What Is a Solana Bundle? How to Detect Coordinated Buy Attacks Before You Ape In

You're watching a pump.fun token launch. The chart shows ten buy transactions in the first three seconds. Volume is ticking up. A Telegram group you follow calls it early. Everything looks like genuine excitement around a fresh launch.

But those ten buy transactions were all from wallets controlled by the same person. The "momentum" is staged. The holders calling it in your Telegram group are in on it. You're the exit liquidity.

This is a bundle — one of the most common and most effective manipulation tactics in the Solana memecoin ecosystem. This guide explains exactly what bundling is, how to read it on-chain, and how automated detection works.

What Is a Bundle in the Solana Memecoin Context?

In the context of Solana token launches, a "bundle" refers to a group of wallets — all controlled by the same entity — that coordinate to buy a token in the same block or within the first few seconds of launch. The term comes from Jito's bundle infrastructure (which allows multiple transactions to land atomically in the same block), but in practice the manipulation pattern applies whenever multiple controlled wallets buy simultaneously, regardless of whether Jito is used.

The mechanics are straightforward:

1. The deployer creates 5–20 wallets (sometimes many more) in advance and funds each with SOL
2. At launch, all wallets execute buy transactions in the same block or within 1–3 blocks of each other
3. This gives the deployer's controlled wallets a combined position of 20–60% of the token supply
4. The chart shows explosive early volume — which attracts real traders and drives the price up
5. Once real buyers have entered and provided sufficient exit liquidity, the bundle wallets sell

The key insight: the early momentum is completely synthetic. Real traders see activity and buy in, but what looks like 15 independent buyers is one person across 15 wallets.

Why Bundling Is Dangerous for Regular Traders

Bundling is dangerous for three compounding reasons:

A Worked Example: What a Bundled Launch Looks Like On-Chain

Here is a representative example of what bundle activity looks like when you trace the transaction history of a launched token. The specifics are drawn from common patterns in bundled launches.

This pattern — multiple wallets buying in the same launch block, all funded from a shared source wallet days before launch — is a textbook bundle. No amount of healthy-looking charts changes the underlying reality: 21% of supply was acquired in 2 blocks by one entity before any real trader had a chance to buy.

How to Spot Bundle Patterns Manually

Manual bundle detection is possible but slow. Here's the approach:

1. Find the launch block. On Solscan or Solana Explorer, look up the token's mint account and find the first transactions. Note the block number of the first buy transactions.
2. Check same-block buyers. List all wallets that bought in the first 1–3 blocks. How many are there? Three or more coordinated same-block buys is suspicious.
3. Trace wallet funding sources. For each early buyer wallet, check their SOL transaction history. Were they all funded by the same address around the same time? A common funding wallet is strong evidence of coordination.
4. Calculate aggregate position. Add up the total supply percentage held by all potentially linked wallets. If it exceeds 15–20%, the concentration risk is significant regardless of coordination.

This process takes 15–30 minutes for one token and requires manual verification across multiple tabs. For fast-moving pump.fun launches where the window to buy at a good price is 3–7 minutes, manual bundle detection is not practically useful — which is exactly what bundlers count on.

How Pumpora's Bundle Detection Layer Works

Pumpora's bundle detection layer runs automatically for every token analysis and contributes up to 25 points to the overall 0–100 risk score. It examines three categories of evidence:

1. Same-Block and Near-Block Clustering

The detection layer examines all buy transactions in the first 10 blocks after launch and identifies clusters of buys that arrived within the same block or within a 2-block window. Multiple wallets buying in the same block at launch is not impossible for legitimate reasons (concurrent manual buyers can theoretically land in the same block), but 4 or more same-block buys at launch is statistically anomalous.

2. Wallet Funding Graph Analysis

For each early buyer wallet, Pumpora traces back the SOL funding chain — typically 2–3 hops. Wallets that share a common funding ancestor within a 7-day window before launch are flagged as potentially coordinated. The larger the cluster of wallets sharing a common funding source, and the closer the funding transactions are to the launch date, the higher the bundle score.

3. Position Aggregation

Pumpora calculates the combined token supply percentage held by the identified bundle cluster. A cluster that controls 10% of supply is noted. A cluster that controls 40% of supply gets maximum weighting — the exit potential is proportionally larger.

The three factors combine into a bundle subscore. A token with five same-block buyers, all funded from the same wallet, controlling 35% of supply would score near the maximum 25 bundle points — meaning bundle risk alone contributes heavily to a high overall risk reading.

The Timeline of a Typical Bundle Rug

Bundle vs Insider Pre-Buy: The Difference

These two attack patterns are related but distinct, and both are scored independently in Pumpora's analysis:

• Bundle: Multiple controlled wallets buy in the same launch block, accumulating a large combined position at the lowest possible price. The intent is supply accumulation and false demand signaling.
• Insider pre-buy: Wallets linked to the deployer buy in the first 1–3 blocks before public awareness. These wallets had advance knowledge of the launch. Pre-buys may involve fewer wallets than a full bundle but are still highly predictive of a bad actor.

A token can have both — a bundle in the first block plus additional pre-buy wallets in blocks 2 and 3. Together these signals carry significant combined weight in Pumpora's scoring model.

What to Do If You Detect a Bundle

The clearest answer: don't buy. A confirmed bundle means you have visibility into a coordinated scheme where the person controlling 25–50% of supply is planning to exit into your position. There is no legitimate reason to proceed with that information.

Some experienced traders attempt to "ride the bundle" — buying very early and targeting an exit before the bundle sells. This strategy has an extremely low success rate. The bundlers know their own timeline. You don't. The exit tends to happen faster than most traders can react, particularly because the sell is coordinated across multiple wallets simultaneously.

For the broader picture of signals to check before any Solana token buy, see our complete guide to detecting rug pulls on Solana. For a comparison of tools that check these patterns, see best Solana rug pull checkers and our RugCheck.xyz alternative comparison.

Frequently Asked Questions

What is a bundle in Solana crypto?

A bundle in the Solana memecoin context refers to a group of wallets — controlled by the same person or team — that buy a token in the same block (or within seconds) at launch. This creates the appearance of strong organic demand and price momentum while the controller accumulates 20–60% of the token supply across their wallets. When they exit, those wallets all sell into the market simultaneously, crashing the price.

How do I know if a Solana token was bundled?

Key on-chain indicators of bundling include: multiple wallets buying in the same transaction block at launch, wallets that were funded from the same source address (usually a SOL funding wallet), and buy amounts that are suspiciously round or follow a clear pattern across wallets. Pumpora's bundle detection layer scores these patterns automatically and includes them in the risk score.

Is bundling on pump.fun illegal or just risky?

Bundling sits in a gray area. It is not illegal in most jurisdictions because crypto markets lack the regulated market manipulation definitions that apply to traditional securities. However, it is widely considered deceptive — it manufactures false demand signals to manipulate other traders' buying decisions. From a practical standpoint, it is one of the strongest predictors of an upcoming rug pull.

Can you profit from a bundled token if you detect it early enough?

Some experienced traders do attempt to buy and exit before the bundlers sell, essentially trading the manufactured momentum. This is extremely high-risk — you are trying to out-time a coordinated group who control a large portion of supply and know their own exit plan. The majority of traders who attempt this approach lose money when the coordinated exit happens faster than expected.