Layer 3 — Security Intelligence

Statistical coordination detection between wallets and entities, bundle/sybil classification, wash-pattern analysis, LP event attribution, entanglement clustering, and real-time security streams.

Includes all Layer 1 + Layer 2 endpoints.

Rate limits: 600 REST req/min and 50 WebSocket connections per key.

WebSocket Streams

events.token.{mint}.security

Channel: token:{mint}:security

Real-time security events for a token — bundles detected, manipulation flagged, rug indicators triggered.

• Published immediately on detection, no batching
• Event types: bundle_detected, wash_trade_flagged, rug_detected, suspicious_activity, coordination_alert
• Includes severity level, evidence summary, affected wallets

events.wallet.{addr}.security

Channel: wallet:{addr}:security

Real-time security events for a specific wallet.

• Wallet-scoped: only events involving the tracked wallet
• Includes: malicious classification, rug profiteer detection (>$500 profit on rugged tokens)
• Cascading alerts when a wallet’s token is rug-detected

BUNDLE_V2.token.{mint}

Channel: token:{mint}:bundles

Raw per-token BundleV2 updates for agents that need the complete bundle state transition payload.

events.token.{mint}.dump_alert

Channel: token:{mint}:dump_alert

Compact coordinated-dump alerts with bundle ID/type, fractional sold_pct, member count, remaining chain inventory, risk score, slot, and timestamp. The alert is emitted only for qualifying dump-start markers; it is not a generic sell notification.

Bundle Detection

GET /v1/token/{mint}/bundles

Full bundle detection results for a token.

Bundle Types

Bundle Lifecycle

Bundles are tracked through their full lifecycle: Active → Dormant / Dumping / Derisked / Exited / Rugged / Merged. Lifecycle transitions are detected automatically using proprietary heuristics.

Parameters

Example

curl -H "Authorization: Bearer $API_KEY" \
  "https://api.conyr.ai/v1/token/EPjFWd.../bundles"

Response

{
  "bundles": [
    {
      "bundle_id": "bndl_abc123",
      "token_mint": "EPjFWd...",
      "bundle_type": "SybilPoisoning",
      "leader_wallet": "4mNqR...",
      "status": "active",
      "member_count_total": 8,
      "member_count_active": 6,
      "chain_balance_ui": 1250000.0,
      "realized_pnl_usd": 3200.0,
      "total_usd_invested": 5400.0,
      "total_usd_returned": 8600.0,
      "total_tokens_bought_ui": 2500000.0,
      "total_tokens_sold_ui": 1250000.0,
      "sold_pct": 50.0,
      "risk_score": 0.85,
      "evidence": ["8 wallets funded from same root within 2 minutes", "Coordinated buying in slot 245678901"],
      "created_at": "2026-03-07T10:00:00Z"
    }
  ],
  "token_mint": "EPjFWd..."
}

Cache TTL: 15 seconds.

GET /v1/token/{mint}/bundles/{bundle_id}

Detailed bundle breakdown — member wallets, inventory, and evidence.

Parameters

Response

{
  "bundle": {
    "bundle_id": "bndl_abc123",
    "token_mint": "EPjFWd...",
    "bundle_type": "SybilPoisoning",
    "leader_wallet": "4mNqR...",
    "status": "active",
    "member_count_total": 8,
    "member_count_active": 6,
    "chain_balance_ui": 1250000.0,
    "realized_pnl_usd": 3200.0,
    "risk_score": 0.85,
    "evidence": ["8 wallets funded from same root within 2 minutes"]
  },
  "members": [
    {
      "wallet_address": "4mNqR...",
      "bundle_id": "bndl_abc123",
      "is_leader": true,
      "is_active": true,
      "chain_balance_ui": 500000.0,
      "realized_pnl_usd": 1200.0,
      "avg_entry_price_usd": 0.00210
    }
  ]
}

Per-wallet: chain-truth balance, realized PnL, average entry price, leader status, and active status.

Coordination Detection

Coordination is exposed as follows, entities, campaigns, crowd state, and pipeline health.

See the dedicated Coordination page for full schemas and examples. The endpoints documented there:

Wash Trade Detection

GET /v1/token/{mint}/wash-trades

Active and recent wash trade detection for a token.

Detects wash trading qualitatively over a rolling ~1-hour window per (wallet, token): repeated rapid direction-flipping that nets out to near-zero exposure is flagged. The detector requires a minimum trade count, a minimum traded volume, and a small absolute net direction relative to the trade count — these thresholds are illustrative and operator-tuned, not a fixed published contract. Atomic same-signature wash detection (is_atomic) is modeled but is not currently surfaced, so is_atomic is always false on the public response. Results are computed fresh per request over a rolling ~1-hour window and cache-fronted for 15 seconds.

Parameters

Example

curl -H "Authorization: Bearer $API_KEY" \
  "https://api.conyr.ai/v1/token/EPjFWd.../wash-trades"

Response

{
  "wash_trades": [
    {
      "wallet_address": "4mNqR...",
      "token_mint": "EPjFWd...",
      "trade_count": 14,
      "direction_flips": 12,
      "volume_usd": 2400.0,
      "net_exposure_pct": 3.2,
      "is_atomic": false,
      "detected_at": "2026-03-07 14:30:00"
    }
  ],
  "token_mint": "EPjFWd...",
  "count": 1
}

Cache TTL: 15 seconds.

Entanglement & Graph Analysis

GET /v1/wallet/{addr}/entanglement

Graph-based wallet cluster analysis showing coordinated wallet groups.

Parameters

Response

{
  "wallet": "7xKXtg...",
  "clusters": [
    {
      "wallet_address": "7xKXtg...",
      "cluster_wallets": ["4mNqR...", "9aBcD...", "2pQrS..."],
      "token_mint": "EPjFWd...",
      "edge_count": 5
    }
  ],
  "cluster_count": 1
}

Transaction adjacency analysis. Returns cluster members with edge weights.

Liquidity Event Attribution

GET /v1/token/{mint}/liquidity/events

The newest 100 LP add/remove events for a token, newest first. Bundle membership and malicious-wallet flags are joined at read time so an agent can distinguish ordinary LP management from a coordinated or flagged actor removing depth.

{
  "token_mint": "EPjFWd...",
  "events": [
    {
      "signature": "5vGk...",
      "ts_ms": 1775574600000,
      "slot": 245678901,
      "pool": "9aBcD...",
      "dex": "pumpswap",
      "wallet": "4mNqR...",
      "side": "remove",
      "token_ui": 1200000.0,
      "quote_ui": 84.2,
      "pct_of_pool": 0.37,
      "is_full_close": true,
      "is_bundle_member": true,
      "is_flagged": false
    }
  ]
}

• pct_of_pool is a fraction and can be null.
• token_ui: 0 or quote_ui: 0 can mean the parser could not resolve the vault delta; it does not prove that side of the event moved nothing.
• The page size is fixed at 100; there are no query parameters.
• Cache TTL: 5 seconds.

GET /v1/token/{mint}/suspicious-activity

Flagged suspicious activity on a token, with embedded live funding-abuse signals.

Parameters

Response

{
  "token_mint": "EPjFWd...",
  "status": "suspicious",
  "flagged_reasons": ["High wash trade volume", "Bundle dumping detected"],
  "flagged_time": "2026-03-07T12:00:00Z",
  "rugged_time": null,
  "live_activity_flags": ["SEED_WAVE_HEAVY", "FARM_FUNDED_FRESH_WALLETS"],
  "funding_abuse": { /* see Funding Abuse for the full schema */ }
}

Returns "status": "clean" with empty flagged_reasons if no suspicious activity is recorded. live_activity_flags and funding_abuse are populated independently and may surface live signals even on otherwise clean tokens.

Intel Composites

Cross-cutting intelligence joins that combine CONYR-proprietary coordination primitives (follow edges, entities, entity memberships, token campaigns, crowd state) with swaps and wallet labels to answer questions no single raw endpoint covers. All seven endpoints are Layer 3 and return the uniform { "error": ..., "code": ... } envelope, mapping any upstream error to 500.

GET /v1/intel/coordinated-pushes/forming

Tokens with a coordinated push forming right now (live campaign carrying real coordination evidence and breadth). This is a detection primitive, not a trading signal.

Parameters

None.

Response

Array of objects:

[
  {
    "tokenMint": "EPjFWd...",
    "latestRegime": "structured",
    "priorRegime": "quiet",
    "campaignId": "camp_abc123",
    "campaignStatus": "active",
    "participantWallets": 12,
    "participantEntities": 2,
    "confidence": 0.71,
    "tokenAgeMinutes": 34
  }
]

GET /v1/intel/wallet/{leader}/cascade

Follower cascade behind a leader’s entry into a mint — which of the leader’s registered followers bought the same token, and how fast.

Parameters

Errors

• 400 Invalid leader wallet — leader is not a valid pubkey.
• 400 Invalid token mint — mint is not a valid pubkey.
• 400 — mint query parameter is missing (required by the query extractor).

Response

Array of objects:

[
  { "follower": "4mNqR...", "confidence": 0.88, "lagSeconds": 7 }
]

GET /v1/intel/entities/emerging

Recently-emerging entities (wallet farms and bundle groups first seen within the window).

Parameters

Response

Array of objects:

[
  {
    "entityId": "ent_abc123",
    "entityKind": "shared_funder",
    "rootWallet": "7xKXtg...",
    "memberCount": 6,
    "confidence": 0.74,
    "firstSeenTsMs": 1709812800000,
    "lastSeenTsMs": 1709816400000
  }
]

GET /v1/intel/token/{mint}/early-buyers

Early/minority buy clusters — entities that coordinated among the wallets buying in the token’s first window_s seconds.

Parameters

Errors

• 400 Invalid token mint — mint is not a valid pubkey.

Response

Array of objects:

[
  {
    "entityId": "ent_abc123",
    "entityKind": "shared_funder",
    "rootWallet": "7xKXtg...",
    "confidence": 0.74,
    "membersInEarlyBuy": 4,
    "memberWallets": ["4mNqR...", "9aBcD...", "2pQrS...", "5tUvW..."]
  }
]

GET /v1/intel/token/{mint}/copy-originator

Likely copy originator in a time window — which candidate has the most other buyers in the window as their registered followers.

Parameters

Errors

• 400 Invalid token mint — mint is not a valid pubkey.
• 400 end_ts_ms must be > start_ts_ms — window end not after start.
• 400 window too wide (max 60 minutes) — window span exceeds 60 minutes.

Response

Array of objects:

[
  {
    "candidateLeader": "4mNqR...",
    "followerBuysInCluster": 5,
    "meanConfidence": 0.86
  }
]

GET /v1/intel/token/{mint}/entity-concentration

Entity-weighted demand concentration — how many distinct entities sit behind the token’s buyers, and what share of volume they control.

Parameters

Errors

• 400 Invalid token mint — mint is not a valid pubkey.

Response

{
  "totalWallets": 240,
  "distinctActors": 180,
  "totalVolumeUsd": 124000.0,
  "entityVolumeUsd": 41000.0,
  "entityVolumeShare": 0.33,
  "topActors": ["ent_abc123", "7xKXtg...", "9aBcD...", "ent_def456", "2pQrS..."]
}

GET /v1/intel/token/{mint}/late-retail

Late-retail entrants — unprofitable or unlabeled wallets that bought in the 10 minutes after elite/profitable wallets sold (“exit liquidity” tier).

Parameters

Errors

• 400 Invalid token mint — mint is not a valid pubkey.

Response

{
  "eliteSells": 8,
  "lateBuyers": 32,
  "lateBuyerVolumeUsd": 9400.0,
  "avgLagSeconds": 142.5,
  "shareUnprofitable": 0.81
}