An explosive report reveals the scale of a manipulation scheme orchestrated on the Solana blockchain. Over 15,000 SOL were fraudulently mined in a single month using a sophisticated memecoin “farming” technique.
Large-scale manipulation
The Pine Analytics report highlights a phenomenon that is much larger than the isolated cases of manipulation known to the general public, such as those involving the LIBRA and MELANIA memecoins.
The figures are telling: more than 4,600 unique “sniper” wallets and more than 10,400 token creators have been identified as active participants in this system on the Solana blockchain.
What makes this manipulation particularly pernicious is its exceptional success rate. Sniper wallets boast an 87% return on investment, demonstrating methodical coordination rather than mere luck.
But the reality is even more worrying. According to the study, more than 50% of cryptos launched on Solana are now “sniped” in the very block they are created in, before ordinary investors have had a chance to discover them via public interfaces.
Ever more sophisticated obfuscation techniques
To avoid detection, manipulators have developed complex and effective strategies, consolidating a well-oiled value extraction system that is close to institutionalization.
In particular, they use multi-wallet structures with “funding chains” comprising up to 5 or 7 intermediate transactions between the token creator and the final sniper. This method, known as “multi-hop funding,” makes it very difficult to establish a direct link between the two parties.
Another formidable tactic is “burner” wallets, which make a single purchase transaction before becoming inactive, mimicking the behavior of ordinary investors who have forgotten their tokens.
Token creators also spread their initial purchases across two to four different wallets to simulate diversified organic demand.
Temporal analysis also reveals suspicious patterns: sniping activity is heavily concentrated between 2:00 p.m. and 11:00 p.m. UTC, with virtually no activity between midnight and 8:00 a.m. UTC. This distribution strangely corresponds to US working hours, suggesting either human coordination or automation programmed according to this time zone.
An ultra-fast extraction strategy
The exit behavior of snipers reveals a well-oiled extraction strategy. More than 55% of sniping operations are completed (purchase then sale) in less than 1 minute, and nearly 85% are completed in less than 5 minutes. The most extreme group represents more than 11% of cases and completes its operations in less than 15 seconds.
This speed goes hand in hand with striking organizational simplicity: in more than 90% of cases, snipers liquidate their positions in just 1 or 2 transactions on decentralized exchanges (DEX).
This behavior contrasts sharply with that of legitimate investors, who tend to stagger their sales or hold their positions for longer.
Paradoxically, it is the fastest portfolios to exit—more precisely, the cohort that sells within 1 minute—that are also the most profitable. This inverse correlation to traditional investment strategies confirms the existence of bots programmed according to the “enter first, sell quickly, exit completely” logic.
Disastrous consequences for the reputation of Solana platforms
This systematic manipulation profoundly alters natural market signals. Retail investors, attracted by artificial price increases, actually serve as exit liquidity for manipulators.
They buy tokens at inflated prices, which the snipers immediately resell at a profit, orchestrating a transfer of wealth from small holders to insiders.
The Pine Analytics report highlights that current defenses are “deemed insufficient” given the scale of the phenomenon. Platforms and protocols struggle to detect these manipulations in real time, particularly due to the constant evolution of obfuscation techniques.
Ways to restore confidence
In response to this widespread manipulation, some solutions are emerging. Pine Analytics recommends that platforms incorporate more transparent indicators of initial token activity to enable investors to identify suspicious launches.
Among the suggestions are displaying the volume concentrated in the first blocks and highlighting abnormally high priority fees, both of which are potential warning signs.
Warning systems could also evolve to become more granular. Rather than simply banning certain tokens, platforms could develop nuanced approaches that alert investors to risky behavior while leaving the final choice up to them.
Finally, wallets with questionable track records could also be identified and flagged, helping to establish a form of decentralized reputation.
