietly controls a large share of supply spread across many addresses.
How can I tell bundled wallets apart from real early buyers?
Follow the money that funded them. Bundled wallets tend to trace back to one source — the deployer or a common parent wallet — often through fresh addresses created just before launch, and they act with identical timing. Genuine early buyers arrive with scattered timing, varied sizes, and unrelated funding histories.
Why can a 0% dev holding stat be misleading?
The stat usually measures only the deployer address itself. A deployer who bundled supply into ten sibling wallets and emptied their own shows 0% while effectively controlling a dominant position. Distribution has to be judged across linked wallets, not by a single address's balance.
Does heavy sniping mean a token is a scam?
Not by itself — popular launches attract third-party snipers the team never invited. The distinction that matters is whether early concentration traces back to the deployer. Outside snipers are mercenaries who sell fast and leave; deployer-linked bundles mean the launch itself was staged.