Bundlers vs snipers. The two ways stealth supply lands at launch.

Both rules fire on the risks list. Both warn that wallets bought at launch and still hold real supply. The evidence behind them isn't the same. 83% of resolved +24h downside outcomes fire at least one sniper or bundler signal at scan, and reading which of the two it is separates "bots raced you in" from "the launch was staged."

A sniper saw the pool open. A bundler was already inside the transaction.

The verdict words on each scan card are unpacked in the verdicts piece. The page-level breakdown of how those verdicts get computed lives in the how-to-read piece. And the +24h patterns those rules are trying to catch, with their share of failures, are in the rug anatomy. This article is the deep-dive on the two signals that do most of the work in the "manufactured distribution" and "insider dump" categories.

Snipers: who could see the launch

A sniper is any wallet that bought the token in the first five blocks after the pool opened, and isn't the deployer or the creation transaction itself. They saw the pool go live and bought immediately. The buy could be a sophisticated bot watching the mempool, a paid sniper service, or a discord bot reacting to a tip-channel. From on-chain alone we can't always tell which.

It's a competitive race. Whoever pays for the priority fee wins. In those first five slots the pool has thin float and almost no public visibility, so the cost of a meaningful position is low and the upside is steep. That's the structure that creates snipers in the first place.

What counts as a sniper buy

• A buy in any of the first five blocks after the block that created the pool.
• A distinct fee-payer wallet (the signer of the buy transaction).
• Not the creator. Not the creation transaction itself.

Why it matters at +24h

Sniper count alone isn't the signal. We score on the supply share that sniper wallets are still holding when you run the scan. Sold snipers are historical, not a live threat. They already took their print and walked.

The thresholds we score against:

• Below 3% of supply still held: surfaced in the holders panel as context, no risk added to the score.
• 3% to 10%: medium risk on the risks list.
• Above 10%: high risk.

A token where twelve wallets sniped at launch and eleven already sold reads almost the same to the next buyer as a token nobody sniped. That's the data the snipers panel is trying to show, and it's why the list of sniper wallets in the UI is colored by whether the wallet is still holding.

Bundlers: who landed in the same slot

A bundler is a wallet that bought in the same Solana slot as another wallet, on the same token. On Solana, two unrelated wallets landing buys in the exact same slot is roughly as likely as two strangers arriving at the same platform on the same second by accident. The mechanism that makes it routine is the Jito bundle: an atomic transaction group submitted to the Jito block-engine, which lands every transaction in the bundle in the same slot, or none of them.

That structure is what we flag. If two or more distinct wallets bought the token inside a single slot, every wallet in that slot gets tagged a bundler. The bundle itself is the proof of coordination. Two wallets with no relationship don't end up in the same slot by accident.

What counts as bundled

• Two or more distinct wallets buying the same mint inside one Solana slot.
• Every wallet in that slot is tagged. The cumulative supply held by the tagged set is what we score on.
• The thresholds match snipers: 3% medium, 10% high. Below 3%, context only.

Why it matters at +24h

Bundlers ride the same numerical thresholds as snipers, but the evidence weight isn't the same. A bundle is hard to write off as luck. If a meaningful share of the cap table is sitting inside one slot, somebody planned that.

Where the two overlap

Every bundler is also a sniper by the loose definition. They bought in the first five blocks. That's why the same wallet can show up in both panels on a scan card. We don't dedupe across panels because the panels answer different questions.

• Snipers panel: who got in first?
• Bundlers panel: who got in together?

Tokens that fire only the sniper rule and not the bundler rule tend to be public, fast, viral launches that any bot with low latency can land on. Tokens that fire both, especially alongside an insider concentration signal, are the ones that were staged. Same on-chain shape at the surface, very different setup underneath.

What you see on the risks list

Both rules name the supply share in the title, so severity reads at a glance.

• Snipers: medium when the still-holding share is between 3% and 10%, high above 10%. Title shows the percentage.
• Bundlers: same thresholds, same title shape.
• Below 3% (all exited): no risk added. Wallets still appear in the holders panel for context.

The "context only" tier is intentional. The cope score doesn't punish a token retroactively for snipers or bundlers that already sold. They've already extracted whatever they were going to extract. The risks list is about what could still hit you, not what already happened.

Why we score them separately

Same shape on chain, different signal value. Snipers are evidence of speed. Bundlers are evidence of coordination. Weight calibration runs against new resolved outcomes daily, and those two pieces of evidence have to be able to move independently:

• If sniper-only signals start over-firing on viral, public launches that don't actually rug, sniper weight drops without touching bundler weight.
• If bundler signals keep predicting downside reliably, they hold or gain weight regardless of what snipers do.

Folding the two into one rule would mean the calibrator can't tell which side of the evidence is moving. We'd lose the ability to retire a noisy signal without retiring a useful one alongside it.

The short version

A sniper saw the pool open and got there fast. The race was real. A bundler bought inside the same atomic group as somebody else, which means the race was scripted. The risks list shows both because the buyer should care about both. The calibration math, and the orchestrated-launch compound, only stay honest when the two stay separate.

Scan a token at doomer.wtf to see which of the two fired, and how much supply they're still holding.