unbundle logounbundle
← All research
Case studySolana·

Three wallets, 22 seconds

Four supposedly separate wallets, all of them funding and drawing from one wallet, mostly in round numbers — and three transfers landing inside 22 seconds. The transfers are verified on-chain; the conclusion is left to you.

Share on X

The addresses

Tracked wallet

8MaVa9kdt3NW…

8MaVa9kdt3NW4Q5HyNAm1X5LbR8PQRVDc1W8NMVK88D5

18 candidate links recorded · all four wallets below also share an exit destination

Open the cluster report →

Largest counterparty

FfyLxGLJu6Wn…

FfyLxGLJu6WnCMahP9AKEDkC3VFWRvcH8wUx42CQTGhB

14 recorded transfers, 573 SOL total

Open the cluster report →

What the data shows

Three transfers, three wallets, 22 seconds

On 2026-07-29 three different addresses sent to the tracked wallet within 22 seconds of each other: 50 SOL at 21:22:55, 50 SOL at 21:23:05 and 20 SOL at 21:23:17. The three transactions occupy slots 436023030, 436023053 and 436023083 — close enough that whoever controlled them acted, or was triggered, in the same moment.

The money moved both ways

This is not one-directional funding. Some of the largest transfers run from the tracked wallet out to these addresses — 110 SOL, 75 SOL and 50.15 SOL among them. Money circulating in both directions between addresses is harder to explain as a one-off payment than a single transfer would be.

Round numbers, repeated amounts

The transfers are dominated by round figures: 110, 75, 50, 40, 30, 25, 20, 15, 10 and 5 SOL. Repeating round amounts across four different counterparties is the shape of a manual or scripted funding routine rather than ordinary trading flows.

All four also share an exit destination

Each of the four links carries a shared-exit signal in addition to the transfers, meaning funds from these wallets and the tracked wallet consolidate at the same destination. Combined with the timing, the independence of the four addresses is the thing that stops being plausible.

The 22-second window (all chain-verified)

Side wallet → tracked wallet · 50 SOL2026-07-29 21:22:55 UTC · slot 436023030

Verified: tracked wallet +50 SOL, counterparty −50.000205 SOL.

Second side wallet → tracked wallet · 50 SOL2026-07-29 21:23:05 UTC · slot 436023053

Verified: tracked wallet +50 SOL, counterparty −50.000205 SOL. Ten seconds after the transfer above.

Third side wallet → tracked wallet · 20 SOL2026-07-29 21:23:17 UTC · slot 436023083

Verified: tracked wallet +20 SOL, counterparty −20.000205 SOL. Twelve seconds after the transfer above.

Largest single transfers, re-checked one by one

Tracked wallet → counterparty · 110 SOL2026-05-23 16:01:32 UTC · slot 421667014

Verified: tracked wallet −110.000080 SOL, counterparty +110 SOL.

Counterparty → tracked wallet · 110 SOL2026-06-06 16:12:14 UTC · slot 424710630

Verified: tracked wallet +110 SOL, counterparty −110.000080 SOL. A near mirror of the transfer above, two weeks later.

Tracked wallet → counterparty · 75 SOL2026-05-18 19:21:37 UTC · slot 420615452

Verified: tracked wallet −75.000080 SOL, counterparty +75 SOL.

Counterparty → tracked wallet · 40 SOL2026-05-29 00:33:22 UTC · slot 422830024

Verified: tracked wallet +40 SOL, counterparty −40.000006 SOL.

What our recorded evidence says about each of the four

CounterpartyRecorded transfersRecorded totalShared exitFront-buys
TWiNYzgn…93oms20 legs476 SOLyes1
PUMPRLSw…1scdS7 legs156 SOLyes1
HodLXSGK…7URvd6 legs85 SOLyes—
FfyLxGLJ…QTGhB14 legs573 SOLyes—

Totals are aggregates across legs recorded by our pipeline, in both directions — not single transactions. We re-fetched the largest legs above and the amounts matched exactly.

Limitations

  • •This is evidence of coordination, not proof of common ownership. On-chain data cannot establish who controls an address.
  • •The transfer totals are aggregates across multiple recorded legs in both directions, not the value of a single transaction.
  • •Only the specific legs listed above were re-fetched and verified by us; the remaining legs behind the totals were not independently re-checked.
  • •Wallets funding each other is normal behaviour between collaborators, funds, or a person moving their own money. It is not by itself evidence of wrongdoing.
  • •Nothing in this report should be read as a legal conclusion or an accusation of unlawful activity.

Check it yourself

Each signature opens on Solscan with its slot and timestamp. Compare the balance movements listed here against what the chain shows; the figures should match exactly.

Share on X