When you check a token's holder distribution, you want to see spread — no single wallet holding too much. Scammers know this, which is why they split their holdings across dozens or hundreds of wallets. On the surface, the distribution looks healthy: no wallet above 2%. In reality, one person controls 60% of the supply through 30 wallets. This is a sybil attack.

How Supply Splitting Works

Before or immediately after launching a token, the creator distributes tokens to a network of wallets they control. Each wallet receives a carefully calculated amount — typically between 0.5% and 2% of total supply. The amounts are slightly varied to avoid obvious patterns.

These wallets serve multiple purposes:

  • False distribution — holder analysis shows "500 unique holders" when in reality 450 of them are the creator
  • Bot trading — the wallets trade with each other to generate artificial volume
  • Coordinated dumping — when the time comes, all wallets sell simultaneously, creating overwhelming sell pressure
  • Influencer allocations — some wallets are given to promoters who will sell after promoting

The "Unknown Balance" Signal

The most reliable way to identify insider wallets is the unknown balance pattern. If a wallet holds tokens but has no corresponding buy transaction on any DEX, it received tokens through a direct transfer — not through market activity.

On every scam token, the top traders list always includes wallets with unknown balances. These wallets received tokens before public trading began. They did not buy at market price; they received allocation from the creator. Every token they sell extracts money from real buyers who paid full price.

Same-Size Wallet Clusters

Even when scammers vary their allocations slightly, patterns emerge. If you see 8 wallets each holding exactly 1.3% of supply, that is not coincidence — it is coordination. Human buyers purchase random amounts at random times, resulting in random percentages. Identical or near-identical holdings across multiple wallets are a statistical improbability in organic markets.

ChainLens runs a same-size cluster detection algorithm that groups wallets with suspiciously similar holdings and flags them when 3 or more wallets match. This alone does not confirm a scam, but combined with other signals (new token, no identity, bot volume), it paints a clear picture.

The burn concentration trick revisited A particularly deceptive combination: the creator burns 99% of supply (looks great!), keeps 0.5% in their wallet (looks small!), but that 0.5% is actually 50% of the remaining 1% circulating supply. ChainLens calculates holder percentages relative to post-burn circulating supply, not total supply, to catch this trick.

How to Avoid Insider Wallet Scams

  1. Look beyond top holder percentage. A "healthy" top holder at 2% means nothing if 30 wallets each hold 2%. Check total concentration of the top 10, top 20, and top 50 holders collectively.
  2. Check for unknown balance wallets. Use RugCheck or block explorers to see which wallets received tokens without buying. Multiple insider wallets are a red flag.
  3. Scan for wallet clusters. Use bubblemaps for cluster analysis and Honeypot.is for overall contract safety.
  4. Calculate post-burn concentration. If supply is burned, recalculate holder percentages based on circulating supply, not total.
Detect Insider Wallets with ChainLens Same-size cluster detection, insider flagging, exchange filtering, burn concentration analysis. All automated. Free.

Frequently Asked Questions

What is a sybil attack in crypto?

One person creates many wallets to fake broad distribution. Instead of one wallet holding 50%, they split across 50 wallets holding 1% each. Detectable through cluster analysis and transfer patterns.

What are unknown balance wallets?

Addresses that hold tokens but never bought them from any DEX. They received tokens through direct transfer before public trading — insider wallets controlled by the creator, bots, or influencers.