Methodology

Nuno counts entities, not wallets. It groups wallets that are very likely controlled by the same operator into an entity (a "cluster"), then recomputes each nad.fun token's holder, concentration and volume numbers per entity. Every link between two wallets keeps the transactions that justify it, so anyone can check each flag on a Monad explorer.

This document is the definition of every number Nuno publishes. Code references are to this repository.

1. Data sources

Data	Source	Notes
Token launches, curve buys/sells, graduations	CurveCreate, CurveBuy, CurveSell, CurveGraduate events from the nad.fun curve contract 0xA7283d07812a02AFB7C09B60f8896bCEA3F90aCE on Monad mainnet	Event ABIs from nad.fun/abi.md; topic hashes checked against live logs. The transaction signer is stored with every trade (see "Trade attribution").
Token launches and curve buys/sells on nad.fun's V2 curve	Create, Buy, Sell events from 0x9f3832732923252A21044F21eE6bd87F09514ae4 (identified through nad.fun's own API: market_type: "V2_CURVE")	Not in nad.fun's docs and unverified on Monadscan. Buy/Sell signatures confirmed by keccak match; their topics are (token, sender), the reverse of V1. The create event (topic 0xac11ceed…) has no public signature: Nuno decodes creator, token, pool from its topics and name, symbol, URI from its data, checked against nad.fun's API. Most nad.fun activity is on V2 (about 48 launches and 3,700 trades per day in October 2026, vs about 10 launches per day on V1).
Balances	ERC-20 Transfer events of every tracked token, from creation onward	Balances are rebuilt from the full transfer history.
Post-graduation trades	V1 tokens: Uniswap V3 Swap on the pool from CurveGraduate. V2 tokens: Uniswap V2-style pair Swap on the pool from the V2 curve's Graduate(token, pool)	Attributed to the transaction signer (the Swap sender is a router). V2-pair swaps report in/out amounts and are stored as signed pool deltas like V3 swaps, so both feed the same volume and wash rules.
Funding (who sent a wallet its MON)	Monad archive state + debug_traceBlockByNumber (section 2)	No public Monad RPC serves trace_filter.
Infrastructure	packages/metrics/src/infrastructure.json, generated by pnpm infra:scan (section 3) plus manual entries; Nansen labels once integrated	Used only to stop exchanges/bridges/routers acting as links.

Window: tokens launched in the last BACKFILL_DAYS days (default 7). Analysis reads mainnet only; snapshots are published to NunoFeed on Monad testnet.

Trade attribution

The curve event's sender is the trading wallet for direct trades and trades through nad.fun's router. When a wallet trades through a bot contract (its own or a shared trading-bot router), sender is that contract. On the 7-day sample this was 94 of 537 curve trades. When sender is a contract, the trade is attributed to the transaction signer. Example: 0x022e… signs calls to its own contract 0x9b2d…, which sells on the curve; those sells belong to 0x022e….

Contracts vs wallets

An address counts as a contract when eth_getCode returns bytecode. EIP-7702 delegated accounts are wallets, not contracts: their code is the 23-byte designator 0xef0100 || delegate, but they are still controlled by a private key. Several active nad.fun traders are 7702 accounts.

2. Funding resolution

For each wallet that bought a tracked token:

1. Find the first-funded block. For an externally owned account, touched(b) = balance(b) > 0 or nonce(b) > 0 can only flip from false to true. Once funded, a wallet can only spend by sending a transaction, which raises its nonce. Nuno binary-searches archive state for the first block where touched is true, searching strictly before the wallet's first buy. That takes about 27 steps over Monad's full history.
2. Find the sender. In that block, a top-level transaction with value to the wallet gives the sender directly. Otherwise Nuno traces the block with callTracer and takes every successful value-carrying frame (CALL, CREATE, CREATE2, SELFDESTRUCT) whose target is the wallet. Frames under a reverted frame are ignored.
3. Find later deposits. A small first funding is often followed by the real money (e.g. 10 MON first, 300,000 MON later). Between the first-funded block and the wallet's first buy (or, for an ancestor, the block where it funded its child), Nuno looks for deposits that raised the balance. If balance(lo) < t <= balance(hi), a binary search finds a block where the balance crossed t upwards, and a balance can only rise through an inbound value transfer, so that block contains a deposit; its sender is found as in step 2. With t at the midpoint, each deposit found halves the remaining gap. Only rises of at least 1 MON are searched. Together with the first funding, at most 5 inbound funding edges are stored per wallet.
4. Record evidence. For every edge Nuno stores the funder (the frame that sent value, possibly a disperse contract), the origin (the transaction signer, i.e. the entity that controls the funds), value, block, timestamp and tx hash.
5. Repeat on every origin, up to 3 hops back.

The origin is used for linking, so bundlers that fan out through a disperse contract are still linked to their operator.

3. Entity resolution (clustering)

Entity resolution runs globally across every tracked token at once. That way an operator who launches or trades many tokens is one entity everywhere, with the same id. Wallets are linked by weighted edges. Weights between the same pair of wallets add up across edge types and across tokens. A pair is merged (union-find) once its total weight reaches 1.0.

Edge	Weight	Rule
same_direct_funder	1.0	Both wallets were funded (first funding or a later deposit) by the same non-infrastructure origin, within 24 h of each other
common_funding_source	0.8	The wallets share any non-infrastructure ancestor within 3 funding hops. Counted once per pair, however many ancestors they share (several shared ancestors on one chain are one signal)
creator_funded	1.0	A token's creator is among the wallet's funding ancestors (≤ 3 hops); links wallet and creator
token_transfer	1.0	One wallet sent a tracked token directly to the other (neither is a contract)
same_block_early_buy	0.5	Both bought the same token in the same block, within 200 blocks (~1 min) of its creation
same_block_sell	0.5	Both sold the same token in the same block

Consequences of the weights:

• A single weak signal (one shared block, or a distant shared ancestor) never merges wallets on its own.
• Two weak signals do. Examples: co-selling in the same block on two different tokens (0.5 + 0.5), or a shared ancestor plus a same-block sell (0.8 + 0.5).

Infrastructure (exchange-like) addresses. Until Nansen labels are integrated, pnpm infra:scan profiles every funding origin on-chain. It marks an address exchange-like if it has sent ≥ 5,000 transactions or holds ≥ 1,000,000 MON. Each entry in infrastructure.json records the numbers and block it was judged on. This is a heuristic, not a label. A busy private wallet can be over-excluded, which only costs recall: its funded wallets are not linked through it. A small exchange deposit wallet can be missed. On 2026-10-08 it flagged 16 of 46 funding origins. The serial-launch funder 0xb245… (91 txs) is not flagged.

Distribution hubs (fan-out cap). Some addresses fund, or send tokens to, hundreds of unrelated people: airdrops, payout wallets, trading-bot services. Without a limit, one of them chains everyone it touched into a single "entity". On the October 2026 window, one wallet that sent tokens to 1,375 different wallets helped merge 3,728 wallets into one group. So an address that funds more than 50 distinct participants, is a shared funding ancestor of more than 50, or sends tokens to more than 50 is treated as a hub (receiving from many is not: farm wallets consolidating into one main wallet stay linked), and those links stop grouping wallets. Its recipients can still be grouped by their own evidence.

Farm exception. A direct funder (or a token creator) above the cap still links its wallets when its payments look like one operator seeding its own wallets:

• the median payment is at most 10 MON;
• at least 80% of payments are within half to double the median;
• at least 80% of recipients got their first funding from it.

Example: 0xb56e…e299 paid 101 fresh wallets about 0.37 MON each. Funders whose payments vary widely, are large, or go to already-funded wallets stay hubs. The exception covers direct funding only, never token transfers or shared ancestors.

Hard rules

• Contracts are never entity members. Each address's code is checked with eth_getCode. nad.fun protocol contracts, curve pools and graduated pools are always excluded.
• Infrastructure addresses never act as linking funders or ancestors.
• Every accepted link keeps its evidence: edge type, tx hash, block, and the token where relevant.
• For very large groups (more than 64 wallets sharing one funder, block or source), links are chained in time order instead of all pairs. The merged result is identical; only per-pair weight accumulation across edge types is reduced.

An entity's id is its lexicographically smallest member address. A wallet with no accepted links is its own entity.

4. Metrics (per token)

All supply shares are in basis points of total supply (10,000 = 100%), rounded down. Total supply is mints minus burns from the token's transfer history. Curve, pool and nad.fun protocol contracts are never counted as holders.

Metric	Definition
rawHolders	Addresses with a non-zero balance, excluding contracts
realHolders	Distinct entities among those holders
effectiveTop10Bps	Combined balance of the 10 largest entities, as a share of total supply
clusterSupplyBps	Balance held by wallets that belong to multi-wallet entities, as a share of total supply
creatorLinkedSupplyBps	Balance held by the creator's entity (the creator alone if unclustered), as a share of total supply
rawVolume	Sum of the MON side of every curve trade (buy: MON in; sell: MON out) plus, after graduation, every Uniswap V3 swap on the token/WMON pool. A swap's side and MON leg come from the pool's signed deltas; the pair is ordered by address (token0 < token1), so the token's side is known without an RPC call
organicVolume	rawVolume minus wash-like volume (below)
organicVolumeBps	organicVolume / rawVolume; 0 when there is no volume

Wash-like volume, computed per entity across all its wallets:

• (a) If an entity both bought and sold, and its net token position change is under 5% of its gross tokens traded, all its MON volume is wash-like.
• (b) Otherwise, round trips count: for each window of 3,600 blocks (~18 min), 2 × min(buy MON, sell MON).
• Entities that only bought or only sold are directional and never count as wash.

Because entities span wallets, one wallet buying while a sibling wallet sells is detected as an entity round trip.

5. Evidence root

evidenceRoot = keccak256(utf8(canonicalJson)), where canonicalJson is:

{"token": "<addr>", "clusters": [
  {"id": "<addr>", "members": ["<sorted addrs>"],
   "evidence": ["<a>:<b>:<edgeType>:<txHash>:<block>", "... sorted, deduplicated"]}
]}

clusters lists the entities active in the token, sorted by id. The source block is not part of the hash, so the root changes only when the evidence changes; the block is published alongside it as sourceBlock. The canonical JSON is stored and served, so anyone can recompute the root and compare it with the one on-chain.

6. On-chain feed

NunoFeed.publish(token, Snapshot) stores the metrics above plus sourceBlock (the mainnet block they were computed at) and evidenceRoot; publishedAt is stamped by the contract. Snapshots can only move forward in sourceBlock. The publisher sends a new snapshot when any of these hold:

• holder counts changed;
• a bps metric moved by at least 25;
• the evidence root changed;
• 6 hours have passed since the last snapshot (heartbeat).

OrganicGate.requireOrganic(token, maxClusterBps, maxAge) reverts when there is no snapshot, when the snapshot is older than maxAge, or when clusterSupplyBps > maxClusterBps.

7. Limitations and known false-positive cases

• Not every inbound transfer. Nuno stores the first funding plus deposits that raised the net balance, at most 5 per wallet. A deposit that was spent again before the wallet's first buy (so the balance never rose past it) can be missed, and so can small deposits under 1 MON.
• Native MON only. Funding via WMON or other ERC-20s is not yet followed.
• EIP-7702 accounts. A delegated EOA can move funds without raising its nonce, which breaks the monotonicity assumption in section 2. Such wallets may resolve to a later block, or to a block with no inbound value; the latter is stored as "no inbound value frame".
• Round-trip traders count as wash. Rule (a) in section 4 classifies any entity that ends the window with a near-zero net position as wash-like. That includes a sniper that buys at launch and later sells everything at a profit, not only volume bots. On the 7-day sample, attributing bot-contract sells to their signers dropped volume-weighted organic volume from about 20% to about 1%, mostly because of one such sniper (0x022e…). "Organic" here means "volume from entities that kept a position", which is stricter than "not wash-traded".
• Distribution hot wallets. A service that funds many independent users (exchange, faucet, trading-bot onboarding) looks the same as an operator funding its own wallets. Example: 0xa934… (7,594 txs) first-funded 8 trading wallets within ~37 minutes. The infrastructure heuristic treats it as infrastructure, so those wallets are not linked. Some of them may in fact be one operator.
• Shared infrastructure funders. Until Nansen labels are integrated, an exchange hot wallet funding two unrelated users within 24 h links them (same_direct_funder). This is the main expected source of false positives, and the hand-review in docs/VALIDATION.md checks for it.
• Coincidental same-block trades. Two independent traders can share a block, especially right after launch. That is why these edges weigh 0.5 and need a second signal.
• DEX swaps and clustering. Post-graduation swaps count toward volume and wash detection, but do not create same_block_* links (those use curve trades only). Swaps routed through aggregators that split across pools are attributed per pool event.
• Supply denominator. Shares use total supply. On the bonding curve most supply sits in the curve contract, so shares of circulating supply are higher than the published numbers.
• Hub cap approximations. Hubs are counted over all funded wallets and all token recipients in the database, so full and incremental runs agree. A shared ancestor (2–3 hops up) above the cap gets no farm exception: wallets that trace back to the same seeder through different intermediaries are then grouped only through their direct funders and other evidence.
• No ground truth. No labelled dataset exists. Accuracy is reported only as the observed precision on the hand-reviewed sample in docs/VALIDATION.md.

Draft verdicts, pre-filled by Claude Code on 2026-10-08 from on-chain checks (every evidence tx re-fetched from rpc1.monad.xyz; funder nonces and balances read at the latest block). Pending human review. Change any verdict you disagree with.

There is no labelled ground truth for wallet clusters. This is a hand review of a reproducible random sample.

Sample generated by pnpm --filter @nuno/metrics validation 42 at mainnet block 111,709,445: 20 flagged links (of 90, across 1 entities) and 10 unflagged buyer wallets (of 19).

Verdict key. Flagged link: TP = the evidence shows common control, FP = plausibly independent (e.g. both funded by an exchange), ? = can't tell. Unflagged wallet: TN = no sign of a link to another sampled/known operator, FN = a link Nuno missed.

Observed precision = TP / (TP + FP) on flagged links. Reported in the README only for this sample.

Flagged links

#	Entity	Wallets	Edge	Evidence	Verdict	Reasoning
1	0x0a0f2937…	0x1b3dc681… ↔ 0x2d5be282…	same_direct_funder	0x88d0162e… @66478733 via 0xb2454805… 0xe771d39f… @66478748 via 0xb2454805…	TP	Both wallets' first funding is a plain transfer of exactly 14,995 MON from 0xb245…66d3b3, at blocks 66,478,733 and 66,478,748 (15 blocks apart). 0xb245…66d3b3 is a private EOA (91 lifetime txs). Its nonce went 49→59 across that burst, so these were 10 consecutive sends to 10 fresh wallets. Both wallets then created tracked tokens (7 and 7 of the 71) and show the same ~550–650-tx bot profile.
2	0x0a0f2937…	0x1b3dc681… ↔ 0x849cb815…	common_funding_source	0x88d0162e… @66478733 via 0xb2454805… 0x9dd12f03… @66478710 via 0xb2454805… 0x88d0162e… @66478733 via 0xf89d7b9c… 0x9dd12f03… @66478710 via 0xf89d7b9c… 0x88d0162e… @66478733 via 0x348ee93e… 0x9dd12f03… @66478710 via 0x348ee93e…	TP	Both wallets' first funding is a plain transfer of exactly 14,995 MON from 0xb245…66d3b3, at blocks 66,478,733 and 66,478,710 (23 blocks apart). 0xb245…66d3b3 is a private EOA (91 lifetime txs). Its nonce went 49→59 across that burst, so these were 10 consecutive sends to 10 fresh wallets. Both wallets then created tracked tokens (7 and 8 of the 71) and show the same ~550–650-tx bot profile. The ancestors 0xf89d… (73,554 txs, 378M MON) and 0x348e… in this link's evidence are exchange-like and would not justify a link alone; the link stands on 0xb245…66d3b3.
3	0x0a0f2937…	0x0a0f2937… ↔ 0xea6cf43b…	same_direct_funder	0x472f4f46… @66478720 via 0xb2454805… 0xc585563e… @66478724 via 0xb2454805…	TP	Both wallets' first funding is a plain transfer of exactly 14,995 MON from 0xb245…66d3b3, at blocks 66,478,720 and 66,478,724 (4 blocks apart). 0xb245…66d3b3 is a private EOA (91 lifetime txs). Its nonce went 49→59 across that burst, so these were 10 consecutive sends to 10 fresh wallets. Both wallets then created tracked tokens (7 and 7 of the 71) and show the same ~550–650-tx bot profile.
4	0x0a0f2937…	0x0a0f2937… ↔ 0x725d3b6d…	common_funding_source	0x472f4f46… @66478720 via 0xb2454805… 0x8db860bf… @66478738 via 0xb2454805… 0x472f4f46… @66478720 via 0xf89d7b9c… 0x8db860bf… @66478738 via 0xf89d7b9c… 0x472f4f46… @66478720 via 0x348ee93e… 0x8db860bf… @66478738 via 0x348ee93e…	TP	Both wallets' first funding is a plain transfer of exactly 14,995 MON from 0xb245…66d3b3, at blocks 66,478,720 and 66,478,738 (18 blocks apart). 0xb245…66d3b3 is a private EOA (91 lifetime txs). Its nonce went 49→59 across that burst, so these were 10 consecutive sends to 10 fresh wallets. Both wallets then created tracked tokens (7 and 7 of the 71) and show the same ~550–650-tx bot profile. The ancestors 0xf89d… (73,554 txs, 378M MON) and 0x348e… in this link's evidence are exchange-like and would not justify a link alone; the link stands on 0xb245…66d3b3.
5	0x0a0f2937…	0xe0b0111d… ↔ 0x2d5be282…	common_funding_source	0x9327686e… @66478743 via 0xb2454805… 0xe771d39f… @66478748 via 0xb2454805… 0x9327686e… @66478743 via 0xf89d7b9c… 0xe771d39f… @66478748 via 0xf89d7b9c… 0x9327686e… @66478743 via 0x348ee93e… 0xe771d39f… @66478748 via 0x348ee93e…	TP	Both wallets' first funding is a plain transfer of exactly 14,995 MON from 0xb245…66d3b3, at blocks 66,478,743 and 66,478,748 (5 blocks apart). 0xb245…66d3b3 is a private EOA (91 lifetime txs). Its nonce went 49→59 across that burst, so these were 10 consecutive sends to 10 fresh wallets. Both wallets then created tracked tokens (7 and 7 of the 71) and show the same ~550–650-tx bot profile. The ancestors 0xf89d… (73,554 txs, 378M MON) and 0x348e… in this link's evidence are exchange-like and would not justify a link alone; the link stands on 0xb245…66d3b3.
6	0x0a0f2937…	0xdd1cf85f… ↔ 0xea6cf43b…	same_direct_funder	0xe12ecdb9… @66478715 via 0xb2454805… 0xc585563e… @66478724 via 0xb2454805…	TP	Both wallets' first funding is a plain transfer of exactly 14,995 MON from 0xb245…66d3b3, at blocks 66,478,715 and 66,478,724 (9 blocks apart). 0xb245…66d3b3 is a private EOA (91 lifetime txs). Its nonce went 49→59 across that burst, so these were 10 consecutive sends to 10 fresh wallets. Both wallets then created tracked tokens (7 and 7 of the 71) and show the same ~550–650-tx bot profile.
7	0x0a0f2937…	0xdd1cf85f… ↔ 0x725d3b6d…	same_direct_funder	0xe12ecdb9… @66478715 via 0xb2454805… 0x8db860bf… @66478738 via 0xb2454805…	TP	Both wallets' first funding is a plain transfer of exactly 14,995 MON from 0xb245…66d3b3, at blocks 66,478,715 and 66,478,738 (23 blocks apart). 0xb245…66d3b3 is a private EOA (91 lifetime txs). Its nonce went 49→59 across that burst, so these were 10 consecutive sends to 10 fresh wallets. Both wallets then created tracked tokens (7 and 7 of the 71) and show the same ~550–650-tx bot profile.
8	0x0a0f2937…	0xe0b0111d… ↔ 0x2d5be282…	same_direct_funder	0x9327686e… @66478743 via 0xb2454805… 0xe771d39f… @66478748 via 0xb2454805…	TP	Both wallets' first funding is a plain transfer of exactly 14,995 MON from 0xb245…66d3b3, at blocks 66,478,743 and 66,478,748 (5 blocks apart). 0xb245…66d3b3 is a private EOA (91 lifetime txs). Its nonce went 49→59 across that burst, so these were 10 consecutive sends to 10 fresh wallets. Both wallets then created tracked tokens (7 and 7 of the 71) and show the same ~550–650-tx bot profile.
9	0x0a0f2937…	0xea6cf43b… ↔ 0xe0b0111d…	common_funding_source	0xc585563e… @66478724 via 0xb2454805… 0x9327686e… @66478743 via 0xb2454805… 0xc585563e… @66478724 via 0xf89d7b9c… 0x9327686e… @66478743 via 0xf89d7b9c… 0xc585563e… @66478724 via 0x348ee93e… 0x9327686e… @66478743 via 0x348ee93e…	TP	Both wallets' first funding is a plain transfer of exactly 14,995 MON from 0xb245…66d3b3, at blocks 66,478,724 and 66,478,743 (19 blocks apart). 0xb245…66d3b3 is a private EOA (91 lifetime txs). Its nonce went 49→59 across that burst, so these were 10 consecutive sends to 10 fresh wallets. Both wallets then created tracked tokens (7 and 7 of the 71) and show the same ~550–650-tx bot profile. The ancestors 0xf89d… (73,554 txs, 378M MON) and 0x348e… in this link's evidence are exchange-like and would not justify a link alone; the link stands on 0xb245…66d3b3.
10	0x0a0f2937…	0x849cb815… ↔ 0xdd1cf85f…	same_direct_funder	0x9dd12f03… @66478710 via 0xb2454805… 0xe12ecdb9… @66478715 via 0xb2454805…	TP	Both wallets' first funding is a plain transfer of exactly 14,995 MON from 0xb245…66d3b3, at blocks 66,478,710 and 66,478,715 (5 blocks apart). 0xb245…66d3b3 is a private EOA (91 lifetime txs). Its nonce went 49→59 across that burst, so these were 10 consecutive sends to 10 fresh wallets. Both wallets then created tracked tokens (8 and 7 of the 71) and show the same ~550–650-tx bot profile.
11	0x0a0f2937…	0x39f234ce… ↔ 0xea6cf43b…	same_direct_funder	0x928affdb… @66478706 via 0xb2454805… 0xc585563e… @66478724 via 0xb2454805…	TP	Both wallets' first funding is a plain transfer of exactly 14,995 MON from 0xb245…66d3b3, at blocks 66,478,706 and 66,478,724 (18 blocks apart). 0xb245…66d3b3 is a private EOA (91 lifetime txs). Its nonce went 49→59 across that burst, so these were 10 consecutive sends to 10 fresh wallets. Both wallets then created tracked tokens (7 and 7 of the 71) and show the same ~550–650-tx bot profile.
12	0x0a0f2937…	0x0a0f2937… ↔ 0x849cb815…	common_funding_source	0x472f4f46… @66478720 via 0xb2454805… 0x9dd12f03… @66478710 via 0xb2454805… 0x472f4f46… @66478720 via 0xf89d7b9c… 0x9dd12f03… @66478710 via 0xf89d7b9c… 0x472f4f46… @66478720 via 0x348ee93e… 0x9dd12f03… @66478710 via 0x348ee93e…	TP	Both wallets' first funding is a plain transfer of exactly 14,995 MON from 0xb245…66d3b3, at blocks 66,478,720 and 66,478,710 (10 blocks apart). 0xb245…66d3b3 is a private EOA (91 lifetime txs). Its nonce went 49→59 across that burst, so these were 10 consecutive sends to 10 fresh wallets. Both wallets then created tracked tokens (7 and 8 of the 71) and show the same ~550–650-tx bot profile. The ancestors 0xf89d… (73,554 txs, 378M MON) and 0x348e… in this link's evidence are exchange-like and would not justify a link alone; the link stands on 0xb245…66d3b3.
13	0x0a0f2937…	0xdd1cf85f… ↔ 0x1b3dc681…	common_funding_source	0xe12ecdb9… @66478715 via 0xb2454805… 0x88d0162e… @66478733 via 0xb2454805… 0xe12ecdb9… @66478715 via 0xf89d7b9c… 0x88d0162e… @66478733 via 0xf89d7b9c… 0xe12ecdb9… @66478715 via 0x348ee93e… 0x88d0162e… @66478733 via 0x348ee93e…	TP	Both wallets' first funding is a plain transfer of exactly 14,995 MON from 0xb245…66d3b3, at blocks 66,478,715 and 66,478,733 (18 blocks apart). 0xb245…66d3b3 is a private EOA (91 lifetime txs). Its nonce went 49→59 across that burst, so these were 10 consecutive sends to 10 fresh wallets. Both wallets then created tracked tokens (7 and 7 of the 71) and show the same ~550–650-tx bot profile. The ancestors 0xf89d… (73,554 txs, 378M MON) and 0x348e… in this link's evidence are exchange-like and would not justify a link alone; the link stands on 0xb245…66d3b3.
14	0x0a0f2937…	0xea6cf43b… ↔ 0x39f234ce…	common_funding_source	0xc585563e… @66478724 via 0xb2454805… 0x928affdb… @66478706 via 0xb2454805… 0xc585563e… @66478724 via 0xf89d7b9c… 0x928affdb… @66478706 via 0xf89d7b9c… 0xc585563e… @66478724 via 0x348ee93e… 0x928affdb… @66478706 via 0x348ee93e…	TP	Both wallets' first funding is a plain transfer of exactly 14,995 MON from 0xb245…66d3b3, at blocks 66,478,724 and 66,478,706 (18 blocks apart). 0xb245…66d3b3 is a private EOA (91 lifetime txs). Its nonce went 49→59 across that burst, so these were 10 consecutive sends to 10 fresh wallets. Both wallets then created tracked tokens (7 and 7 of the 71) and show the same ~550–650-tx bot profile. The ancestors 0xf89d… (73,554 txs, 378M MON) and 0x348e… in this link's evidence are exchange-like and would not justify a link alone; the link stands on 0xb245…66d3b3.
15	0x0a0f2937…	0x1b3dc681… ↔ 0x725d3b6d…	common_funding_source	0x88d0162e… @66478733 via 0xb2454805… 0x8db860bf… @66478738 via 0xb2454805… 0x88d0162e… @66478733 via 0xf89d7b9c… 0x8db860bf… @66478738 via 0xf89d7b9c… 0x88d0162e… @66478733 via 0x348ee93e… 0x8db860bf… @66478738 via 0x348ee93e…	TP	Both wallets' first funding is a plain transfer of exactly 14,995 MON from 0xb245…66d3b3, at blocks 66,478,733 and 66,478,738 (5 blocks apart). 0xb245…66d3b3 is a private EOA (91 lifetime txs). Its nonce went 49→59 across that burst, so these were 10 consecutive sends to 10 fresh wallets. Both wallets then created tracked tokens (7 and 7 of the 71) and show the same ~550–650-tx bot profile. The ancestors 0xf89d… (73,554 txs, 378M MON) and 0x348e… in this link's evidence are exchange-like and would not justify a link alone; the link stands on 0xb245…66d3b3.
16	0x0a0f2937…	0x511e8425… ↔ 0x2d5be282…	same_direct_funder	0xf7b03822… @66478728 via 0xb2454805… 0xe771d39f… @66478748 via 0xb2454805…	TP	Both wallets' first funding is a plain transfer of exactly 14,995 MON from 0xb245…66d3b3, at blocks 66,478,728 and 66,478,748 (20 blocks apart). 0xb245…66d3b3 is a private EOA (91 lifetime txs). Its nonce went 49→59 across that burst, so these were 10 consecutive sends to 10 fresh wallets. Both wallets then created tracked tokens (7 and 7 of the 71) and show the same ~550–650-tx bot profile.
17	0x0a0f2937…	0x849cb815… ↔ 0x1b3dc681…	same_direct_funder	0x9dd12f03… @66478710 via 0xb2454805… 0x88d0162e… @66478733 via 0xb2454805…	TP	Both wallets' first funding is a plain transfer of exactly 14,995 MON from 0xb245…66d3b3, at blocks 66,478,710 and 66,478,733 (23 blocks apart). 0xb245…66d3b3 is a private EOA (91 lifetime txs). Its nonce went 49→59 across that burst, so these were 10 consecutive sends to 10 fresh wallets. Both wallets then created tracked tokens (8 and 7 of the 71) and show the same ~550–650-tx bot profile.
18	0x0a0f2937…	0x511e8425… ↔ 0x39f234ce…	common_funding_source	0xf7b03822… @66478728 via 0xb2454805… 0x928affdb… @66478706 via 0xb2454805… 0xf7b03822… @66478728 via 0xf89d7b9c… 0x928affdb… @66478706 via 0xf89d7b9c… 0xf7b03822… @66478728 via 0x348ee93e… 0x928affdb… @66478706 via 0x348ee93e…	TP	Both wallets' first funding is a plain transfer of exactly 14,995 MON from 0xb245…66d3b3, at blocks 66,478,728 and 66,478,706 (22 blocks apart). 0xb245…66d3b3 is a private EOA (91 lifetime txs). Its nonce went 49→59 across that burst, so these were 10 consecutive sends to 10 fresh wallets. Both wallets then created tracked tokens (7 and 7 of the 71) and show the same ~550–650-tx bot profile. The ancestors 0xf89d… (73,554 txs, 378M MON) and 0x348e… in this link's evidence are exchange-like and would not justify a link alone; the link stands on 0xb245…66d3b3.
19	0x0a0f2937…	0x725d3b6d… ↔ 0x849cb815…	common_funding_source	0x8db860bf… @66478738 via 0xb2454805… 0x9dd12f03… @66478710 via 0xb2454805… 0x8db860bf… @66478738 via 0xf89d7b9c… 0x9dd12f03… @66478710 via 0xf89d7b9c… 0x8db860bf… @66478738 via 0x348ee93e… 0x9dd12f03… @66478710 via 0x348ee93e…	TP	Both wallets' first funding is a plain transfer of exactly 14,995 MON from 0xb245…66d3b3, at blocks 66,478,738 and 66,478,710 (28 blocks apart). 0xb245…66d3b3 is a private EOA (91 lifetime txs). Its nonce went 49→59 across that burst, so these were 10 consecutive sends to 10 fresh wallets. Both wallets then created tracked tokens (7 and 8 of the 71) and show the same ~550–650-tx bot profile. The ancestors 0xf89d… (73,554 txs, 378M MON) and 0x348e… in this link's evidence are exchange-like and would not justify a link alone; the link stands on 0xb245…66d3b3.
20	0x0a0f2937…	0xdd1cf85f… ↔ 0x0a0f2937…	common_funding_source	0xe12ecdb9… @66478715 via 0xb2454805… 0x472f4f46… @66478720 via 0xb2454805… 0xe12ecdb9… @66478715 via 0xf89d7b9c… 0x472f4f46… @66478720 via 0xf89d7b9c… 0xe12ecdb9… @66478715 via 0x348ee93e… 0x472f4f46… @66478720 via 0x348ee93e…	TP	Both wallets' first funding is a plain transfer of exactly 14,995 MON from 0xb245…66d3b3, at blocks 66,478,715 and 66,478,720 (5 blocks apart). 0xb245…66d3b3 is a private EOA (91 lifetime txs). Its nonce went 49→59 across that burst, so these were 10 consecutive sends to 10 fresh wallets. Both wallets then created tracked tokens (7 and 7 of the 71) and show the same ~550–650-tx bot profile. The ancestors 0xf89d… (73,554 txs, 378M MON) and 0x348e… in this link's evidence are exchange-like and would not justify a link alone; the link stands on 0xb245…66d3b3.

Unflagged wallets

#	Wallet	Verdict	Reasoning
1	0x9689474d…	TN	First funded with 9,846 MON by 0xdb2a…f254 (11,560 lifetime txs, 6.8M MON: exchange-like). 1 buy on 1 token. Only shared ancestor is at hop 3 with one other buyer. No link to the operator lineage.
2	0x62c706c2…	TN	First funded with 410.9 MON by 0x158e…5303 (private, 87 txs). 2 trades on 1 token. Shares no funding ancestor with any other buyer in the data.
3	0x291bc9aa…	TN	First funded with 397.7 MON by 0xf539…3d85 (private, 14 txs) at block 41.4M. 5 trades on 1 token. Its only shared ancestor is 0xf70d…dbef at hop 3 (578,677 txs: exchange-like), correctly not enough to link.
4	0x23ad000e…	TN	First funded with 200 MON by 0xdcbb…24ad (account with code, 3,327 txs: smart or delegated wallet). 2 trades on 1 token. No shared ancestors.
5	0xb75d93f8…	TN	First funded with 14,124 MON directly by 0xf70d…dbef (578,677 txs, 8.4M MON: exchange-like). 1 buy. Shares that exchange-like lineage with two other buyers. One lineage only counts once (0.8), correctly below the threshold.
6	0x51c83637…	TN	First funded with 13,857 MON by 0xa934…9c49 (7,594 txs, high-throughput distributor) at block 37.7M. 1 buy. Shares 0xa934… lineage with 2 other buyers. That is the lineage behind the double-count bug fixed today; not linked now.
7	0x6f370da2…	TN	First funded with 100 MON by 0x9322…2bd5 (587 txs, 42.7M MON: whale or treasury). 1 buy. Was wrongly merged with 0xf359… before today's fix (two shared ancestors on one chain counted twice). Now correctly unflagged.
8	0x5c16a939…	TN	First funded with 682.5 MON by 0x7ff8…1cce5 (701 txs, 751k MON). 3 buys on 1 token. No shared ancestors.
9	0x91fea3a2…	TN	First funded with 26,948 MON by 0x04d9…6d56 (48,290 txs: exchange-like). 9 buys on 1 token. Shared ancestors only at hops 2–3 via high-volume addresses.
10	0x022e9c32…	? (possible FN)	Sniper pattern on the operator's tokens. It bought 58 of the 71 tokens, each exactly once, 1–2 blocks after launch, for 350–500 MON. It sells through its own contract 0x9b2d…94c4: it signs a call (selector 0xb8a9ddeb) that pulls the tokens and sells on the curve, so the 56 curve sells are attributed to the contract. Funded by 0x33f1…3f99 (private, 44 txs), which was funded by 0xabde…9d76 (exchange-like); no link to 0xb245…66d3b3 within 3 hops. Either an independent launch-sniper bot or the operator's own buyer; on-chain evidence cannot tell which. Since 2026-10-08 its contract-routed sells are attributed to it (trade attribution by tx signer).

Result

Flagged links: 20 TP, 0 FP, 0 ?. Observed precision on this sample: 20/20 (100%).

Unflagged wallets: 9 TN, 1 ? (possible FN).

Caveats that matter more than the headline number:

• All 20 flagged links come from one entity, because only one multi-wallet entity exists in the 7-day window. The sample effectively tests one clustering decision, made of 20 pairs, not 20 independent ones. It says little about precision on other operator styles.
• A false positive was found and fixed before this review. 0x6f37… and 0xf359… were merged because they shared two ancestors on one funding chain, and each was counted. That behaviour is fixed (one lineage counts once per pair). Without the fix, the sample would likely have included an FP.
• Exchange-like ancestors are common: 0xf89d… (73,554 txs), 0xf70d… (578,677 txs), 0xa934…, 0xabde…, 0x04d9…, 0xdb2a…. They create 0.8 common_funding_source overlaps between unrelated buyers. None merged wallets on its own here, but pairing one with a weak signal (e.g. one same-block sell) would. Excluding these addresses as infrastructure (Nansen labels or an evidence-backed manual list) is the main precision safeguard still missing.
• Possible miss (row 10): 0x022e… snipes the operator's launches and sells through its own contract. Its sells were credited to the contract; fixed: curve trades with a contract sender are now attributed to the transaction signer. It is still not linked to the operator: no funding or transfer evidence connects them.
• Also fixed after this review: EIP-7702 delegated wallets were wrongly treated as contracts and excluded (6 active traders, incl. 0xd243… with 50 trades). They are now wallets, and their funding is resolved.
• Exchange-like ancestors are now excluded via pnpm infra:scan (16 addresses, e.g. 0xf89d…, 0xf70d…, 0xa934…). The 20 flagged links above are unchanged: they rest on 0xb245…, which is not flagged.
• Also seen: 0xb245…66d3b3 sent a second burst of 10 transfers right after the first (nonce 59→69 by block 66,478,800). Those recipients haven't traded in the window, so they are not in the data.