Identify bundler wallets, sniper activity, and rat-trader patterns on any Solana token — pump.fun, Moonshot, Raydium, Meteora — with the Noesis /bundle analysis.

Bot /bundleREST GET /api/v1/token/{mint}/bundlesMCP token_bundles

How to detect bundled buys on Solana tokens

TL;DR. Noesis's /bundle analysis classifies every holder of any Solana SPL token by buy-time behavior and returns the share of supply held by bundlers (fresh wallets classified by GMGN's bundle detector), snipers (first-block bots with profit), and rat traders (quick in-and-out flippers). Works on pump.fun, Moonshot, Raydium, Meteora, or any other launcher. A single call to GET /api/v1/token/{mint}/bundles gives a risk rating: under 10% bundler supply is green, 10-25% yellow, above 25% red.

Why bundle detection matters

Bundled launches are the dominant rug-and-dump pattern across Solana — most visible on pump.fun but just as common on other launchpads and direct Raydium/Meteora launches. A bundler scripts 20-50 fresh wallets to buy the same token within the first block or two, capturing a large portion of the initial supply before any organic discovery. The bundled wallets then either dump on the first pump, or sit as "exit liquidity" for later retail.

Classic SEO-style holder lists hide this because each bundled wallet looks small in isolation. What matters is the cluster: how much of the supply was bought by wallets that share the same first-buy slot, the same behavior profile, and often the same funder. /bundle surfaces that cluster as a single number.

What counts as a bundled buy?

Noesis classifies every holder into one of four behavior categories based on its buy timing and subsequent activity:

  1. Bundlers — Fresh-wallet buyers identified by GMGN's bundle-detection algorithm. These are wallets with little prior activity that the detector classifies as bundled; exact detection window is GMGN's heuristic and not directly controllable by us. The core bundle signal.
  2. Snipers — Bot-pattern wallets that bought in the first slot(s) and made profit. Often the tightest-timed buys of all — millisecond-level.
  3. Rat traders — Wallets that bought early but dumped within a short window, realizing profit and exiting. These are the flipper bots, not long-term bundlers.
  4. Whales, traders, organic — Everyone else, broken down by position size and activity pattern.

The "bundler %" reported in the output is specifically category 1 supply share — the wallets still sitting on the position.

How does Noesis detect bundled activity?

/bundle is a pass-through to GMGN's bundle detector. We combine:

Output is a risk rating + a composition breakdown. The risk tiers are tuned against meme-coin-scale launches (pump.fun, Moonshot, direct Raydium) — a launch with 5% bundler supply is noise, a launch with 40% is a rug waiting to happen.

How to run the analysis

Telegram bot

/bundle EPjFWdd5...

or the short form /b. Typical output:

📦 Bundle & Bot Analysis

EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v · $2.3k

📦 Bundler Traders: 🔴 32.5%
  └ 28 bundler wallets in holders
🆕 Fresh Wallets: 🔴 28.1%
  └ 35 fresh wallets in holders
🤖 Bot/Degen: 🔴 11.2%
  └ 14 snipers in holders
🐀 Rat Traders: 🟡 5.3%
🪤 Entrapment: 🟡 8.9%
  └ 12 insider wallets

👥 Holder Composition:
  Top 10 holders: 45.2%
  Dev/Team hold: 22.1%

REST API

curl -H "X-API-Key: $NOESIS_API_KEY" \
  "https://noesisapi.dev/api/v1/token/EPjFWdd5.../bundles"

MCP (for AI agents)

token_bundles(mint="EPjF...1v")

or prompt:

Run a bundle analysis on token EPjF...1v and return the bundler percentage, sniper count, and rat trader share.

SDKs

TypeScript

import { Noesis } from "noesis-api";
const noesis = new Noesis({ apiKey: process.env.NOESIS_API_KEY! });
const b = await noesis.token.bundles("EPjFWdd5...");
console.log(`Bundler %: ${b.token_stat.top_bundler_trader_percentage}`);

Python

from noesis import Noesis
noesis = Noesis(api_key=os.environ["NOESIS_API_KEY"])
b = noesis.token.bundles("EPjFWdd5...")
print(b["token_stat"]["top_bundler_trader_percentage"])

Rust

let client = noesis_api::Client::new(api_key);
let b = client.token_bundles("EPjFWdd5...").await?;
println!("Bundler analysis: {:?}", b);

Understanding the output

The bundle response contains two main sections:

token_stat fields describe bundle and bot classifications:

holder_stat fields count wallets in each category:

Per-wallet details are available in the full response for drill-down analysis.

How to combine /bundle with other commands

Chain 1 — Is the bundler cluster also a team cluster?

/bundle <mint>                        high bundler %
  → /team <mint>                      if team also flags, same coordinated actor
  → /fresh <mint>                     confirms fresh-wallet funding

Chain 2 — Will snipers dump?

/bundle <mint>                        sniper count + combined profit
  → /topholders <mint>                find the sniper wallets in the holder list
  → /walletchecker <sniper_wallet>    check historical dump pattern across other tokens

Chain 3 — Is this a clean launch? A token with low /bundle + low /team + low /fresh is the highest-confidence organic launch signal Noesis can produce. All three being green is rarer than it sounds.

Chain 4 — Serial bundler detection

/bundle <mint_a>                       flag bundler wallets
  → /cross <mint_a> <mint_b>          check if same wallets bundled other recent launches

When /bundle false-positives

Caveats

FAQ

What bundler percentage is considered safe? Under 10% bundler supply is green and typical for organic launches. 10–25% is a yellow flag — pair with /team and /fresh before judging. Above 25% is a red flag and usually indicates a coordinated launch where bundled wallets are still holding exit liquidity. Same thresholds apply across pump.fun, Moonshot, Raydium, and Meteora launches.

What's the difference between a bundler and a sniper? Snipers are bot-pattern buyers in the first one or two slots — tight-timed, high-volume first buys, often still profitable. Bundlers are fresh wallets classified by GMGN's bundle detector. Snipers are mostly independent actors; bundlers are usually one actor running many wallets.

Does /bundle work on non-pump.fun tokens? Yes. The heuristic uses the token's mint timestamp, not a launcher-specific signal. Any Solana SPL token works — Moonshot, direct Raydium launches, Meteora pools, LetsBonk, migrated pump.fun tokens, etc.

How is /bundle different from /team? /bundle is GMGN's classification-based detector — it identifies wallets flagged by a bundle-detection algorithm. /team is a graph-based detector — it cares about funding sources and wallet relationships regardless of how they bought. A launch where both fire is the strongest coordinated-launch signal.

Why do rat traders count separately from bundlers? Rat traders already exited — they're not sitting on supply you'll eat when they dump. They matter for understanding historical extraction (how much early value left the book) but not for forward-looking dump risk.

Can I see the individual bundler wallets? Yes. The full API response includes per-wallet breakdown of every category. The Telegram bot output is a summary; the REST response has the full list.

Related guides

Noesis — on-chain intelligence. Home · API docs · MCP · llms.txt