Layer 3 — Security Intelligence

Statistical coordination detection between wallet pairs and squads, bundle/sybil classification, wash trade analysis, entanglement graph clustering, and real-time security event streaming. The only manipulation detection API on Solana.

Includes all Layer 1 + Layer 2 endpoints.

Rate limits: 600 REST req/min, 50 WebSocket connections, unlimited tracked wallets, full bundle history, full coordination firehose, unlimited webhook alerts.

WebSocket Streams

events.token.{mint}.security

Channel: token:{mint}:security

Real-time security events for a token — bundles detected, manipulation flagged, rug indicators triggered.

• Published immediately on detection, no batching
• Event types: bundle_detected, wash_trade_flagged, rug_detected, suspicious_activity, coordination_alert
• Includes severity level, evidence summary, affected wallets

events.wallet.{addr}.security

Channel: wallet:{addr}:security

Real-time security events for a specific wallet.

• Wallet-scoped: only events involving the tracked wallet
• Includes: malicious classification, rug profiteer detection (>$500 profit on rugged tokens)
• Cascading alerts when a wallet’s token is rug-detected

Bundle Detection

GET /v1/token/{mint}/bundles

Full bundle detection results for a token.

Bundle Types

Bundle Lifecycle

Bundles are tracked through their full lifecycle: Active → Dormant / Dumping / Derisked / Exited / Rugged / Merged. Lifecycle transitions are detected automatically using proprietary heuristics.

Parameters

Example

curl -H "Authorization: Bearer $API_KEY" \
  "https://api.conyr.ai/v1/token/EPjFWd.../bundles"

Response

{
  "bundles": [
    {
      "bundle_id": "bndl_abc123",
      "token_mint": "EPjFWd...",
      "bundle_type": "SybilPoisoning",
      "leader_wallet": "4mNqR...",
      "status": "active",
      "member_count_total": 8,
      "member_count_active": 6,
      "chain_balance_ui": 1250000.0,
      "realized_pnl_usd": 3200.0,
      "total_usd_invested": 5400.0,
      "total_usd_returned": 8600.0,
      "total_tokens_bought_ui": 2500000.0,
      "total_tokens_sold_ui": 1250000.0,
      "sold_pct": 50.0,
      "risk_score": 0.85,
      "evidence": ["8 wallets funded from same root within 2 minutes", "Coordinated buying in slot 245678901"],
      "created_at": "2026-03-07T10:00:00Z"
    }
  ],
  "token_mint": "EPjFWd..."
}

Cache TTL: 15 seconds.

GET /v1/token/{mint}/bundles/{bundle_id}

Detailed bundle breakdown — member wallets, inventory, and evidence.

Parameters

Response

{
  "bundle": {
    "bundle_id": "bndl_abc123",
    "token_mint": "EPjFWd...",
    "bundle_type": "SybilPoisoning",
    "leader_wallet": "4mNqR...",
    "status": "active",
    "member_count_total": 8,
    "member_count_active": 6,
    "chain_balance_ui": 1250000.0,
    "realized_pnl_usd": 3200.0,
    "risk_score": 0.85,
    "evidence": ["8 wallets funded from same root within 2 minutes"]
  },
  "members": [
    {
      "wallet_address": "4mNqR...",
      "bundle_id": "bndl_abc123",
      "is_leader": true,
      "is_active": true,
      "chain_balance_ui": 500000.0,
      "realized_pnl_usd": 1200.0,
      "avg_entry_price_usd": 0.00210
    }
  ]
}

Per-wallet: balance, realized PnL, entry/exit timing, buy/sell ratio. Inventory tracking uses chain-truth wallet balances.

Coordination Detection

GET /v1/token/{mint}/coordination

Active coordinated wallet pairs trading this token.

Detection Method

Multi-signal statistical analysis of wallet pair trading behavior. Coordination is scored using multiple features including timing correlation, exit synchronization, and trading overlap. Results are filtered through statistical significance tests to minimize false positives.

Parameters

Example

curl -H "Authorization: Bearer $API_KEY" \
  "https://api.conyr.ai/v1/token/EPjFWd.../coordination?limit=20"

Response

{
  "pairs": [
    {
      "wallet_a": "4mNqR...",
      "wallet_b": "9aBcD...",
      "token": "EPjFWd...",
      "ewma_score": 0.92,
      "coord_score": 0.88,
      "lag_peak": 0.75,
      "lag_asym": 0.12,
      "exit_sync": 4,
      "overlap": 0.85,
      "pair_support": 15,
      "event": "activated",
      "ts_ms": 1709654400000
    }
  ],
  "token_mint": "EPjFWd...",
  "count": 1
}

Cache TTL: 30 seconds.

GET /v1/wallet/{addr}/coordination

All coordination signals involving a specific wallet.

Parameters

Response

{
  "wallet": "7xKXtg...",
  "pairs": [ ... ],
  "squad_memberships": [
    {
      "wallet": "7xKXtg...",
      "family_id": "fam_xyz789",
      "score": 0.88,
      "density": 0.72
    }
  ],
  "pair_count": 3
}

Lists every paired wallet with coordination score and support count. Includes squad membership if the wallet belongs to a coordinated group.

GET /v1/squad/{family_id}

Squad details — membership, density, lifecycle state, and anchor wallets.

Parameters

Response

{
  "squad": {
    "family_id": "fam_xyz789",
    "squad_id": "sqd_abc123",
    "anchors": ["4mNqR...", "9aBcD..."],
    "members": ["4mNqR...", "9aBcD...", "7xKXt...", "2pQrS..."],
    "core_size": 4,
    "density": 0.83,
    "score": 0.88,
    "distinct_tokens": 3,
    "active_edges": 6,
    "max_pair_score": 0.95,
    "event": "active"
  },
  "members": [
    {
      "wallet": "4mNqR...",
      "family_id": "fam_xyz789",
      "score": 0.92,
      "density": 0.85
    }
  ],
  "member_count": 4
}

• Squad detection via graph analysis of coordinated wallet pairs
• Score reflects coordination strength with size-adjusted penalties
• Family ID: stable identifier derived from anchor wallets
• Lifecycle: Formed → Active → Dissolved

Wash Trade Detection

GET /v1/token/{mint}/wash-trades

Active and recent wash trade detection for a token.

Detects both standard wash trading patterns (rapid direction flips with minimal net exposure) and atomic wash trades (within a single transaction). Cooldown-gated to avoid alert flooding.

Parameters

Example

curl -H "Authorization: Bearer $API_KEY" \
  "https://api.conyr.ai/v1/token/EPjFWd.../wash-trades"

Response

{
  "wash_trades": [
    {
      "wallet_address": "4mNqR...",
      "token_mint": "EPjFWd...",
      "trade_count": 14,
      "direction_flips": 12,
      "volume_usd": 2400.0,
      "net_exposure_pct": 3.2,
      "is_atomic": false,
      "detected_at": "2026-03-07 14:30:00"
    }
  ],
  "token_mint": "EPjFWd...",
  "count": 1
}

Cache TTL: 15 seconds.

Entanglement & Graph Analysis

GET /v1/wallet/{addr}/entanglement

Graph-based wallet cluster analysis showing coordinated wallet groups.

Parameters

Response

{
  "wallet": "7xKXtg...",
  "clusters": [
    {
      "wallet_address": "7xKXtg...",
      "cluster_wallets": ["4mNqR...", "9aBcD...", "2pQrS..."],
      "token_mint": "EPjFWd...",
      "edge_count": 5
    }
  ],
  "cluster_count": 1
}

Transaction adjacency analysis. Returns cluster members with edge weights.

GET /v1/token/{mint}/suspicious-activity

Flagged suspicious activity on a token.

Parameters

Response

{
  "token_mint": "EPjFWd...",
  "status": "suspicious",
  "flagged_reasons": ["High wash trade volume", "Bundle dumping detected"],
  "flagged_time": "2026-03-07T12:00:00Z",
  "rugged_time": null
}

Returns "status": "clean" with empty flagged_reasons if no suspicious activity detected.

Webhook Delivery

POST /v1/webhooks

Register webhook endpoints for real-time security event delivery.

Request Body

{
  "url": "https://your-server.com/webhook",
  "events": ["bundle_detected", "coordination_alert", "wash_trade", "rug_detected"],
  "filters": {
    "token_mints": ["EPjFWd..."],
    "severity": "high"
  }
}

Supported Events

Filterable by token, wallet, severity level, and event type. Retry with exponential backoff on delivery failure.