Research on Internal Sniping Arbitrage in Solana Token Issuance

Summary

This report investigates a prevalent and highly coordinated meme Token farming model on Solana: Token deployers transfer SOL to "sniper wallets", enabling these wallets to purchase within the same block as the Token launch. By focusing on the clearly verifiable funding chain between deployers and snipers, we identify a set of high-confidence extraction behaviors.

Analysis shows that this strategy is neither a coincidence nor a marginal behavior. In just the past month, over 15,000 SOL have been profited from more than 15,000 token issuances through this method, involving over 4,600 sniper wallets and more than 10,400 deployers. These wallets demonstrate an unusually high success rate of (87% profit ), clean exit methods, and structured operational patterns.

Main findings:

• Deployers fund sniper systems that are systematic, profitable, and often automated, with activities concentrated during US working hours.
• The multi-wallet farming structure is common, often using temporary wallets and collaborative exits to simulate real demand.
• The obfuscation methods have upgraded, such as multi-hop capital chains and multi-signature sniper trading, to evade detection.
• Although limited, a jump fund filter can still capture the clearest and repeatable large-scale "insider" behavior cases.
• Propose actionable heuristic methods to assist protocol teams and front-end in real-time identification, labeling, and response to such activities.

Although the analysis only covers a subset of block sniping within the same network, its scale, structure, and profitability indicate that Solana token issuance is being actively manipulated by a collaborative network, and existing defenses are far from adequate.

Methodology

This analysis aims to identify behaviors indicating the collaborative farming of meme tokens on Solana, particularly the situation where deployers provide funds to sniper wallets at the same block as the token launch. We divide the issue into the following stages:

1. Filter same block sniping
2. Identify the wallet associated with the deployer
3. Associate sniping with Token profits
4. Measure Scale and Wallet Behavior
5. Machine Activity Trace
6. Exit Behavior Analysis

Focus on the clearest threats

On Solana, over 50% of tokens are sniped at the moment of block creation, and same-block sniping has become the dominant issuance model. To reduce false positives and highlight genuine collaborative behavior, we only count snipes where there is a direct SOL transfer between the deployer and the sniping wallet before the token goes live. This allows us to confidently identify: wallets directly controlled by the deployer; wallets acting under the deployer's command; wallets with internal channels.

Case Study 1: Direct Funding

The deployer's wallet sends a total of 1.2 SOL to 3 different wallets, and then deploys the token. The 3 funded wallets complete the rush to purchase the token within the same block of its creation, ahead of broader market visibility. They then quickly sell to make a profit, executing a coordinated flash exit. This is a typical example of pre-funding sniper wallets brushing farm tokens, directly captured by our funding chain method.

Case Study 2: Multi-hop Funding

A certain wallet is related to multiple token sniping activities. It injects funds into the final sniping wallet through 5-7 layers of relay wallets, thereby completing the sniping within the same block. Our existing methods only detect part of the initial transfers by the deployer and fail to trace the entire chain. These relay wallets are usually "single-use," only used for transferring SOL, making it difficult to associate them through simple queries.

Discover

Focusing on the "same area block sniping + direct capital chain" subset, we reveal a wide-ranging, structured, and highly profitable on-chain collaborative behavior. The following data covers from March 15 to the present:

1. Sniping that is funded by the deployer and occurs in the same block is very common and systematic.
2. This behavior is a large-scale profit.
3. Repeated deployment and sniper targeting of brushing farming networks
4. Sniping presents a human-centered time pattern
5. Confusion of ownership between one-time wallets and multi-signature transactions

Exit Behavior

We break down the data along two major behavioral dimensions: exit speed and number of sell transactions.

Data conclusion:

1. Exit speed

   • 55% sniper sold out in 1 minute
   • 85% clear out within 5 minutes
   • 11% completed within 15 seconds

2. Number of sales

   • Over 90% of the targeted wallets exit with only 1-2 sell orders.
   • Rarely use progressive selling

3. Profit Trend

   • The most profitable is the wallet that exits in <1 minute, followed by <5 minutes.
   • Holding for a longer time or selling multiple times may result in slightly higher average profit per transaction, but the quantity is very small, contributing limited to total profit.

These patterns indicate that sniper actions funded by deployers are not trading activities, but rather automated, low-risk extraction strategies.

Conclusion

This report reveals a continuous, structured, and highly profitable Solana token issuance extraction strategy: deployer-funded same-block sniping. By tracking the direct SOL transfers from deployers to the sniping wallets, we identified a batch of insider-style behaviors that leverage Solana's high-throughput architecture for collaborative extraction.

Although this method only captures part of the block sniping within the same block, its scale and pattern indicate that this is not sporadic speculation, but rather operators with privileged positions, repeatable systems, and clear intentions. The importance of this strategy is reflected in:

1. Distort early market signals to make the token appear more attractive or competitive.
2. Endanger retail investors - they become trapped in liquidity without knowing it.
3. Undermine the trust in open token issuance, especially on platforms that prioritize speed and usability.

To alleviate this problem, what is needed is not only passive defense, but also better heuristics, front-end early warning, protocol-level safeguards, and ongoing efforts to map and monitor collaborative behavior. Detection tools already exist - the issue is whether the ecosystem is truly willing to apply them.

This report provides a reliable and reproducible filter to identify the most obvious co-behavior. But this is just the beginning. The real challenge lies in detecting highly obfuscated and continuously evolving strategies, and building an on-chain culture that rewards transparency rather than extraction.