I started this project wanting to build a trading bot for Pump.fun coins on Solana. Most of my time ended up going somewhere else: figuring out who was rugging those coins, and how much they were making from it.
It was an experiment from the start. I wanted to know whether a bot could trade alongside the ruggers and still come out ahead after fees, and I wanted to understand how their operations actually worked. Speed was never going to be my advantage. The teams that win the race to buy first run servers next to Solana’s validators and pay for private data feeds. So instead of racing them, I tried to out-research them. Before the bot touched a single real coin, I’d spent days recording every launch and trade on Pump.fun so I could test ideas against what had actually happened.
What I built
Most of it is written in Rust, and it came together in a few pieces:
- Decoder. Reads raw Solana transactions and works out what happened in each one, whether that’s a coin launching, someone buying or a pool getting drained. I generated it from the interface files Pump.fun publishes for its programs, so when Pump.fun changed something, my build broke loudly instead of quietly recording garbage.
- Data feeds. Triton’s streaming feed gave me low-latency data during live runs, and Helius let me follow every block and look up any wallet’s history.
- Database. Everything went into ClickHouse, which held about 83 million trades by the end of the first week.
- Strategy engine. The same code ran backtests on the recording, simulated trades live and placed real ones, with a pool simulator that accounted for fees, price impact and delays.
- Live trader. An encrypted wallet that built and sent the real buy and sell transactions.
- Analysis scripts. Python scripts for tracing wallets and running the operator studies further down.
Getting the data right took longer than anything else. I’d assumed Solana produces a block every 0.4 seconds, since that’s the number everyone quotes. It’s closer to 0.27, so every “minutes” figure I’d calculated was off until I measured it. Pump.fun also shipped new instructions partway through my first week without documenting them, and about 2% of trades on its swap program were being silently dropped until my anomaly checks flagged them.
Every strategy I tried, and why most lost
Every round trip costs somewhere between 0.6% and 2.5% in fees, depending on the pool. That sounds small until you notice that buying at random loses almost exactly that much. An idea has to beat the fee before it can beat anything else, and most of mine didn’t.
Some quick background first. Pump.fun coins start on a pricing curve and move to a real trading pool, which people call graduating, once about 85 SOL has gone in. Several of these strategies were built around that moment. Here’s everything I tried on Pump.fun:
- Sniping brand-new launches. Be one of the very first buyers on a new coin and ride it if it takes off. My version only bought launches where the early buying looked natural, and it sold the moment the developer sold or a big holder dumped.
- Buying just before graduation. A coin’s price climbs as its curve fills, and coins that graduate often jump again once they reach a real pool. So this bought coins whose curve was most of the way full, at 60 to 80 of the 85 SOL, and sold five minutes after they graduated.
- Buying the dip on new coins. Shortly after a launch, once the developer had sold and a burst of selling had knocked the price down 5% or more, buy and sell about 15 seconds later, betting on a bounce.
- Momentum. Buy when the price has been rising on net buying over a short window, then sell at a profit target, at a loss limit, or when the price falls back a set amount from its high.
- Volume flow. The same kind of bet, but triggered by a surge in trading volume from lots of different buyers rather than by the price itself.
- Chasing runners after graduation. Some graduated coins go on to huge market caps, so this bought coins that crossed $150k or $250k, or were still climbing 5 to 30 minutes after graduating, hoping to catch the next big one.
- Buying right after a big sell. When one large sell knocks the price down, it often bounces, so this bought the drop and sold once part of it came back.
- Copying profitable wallets. Pick the wallets that made the most money on earlier data, then buy when they buy and sell when they sell.
- Following one big buyer. Buy right after a single large buy that takes a big share of the pool, then hold for a set time.
- Random entries. Buy at random and hold for a fixed time. This was my control, the bar every other strategy had to clearly beat.
- Following buys of 300 SOL or more. When a coin graduated instantly and someone bought 300 SOL or more of it in the first half second, buy right behind them, hold for about seven minutes and sell early if several wallets start dumping at once.
- Following buys of 100 to 300 SOL, out fast. The same idea aimed at coins with a smaller big buy, which jump faster but get dumped more often, so it got out much sooner. This is the one most of this post is about.
I also ran a few strategies on established Solana tokens like BONK, WIF and JTO as a sanity check, to see whether any of this worked outside the meme coin casino:
- Trend following with dip buying. Only hold a token while it’s in an uptrend, meaning its short-term average price is above its long-term one and SOL itself is above its 30-day average, and buy when it dips 10% inside that trend.
- Buying small dips. The same trend filter, but buying 2–3% dips instead.
- Whale and smart-wallet signals. Buy when large wallets or historically profitable wallets buy, or when more money is flowing into a token than out.
- Cross-exchange arbitrage. Look for the same token priced differently on two exchanges, then buy on one and sell on the other in a single transaction.
A later research pass also looked at Meteora, which runs its own launchpad with a similar pricing curve. The idea there was to buy those curves early and sell into the climb. I never traded it.
How they did
Sniping was the worst. Over 1,153 test trades only 18% won, and it lost 10.5 SOL, because the creator and the wallets launching with them sell into those first buyers within seconds. Being early mostly meant being their exit. Buying just before graduation lost 12–17% per trade, since 34–57% of those coins were dumped before they ever graduated. The dip strategy lost too. Some profitable bots make exactly that trade, but they do it inside the same block as the selling, and at my speed it lost even with no delay at all.
Momentum and volume flow both lost on data they hadn’t seen once fees came out, even after tuning. Chasing runners looked great on minute-by-minute charts, then lost or broke even when I replayed it trade by trade, because most runners get dumped too and the stops gapped straight through. Buying after a big sell didn’t last long. That big sell was usually the first leg of a coordinated drain, with more selling right behind it.
Copying wallets lost in every version I tried, even on the same data I’d picked the wallets from. The most profitable wallets turned out to be the operators themselves, or bots that hold for 7 to 10 seconds, and you can’t copy either one. Following one big buyer did make money, but nearly all of its trades were coins the graduation strategy was already catching, just with more noise.
The 300 SOL version won 41 of its 42 real trades, but its wins averaged just 2.5%. The one loss was a −98% rug, and it more than wiped out everything the other 41 had made. A filter that skipped coins tied to wallets behind past drains went 12 for 12 live, but at 2.5% a win, one rug cancels out about 40 of them. That’s what pushed me toward the faster 100 to 300 SOL version.
The established tokens told the same story more slowly. Trend following beat simply holding on a risk-adjusted basis in three-year backtests, at about 50–56% a year with a 39% worst drop against 90%, but it earned so slowly that I stopped after running it with fake money for about a day. Buying small dips lost because the fees ate the bounce. The whale and smart-wallet signals showed no tradable edge in 37 hours of swaps, and arbitrage found zero profitable gaps in 481 price quotes.
I also kept a running list of results that looked amazing and were wrong. One momentum strategy showed a profit climbing from $373 to $544, but I’d been counting about 17.6 SOL of “virtual” liquidity in each pool as if it were real money. A graduation strategy with a perfect win rate was buying into pools that held less than 2 SOL. After a few of those I stopped believing any good number until it held up on data the strategy had never seen and matched what actually happened on-chain.
The one thing that worked
About half of all graduations happen in the same block as the launch, because someone buys the entire curve in one go. On some of those, a single wallet then puts 100 SOL or more into the new pool within about half a second. The price usually keeps creeping up for a few minutes after that.
So the bot bought right after a buy of 100 to 300 SOL landed. It sold at +10% or after three minutes, whichever came first, with a stop at −20%. In the backtest that made about 12 SOL over 663 trades at 1 SOL each. It won 85% of the time and made money in both halves of the data.
Live, it mostly did what the backtest said it would. Real buys landed within a block or two of the signal, and the prices I got were within a fraction of a percent of the simulated ones. Between October 1 and 5 the bot made 545 real trades and won 487 of them, or 89.4%. The first two days ran the 300 SOL version from the list above. Everything after that ran this one, which won 446 of its 503 trades (88.7%), and its winners made 7.9% on average.
It still finished slightly down, at −0.065 SOL. Counting a rug as any trade that lost half or more, the average rug cost 78.7%, so one rug undid about ten average wins. Whether a day made money came down to how often the coins got rugged. On October 4 that was 10 of 214 trades (4.7%), and the bot made 1.45 SOL. On October 5 it was 27 of 267 (10.1%), and I was also running an experiment that split each trade across three wallets. That day lost 1.27 SOL, and the three-wallet trades alone lost 1.80.
So I went looking for who was doing the rugging.
Who runs these coins
I took the wallets behind my losing trades and pulled their full transfer histories, up to 6,000 transactions each, then lined them up against everything in the database. The same pattern kept showing up:
- The operator’s main wallet sends 85–100 SOL to a brand-new wallet.
- That new wallet creates a coin and buys the whole curve in one transaction, so the coin graduates the moment it exists.
- Within about half a second, the main wallet buys roughly 150 SOL of it in the new pool. This was the big buy my bot was following.
- Bots start buying tiny amounts on a timer, and the creator sends small amounts of the token to thousands of wallets so the chart and the holder count look busy.
- The main wallet sells everything in one transaction, usually somewhere between 5 and 40 minutes later.
- The money goes into the next fresh wallet, and it starts again.
The fake activity is cheap. In the 1,096 coins I looked at closely, a typical pool got about 900 buys from around 300 wallets in its first four and a half minutes. The median buy was 0.0002 SOL. Added up, all of that outside buying came to about 12.8 SOL per pool, next to the operator’s 150.
How much they make
Following the money linked 858 wallets to 9 operators. Each had a main wallet and a small “gas” wallet that kept topping it up, and most had a steady stream of creator wallets they’d funded. In the histories I pulled, none of the nine sent money to each other or shared a counterparty, so as far as I can tell they’re separate operations that happen to run the same playbook.
The busiest one, a wallet starting 4G9JAz, led 143 coins in about four days, around 35 a day. It funded the creator of every one of them and dumped 98% of them, usually in a single sell about 14 minutes after buying in. Over those four days its main wallet took in about +16,145 SOL more than it sent out. At today’s price of roughly $92 per SOL, that’s about $1.5 million. Its gas wallet topped it up 53 times along the way.
A second operator, 2w3nD9, led 118 coins, and its transfer history shows about 76,170 SOL going out. The rest ran anywhere from a handful of coins to more than a hundred. Nobody here is getting lucky on a meme coin. These are businesses.
The other side of that ledger is everyone else. In one full day of data, about 262,000 wallets opened and closed around 1.06 million positions. Only 27.8% of those wallets came out ahead, and together they lost 26,500 SOL, about $2.4 million at today’s price. That money went to fees and to insiders like these.
Earlier on I’d looked at coordinated drains, where five or more wallets each sell around 1% of a coin’s supply in the same block. The first day of data had 45 of them, involving 1,618 wallets, and together they pulled out 21,214 SOL. That’s almost exactly the 20,821 SOL the big early buyers had put in.
There’s another layer underneath. A few wallets act as funding hubs, and one of them paid 111 flagged wallets, sits behind 761 coin launches and does about 1,200 transactions an hour. I assumed the hubs were behind the rugs that hit my trades, but they weren’t. They fund small launch-and-dump coins that rarely graduate, while the operators I was trading against fund their own creators.
Anatomy of a rug
My worst trade shows the whole thing in about four minutes. I bought 0.5 SOL of a coin right after 593 SOL of buying came in from one wallet. A bot then bought roughly 0.5 SOL every 12 seconds while the creator sent 20 tokens each to 3,871 wallets. Then that one wallet sold everything at once, taking 611.7 SOL out of a 680 SOL pool, and the price fell 99%.
My stop-loss fired a second later and got back 0.0093 SOL. Selling in the very next block would have gotten the same price, because when the whole dump is one transaction there’s nothing to get ahead of. The wallet that did it had been funded with 5,408 SOL by its gas wallet.
What bothered me most is that the bots and the token spraying showed up on 85–98% of my winning coins too. They weren’t a warning sign at all. It’s just what these operators always do.
Patterns in when they dump
Every big operator dumps early on some of its coins, inside my three-minute window, anywhere from about 2% to 13% of the time. Those early dumps were where my bot lost its money, so I spent a lot of time trying to predict them.
Big outside buys turned out to matter. When someone other than the operator bought 1 to 1.5 SOL, the operator dumped within 30 seconds 18.6% of the time, compared with 1.6% at a random moment. Pools that got an outside buy of 1 SOL or more in the first two minutes were dumped early half the time, against 12% for the rest. That doesn’t prove operators are watching for big buyers, but it’s why I kept my own buys under 0.8 SOL.
The operators also run on a rhythm. During a session they launch a new coin every 10 to 40 minutes, and coins inside that rhythm rugged only 2.8% of the time. The first coin after a break of 40 minutes or more rugged 5.7% of the time and lost money on average. Coins launched less than 10 minutes after the previous one rugged 12.5% of the time, though that’s only 16 coins. This one held up on data the rule had never seen.
Some operators hide their exits as well. They buy from one wallet, pass the tokens to a second wallet and sell from there, so the buying wallet’s history looks clean. On small coins that’s almost always how it works (126 of 128 early dumps). In the coins I traded it was rare until October 7 and 8, when four operators started doing it on 98 coins. One of those selling wallets received tokens from its buying wallet 585 times.
Simply blacklisting the operators didn’t work. The operators whose dumps cost me money were the same ones running the pumps I made money on, so skipping wallets with a history of drains cost me more winning trades than it saved me in losses. Narrower filters did better. The best one skipped operators that had already passed tokens to a second wallet on an earlier coin, but even that only trimmed the losses once the strategy started fading. I also tested about 25 different signals I could see at the moment of buying, and none of them predicted a drain reliably on new data.
After the worst day I checked whether they’d caught on to me. They hadn’t. The six rugs I checked on my main wallet came from six different operators, each dumping early at its usual rate. Nobody front-ran my buys, and the dumps came 50 to 140 seconds after I bought, not the few seconds you’d expect from someone reacting to me. No money ever moved between their wallets and mine either. It was just a bad day.
What I’d tell someone trying this
Record the market before you trade it. Having every trade on file next to each live run is the only reason I could tell bad luck from bad logic. Be suspicious of good results, too, because most of my early winners turned out to be a bug or luck. And size your trades for the rug rather than the average trade. Mine won 89% of its trades and still lost money.
The bigger lesson is that the edge was never really mine. It only existed because a handful of operators pumped coins in a predictable way, and it shrank as they changed how they dumped. By mid-October the strategy no longer made money on new data.
What this looks like from a security angle
Take the meme coins out of it and what’s left is a pump and dump, automated and running all day. Nearly every part of it is fake in some way. The “developer” is a brand-new wallet the operator funded for that one coin, so the dev and the biggest buyer are the same people. The big buy that makes the chart jump is the operator’s own money, and it leaves again in one transaction. Most of the trading activity is bots buying fractions of a cent, and the thousands of holders are mostly wallets the creator sprayed tokens to. When an operator sells from a second wallet, even the buying wallet’s clean track record is fake.
In the stock market, pushing a price up with coordinated buying and then selling into the people it attracts is textbook market manipulation. On Pump.fun it happens dozens of times a day out in the open. None of it is secret. It just hides in the volume and an endless supply of new wallets.
As a security research exercise, what surprised me was how little it took to see. I didn’t need any special access. A transaction decoder, a database and a lot of patient wallet tracing were enough to map nine separate operations and work out what the biggest ones took home. Their anonymity is thinner than it looks. They keep reusing the same gas wallets and funding their creators from one main wallet, and one of them bought exactly 163.04 SOL on coin after coin. Every transfer is public, so anyone willing to follow the money can map it.
Wallets in this post
Everything on-chain is public, so here are the full addresses of the operator wallets I’ve mentioned. Each one links to its page on Solscan if you want to dig in yourself. What’s below is what these wallets did on-chain, not who’s behind them.
4G9JAzftaydKjB2558MLnkYw175KMN6NGGgyxkeRuwwA: main wallet of the busiest operator, which led 143 coins in about four days.AzkmmXoHRiiVbDCF8ggcg8LkbH2dMKdsDLindwKAyTYx: the gas wallet that topped up 4G9JAz 53 times.2w3nD9VdShyo1zTuoajtgQKKSRMQNPSHxHPwDwfB5Q3c: main wallet of the second operator, which led 118 coins.6LjpaPokHuUZt5iG5zxMffC41191rwUqSEUuEErD8crm: the wallet that pulled 611.7 SOL out in one sell on my worst trade.12W7FEnkVqRjEW88vZJcuuBwNn1odNG9z7xX37CBT1dU: the wallet that funded 6LjpaP with 5,408 SOL.9F9hLL823Ktc59Jdk7oubZN3aDaD9KWKyHHbX8kXD7db: a buying wallet that passed its tokens to a second wallet to sell.B1ebs39uWpoAVmiY45GcJGCuooguZKnkVforAQKhh7Dw: that second wallet, which did the selling on 50 coins from October 7 on.5tzFkiKscXHK5ZXCGbXZxdw7gTjjD1mBwuoFbhUvuAi9: the funding hub that paid 111 flagged wallets.
Wrapping up
This was always an experiment, and it’s done. Could a bot out-trade the ruggers? Not reliably, and not for long.
The investigation ended up being the better part. I went in trying to trade around these people and came out with a pretty clear picture of how they work and what they take.
If you work in security, fraud or on-chain investigation, or you’re poking at something like this yourself, I’d genuinely like to compare notes. Get in touch on my contact page.