A Kolscan row is one pubkey. An operator is a component in a graph. If you copy addresses one-by-one you will clone the billboard wallet and miss the ring that actually bought slot 0.
This is how you group them on-chain. No off-chain stalking. Signatures, transfers, and program ix lists only.
The graph
Nodes = wallets that touched a Pump / PumpSwap / Raydium mint you care about.
Edges = evidence they share control. Weight the edge by how many independent tests fire.
Then run union-find (disjoint set). Two wallets in the same parent are one persona for copy / snipe decisions.
Do not require every test. Require two independent families: money flow and behavior.
Test family A — money flow
A1. Shared funder (the main edge).
Walk inbound SOL / WSOL one hop. If 8 “unrelated” traders were funded from the same address inside a 15–60 minute window, they are a spray. Stronger if amounts are near-identical or a fixed grid (0.101, 0.101, 0.102).
edge(A, B) += 3 if funder(A) == funder(B)
and |fundtime(A) - fundtime(B)| < T
and count(siblings) >= 5
A2. Shared sink.
After sells, SOL lands back on one treasury. Consolidation is quieter than the spray and more reliable. A KOL costume leaves PnL in the public key. A farm sweeps.
A3. Peel chain.
Treasury → W1 → W2 → W3 where each hop only exists to trade once. Treat the leaf as the signer, the root as the person. Copying W3 without the root is how you miss the next leaf.
A4. Rent / ATA payer.
The wallet that paid rent for 40 ATAs is the operator even if those ATAs sit on other signers.
Test family B — same-slot behavior
B1. Jito bundle_id.
Create + N buys with one bundle id = one intent. Label every signer in that envelope insider_bundle for that mint. They may never share a funder you have indexed yet. The bundle is enough.
B2. First-buyer co-occurrence.
For each mint, take wallets that buy in slots [create, create+K] (K = 2 to 8). Build an undirected graph: edge if two wallets co-appear in that window on ≥ N distinct mints (N = 3 is already loud; N = 8 is a desk).
This is how persistent sniper rings show up: they are not funded the same morning every time, but they keep arriving together.
B3. Same compute budget + tip shape.
Identical CU limit, identical tip account class, identical buy_v2 account order bugs. Weak alone. Strong with A1 or B2.
Test family C — trade geometry (wash vs trader)
C1. Round trip.
Same wallet buys and sells the same base amount inside one tx, or within a few seconds at the same curve price. That wallet is a volume machine. Do not put it on a “smart money” list.
C2. Ping-pong.
A buys, B sells the same size, funds return to A. Two nodes, one inventory.
C3. Inventory vs volume.
net_sol_in ≈ 0 across 50 swaps of one mint, but 24h volume is huge. Cluster as washer, not sniper.
Union-find recipe
parent = {w: w for w in wallets}
def find(w):
while parent[w] != w:
parent[w] = parent[parent[w]]
w = parent[w]
return w
def union(a, b):
parent[find(a)] = find(b)
for (a, b, score) in edges:
if score >= THRESHOLD:
union(a, b)
Store on the component:
- size
- root funder / root sink
- mints in common
- median
entry_slot - create_slot - median hold slots
- fraction of buys that share a bundle with
create
A component with median_hold_slots < 50 and bundle_with_create > 0.3 is a launch desk. A component with long holds, many mints, no create-bundle overlap is closer to a real trader. Copy only the second, and even then as a classifier (this mint has informed flow), not a market order.
What people skip
- Clustering only by “bought the same coin.” That merges the whole front page.
- Using 24h PnL before the graph. The billboard wallet is often the last hop.
- One-hop funding and stopping. Peel chains exist so that hop looks clean.
- Ignoring sells. The sink is the identity.
- Treating each mint independently. Rings are cross-mint.
- Copying every signer in a component at full size. You just cloned the farm’s impact.
How I check a cluster is real
Pick 20 mints the component touched. For each mint list first 16 buyers. If the same 4–10 component wallets occupy that window again and again, it is not coincidence.
Then replay: remove the component’s own buys from “organic flow.” If the mint had almost no other buyers in 30 minutes, the cluster was the market. Copying them is buying their bag.
Last sanity check: destroy the public KOL address and see if the component still trades next week. If yes, you grouped the desk. If the graph dies with the tweet wallet, you grouped a costume.
That component id — not the Kolscan handle — is what a sniper watchlist should store.
Telegram: https://t.me/C00LBB
Site: https://coolbb.site
Top comments (0)