Token Bundling Scam: How Pump-and-Dump Operators Pre-Capture the Supply

Token bundling is the dominant pump-and-dump pattern on Solana memecoin launches in 2026, and it has spread to Ethereum and Base launches via Flashbots. The mechanism is brutally simple: the operator uses a transaction-bundling service to combine the token launch and a series of buy transactions into a single atomic block, capturing the majority of supply across dozens of wallets they control before any human-on-the-internet can possibly buy. By the time a Telegram pump or a Pump.fun trending list surfaces the token to retail, the operator already holds 60-95% of total supply, distributed across what looks (to a casual viewer) like a normal early-buyer cohort.

The scam works because retail buyers cannot tell the difference between forty independent early adopters and forty wallets controlled by one operator. The wallets all show up as "early holders" on the chart. The buy concentration looks intense but plausible. By the time you have done five seconds of research, you have already convinced yourself this is a hot launch with strong early demand. What you are actually looking at is the operator's pre-loaded exit position.

This article breaks down how bundling works at the protocol level, what the buyer's experience looks like step by step, how to detect a bundled launch in the time you have before the next candle prints, and what a forensic investigator can do after the fact. Funds direct from the contract are rarely recoverable — the operator did not break any code, they just out-positioned you. But the operator is traceable, and that is the thread that leads to attribution.

What Token Bundling Actually Is

A "bundle" in this context is a sequence of transactions that get executed atomically — meaning either all of them succeed or none of them do, and they all land in the same block. Bundling is a legitimate primitive in modern crypto infrastructure: it is used for MEV protection, arbitrage execution, and complex DeFi positions where partial execution would be dangerous. The scam version uses the same primitive for a different purpose.

In a bundle scam, the operator constructs a bundle that contains:

1. The transaction that creates and lists the token (deploys the contract or initializes the Pump.fun bonding curve).
2. Twenty to fifty buy transactions, each from a different wallet that the operator controls.

All of those transactions execute in the same block. From the perspective of any other participant on the network, the very first block that contains the token contains both the token's existence and the operator's pre-positioned 60-95% supply concentration. There is no window in which a normal buyer could have competed for that supply. The launch was, by construction, the operator's snipe of their own token.

Why It Works at the Protocol Level

Two pieces of infrastructure made bundle scams accessible to operators with minimal technical sophistication: Jito on Solana and Flashbots on Ethereum.

Jito on Solana

Jito Labs runs the dominant transaction-bundling and MEV infrastructure on Solana. Jito's bundle service lets a transaction submitter pay a tip to a Jito-connected validator in exchange for atomic inclusion of a sequence of transactions in the next block. Operators construct a bundle containing one token-creation transaction and many buy transactions, submit it to Jito, pay a tip in SOL, and the validator includes the entire bundle. The token is created and the operator owns the majority of supply in the same slot — about 400 milliseconds end to end.

Solana's high throughput and Jito's bundle market made this so cheap and so accessible that a meaningful share — often cited at 30-60% — of Pump.fun launches in 2024-2025 were bundled. Pump.fun eventually added a built-in bundle indicator on token pages because the problem was so visible.

Flashbots on Ethereum

Flashbots provides similar functionality on Ethereum and Ethereum-compatible chains (Base, Arbitrum, Optimism, BSC via private equivalents). An operator submits a Flashbots bundle to a builder, pays a priority tip, and the bundle gets included atomically in the next block by a participating validator. The mechanics are identical to Solana — deploy the token, bundle in dozens of buys, capture supply before the public mempool can react.

On Ethereum, the higher gas costs make small bundle scams less profitable, so the pattern there is concentrated on tokens with more elaborate marketing schemes (because the operator needs a bigger payout to justify the gas). On Solana, the negligible cost per transaction means any operator with a few hundred dollars of capital can run a full bundle scam.

The Buyer's Experience: A Walkthrough

Step 1: Discovery

You see a new token on Pump.fun, in a Telegram alpha group, on a Solana trending list, or via a paid X promotion. The pitch is the usual — "fair launch," "no team allocation," "doxxed dev," "100x potential." The price chart shows a steep early candle. The market cap is small but climbing. Someone in the chat says "we're early."

Step 2: Buy

You connect your Phantom wallet (or MetaMask, on the EVM equivalent) to Pump.fun, Raydium, Jupiter, or whichever DEX hosts the token. You buy in. The transaction confirms. The token shows up in your wallet. Your buy contributed to the green candles you saw.

Step 3: The Pump

For the next minutes to hours, the chart continues to pump. More retail buyers see the trending token and pile in. Your position appreciates. You feel good. You may even buy more, or post about the trade in a Telegram channel ("up 4x already, NFA"). Trending lists pick up the token, which brings more buyers, which pushes the price higher.

Step 4: The Distribution

Behind the scenes, the operator's many bundle wallets are selling. They sell in coordinated waves — small enough not to crash the price too obviously, sustained enough to dump their entire pre-captured position over the course of the pump. Each wallet sells 2-5% at a time. The chart still looks bullish to you because more retail is buying than the operator is selling on any given block.

Step 5: The Final Dump

Once the operator's position is mostly out, or once retail demand starts to slow, the operator sells the remainder in one or two large transactions. The chart drops 70-95% in minutes. The Telegram chat fills with "what just happened?" The token's market cap collapses. The operator's wallet (or the consolidator wallet they swept into) holds the SOL or ETH that the buyers contributed.

Step 6: The Realization

You look at the holder list on Solscan or the deployer transaction on Etherscan. You see that the wallets that sold most aggressively were among the wallets that bought in the launch block. You see those same wallets were funded from the same source minutes before the launch. You realize the whole thing was a bundle, and that you were the exit liquidity from the moment you bought.

Bundle Mechanics: Jito, Flashbots, and the Launch Block

To make the operator's job concrete, here is the actual sequence of operator-side actions for a typical Solana bundle scam:

1. Generate fresh wallets. The operator scripts the creation of 20-50 fresh Solana wallets. Each one starts with zero balance.
2. Fund them from a single source. The operator sends a small amount of SOL to each wallet from one funding wallet, which itself was funded from a centralized exchange withdrawal. The funding pattern is the operator's first KYC-linked footprint.
3. Construct the bundle. Using a Jito-compatible bundle script, the operator packages: (a) the Pump.fun create-token instruction, (b) buy instructions from each of the 20-50 funded wallets, in a specific size pattern designed to capture as close to 100% of the curve's initial supply as possible.
4. Submit and tip. The bundle is submitted to a Jito block engine with a SOL tip. A participating validator includes the entire bundle in the next slot.
5. Token is live with operator pre-captured supply. Within ~400ms, the token exists on Pump.fun with a holder distribution like: 20-50 holders each with 1-5% of supply, plus the bonding curve. To a casual viewer, this looks like an unusually well-distributed early launch.
6. Marketing kicks in. The operator (or paid shillers) post the token in Telegram, X, Discord. Retail buyers pile in. The chart pumps from the bonding curve.
7. Coordinated distribution. The operator scripts coordinated sells across the 20-50 wallets, draining their positions back into SOL.
8. Consolidation. The operator sweeps SOL from all wallets to a consolidator wallet and ultimately back to a centralized exchange for fiat conversion.

The entire scam, from fresh wallet generation to consolidated exit, can run in 30 minutes for a low-effort version. The operator's edge is not technical sophistication — it is the bundle service's atomicity guarantee, which converts "deploy a token and hope" into "deploy a token and own 90% of it before anyone else can compete."

Volume Farming: How Bundle Wallets Fake Organic Activity

Owning the supply is only half the operator's job. The other half is making the token look like a real, healthy launch — one with organic buyers, organic sellers, organic trading volume — long enough to attract retail. That second half is called volume farming, and it is the wash-trading layer on top of the bundle.

Farming works because the operator already controls 20-50 wallets from the bundle. Those wallets can transact with each other on the DEX, generating "volume" that looks identical to organic volume from the chart's perspective. Each wash trade is a bundle wallet selling tokens to another bundle wallet (via the pool) and the second wallet immediately buying them back. The pool's reserves cycle, the chart prints volume, and the trending algorithms that scan for "tokens with growing volume" surface the bundled token as a hot launch.

What operators are farming for

• Trending lists. Pump.fun, DEX Screener, BullX, Photon, Axiom, and most Solana terminals all surface tokens by volume metrics. A bundled token with $50K in wash-traded volume looks identical to a token with $50K in real demand. It gets surfaced. Real buyers see it on the trending tab.
• Trading bot signals. Many automated trading bots scan for tokens hitting certain volume or transaction-count thresholds. Wash-traded volume triggers those signals. Bot buyers pile in mechanically.
• FOMO from human watchers. Traders watching new launches see "this one has volume" and interpret it as legitimacy.
• Paid promotion qualification. Some Telegram and X promoters require minimum volume metrics before they'll shill a token. Farming gets the token across that bar.

The on-chain signature of farming

Wash trading between bundle wallets leaves a recognizable footprint on-chain:

• Same set of wallets on both sides of trades — the bundle wallets appear repeatedly as buyer and seller across many transactions, often within seconds of each other.
• Net token flow near zero across the bundle wallets — tokens cycle within the cluster without the cluster's total holdings meaningfully changing.
• Volume spikes with no new holder addresses — volume goes up but the holder count stays flat or grows slowly. Real demand brings new wallets; farming does not.
• Suspicious round-number trade sizes — farmed trades often happen in clean round amounts because the operator's script is generating them mechanically.
• Trading rhythm that does not match retail patterns — consistent intervals, identical sizes, or activity at hours when no human in the relevant timezone would be trading.

Why farming makes the bundle scam more dangerous

Without farming, a bundled token shows obvious red flags — concentrated buys at launch, no follow-on volume, immediate dump. With farming, the token looks like a normal organic launch for hours or days. The wash-traded volume creates space for the operator to extract significantly more from real retail buyers because the chart and the trending lists both lend the token false legitimacy. A bundle without farming might net the operator $5,000 from a few unlucky bots. A bundle with sustained farming can net $100,000+ from retail buyers who saw the token trending and convinced themselves it was real.

The detection tools listed below (Bubblemaps, Trench, RugCheck) all account for farming patterns in their scoring — they cluster wallets by funding source and transaction relationships, which exposes both the bundle and the wash trading on top of it.

The Pump-and-Dump That Follows

The pump-and-dump portion is straightforward once the operator owns the supply. The chart pattern is similar to the honeypot pattern (see our piece on honeypot scams for the visual signature) but with a key difference: in a bundle scam, sells are happening throughout the pump — they are just the operator's sells, not retail's.

Common bundle dump patterns:

• Stair-step dump. The operator sells in waves of 5-15% of their position per minute, letting the chart reset between sells. The chart shows continued upward momentum punctuated by short pullbacks — each pullback is the operator dumping. Retail interprets each pullback as "buy the dip."
• Slow drip dump. Spread over hours or days. Each individual sell is small. The chart appears organic. The operator's exit is invisible to anyone not specifically tracking the bundle wallets.
• Single rug dump. The operator dumps the entire remaining position in one or two transactions. Chart drops 80-95% in seconds. Common at the end of marketed pumps when the operator has wrung most of the value out and is now extracting the last of it.
• Liquidity removal. If the operator created a Raydium pool with locked LP tokens timed to unlock, they may unlock and remove the LP entirely. This is a true rug pull on top of the bundle dump — buyers can't even sell at the floor because there's no pool.

How to Spot a Bundled Launch Before Buying

The detection signals that distinguish a bundled launch from a fair one are visible on-chain in the first minutes of the token's life. The most reliable:

Holder concentration in the launch block

Look at the token's holder list on Solscan (Solana) or Etherscan (EVM). A bundled token shows 20-50 wallets that all received their tokens in the same launch block, each holding a similar percentage of supply. A fair launch shows holders accumulating gradually across many blocks.

Wallet age

Click into the largest holder wallets. A bundled token's top holders are wallets created within minutes of the token's launch — often the same minute. Wallets with no transaction history before the launch and only the launch buy plus subsequent sells are bundle wallets.

Common funding source

Trace each top holder's funding. In a bundled token, all of them trace back to the same wallet (the operator's funder), which itself usually traces to a CEX withdrawal. In a fair launch, holders are funded from many different sources.

Synchronized selling

Within the first 30 minutes after launch, watch the sell pattern. A bundled token shows top holders selling in coordinated waves — multiple holders selling within the same few seconds, then a pause, then more holders selling. A fair launch shows random uncoordinated selling.

The "all green chart with too many sells" anomaly

A pure honeypot has zero sells. A bundle scam has the opposite signature — the chart looks bullish but the sell volume is unusually high relative to retail buy volume, because the operator is dumping into every wave of buyers.

Pump.fun bundle indicator

For Pump.fun tokens specifically, the platform surfaces a bundle warning on token pages where bundle activity is detected. Trust this indicator — it is doing the wallet-clustering math automatically.

Bundle Detection Tools

Solana-focused

The visual signature of a bundled token is so distinctive that you can identify one in seconds with the right tool. Industry analytics accounts surface bundle patterns in real time:

A bundled token visualized: the funder wallet at the center, connected to dozens of bundle wallets that all bought in the same block. The clustering pattern is the on-chain fingerprint of a coordinated launch.

— Bubblemaps (@bubblemaps) View tweet

On-chain analysis of another bundled launch: dozens of wallets funded from a common source, all buying in the same block, then dumping in coordinated waves on retail buyers. The pattern is unmistakable once you know what to look for.

— Lookonchain (@lookonchain) View tweet

Below is the visual evidence the tweets are pointing at — the wallet cluster, the bundle launch chart, and the all-too-common spike-then-rug trend pattern that follows:

• Bubblemaps — the visual gold standard. Each holder is a bubble; bubbles are connected by lines if their wallets are linked by funding or transactions. A bundled token shows a tightly clustered ball of 15-50 connected bubbles. A healthy token shows a scattered field. The visual signature is unmistakable in 2 seconds.
• RugCheck.xyz — reports bundle percentage at the top of every Solana token page, plus mint authority, freeze authority, LP lock status, and known scam patterns. The first check before buying any Sol memecoin.
• Photon, BullX, Axiom — trading terminals with built-in bundle detection on the token search page. Many active Solana traders run all three in parallel.
• Trench — bundle-specific detector with detailed cluster analysis on Solana tokens.
• Pump.fun built-in indicator — the platform shows a bundle warning on tokens where bundle activity is detected. Built into the UI; no extra tool required.
• Birdeye + Solscan — manual verification: holder distribution, wallet age, funding source.

EVM-focused (Ethereum, Base, Arbitrum, BSC)

• Bubblemaps — supports EVM chains; same visual cluster pattern.
• Etherscan / Basescan + GoPlus — manual holder analysis combined with token security scoring.
• DEXTools — charting tool with built-in security report including holder concentration warnings.
• DEX Screener — multi-chain charts with security tab.

What to Do If You've Been Hit

Honest answer: direct recovery from the on-chain liquidity is rarely possible. The operator did not break any smart contract rule — they bought tokens at the bonding curve price, sold them at higher prices to retail buyers, and pocketed the difference. There is no protocol-level violation to undo.

That said, several steps are worth taking:

1. Preserve evidence. Screenshot the token's chart, the holder list at the time of your buy, your buy transaction, the operator's bundle transaction (if you can identify the launch block). Save any Telegram or Discord messages that promoted the token.
2. Report to industry blacklists. Submit the token contract and operator wallets to Chainabuse, the relevant block explorer's address tagging, and any chain-specific scam-reporting platforms.
3. File a formal complaint. File with the FBI's IC3 regardless of the dollar amount. Cumulative reports against the same operator wallet eventually trigger federal aggregation.
4. Engage a forensic investigator if the loss is material. The operator behind the bundle is traceable. See the next section.
5. Do not engage with "recovery" services that contact you. Within hours of being hit, you will receive Telegram or Discord messages from people claiming to be able to retrieve your funds. They cannot. They are running the secondary scam. See how to spot recovery scams for the full pattern.

The Forensic Angle: Tracing the Bundler

Bundle scams are forensically rich precisely because the operator's many wallets are tightly linked. The operator built the convenience of having dozens of wallets at the cost of building dozens of forensic links between them. A typical bundle-trace workflow:

1. Identify the bundle wallets. Pull the launch block from a block explorer. Every wallet that bought the token in that block is, with very high probability, an operator wallet. For tokens on Pump.fun, the bundle indicator and tools like Bubblemaps or Trench have already done this clustering — the investigator just exports the cluster.
2. Trace each wallet's funding. Every bundle wallet was funded from somewhere — usually a single funder wallet, which itself was funded from a centralized exchange withdrawal. The CEX withdrawal is the operator's first KYC link.
3. Trace the consolidation. After dumping, the bundle wallets sweep their proceeds to one or more consolidator wallets. Those consolidators ultimately deposit at a CEX for fiat conversion. The CEX deposit is the operator's second KYC link.
4. Cluster the operator's full deployment history. The same funder wallet, the same consolidator wallet, the same off-ramp exchange — all of these are reused across the operator's deployments. Many bundle operators run dozens of bundles per week. Cluster analysis identifies all of them, dramatically expanding the victim pool and the dollar damage attributable to a single operator.
5. Produce the report. The deliverable identifies the operator's exchange-side accounts via the KYC links, quantifies the aggregate loss across all victims of all the operator's bundles, and provides the documentation a federal agency needs to subpoena the exchange and identify the operator personally.

An individual victim's loss is uncertain to recover. But the forensic case against the operator is strong precisely because bundling produces so many on-chain links between operator wallets — the operator's convenience cost them their anonymity. Aggregating an operator's full deployment history often crosses the federal-priority threshold where a single $5,000 loss would not.

For broader forensic methodology, see how blockchain forensic investigators trace crypto and crypto forensic investigation. For the related on-chain scam pattern where the contract itself locks the buyer, see our honeypot scam piece. For the broader category of token-launch scams, see rug pull red flags.

Frequently Asked Questions

Token bundling is one face of the broader category of token-launch scams. For the contract-side variant where buyers cannot sell at all, see honeypot scam. For the broader token-launch red-flag checklist, see rug pull red flags. For what to do in the broader aftermath of any crypto scam, see what to do after a crypto scam.