One hop tells you who sent a wallet its first SOL. Three hops tell you who is behind it. This is the method, by hand on an explorer and then with a scanner, and the point where each trail stops being useful.
We walked this trail on 16 September 2026 from a wallet scored 82 of 100 by Ocinct. Hop 1 was a plain wallet that sent 0.041 SOL, 34 days before the scan. A second wallet, scored 25, was funded with exactly 2 SOL 14 days before by another plain wallet [1]. Neither funder carried an exchange label, which is what sends you to hop 2.
The idea
Every wallet was funded by a wallet that was itself funded. Follow that chain and you always land on one of two things: a place where SOL enters the ecosystem (an exchange, a bridge, a validator payout) or a loop. Everything in between is the operator's own plumbing.
The interesting wallets are the ones in between. That is where a deployer funds an insider, where a relay funds twenty snipers, and where an old wallet with losses funds the new wallet with the clean record.
By hand, on an explorer
- Open the wallet. Note the Funded by address, the amount and the date. Write them down; you will lose track by the third hop.
- Open the funder. Read its own Funded by line. Note it. Then look at its transfers: how many other wallets did it fund, and when?
- Open the funder's funder. Same thing. At this point you are usually at an exchange label, a bridge, or a wallet with hundreds of outgoing transfers.
- Stop when the trail stops. An exchange hot wallet has thousands of incoming transfers and tells you nothing more. A loop (A funded by B funded by A) means you are inside the operator's own wallets.
Each hop is one page load, so three hops is quick for one wallet. It is not quick for fifty, which is why scanners exist.
Reading each hop
Hop 1, the funder. The question is who or what it is.
- Labelled exchange: the wallet was created by a person withdrawing SOL. Common, honest, not informative on its own.
- Bridge: same, from another chain.
- A wallet that trades: the operator moved money from one trading wallet to another. Look at the old one. Its record is the operator's real record.
- A wallet that only funds: a relay. Count how many wallets it funded and when. Ten wallets funded within an hour, each with 1 to 3 SOL, is a farm being set up.
Hop 2, the funder's funder. Relays are usually funded from an exchange, one withdrawal, then split. If hop 2 is a token deployer, or a wallet that deployed tokens the relay's children then traded, you have found an insider structure in two page loads.
Hop 3, the origin. Mostly an exchange. When hop 3 is still a plain wallet with few transfers, the operator is layering on purpose. That is not proof of anything, but it is a reason to spend your attention elsewhere.
Amounts and timing carry information too
The amount says what the wallet was set up to do. A wallet funded with 0.5 SOL is a sniper or a test. A wallet funded with 50 SOL from an exchange is a trader moving in.
The date says how old the record is. A wallet funded on the 3rd with a perfect record since the 3rd has a three day record. Compare the funding date to the first trade: a wallet funded and trading within the same minute was set up by a script.
Where the trail stops
Three cases end a trail, and a scanner should say which one it hit:
- Depth reached. You walked as far as you decided to. Ocinct walks 3 levels on Pro and 6 on Elite.
- No funder on record. Very old wallets, wallets first funded with a token, or wallets whose first SOL came from a program (a validator reward, a program refund) have no first native transfer from a wallet.
- A loop. The chain returns to a wallet already visited. Everything inside the loop belongs to one operator.
Doing it with a scanner
Ocinct's funding trail runs the same walk from the scan card. Each hop shows the address, the SOL amount, the date, the transaction and the exchange label when there is one, with a button to scan the funder as a wallet in its own right. Pro shows hops 1 to 3, Elite hops 1 to 6, and both name why the trail stopped.
For a list of wallets rather than one, token traders on paid plans groups a token's top traders by funder, and who copies who checks whether they move together. That is the fast way to find out whether the top ten of a token are ten people or one. The method for reading that is in how to detect a crew.
Sources
[1] Ocinct scan cards, 16 September 2026: https://ocinct.com/funding-trail
[2] Helius, Wallet API, Funded by, funder types and limitations: https://www.helius.dev/docs/wallet-api/funded-by
[3] Solscan help center, What is Funded by: https://info.solscan.io/what-is-funded-by/