Holders & Funding: cabal detection
This is the Nun Report's signature analysis: who actually owns the token, and where their money came from. A token can have a clean contract and a credible team on the surface while a hidden group of insider wallets controls the supply, waiting to dump on you. This section finds that group.
It spans two parts of the dossier: "II. Holders & Distribution" and the funding details under "III. Provenance & Team."
Key ideas first
- Fresh wallets: wallets created around launch time, with no prior history. A pile of these is normal for retail, but suspicious when they're coordinated.
- Insider bundle: a set of fresh wallets that are linked (shared funders, shared timing) and grabbed the supply early. This is the "cabal."
- Funding provenance: where each wallet's starting money came from. This is the thread that unravels a bundle.
What "Holders & Distribution" shows
| Field | Meaning |
|---|---|
| Holders | Total wallets holding the token. |
| Fresh wallets | How many were freshly created around launch. |
| Insider bundle | How many of those are in the coordinated group. |
| Severity | The bundle's risk level: none / low / medium / high / flagged, sometimes with an estimated % of supply. |
| Coordinated | Yes 🚩 (they share funders/timing) or No (dispersed, organic). |
| Funding age | When the bundle wallets were created relative to launch: team-prep (≤1h before, insider prep), staged (1–24h before), early (>24h before), normie (after launch, i.e. retail). |
| Supply held | How much of the total supply the bundle controls, e.g. "~23% by the bundle." |
| Rent-seeded | Wallets funded with the exact minimum "rent" amount: a fingerprint of an automated, scripted bundle. |
| Laundering | Multi-hop funding cycles used to hide the money trail. |
Funding provenance (the money trail)
Under Provenance & Team, the Funding provenance block sorts the bundle's funding into:
- Known venues: wallets funded by withdrawing from an exchange (e.g. a named exchange, shown as "Exchange ×2"). Exchange withdrawals are relatively normal and less suspicious than private funding.
- Private funders: wallets funded by other private wallets. Two tags matter
here:
- shared: this funder seeded 2 or more of the fresh wallets. This is the classic cabal tell: one person quietly funding a fleet of "independent-looking" wallets.
- insider: the funder is itself in the bundle.
- Unattributed: funding source couldn't be traced.
Bundle & rent-seeded wallet lists
The dossier lists the actual wallets so you can verify everything onchain. Each row links to the block explorer and shows tags like insider, an age tag (team-prep / staged / early / normie), whether it's an extractor ("selling X SOL"), how much it was seeded with, its % of supply, whether it has dumped, and its funding source.
How to read it (the cabal checklist)
Ask these in order:
- Is it coordinated? Coordinated: Yes 🚩 is the first alarm.
- How much do they hold? A bundle controlling a large % of supply can crash the price whenever they choose.
- When did they get in? Lots of team-prep wallets = the insiders positioned themselves before you ever had a chance.
- Who funded them? A shared private funder behind many wallets is a strong cabal signal. Exchange (known-venue) funding is softer.
- Are they leaving? extractor tags and dumped markers mean the insiders are already selling; the dump may be underway.
Coordinated: Yes · high severity · ~30% supply held · many team-prep wallets · one shared private funder · extractors already dumping. That combination is a textbook insider rug. Even a perfect contract and great social buzz don't save you from it.
Money coming from an exchange looks more organic than a shared private funder, but sophisticated groups use exchanges to launder the trail too. The Nun Report shows you the split so you can weigh it; it never treats "exchange-funded" as a free pass.