Bundles (Coordinated Clusters)
A bundle is a group of wallets that act as one — sybil clusters, CEX-coordinated groups, Jito bundles, synthetic swarms — pretending to be independent traders. Conyr detects them in real time, identifies the leader, tracks the whole cluster through its lifecycle, and tells you exactly how much of the token’s supply it controls. This is the manipulation-detection layer no raw-data API offers.
And you don’t stop at “a bundle exists.” Drill into any bundle to see the coordination itself — the exact member wallets, the leader, each member’s chain-truth balance and realized PnL, and the funding or execution family that links them. One call takes you from “this token is bundled” to “here are the wallets and how they’re connected.”
Why it matters
A token can look like it has 200 organic buyers when 8 coordinated wallets are running the float. Bundle detection collapses that illusion: you see the cluster as one actor, its real supply-at-risk, whether it’s accumulating or dumping, and the on-chain evidence behind the call.
Bundle types
The bundle_type Conyr assigns each cluster:
| Type | What it is |
|---|---|
SybilPoisoning | Many wallets funded from a shared source, buying in concert |
CexCoordinated | Wallets funded from known CEX hot wallets linked together |
SyntheticSwarm | Structurally isomorphic wallet clusters (manufactured “crowd”) |
JitoSequential | Same-slot sequential transactions via Jito bundles |
SameSlotBuyCohort | A cohort buying within the same slot |
LaunchSlotBurst | A burst of coordinated buys at the launch slot |
MultiSell | Coordinated multi-wallet selling |
Synthetic | A hybrid that combines multiple detection signals, these are high risk 98% confidence bundles |
Lifecycle
Each bundle is tracked through its life: active · dormant · dumping · derisked · exited · rugged · merged. Transitions are detected automatically — see the marker timeline on Bundle Lifecycle & Markers.
Summary
Free GET /v1/token/{mint}/bundles/summary
The free, one-glance read: how bundled is this token?
| Field | Description |
|---|---|
bundle_count / open_bundle_count | Total and still-open bundles |
bundled_supply_pct | Percent of token supply controlled by bundles |
bundled_value_usd | USD value of bundled holdings |
bundled_realized_pnl_usd | Realized PnL the bundles have already taken |
dominant_bundle_type | The most severe type present |
curl -H "Authorization: Bearer $API_KEY" \
"https://api.conyr.ai/v1/token/EPjFWd.../bundles/summary"Full bundles
L3 GET /v1/token/{mint}/bundles
The full roster. Each bundle reports its type, leader, lifecycle status, member counts, chain-truth balances, realized PnL, invested/returned, how much it’s sold, a calibrated risk_score, and human-readable evidence.
{
"bundles": [
{
"bundle_id": "bndl_abc123",
"token_mint": "EPjFWd...",
"bundle_type": "SybilPoisoning",
"leader_wallet": "4mNqR...",
"status": "active",
"member_count_total": 8,
"member_count_active": 6,
"chain_balance_ui": 1250000.0,
"realized_pnl_usd": 3200.0,
"total_usd_invested": 5400.0,
"total_usd_returned": 8600.0,
"sold_pct": 50.0,
"risk_score": 0.85,
"evidence": [
"8 wallets funded from the same source in a tight window",
"Coordinated buying within a single slot"
],
"created_at": "2026-03-07T10:00:00Z"
}
],
"token_mint": "EPjFWd..."
}Bundle detail
L3 GET /v1/token/{mint}/bundles/{bundle_id}
The coordination drill-down. Returns every member wallet — chain-truth balance, realized PnL, average entry, and leader/active flags — and, when the cluster maps to a known coordination family, a linked_entity block that takes you straight into Follows, Entities & Campaigns.
{
"bundle": {
"bundle_id": "bndl_abc123",
"bundle_type": "SybilPoisoning",
"risk_score": 0.85,
"linked_entity": { "entity_id": "ent_abc123", "entity_kind": "shared_funder", "member_count": 14, "bundle_member_share": 0.75 }
},
"members": [
{
"wallet_address": "4mNqR...",
"is_leader": true,
"is_active": true,
"chain_balance_ui": 500000.0,
"realized_pnl_usd": 1200.0,
"avg_entry_price_usd": 0.00210
}
]
}evidence is the explainable surface — human-readable reasons you can show a user. Treat risk_score as an opaque calibrated number (build product logic on bundle_type, status, sold_pct, and evidence, not the raw score). Balances are chain-truth — read from actual wallet state, not inferred from swaps, so transfers and mints can’t hide inventory. Summary and detail cache 15s; bundle detection itself is live.
Bundle detections also fire on the token security stream as bundle_detected. For per-supply concentration scoring that consumes these bundles, see Token Health Score.