Layer 3 — Security Intelligence

Statistical coordination detection between wallet pairs and squads, bundle/sybil classification, wash trade analysis, entanglement graph clustering, and real-time security event streaming. The only manipulation detection API on Solana.

Includes all Layer 1 + Layer 2 endpoints.

Rate limits: 600 REST req/min, 50 WebSocket connections, unlimited tracked wallets, full bundle history, full coordination firehose, unlimited webhook alerts.

WebSocket Streams

events.token.{mint}.security

Channel: token:{mint}:security

Real-time security events for a token — bundles detected, manipulation flagged, rug indicators triggered.

• Published immediately on detection, no batching
• Event types: bundle_detected, wash_trade_flagged, rug_detected, suspicious_activity, coordination_alert
• Includes severity level, evidence summary, affected wallets

events.wallet.{addr}.security

Channel: wallet:{addr}:security

Real-time security events for a specific wallet.

• Wallet-scoped: only events involving the tracked wallet
• Includes: malicious classification, rug profiteer detection (>$500 profit on rugged tokens)
• Cascading alerts when a wallet’s token is rug-detected

Bundle Detection

GET /v1/token/{mint}/bundles

Full bundle detection results for a token.

Bundle Types

Bundle Lifecycle

Bundles are tracked through their full lifecycle: Active → Dormant / Dumping / Derisked / Exited / Rugged / Merged. Lifecycle transitions are detected automatically using proprietary heuristics.

Parameters

Example

curl -H "Authorization: Bearer $API_KEY" \
  "https://api.conyr.ai/v1/token/EPjFWd.../bundles"

Response

{
  "bundles": [
    {
      "bundle_id": "bndl_abc123",
      "token_mint": "EPjFWd...",
      "bundle_type": "SybilPoisoning",
      "leader_wallet": "4mNqR...",
      "status": "active",
      "member_count_total": 8,
      "member_count_active": 6,
      "chain_balance_ui": 1250000.0,
      "realized_pnl_usd": 3200.0,
      "total_usd_invested": 5400.0,
      "total_usd_returned": 8600.0,
      "total_tokens_bought_ui": 2500000.0,
      "total_tokens_sold_ui": 1250000.0,
      "sold_pct": 50.0,
      "risk_score": 0.85,
      "evidence": ["8 wallets funded from same root within 2 minutes", "Coordinated buying in slot 245678901"],
      "created_at": "2026-03-07T10:00:00Z"
    }
  ],
  "token_mint": "EPjFWd..."
}

Cache TTL: 15 seconds.

GET /v1/token/{mint}/bundles/{bundle_id}

Detailed bundle breakdown — member wallets, inventory, and evidence.

Parameters

Response

{
  "bundle": {
    "bundle_id": "bndl_abc123",
    "token_mint": "EPjFWd...",
    "bundle_type": "SybilPoisoning",
    "leader_wallet": "4mNqR...",
    "status": "active",
    "member_count_total": 8,
    "member_count_active": 6,
    "chain_balance_ui": 1250000.0,
    "realized_pnl_usd": 3200.0,
    "risk_score": 0.85,
    "evidence": ["8 wallets funded from same root within 2 minutes"]
  },
  "members": [
    {
      "wallet_address": "4mNqR...",
      "bundle_id": "bndl_abc123",
      "is_leader": true,
      "is_active": true,
      "chain_balance_ui": 500000.0,
      "realized_pnl_usd": 1200.0,
      "avg_entry_price_usd": 0.00210
    }
  ]
}

Per-wallet: balance, realized PnL, entry/exit timing, buy/sell ratio. Inventory tracking uses chain-truth wallet balances.

Coordination Detection

Coordination is now exposed as five primitives — follows, entities, campaigns, crowd, and health — covering the full surface previously served by pair-level coordination, squad detection, and family-graph endpoints.

See the dedicated Coordination page for full schemas and examples. The endpoints documented there:

Wash Trade Detection

GET /v1/token/{mint}/wash-trades

Active and recent wash trade detection for a token.

Detects wash trading qualitatively over a rolling ~1-hour window per (wallet, token): repeated rapid direction-flipping that nets out to near-zero exposure is flagged. The detector requires a minimum trade count, a minimum traded volume, and a small absolute net direction relative to the trade count — these thresholds are illustrative and operator-tuned, not a fixed published contract. Atomic same-signature wash detection (is_atomic) is modeled but is not currently surfaced, so is_atomic is always false on the public response. Results are computed fresh per request over a rolling ~1-hour window and cache-fronted for 15 seconds.

Parameters

Example

curl -H "Authorization: Bearer $API_KEY" \
  "https://api.conyr.ai/v1/token/EPjFWd.../wash-trades"

Response

{
  "wash_trades": [
    {
      "wallet_address": "4mNqR...",
      "token_mint": "EPjFWd...",
      "trade_count": 14,
      "direction_flips": 12,
      "volume_usd": 2400.0,
      "net_exposure_pct": 3.2,
      "is_atomic": false,
      "detected_at": "2026-03-07 14:30:00"
    }
  ],
  "token_mint": "EPjFWd...",
  "count": 1
}

Cache TTL: 15 seconds.

Entanglement & Graph Analysis

GET /v1/wallet/{addr}/entanglement

Graph-based wallet cluster analysis showing coordinated wallet groups.

Parameters

Response

{
  "wallet": "7xKXtg...",
  "clusters": [
    {
      "wallet_address": "7xKXtg...",
      "cluster_wallets": ["4mNqR...", "9aBcD...", "2pQrS..."],
      "token_mint": "EPjFWd...",
      "edge_count": 5
    }
  ],
  "cluster_count": 1
}

Transaction adjacency analysis. Returns cluster members with edge weights.

GET /v1/token/{mint}/suspicious-activity

Flagged suspicious activity on a token, with embedded live funding-abuse signals.

Parameters

Response

{
  "token_mint": "EPjFWd...",
  "status": "suspicious",
  "flagged_reasons": ["High wash trade volume", "Bundle dumping detected"],
  "flagged_time": "2026-03-07T12:00:00Z",
  "rugged_time": null,
  "live_activity_flags": ["SEED_WAVE_HEAVY", "FARM_FUNDED_FRESH_WALLETS"],
  "funding_abuse": { /* see Funding Abuse for the full schema */ }
}

Returns "status": "clean" with empty flagged_reasons if no suspicious activity is recorded. live_activity_flags and funding_abuse are populated independently and may surface live signals even on otherwise clean tokens.

Intel Composites

Cross-cutting intelligence joins that combine CONYR-proprietary coordination primitives (follow edges, entities, entity memberships, token campaigns, crowd state) with swaps and wallet labels to answer questions no single raw endpoint covers. All seven endpoints are Layer 3 and return the uniform { "error": ..., "code": ... } envelope, mapping any upstream error to 500.

GET /v1/intel/coordinated-pushes/forming

Tokens with a coordinated push forming right now (live campaign carrying real coordination evidence and breadth). This is a detection primitive, not a trading signal.

Parameters

None.

Response

Array of objects:

[
  {
    "tokenMint": "EPjFWd...",
    "latestRegime": "structured",
    "priorRegime": "quiet",
    "campaignId": "camp_abc123",
    "campaignStatus": "active",
    "participantWallets": 12,
    "participantEntities": 2,
    "confidence": 0.71,
    "tokenAgeMinutes": 34
  }
]

GET /v1/intel/wallet/{leader}/cascade

Follower cascade behind a leader’s entry into a mint — which of the leader’s registered followers bought the same token, and how fast.

Parameters

Errors

• 400 Invalid leader wallet — leader is not a valid pubkey.
• 400 Invalid token mint — mint is not a valid pubkey.
• 400 — mint query parameter is missing (required by the query extractor).

Response

Array of objects:

[
  { "follower": "4mNqR...", "confidence": 0.88, "lagSeconds": 7 }
]

GET /v1/intel/entities/emerging

Recently-emerging entities (wallet farms and bundle groups first seen within the window).

Parameters

Response

Array of objects:

[
  {
    "entityId": "ent_abc123",
    "entityKind": "shared_funder",
    "rootWallet": "7xKXtg...",
    "memberCount": 6,
    "confidence": 0.74,
    "firstSeenTsMs": 1709812800000,
    "lastSeenTsMs": 1709816400000
  }
]

GET /v1/intel/token/{mint}/early-buyers

Early/minority buy clusters — entities that coordinated among the wallets buying in the token’s first window_s seconds.

Parameters

Errors

• 400 Invalid token mint — mint is not a valid pubkey.

Response

Array of objects:

[
  {
    "entityId": "ent_abc123",
    "entityKind": "shared_funder",
    "rootWallet": "7xKXtg...",
    "confidence": 0.74,
    "membersInEarlyBuy": 4,
    "memberWallets": ["4mNqR...", "9aBcD...", "2pQrS...", "5tUvW..."]
  }
]

GET /v1/intel/token/{mint}/copy-originator

Likely copy originator in a time window — which candidate has the most other buyers in the window as their registered followers.

Parameters

Errors

• 400 Invalid token mint — mint is not a valid pubkey.
• 400 end_ts_ms must be > start_ts_ms — window end not after start.
• 400 window too wide (max 60 minutes) — window span exceeds 60 minutes.

Response

Array of objects:

[
  {
    "candidateLeader": "4mNqR...",
    "followerBuysInCluster": 5,
    "meanConfidence": 0.86
  }
]

GET /v1/intel/token/{mint}/entity-concentration

Entity-weighted demand concentration — how many distinct entities sit behind the token’s buyers, and what share of volume they control.

Parameters

Errors

• 400 Invalid token mint — mint is not a valid pubkey.

Response

{
  "totalWallets": 240,
  "distinctActors": 180,
  "totalVolumeUsd": 124000.0,
  "entityVolumeUsd": 41000.0,
  "entityVolumeShare": 0.33,
  "topActors": ["ent_abc123", "7xKXtg...", "9aBcD...", "ent_def456", "2pQrS..."]
}

GET /v1/intel/token/{mint}/late-retail

Late-retail entrants — unprofitable or unlabeled wallets that bought in the 10 minutes after elite/profitable wallets sold (“exit liquidity” tier).

Parameters

Errors

• 400 Invalid token mint — mint is not a valid pubkey.

Response

{
  "eliteSells": 8,
  "lateBuyers": 32,
  "lateBuyerVolumeUsd": 9400.0,
  "avgLagSeconds": 142.5,
  "shareUnprofitable": 0.81
}

Webhook Delivery

POST /v1/webhooks

Register webhook endpoints for real-time security event delivery.

Request Body

{
  "url": "https://your-server.com/webhook",
  "events": ["bundle_detected", "coordination_alert", "wash_trade", "rug_detected"],
  "filters": {
    "token_mints": ["EPjFWd..."],
    "severity": "high"
  }
}

Supported Events

Filterable by token, wallet, severity level, and event type. Retry with exponential backoff on delivery failure.