How to Spot a Cabal: A Forensic Field Guide

Every coordinated memecoin pump leaves the same fingerprints on-chain. We've read enough of them to turn the pattern recognition into a checklist. This is the one we run before we let anyone we like put real money in.

"Cabal" is loose language for something pretty specific. We use it to mean a coordinated group of wallets, usually funded from a common origin, that holds an outsized fraction of a token's float and trades it in concert. They are not the same as a fair whale. A single rich wallet that bought on the open market isn't a cabal, even if it holds 5% of supply. The defining feature is coordination.

Coordination is detectable. Cabals leave six different fingerprints, and the more of them you can stack on the same set of wallets, the higher your confidence. None of these signals is conclusive in isolation; together they tell a clear story.

Signal 1: Cluster shape

Before you look at any individual wallet, look at the cluster shape of the whole token. A healthy token's bubble map is a wide, low-rise field: many small clusters, none of them dominating. A cabal-controlled token is a mountain, one or two clusters that dwarf everything else.

The quick metric is top-cluster share, the fraction of supply the single largest cluster controls. Our rule of thumb:

• Under 20%: usually fine, even on a young token.
• 20% to 35%: worth a closer look. Investigate the cluster's funder and trade timing.
• 35% to 50%: concentrated enough to move price single-handedly. Treat it as a thesis investment, not a holder-distribution play.
• Over 50%: the cluster controls the float, and the price only moves when they decide it does.

This is the metric that drives our token grade cap. A token with a top cluster above 50% can't grade higher than D in Intel Maps, no matter how clean its other numbers look, because those numbers are downstream of the cluster's behavior.

Signal 2: Shared funder

The single most reliable on-chain signal of coordination is shared funding. If twenty wallets all received their first transaction from the same origin address, they are not twenty independent buyers; they are one buyer, fanned out across twenty addresses for the optical effect.

To check: pick a suspicious wallet, walk its transaction history back to its first JettonTransfer or TON receipt, and identify the source. Then check whether other large holders trace back to the same source. A funder that originated more than three of the top fifty holders is suspicious; a funder that originated more than ten is a cabal.

The counter-tactic to watch for: multi-hop funding. Sophisticated operators don't fund directly from a single source; they fan out through one or two intermediary wallets, often new EOAs created the same day, so the shared-funder check fails. The fingerprint just moves to the intermediate wallets. Find a fresh address that funded multiple top holders and was itself funded once and then never touched again, and you've found the cabal's distribution layer.

Signal 3: Co-trade timing

Coordinated wallets buy and sell in concert. When a cabal exits, they don't exit one by one over a week; they exit in the same five-minute window, usually triggered by a pre-arranged signal in a Telegram group.

The diagnostic: pick a sharp price move (a 30% pump or dump that lasted under an hour) and pull the wallets that bought or sold the token within that window. Cluster them by funder. If a single funder family accounts for more than 40% of the volume in that window, the move was internal.

Co-trade timing is harder to fake than shared funding because it requires real coordination at the moment of the trade. Tools that surface this signal cheaply (we built one into our cluster engine for exactly this reason) have become the load-bearing piece of most forensic stacks. The shared-funder check has been countered for years, but you can't fake atomicity.

Signal 4: KOL entry timing

KOLs (key opinion leaders, the Telegram and Twitter callers who can move retail in size) have a characteristic entry pattern. They buy before they call. The interesting question is how long before.

A KOL who calls a token they bought ten minutes ago is doing something different from one who calls a token they bought ten weeks ago. The first is functionally part of the cabal even without formal coordination, because the call is the exit signal. The second is calling something they had conviction in.

The pattern that should make you back away: a token where the top three callers all entered within a 24-hour window of each other, weeks before the public call. That is not coincidence. The call is coordinated even if the wallets aren't shared.

Our KOL leaderboard tracks every known caller's entry timestamp per token. The seam between "they had conviction" and "they are part of the play" is usually visible in the timestamps.

Signal 5: Infrastructure mislabels

This is the most subtle of the six and the most frequently abused. Forensic tools that don't label infrastructure correctly will often rank a DEX router contract, a vesting contract, or a CEX deposit address as a "top holder." A cabal that knows this will sometimes use the mislabel deliberately to hide its float.

The diagnostic: pick the top ten holders and check whether each one is a person, a contract, or a piece of infrastructure. If three of the top ten are routers and pools, your "real" top ten is positions 4 through 13, and the concentration metrics you computed from the raw list are wrong by 30% or more.

The opposite mistake is just as common: tools that label too aggressively and strip out wallets that look like infrastructure but are in fact large individual holders. Both errors share one root cause. The tool never checked its labels against the DEX or CEX contract registry itself. First-party labels (where the DEX confirms that an address is a router for its protocol) are the only reliable defense.

Signal 6: Liquidity vs. holder ratio

A healthy token has liquidity proportional to its holder base. A cabal-controlled token often does not. Either the liquidity is thin relative to the apparent market cap (because most of the float sits off-pool with the cabal), or it is suspiciously thick relative to the holder count (because the cabal is using its own funds to inflate depth).

The cheap diagnostic: take the token's reported market cap and divide it by the sum of liquidity across its top three pools. A ratio above 50:1 means a small sell can move the price double digits, which is fine for a small token but a red flag on anything claiming a multi-million-dollar valuation. A ratio under 5:1 on a freshly launched token, with low holder count, often means the cabal is providing the liquidity itself.

The composite read

Any single signal can have an innocent explanation. Cluster shape can look bad on a brand-new token because the distribution hasn't had time to fan out. Shared funding can be real coincidence on small holder counts. KOL entry timing can reflect honest early conviction. Liquidity ratios are noisy on tokens with thin pools.

The diagnostic is the stack. A token that fails on two signals is worth investigating. A token that fails on four is a cabal regardless of what the marketing says.

What to do with the verdict

Spotting a cabal doesn't necessarily mean "don't trade." It means "trade with your eyes open." Cabal-controlled memecoins can pump enormously; for the people running the structure, that is the whole point. A trader who knows a token is a cabal can sometimes ride the coordinated pump and exit before the dump. A trader who mistakes the same token for a fair-launch community phenomenon becomes the exit liquidity.

The asymmetry is what matters: a clean read of the on-chain structure costs you twenty minutes and a few API calls. Not having that read costs you a position.