You keep getting rugged on tokens that looked clean. No obvious red flags, reasonable liquidity, some organic buys. But still rekt. The reason is probably bundlers — and most traders have no idea how they work.
What Is a Bundler Bot?
A bundler is a program that lets a token developer launch a token and buy a large chunk of supply in the same transaction block — or across several consecutive blocks — so fast that no retail trader can react. By the time the token shows up on DEX Screener or gets posted in Telegram groups, the dev has already secured their bags at near-zero cost.
Here's the sequence:
- Dev deploys token contract
- Bundler creates pool and adds initial liquidity in the same bundle
- Bundler buys 15–40% of supply across 20–50 wallets simultaneously
- All of this happens in 1–3 Solana blocks (roughly 1.5 seconds)
- Token goes live "on the market" — already owned mostly by the dev
By the time you scan the token and hit buy, you're buying dev's future sell. The chart looks like genuine price discovery. It's theater.
The Multi-Wallet Fragmentation Trick
Smart rug devs don't buy everything in one wallet — that's an obvious red flag. Instead, they use bundlers to fragment the buy across dozens of fresh wallets, each holding 0.5–3% of supply. On-chain it looks like 40 different people discovered the token at launch. In reality it's one person with one script.
How to spot it: on Solscan or Birdeye, look at the top holders list for any new token. If you see 20–30 wallets that:
- All bought within the first 10–30 seconds
- All have zero transaction history before this token
- All hold roughly equal percentages (0.5–2% each)
- All received SOL from the same funding wallet
...that's a bundler. The "40 holders" is actually 1 dev with 40 burner wallets.
Sniper Bots: The Legitimate(ish) Version
Not all early buys are malicious. Sniper bots are used by traders — not just devs — to buy tokens the instant they launch before anyone else can react. Legitimate sniper activity looks different from bundler activity:
- Sniper wallets typically have transaction history (they've traded other tokens)
- They buy different amounts (not suspiciously uniform)
- They often sell quickly — you'll see their entry and exit clearly on the chart
- They're not funded from the same source wallet as the deployer
Heavy sniper activity at launch isn't necessarily a rug signal — it means the token got noticed by bots. What matters is whether the snipers are retail bots or the dev's own infrastructure.
The "Graduated to Raydium" Trap
pump.fun tokens graduate to Raydium once they hit a certain bonding curve milestone (typically around $69K market cap). Many traders treat graduation as a safety signal — if it survived long enough to graduate, it must be real. This is a mistake.
A bundler-armed dev can graduate their own token to Raydium deliberately. Here's how: buy enough supply via bundler at launch to push the bonding curve to graduation threshold, let retail FOMO pile in after the "graduated!" announcement, then dump everything from the fragmented wallets once there's enough exit liquidity. The "graduation" is manufactured — it's just the dev buying enough of their own token to trigger the threshold.
Freeze Authority and Mint Authority
Two on-chain permissions that many traders don't check:
Mint Authority — If the token's mint authority hasn't been revoked, the deployer can create new tokens at will and dilute every existing holder to zero. This is less common on pump.fun (they auto-revoke) but common on custom Raydium launches.
Freeze Authority — The deployer can freeze specific wallet addresses, preventing them from selling. This is the classic "honeypot" mechanic on Solana. You buy, the dev freezes your wallet, you watch the token pump while you can't sell. Always verify freeze authority is revoked on Solscan before buying any custom launch.
What Our Engine Actually Sees
RugPullShield's scoring engine doesn't directly detect bundler wallets — that would require deep on-chain analysis that takes too long for real-time scanning. Instead, it detects the market signatures that bundler activity leaves behind:
- Abnormal volume-to-liquidity ratios — Bundler activity creates enormous volume relative to pool size
- Suspicious price velocity — Price moving 20x in 30 seconds before any organic discovery
- Sell pressure patterns — Bundler wallets sell in coordinated waves visible in tx count ratios
- Age + mcap correlation anomalies — Tokens hitting high mcap in seconds rather than minutes
The engine learned these patterns from millions of real token outcomes across Solana. When it flags HIGH risk, it's often because the on-chain footprint matches tokens that previously rugged via exactly these mechanics.
Your Pre-Buy Checklist
For any non-pump.fun launch (custom Raydium pools especially):
- Check top 20 holders on Birdeye — count unique vs. suspicious wallet clusters
- Verify mint authority revoked on Solscan (Token → Authority)
- Verify freeze authority revoked
- Check deployer wallet age and history — fresh wallet = higher risk
- Run a RugPullShield scan to cross-check market data signals
- Test sell with a micro position before going in size
None of this is bulletproof. Sophisticated devs can pass all these checks. But each filter you add reduces the universe of tokens that will rug you, and that's what keeps your stack alive long term.