How to Identify Suspicious Activity in New Token Launches

A new token is ten minutes old, the chart is green, the volume counter is spinning, and the Telegram is loud. Every one of those things can be manufactured by one person with a few wallets and a bot. If you want to identify suspicious activity in new token launches, you have to stop reading the excitement and start reading the record: how the token was set up, who bought in the first block, whether the volume is real, and what's happening to the liquidity. Here's how I look at each of those, what the research says, and where the signals can fool you. Sources are linked so you can check me.

Why new launches are where the games happen

New tokens are cheap to make and cheap to fake. Chainalysis counted more than 2 million tokens launched in 2024 and flagged 74,037 of them (3.59%) as showing patterns that may be linked to pump-and-dump schemes. In about 94% of those suspected cases, the pool was drained by the same address that created it. The median time from pool launch to abandonment was zero days.

Two things to keep straight about that study. It covered Ethereum, BNB Smart Chain and Base, not Solana. And Chainalysis says itself that its method tracks patterns of behavior, not intent, so a flag isn't proof. Still, the shape it describes (launch, hype, fake volume, sell at the top, pull the pool) is the same one we see in the Solana trenches, and the warning signs below map onto each step.

Signal 1: the token's own settings

Before any trading, look at what the token can do. Most Solana meme coins use the original token program, where the big questions are mint and freeze authority (covered in what "mint authority revoked" actually means). But a token built on the newer Token Extensions program, also called Token-2022, can carry extra powers that a quick check might miss. Solana's own docs describe a few that matter a lot to a buyer:

• Permanent delegate. Per Solana's docs, this is a mint-level authority that "can authorize transfers and burns for any token account for that mint," and holders can't revoke it. In plain words: someone can move or burn your tokens without you.
• Transfer fees. A transfer fee takes a cut of every transfer, and the fee authority can change the rate later (the new setting kicks in two epochs after it's set). A token that trades fine today can get expensive to move tomorrow.
• Pausable. A pausable mint lets a pause authority stop transfers, mints and burns for the whole token. If you can't transfer, you can't sell.

None of these is automatically a scam. They exist for real reasons, like compliance controls on regulated assets, and a legit issuer explains them up front. The red flag is a random meme coin carrying them with no explanation, because there's no honest reason a fun coin needs the power to take your tokens. If sells are blocked or taxed into nothing, you're looking at a honeypot token.

Signal 2: who bought in the first block

The first seconds of a launch tell you who had a head start. Pine Analytics studied Pump.fun launches over about a month in spring 2025 and found that more than half of tokens were sniped in the same block they were created. In the clearest insider cases, the snipers had swapped SOL directly with the creator right before launch, and most of them sold within minutes.

What that looks like on an explorer: several buys in the creation block or the next couple, from wallets that are brand new, similar in size, and funded from the same place shortly before. That's often called a bundle. One operator buys a big slice of supply across many wallets so the holder list looks spread out. I went through how to trace those wallets one hop back in how to analyze a Solana wallet before buying a token, so I won't repeat the whole routine here.

Signal 3: volume that isn't real

Volume is the number people trust most and should trust least. Wash trading means buying and selling the same asset to fake demand without anyone's position actually changing. Chainalysis found up to $2.57 billion in suspected wash trading volume on Ethereum, BNB Smart Chain and Base in 2024 (it calls that an upper bound). One of its heuristics looked for addresses that bought and sold within about five minutes for almost the same dollar amount, over and over. Another found single controller wallets funding many trading wallets at once; the median controller ran 7 of them.

The report also shows how ordinary this has become. It looked at a paid "volume bot" service whose bots buy and sell a token 100 times in rapid succession. On one token in its case study, the bot made up about 43% of the token's Uniswap volume from July 27 to July 30. Signs you might be looking at fake volume:

• Matched round trips. The same wallets buy and sell near-identical amounts again and again.
• Busy chart, flat holders. Volume climbs but the number of real holders barely moves.
• Machine rhythm. Trades land at steady intervals and sizes that no group of humans would produce.

Fair warning: arbitrage and MEV bots also buy and sell fast, and Chainalysis notes they can look like wash trading. Fast trading alone isn't the tell. Fast trading that goes nowhere, by connected wallets, is.

Signal 4: what's happening to the liquidity

The liquidity pool is the exit door for everyone. Chainalysis's pump-and-dump filter was built around it: someone adds liquidity, the pool gets traction, then at least 65% of the liquidity is pulled and the pool goes quiet. So check who provided the liquidity, whether the LP tokens are locked or burned (my guide on LP locked vs burned explains the difference), and whether anyone has been pulling it out. On a Pump.fun-style bonding curve, the curve itself holds the reserves until the token graduates, so the question there shifts to who holds supply and how fast they're selling.

Where these signals can fool you

• Clean signals aren't safety. A token can pass every check above and still go to zero because nobody cares about it. Most do.
• Operators adapt. Pine documented funding routed through several single-use wallets to hide the link. The better the setup, the less these quick checks catch.
• Context matters. A shared funder can be an exchange. A big early buy can be a real fan with a big wallet. One signal is a question. Several together are a pattern.
• It's a snapshot. Authorities, holders and liquidity can all change an hour after you look.

A quick launch check before you ape

• Settings first. Which token program, which authorities are live, and any permanent delegate, transfer fee or pause power.
• First block. How many buys landed at creation, and are those wallets new, same-sized or commonly funded?
• Volume versus holders. Does real holder growth match the trading, or is it the same wallets cycling?
• Liquidity. Who added it, is it locked or burned, and has any been pulled?
• Can't tell? Size it like a loss. Unclear isn't the same as safe.

If you want a faster first pass, the free DarkGeneral Interrogator takes a contract and gives a plain-English risk assessment with proof links. It won't catch everything, and the explorer stays the source of truth.

Where to go from here

For the bigger picture of who wins on these launches, read why most Solana meme coin traders lose money. For the other classic warning signs, see how to spot a rug pull. Fresh stories land on the live crypto news page.

The takeaway: hype, volume and a green chart are the easiest parts of a launch to fake. Settings, first-block buyers and liquidity moves are written on-chain, and they're much harder to hide. Read those first, and let the excitement wait. Which of these four signals do you actually check before you buy?

Still building. Still here. 🫡