Sybil & Holder Quality Report

📋 Report Details & Methodology

🪙 Token & data ranges

Token address 2nP9yKQNSGQy851iyawDvBkzkK2R2aqKArQCKc2gpump

Token namePsyopAnime

Token symbolPSY

Launch dateJanuary 9 5:30PM

Account funding rangeJan 2024 till Now

Transfers rangeJan 2 to Jan 15

Methodology & scope

🎯 Risk Dimension: how it works

Plain language: Risk Dimension measures coordinated wallet behavior using three signals (fan-out/fan-in, burst timing, amount templating) and assigns a probability + category.

Token-specific scope:

Create Wallet — account‑opening funding (independent of token).
Pre-Fund & Buy & Exit / Drain — USDC/SOL before first buy and after each sell.
Receive & Sell & Buy & Send Token — SPL token only (e.g. PSY).

Time ranges: Create Wallet: Jan 2024 till Now. Transfer-based: Jan 2 to Jan 15. Update when regenerating for another token or window.

📐 Cluster min size, filter & sort

Minimum size (display/export) — clusters below min are excluded from table and CSV.

Create Wallet: 4+ wallets
Receive & Sell: 4+ senders
Buy & Send Token: 4+ recipients
Pre-Fund & Buy: 4+ wallets
Exit / Drain: 4+ wallets
SUPER: 2+ wallets

Sort: Create Wallet, Buy & Send Token, Pre-Fund & Buy, Exit / Drain: % wallets with time distance (desc). Receive & Sell: time distance (desc), then detected count (desc).

📦 Export limits & caps

Members per cluster (stored): 2,000. Program similarity: same 2k cap.

Top displayed: Create Wallet, Receive & Sell, Buy & Send Token 200 (risk-only); Pre-Fund & Buy, Exit / Drain 500; Super 200. Full list includes clean.

Create Wallet, Buy & Send Token, Pre-Fund & Buy, Exit / Drain: sort by % of wallets with time distance (desc). Receive & Sell: time distance (desc), then detected count (desc). Pre-Fund & Buy / Exit / Drain: drop clusters >1k unless source has label.

Insights & classification

🏷️ Cluster row tags (Router, Clean override, Sybil)

Router/Market/Fees (blue): Cluster source appears as source in both Receive & Sell and Buy & Send Token with size ≥25 on at least one side and size difference <50%; OR the wallet/cluster label matches a Router/DEX/Fees rule (label must contain both strings of at least one predefined pair, e.g. "jupiter" and "aggregator"). When this tag is shown, other warning/sybil tags are hidden.

Potential Fee/HFT/Whale (yellow/gold): Same both‑sides and <50% size difference but cluster size 6–24 on both sides (neither side ≥25). When shown, other tags are hidden.

Clean Cluster override (green): If ≥75% of the cluster's subrow wallets are classified as Router/Market/Fees (by size or label), the main cluster row is overridden to "Clean Cluster" (green = clean/safe; distinct from Router blue and Warning yellow).

Sybil Candidate (red): Detected > 0, clean = 0, and not Router/Potential Router.

Warning Cluster Lvl 1/2/3 (yellow/orange): Based on clean vs detected ratios (see table logic). Router and Potential Router take precedence when applicable.

📊 Issuer KPIs

Wallets Analyzed

30,882

Total token holders

Suspected Sybil

16.8%

Estimated farm wallets

High-Risk Clusters

153,640

Coordinated networks

Health Score

83/100

Overall token health

🧠 Risk Dimension Specs (Fan, Burst, Template)

⚙️ Methodology (3 signals)

Signals

Fan (30 pts, 30d scale); Burst (40 pts, 10‑min bucket); Template (25 pts, amount dominance). Max 95 pts.

Probability

P = 1/(1+e^-(score-50)/10). Categories: ≥70 Confirmed; ≥50 Likely; ≥30 Suspicious; else Clean.

Who is counted

Create Wallet, Pre-Fund & Buy, Exit / Drain = wallets in all_wallet_addresses. Receive & Sell = recipient + senders (timing = recipient). Buy & Send Token = recipients (timing = source). Detected = Confirmed/Likely/Suspicious; Clean = Clean/N/A.

📐 Fan (scale)

How many wallets or sources link to a cohort in the last 30 days.

≥20030 pts

50–19920 pts

10–4910 pts

<100 pts

⏱️ Burst (timing)

How many cohort events fall into the same 10‑minute window.

≥5040 pts

15–4930 pts

5–1415 pts

<50 pts

📋 Template (amounts)

Dominance of one amount inside the same 10‑minute window.

≥80%25 pts

50–79%18 pts

20–49%10 pts

<20%0 pts

💡 Decisions This Informs

Airdrop / Claim Allowlisting

Exclude high-risk clusters, reduce allocations, or require extra criteria

Rewards & Incentives

Apply caps per cluster, not per wallet

Vesting / Unlock Strategy

If post-drain clusters are high, consider longer vesting / claim streams

Governance Integrity

Cluster-based voting weight, anti-sybil gating

Market Health

Understand genuine holders vs mercenary farmers

Clusters per risk dimension (top 500 per type)

🔬 Detection patterns (used in tables below)

Common Funder Clustering

Farms bootstrap wallets from same source

Burst Funding Detection

Mass wallet setup before airdrops/claims

Amount Templating

Scripted distributions / identical funding

Internal Funding / Transfer Chains

Coordinated control + obfuscation of origin

Post-Receive Drain Pattern

Receive → sell quickly → consolidate to exits

Program Similarity

Shared programs → scripted/sybil behavior

Farm Initialisation

🪙

Create Wallet

Issuer meaning: "Wallets were created/funded in a coordinated way."

Used for: pre-screening / sybil scoring before distribution.

Staging & Token Acquisition

💰

Pre-Fund & Buy

Issuer meaning: "Wallets were prepared ahead of your token event."

Used for: identifying farms that spun up before claim/airdrop.

📤

Buy & Send Token

Issuer meaning: "One source sent token to many wallets — fan-out."

Used for: spotting distribution from a single controller.

Finalisation & Exit

📥

Receive & Sell

Issuer meaning: "Many senders sent token to same wallet(s) — fan-in."

Used for: spotting concentrated receipt / wash-in patterns.

💸

Exit / Drain

Issuer meaning: "Wallets like extractors: receive → dump → consolidate."

Used for: measuring toxic supply, deciding vesting/locks, post-mortems.

Showing table

Top 500 Risk Clusters · Pre-Fund & Buy

Top 5 Programs & Analysis

Cluster size distribution

Cluster Classification Counts

How the Top 500 Clusters Are Chosen

🔍Step 1: Filter to clusters with size ≥ 4

📊Step 2: Sort by Time Distance + Detected Count

✅Step 3: Take the Top 500 Cluster Addresses

💡 Insights & How to Read the Report

Interpret cluster tables, wallet scores, and use Graph (Sankey) and History (TXT) from each row.

Insights

📊

Signals & scoring

Time distance

Tables sort by % wallets with time distance (desc) or time distance (desc). Tighter timing → stronger coordination signal.

Fan / Burst / Template

Fan = 30d scale; Burst = 10‑min window; Template = amount dominance.

Template + size

High template + low cluster size → higher bad-actor likelihood.

Other scores

Multi‑signal → stronger coordination; single‑signal → possibly one‑off.

Program similarity

High RMV + high similarity → strong sybil; high RMV + low → coordinated but diverse.

Cluster row tags

Sybil Candidate

Detected > 0, clean = 0, not Router/Potential Router.

Warning Cluster Lvl 2

Both detected and clean; more detected than clean.

Warning Cluster Lvl 3

Both detected and clean; more clean than detected.

Warning Cluster Lvl 1

All clean (0 detected).

Router/Market/Fees

Size ≥25 both sides or label match; other tags hidden when shown.

Potential Fee/HFT/Whale

Size 6–24 both sides, <50% diff; other tags hidden when shown.

Clean Cluster

≥75% of subrows Router/Market/Fees → override to Clean.

🔍 Key Findings

16.8% of wallets share funding sources → likely farms
153640 clusters show automation signals (burst/templated amounts)
Multiple wallets consolidate to a small set of exits after receiving tokens
Transfer chains suggest coordinated control across 458 transfer clusters (402 IN, 56 OUT)

📌 Scope & Data Limitations

RMV definition: RMV means "Risk Measurement Vector" — a coordinated‑behavior scoring framework based on fan‑out/fan‑in, burst timing, and amount templating.
Token-specific analysis: all transfer-based RMV types (Receive & Sell, Buy & Send Token, Pre-Fund & Buy, Exit / Drain) are computed only for the target SPL token shown in the report title.
Time ranges: transfer-based RMVs use the transfer dump window shown above; account-opening RMV uses the account-opening range shown above.
10-minute bucket: the burst window is fixed at 10 minutes (per RMV spec) and has not been tuned per-token.
Pre/Post qualification: any SOL/USDC received before the first token buy counts as pre‑funding; any SOL/USDC sent after a token sell counts as post‑exit (no minimum time gap).
Transfer counts: Receive & Sell / Buy & Send Token use transfer record counts (not unique counterparties), which can overcount repeated transfers.