How to trace who funded a Solana wallet, three levels deep

One hop tells you who sent a wallet its first SOL. Three hops tell you who is behind it. This is the method by hand on an explorer, what a scanner does for you, and the point where each trail stops being useful.

We walked this trail on 16 September 2026 from a wallet scored 82 of 100 by Ocinct. Hop 1 was a plain wallet that sent 0.041 SOL, 34 days before the scan. A second wallet, scored 25, was funded with exactly 2 SOL 14 days before by another plain wallet [1]. Neither funder carried an exchange label, which is what sends you to hop 2.

Where does a funding trail lead?

Most wallets were funded by a wallet that was itself funded. Follow that chain and you land on a place where SOL enters the ecosystem (an exchange, a bridge, a validator payout), on a loop, or on a wallet with no funder on record. Everything in between is the operator's own plumbing.

The interesting wallets are the ones in between. That is where a deployer funds an insider, where a relay funds twenty snipers, and where an old wallet with losses funds the new wallet with the clean record.

How do you trace a funding trail by hand?

1. Open the wallet. Note the Funded by address, the amount and the date. Write them down; you will lose track by the third hop.
2. Open the funder. Read its own Funded by line. Note it. Then look at its transfers. How many other wallets did it fund, and when?
3. Open the funder's funder. Same thing. At this point you are usually at an exchange label, a bridge, or a wallet with hundreds of outgoing transfers.
4. Stop when the trail stops. An exchange hot wallet has thousands of incoming transfers and tells you nothing more. A loop (A funded by B funded by A) means you are inside the operator's own wallets.

Each hop is one page load, so three hops is quick for one wallet. It is not quick for fifty, which is why scanners exist.

What does each hop of the trail tell you?

The first hop says who funded the wallet, the second how the operator set it up, the third where the money came into Solana.

Hop 1, the funder. The question is who or what it is.

• A labelled exchange means the wallet was created by a person withdrawing SOL. Common, honest, not informative on its own.
• A bridge means the same, from another chain.
• A wallet that trades means the operator moved money from one trading wallet to another. Look at the old one. Its record is the operator's real record.
• A wallet that only funds is a relay. Count how many wallets it funded and when. Ten wallets funded within an hour, each with 1 to 3 SOL, is a farm being set up.

Hop 2, the funder's funder. Relays are usually funded from an exchange, one withdrawal, then split. If hop 2 is a token deployer, or a wallet that deployed tokens the relay's children then traded, you have found an insider structure in two page loads.

Hop 3, the origin. Mostly an exchange. When hop 3 is still a plain wallet with few transfers, the operator is layering on purpose. That is not proof of anything, but it is a reason to spend your attention elsewhere.

What do the amount and the date of a funding tell you?

The amount says what the wallet was set up to do. A wallet funded with 0.5 SOL is a sniper or a test. A wallet funded with 50 SOL from an exchange is a trader moving in.

The date says how old the record is. A wallet funded on the 3rd with a perfect record since the 3rd has a three day record. Compare the funding date to the first trade. A wallet funded and trading within the same minute was set up by a script.

Where does a funding trail stop?

Three cases end a trail, and a scanner should say which one it hit.

• Depth reached. You walked as far as you decided to.
• No funder on record. Very old wallets, wallets first funded with a token, or wallets whose first SOL came from a program (a validator reward, a program refund) have no first native transfer from a wallet.
• A loop. The chain returns to a wallet already visited. Everything inside the loop belongs to one operator.

Can you trace who funded a wallet automatically?

Yes. On Pro and Elite, Ocinct's Who funded it starts from the last SOL a wallet received and walks back, sender by sender, while each one only passed the money on. It goes 3 levels deep on Pro and 6 on Elite, and stops at a wallet with its own history or at an exchange, which it names. The scan card still shows the first hop, under Where its first SOL came from, with the address, the SOL amount, the date and the exchange label when the data provider has one.

Ocinct also follows money the other way. Trace a wallet takes a wallet that went empty, follows the SOL it sent away, wallet by wallet, until the trail stops, and says whether the last wallet still trades. It goes 3 steps deep on Pro and 6 on Elite.

For a list of wallets rather than one, token traders on paid plans groups a token's top traders by funder, and who copies who checks whether they move together. That is the fast way to find out whether the top ten of a token are ten people or one. The method for reading that is in how to detect a crew.

Questions

Sources

[1] Ocinct scan cards, 16 September 2026, https://www.ocinct.com/funding-trail

[2] Helius, Wallet API, Funded by, funder types and limitations, https://www.helius.dev/docs/wallet-api/funded-by

[3] Solscan help center, What is Funded by, https://info.solscan.io/what-is-funded-by/