Anatomy of a pump.fun extraction crew: a wallet-by-wallet teardown

Most "smart money" on pump.fun is not smart and not money you can follow. It is an operator wearing eight masks. This post takes a single crew apart transaction by transaction, names every wallet, and shows the exact on-chain handoff that turns a 21-SOL launch snipe into a 328-SOL exit. Everything here is independently verifiable: paste the addresses and signatures into any Solana explorer and you will see the same thing Conyr's indexer saw in the swap stream. We earlier covered how coordinated bundles work in the abstract. This is the same machine, fully reverse-engineered, with the receipts.

All figures are from Conyr's parse of the live Solana swap stream over the 30 days ending 2026-06-22. SOL is converted at the ~$73/SOL spot derived from the same swap data; the SOL amounts are the ground truth.

Takeaways#

• A wallet that looks like an elite trader (+$234K realized, 97% win rate) turned out to never buy the tokens it sells. It receives them. The "skill" is an accounting illusion.
• The operation splits roles across two wallet types: a sniper that buys ~44% of supply in the token's creation slot, and a distributor that receives the bag by transfer and ladders it out. The split is what defeats holder pages, leaderboards, and copy-trade tools.
• The supply handoff is provable to the digit: the sniper buys 437,726,205,809,908 tokens; the distributor sells 437,726,205,809,908 tokens having bought zero.
• The crew runs four distributor wallets with 91–100% mutual token overlap — and a second, independent crew runs the identical playbook at ~3× the volume. This is a template, not a one-off.
• The retail is real, not wash: 98.5% of buy volume on these tokens (675,701 SOL across 86,655 wallets) came from outside the operation. ~10K SOL of coordinated buying ignites ~676K SOL of genuine FOMO.
• The selling strategy is demand-paced distribution: sell at ~60% of the live retail buy rate to hold a flat price plateau, then dump the tail when bids dry up. Median token is dead in 4 minutes.
• Across the whole chain in 30 days, 4,506 launches (~150/day) carry this exact fingerprint.

One token, every receipt#

Start with a single token and follow it end to end. The mint:

5AzEPojQQMgLmwwbtVEaoCjDoDddA2P9GY9RbMVEpump

The snipe. In the token's creation slot (428072961, 2026-06-22 03:01:58 UTC), wallet

8qhHz3D4A1AhcGwRS6ZRH4Y7iCr2ojWqt24LovtnCETv

bought 21.118 SOL worth of the token — 437,726,205,809,908 base units, roughly 44% of the supply — in a single transaction:

5fny5ULfLhp4DBd9Sk7Wwkurau5hxqnmi1MQqLL3gFBPkcSJHySnoS3TX9uq6Wqq17FjTE4k66hzDY2udcPfe26Q

Conyr's parser tagged that swap BOT:SNIPER and SNIPER:PUMP:LAUNCH_SLOT. It was not alone — the creation slot held a cohort of wallets buying together, the classic launch-slot bundle that manufactures an instant green candle.

The handoff. Forty seconds later, a different wallet starts selling:

9k7hbwNhmbWF89racE8GtEfeiwBYvjymYgVyH2neimQu

Its first sale lands at slot 428073064, 03:02:39 UTC:

3zEG1prfF6PHscx3CXTZ7UnUWM54JuV9VVkW2dMCooczmTPW6jJWspoR4PzUKukSTVyzTQQCNiexVvrmstzm34KM

Over the next three minutes it sells 99 times for a total of 328.49 SOL — and here is the tell: across the entire token's history this wallet has zero buy transactions on it. It cannot sell what it never bought on a DEX. The tokens arrived by SPL transfer.

The proof. Sum the two sides:

The amounts match to the unit. The sniper bought the bag for 21 SOL, shipped it to the distributor, and the distributor sold it for 328 SOL — a ~15× markup, because the bundle plus the retail it attracted ran the price up before the distributor unloaded. Anyone can confirm every line above on a public explorer.

Why split the operation in two#

A single wallet that buys 44% of supply and dumps it is the oldest red flag on the chain. Every rug checker catches it. So the operator separates the two functions:

• The sniper takes the risk and the visible footprint. It buys in the creation slot, so on-chain it looks like an aggressive bot. Its realized PnL reads near zero, because it ships the tokens out rather than selling them — defeating any tool that ranks wallets by profit.
• The distributor receives a clean bag with no visible cost basis and sells into the pump. Its books show a large profit with no matching purchases, which naive analytics happily render as a 97%-win-rate elite trader.

That asymmetry is the entire disguise. The wallet you would copy (the profitable distributor) has no entry to copy. The wallet with the entry (the sniper) shows no profit. And because the bag moves by SPL transfer, not SOL, there is no funding edge linking them in a SOL-flow graph — we checked: no direct SOL transfer and no shared SOL funder between the two. The only thing that ties them together is behavior.

It is a fleet, not a wallet#

The distributor above does not work alone. Three more wallets show an identical fingerprint — tiny per-token buys, large per-token sells, no launch snipes, ~$200K realized each:

These four trade essentially the same token set. Pairwise, they share 49–53 of their ~50–60 tokens — 91–100% overlap on the smaller wallet in each pair. On most of those tokens, all four sell together. Four wallets with identical behavior dumping the same fifty tokens in concert is not four traders. It is one operator splitting each bag four ways so no single wallet ever looks like it is holding, or dumping, the float.

The snipers feeding this crew are the launch-slot bundle wallets — 8qhHz3D…CETv, 6Qx9iprva…HLDP, 339QJtz…wnoY, A4416euj…1MGX — each of which snipes only ~17–20 launches, tightly scoped to this operation.

A template, not a single crew#

Run the same detection across the chain and the pattern repeats. A second, unrelated group —

EJAs4imiMjqv8bUffgUXBhe4HosSpcnvjAJCjWK8fgsj
FpwgTbw7os7SWPCEticrtDPGmCgTRdjnwvL8mFghra4e
CmZWNXG3Rwq6q9qNAaqM87VWCcQzj2XjZs3LHnhLqT8P
EsN3gDkPhYDcbDLWKKjXG8euB4JauAoZ1qZLmoBK6hs7

— runs the identical playbook at roughly 3× the scale: 154–167 tokens each, 98–100% mutual overlap, a combined +30,288 SOL (~$2.2M) net for the 30-day window. Critically, this second group overlaps the first by only 31–42%. Same machine, different operator.

Servicing both is a layer of sniper-as-a-service bots — wallets like HkhDTEEn…R7Pyz, CyPYsEpW…9PTgt, C9Efxy4p…abS7B, 3NxtfjKw…VDC5L that snipe 87–98 launches each across the ecosystem, not tied to any single crew. (One participating sniper carries an offensive vanity prefix; we have redacted it. It is a general-purpose HFT bot, not a crew member.)

Zoom all the way out and the fingerprint — a launch-slot sniper bag handed to a zero-buy wallet that then ladder-dumps — appears on 4,506 pump.fun launches in 30 days, about 150 per day, roughly 1.6% of all real launches. On the confirmed set, snipers put in ~62,700 SOL and distributors pulled out ~400,412 SOL: a 6.4× aggregate, 4.2× median markup.

Where the retail actually comes from#

The natural question: who is buying enough for this to work? We decomposed every buy on the first crew's tokens into insider versus outside money:

• Total buy volume: 685,721 SOL
• Insider (the crew's own wallets): 10,021 SOL — 1.5%
• External: 675,701 SOL — 98.5%, from 86,655 distinct wallets

Almost none of the external buyers carry bot labels. This is not wash trading; it is real retail. The mechanism is ignition and amplification: ~10K SOL of coordinated bundle buying manufactures a credible green candle and market cap at slot zero, which trips the trending and ranking algorithms (pump.fun, the aggregators, the trending bots), which feed reactive snipers, copy-bots, and Telegram callers, which bring genuine FOMO. Ten thousand SOL of spark, six hundred seventy-five thousand SOL of fire — a ~67× amplification. The off-chain promotion that makes these launches catch while most fizzle is the one layer the chain does not show, but the economics demand it exists.

The selling strategy, second by second#

Distributors do not use fixed price targets. They sell at the rate the market buys. Here is one launch (6CRRDXY27n5xzGNPAZJMgBz1mMhM6VvGsHCfCn6spump, creation slot 427641617, 2026-06-20 03:25:57 UTC) bucketed into 15-second windows from launch — external buy volume, crew sell volume, and a price proxy:

sec    ext_buy(SOL)   crew_sell(SOL)   price
  0       24.7           24.7          0.010   launch bundle
 15-30    11→18          0→9.4         0.044→0.052   retail floods in, +5x
 45-90    64→22          26→23         0.057→0.060   PEAK; pacing begins
 90-375   ~25/bucket     ~21/bucket    ~0.05–0.06    5-MIN PLATEAU
 390       8.5           58.2  ◄ DUMP  0.048   demand wanes → dump the tail
 405+      3.6→0          0            0.016→0.001   collapse ~97%, dead

Read the middle rows: for five straight minutes the crew's sells track the incoming retail buys almost bucket for bucket. They throttle their selling to match demand, holding the price on a flat plateau. A plateau looks healthy, a healthy chart keeps the token trending, and trending keeps the retail coming. They are market-making their own exit, sized to the bid. The instant buy volume falters (~sec 390), they dump the remaining bag in one shot and the token collapses ~97% within two minutes.

This is systematic, not anecdotal. Across all of the crew's tokens, crew sells correlate positively with external buys per bucket (corr 0.314) and run at ~0.6 SOL sold per 1 SOL bought. And the lifespan is brutal: across 203 of their tokens, the median active life is 4 minutes.

The money, on the ground#

Per-wallet realized PnL can be argued with — cost basis, transfers, attribution. Net SOL flow cannot. It is simply every SOL the wallets received minus every SOL they spent, and internal wash trades cancel out. For the first crew's eight core wallets (four distributors + four snipers):

• Spent buying: ~2.0K SOL (snipers) + small distributor buys
• Distributor net: +13,733 SOL; sniper net: −2,040 SOL (they ship tokens out, so their "loss" is the distributors' gain)
• Crew net: ~+11,693 SOL ≈ $853K across ~50 launches in 30 days.

The second crew nets ~+30,288 SOL ≈ $2.2M over the same window. Chain-wide, the full receive-and-dump pattern moved 1.28M SOL out of pools in 30 days. This is real money. "Real," though, is not "skill" — it is roughly $3M transferred from ~86,000 retail wallets to a handful of operators wearing many faces.

Verify it yourself#

Nothing here requires Conyr's data. Everything is on-chain:

1. The handoff. Look up token 5AzEPojQ…VEpump. Confirm 8qhHz3D…CETv bought 437,726,205,809,908 units in the creation slot (tx 5fny5ULf…Pfe26Q). Then look up 9k7hbw…neimQ on the same token: confirm it has no buys and that its sells sum to 437,726,205,809,908 units (first sell 3zEG1prf…34KM).
2. The fleet. Pull the token lists for the four distributors and intersect them. You will see the same ~50 tokens.
3. The lifespan. Chart any of their tokens. You will see a sub-ten-minute spike and collapse.

And here is the detection logic, so anyone with an indexed swap feed can reproduce the population, not just the example:

• Aggregate every swap by (token, wallet) into buy-SOL, sell-SOL, and bought/sold token amounts.
• Distributor instance: on a token, sell-SOL > ~5 and buy-SOL < ~0.5 (sold a bag it did not buy).
• Sniper instance: a buy in the token's creation slot (or first slot), typically a large share of supply.
• Handoff: a sniper's bought token-amount equals a distributor's sold token-amount on the same token.
• Cluster: wallets that recur together as distributors across many tokens. Co-occurrence, not funding, is the link.

Why this is the wrong thing to copy and the right thing to detect#

The instinct on seeing a +$234K, 97%-win wallet is to follow it. This teardown is the counter-argument. The profit lives in a structural position — supply acquired in the creation slot and handed to a clean wallet — that a follower cannot reproduce and would not want to. By the time the snipe is visible on-chain, the price is already up ~288% within two seconds; entering after that makes you the exit liquidity the distributor is paced to sell into. There is no copyable trade here. There is only a thing to recognize before you buy.

That is the entire premise of Conyr. The wallet-cluster behavior, the launch-slot bundle, the zero-buy distributor — these are signals in the live stream, not forensics after the fact. The free bundles summary returns the supply-concentration picture for any mint in one call, and the wallet-labels taxonomy tells you whether the crowd around a token is organic or a fleet. The 86,000 wallets in this report bought first and found out later. The point of building this is so the next 86,000 do not have to.