Funding Abuse

Early-buyer cohort funding-pattern analysis. Conyr inspects every wallet that bought a token within its first N minutes of trading and surfaces structural funding patterns — fresh wallets seeded just before the buy, farm-funded wallets, CEX-root convergence, and shared trading-terminal signals.

Layer 3 only — Security Intelligence.

GET /v1/token/{mint}/funding-abuse

Aggregate summary plus a per-wallet breakdown of suspicious early buyers.

Parameters

Parameter	In	Type	Required	Default	Constraints
`mint`	path	string	yes	—	—
`early_window_minutes`	query	integer	no	`60`	10–240
`limit`	query	integer	no	`50`	Max 200 wallets

Example

curl -H "Authorization: Bearer $API_KEY" \
  "https://api.conyr.ai/v1/token/EPjFWd.../funding-abuse?early_window_minutes=60&limit=50"

Response

{
  "token_mint": "EPjFWd...",
  "summary": {
    "token_mint": "EPjFWd...",
    "token_first_buy_ts": "2026-04-25 14:30:00.000",
    "early_window_minutes": 60,
    "early_buyer_count": 42,
    "seeded_wallet_count": 24,
    "seeded_wallet_pct": 0.5714,
    "funded_by_farm_count": 12,
    "funded_by_farm_pct": 0.5,
    "cex_root_count": 15,
    "distinct_cex_root_count": 4,
    "cex_root_pct": 0.625,
    "avg_seed_fund_to_buy_seconds": 18000.0,
    "median_seed_fund_to_buy_seconds": 9000.0,
    "top_seeded_terminal": "PHOTON",
    "top_seeded_terminal_wallets": 10,
    "top_seeded_terminal_share": 0.4167,
    "suspicious": true,
    "score": 81.0,
    "reasons": [
      "SEED_WAVE_HEAVY",
      "FARM_FUNDED_FRESH_WALLETS",
      "CEX_DISPERSED_ROOTS",
      "FAST_FUND_TO_BUY"
    ]
  },
  "wallets": [
    {
      "wallet_address": "7xKXtg...",
      "first_buy_ts": "2026-04-25 14:32:14",
      "first_buy_slot": 245678910,
      "first_buy_usd": 425.30,
      "first_buy_dex": "raydium",
      "last_fresh_fund_ts": "2026-04-25 12:30:00",
      "fresh_fund_to_buy_seconds": 7334,
      "funded_by_farm": 1,
      "root_label": "Binance",
      "root_source": "5tzFkiKscXHK5ZXCGbXZxdw7gTjjD1mBwuoFbhUvuAi9",
      "direct_funder": "9aBcD...",
      "is_root_cex": 1,
      "primary_terminal": "PHOTON",
      "automation_label": "ORGANIC",
      "is_seeded_wallet": 1
    }
  ]
}

Summary fields

Field	Description
`early_buyer_count`	Distinct wallets that bought within `early_window_minutes` of the first observed buy
`seeded_wallet_count`	Subset that were freshly funded shortly before their first buy
`funded_by_farm_count`	Subset whose funder matches farm-distributor patterns
`cex_root_count` / `distinct_cex_root_count`	Seeded wallets traceable to a CEX hot wallet, and how many distinct CEX roots they span
`avg_seed_fund_to_buy_seconds` / `median_seed_fund_to_buy_seconds`	How quickly funded wallets entered after receiving SOL
`top_seeded_terminal`	The trading terminal most concentrated among seeded wallets
`top_seeded_terminal_share`	Fraction of seeded wallets concentrated on `top_seeded_terminal`
`score`	Composite suspiciousness score, 0–100
`suspicious`	`true` once `score` crosses Conyr’s calibrated threshold
`reasons`	Reason codes that contributed to the score

⚠️

Conyr’s score weights and the suspicious cutoff are calibrated proprietarily and not part of the public contract. Treat suspicious and reasons as the stable surface; build product UI off those, not off score alone.

Reason codes

Code	Meaning
`SEED_WAVE_HEAVY`	A large share of the early-buyer cohort is freshly funded
`SEED_WAVE_MODERATE`	A meaningful share of the cohort is freshly funded
`SEED_WAVE_LIGHT`	A small but elevated share is freshly funded
`FARM_FUNDED_FRESH_WALLETS`	A material slice of seeded wallets was funded by known farm distributors
`CEX_DISPERSED_ROOTS`	Many seeded wallets trace to several distinct CEX hot wallets — coordinated dispersal
`CEX_ROOT_CONVERGENCE`	Several seeded wallets trace to a small number of CEX hot wallets — coordinated convergence
`FAST_FUND_TO_BUY`	The cohort’s median funding-to-buy gap is short
`SAME_DAY_FUND_TO_BUY`	The cohort’s average funding-to-buy gap is within a single day
`SHARED_TERMINAL_<terminal>`	A dominant share of seeded wallets used the same trading terminal

Per-wallet fields

Field	Description
`is_seeded_wallet`	`1` if the wallet was fresh-funded shortly before its first buy on this token
`fresh_fund_to_buy_seconds`	Seconds between the most recent fresh-funding event and first buy
`funded_by_farm`	`1` if the funder matches farm-distributor patterns
`root_label` / `root_source`	Resolved provenance root (e.g. `"Binance"`) and the on-chain hot-wallet address
`is_root_cex`	`1` if `root_label` resolves to a known CEX
`direct_funder`	The wallet that directly funded this address
`primary_terminal`	Dominant trading terminal for this wallet’s swaps

Embedded in `suspicious-activity`

GET /v1/token/{mint}/suspicious-activity now embeds the funding-abuse summary on every response:

{
  "token_mint": "EPjFWd...",
  "status": "suspicious",
  "flagged_reasons": ["High wash trade volume"],
  "flagged_time": "2026-04-25T12:00:00Z",
  "rugged_time": null,
  "live_activity_flags": ["SEED_WAVE_HEAVY", "FARM_FUNDED_FRESH_WALLETS"],
  "funding_abuse": { /* same shape as `summary` above */ }
}

live_activity_flags mirrors funding_abuse.reasons whenever funding_abuse.suspicious is true, and is empty otherwise. Use it as the single source for “what’s actively suspicious right now.”

Cache TTL: roughly 30 seconds for the funding-abuse summary; suspicious-activity itself is not separately cached.

Coordination WebSockets