PAID
Created Sep 15, 2026. +296% in the first minute, 503x at the peak.
Every one of them has since sold. None is tied to the dev by funding.
Solana wallet intelligence
See the wallets behind any Solana token.
Sleuth shows who bought a token in its first seconds and who funded them. Paste a mint and read the bundles, snipers and insiders in one report.
Try , or .
Live
Latest findings
Every X-Ray anyone runs lands here. The links open the full report.
X-Rays run
…
Tokens covered
…
Wallets traced
…
Bundled launches found
…
Case files
The first ten seconds of two big runs
PAID ran 503x and SUUB ran 15x. Sleuth shows who bought each one first. Both charts use the same scale, and each bar is the most that group held at once.
SUUB
Created Sep 17, 2026. 15x in 16 minutes.
Dev plus bundle came to three times the 15% cap sniper bots filter on. All of it had sold by minute 21, so a holder check then read clean.
Figures from Sleuth X-Rays run on Sep 29, 2026. Share of supply at launch.
What the bots see
The first second decides who even looks
Sniper terminals read a new token the moment it mints and skip anything that fails their filters. They publish those filters. Sleuth computes every one of them from the chain and shows the pass mark next to it.
Launch
- Dev buy and what the dev holds now
- Bundle: wallets that bought in the creation block
- Snipers: wallets in the first 10 seconds
- Insiders: early buyers tied to the dev by funding
Token
- Mint and freeze authority revoked
- Top 10 holders under 30%
- Dev plus bundle under 15% at launch
- Transfer fees, hooks and permanent delegates
Surface
- X, Telegram and website in the mint metadata
- The deployer's other launches
- Older tokens with the same ticker
- Volume against value, to spot wash trading
Three tools
One address in, one report out
Each report links every number to Solscan, so anyone can check the work.
Token X-Ray
Launch forensics, the bot filter checklist, holder concentration, funding clusters and copycat tickers in one report.
Overlap scan
Paste two or more tokens. Sleuth lists the wallets that hold all of them and ranks each wallet by match count and position size.
Wallet profile
Balances, first activity, recent volume and the wallet that funded it. Follow the trail one hop at a time.
Method
How Sleuth reads a token
Five steps, all from public Solana data. The method page states every rule and every limit.
-
Replay the launch
Sleuth reads the token's first successful transactions and records who bought in the creation block and in the first ten seconds.
-
Snapshot every holder
Sleuth reads every token account for the mint and groups the accounts by owner. Large tokens load in parallel address ranges.
-
Separate people from programs
A wallet address lies on the ed25519 curve. Pools, bonding curves and vaults use program addresses off the curve. Sleuth tests every owner.
-
Trace the first funding
For the dev, the early buyers and the top holders, Sleuth finds the first transaction that sent each wallet SOL. Busy exchange wallets never link a cluster.
-
Check the filters
Sleuth applies the thresholds sniper terminals publish and names the fact behind every flag.
Holder access
Hold the token for deeper scans
Sleuth reads your balance after you sign a plain text message. The signature moves no funds and approves nothing.
Free
Every tool, with lighter limits.
Holder
Wallets that hold the project token.
Project token
Token details appear here at launch.
Everywhere you research
Web, Telegram, API and command line
Telegram bot
Paste an address into the chat and the bot answers with the right report. Commands: /xray, /overlap, /wallet and saved scans.
JSON API
Start a report with one POST request and poll for the result. Every report the site shows is available as JSON.
Command line
Run npm run cli -- xray <mint> for a terminal report, or add --json to feed your own scripts.
Questions
Frequently asked
What are bundles, snipers and insiders?
A bundle is a set of wallets that bought in the same block that created the token. Snipers bought in the first ten seconds. Insiders are early buyers whose first SOL came from the dev, from the dev's own funder, or who funded the dev. The method page gives the exact rules.
How does Sleuth know who the dev is?
The dev is the wallet that paid for the transaction that created the token. On launchpads that relay creation through their own wallet, that wallet appears as the dev instead.
Where does the data come from?
Sleuth reads Solana mainnet through Helius RPC and DAS APIs, market data from DexScreener and token metadata from IPFS. Every address in a report links to Solscan so you can check it.
What is a funding cluster?
A group of top wallets whose first SOL came from the same source wallet. A person who spreads one buy across fresh wallets usually leaves this trail. A shared funder suggests common control and still needs confirmation.
Why are pools and exchanges left out of the top 10?
A liquidity pool or an exchange hot wallet holds tokens for many people. Counting it as one holder would overstate concentration, so Sleuth lists it separately.
Does a clean report mean a token is safe?
No. Sleuth checks token settings and wallet links. It cannot see team intent, off-chain promises or future sells.
Is it safe to connect my wallet?
Sleuth asks your wallet to sign a text message. The message says it sends no transaction and costs nothing. Sleuth never asks you to approve a transaction.