What Is Bundle Sniping? How Insiders Buy Before You Do

Bundle sniping lets memecoin insiders buy tokens before anyone else can. Here's how it works, how to spot it, and what Drill's data shows about bundler concentration on Solana.

Alex•

April 2, 2026

7 min read

What Is Bundle Sniping? How Insiders Buy Before You Do

You know that feeling when a token launches and by the time you click "buy," it's already up 300%?

That's not bad luck. That's not slow internet. Someone was literally in the same transaction as the launch itself, buying before the token was even publicly tradeable. They didn't beat you by milliseconds. They beat you by design.

It's called bundle sniping. And once you understand how it works, you'll never look at a Pump.fun launch the same way.

How a Normal Token Launch Works

Let me walk you through what's supposed to happen when a new memecoin goes live on Pump.fun.

A creator deploys a token. The bonding curve opens. Buyers start swapping SOL for the new token. The price rises as more people buy. If enough people buy (about 85 SOL worth), the token "graduates" and moves to a DEX like Raydium or PumpSwap, where it trades freely.

Simple enough. First come, first served. The people who find the token earliest get the best price.

Except that's not what actually happens. Not even close.

What Bundle Sniping Really Is

A bundle is a group of transactions submitted to Solana block builders (like Jito) as one atomic package. That means every transaction in the bundle either executes together, in order, or none of them execute at all.

Here's why that matters.

The token creator doesn't just deploy the token. They submit a bundle that includes the token creation AND buy orders from wallets they control. All in one shot. All in the same block. The creator's wallets buy at the absolute floor price, before any external buyer can even see the token exists.

Think of it like this: imagine a store opening its doors, but the owner's friends are already inside, filling their carts, before the "open" sign even flips.

On Solana, a block slot lasts about 400 milliseconds. Bundle sniping doesn't happen in the first second. It happens in the first fraction of a second, baked into the launch transaction itself.

The Playbook, Step by Step

Here's what a typical bundle snipe looks like:

Step 1: Create the wallets. The creator generates 5 to 20 fresh wallets. Brand new, zero history. Sometimes they fund them through intermediate wallets to make the money trail harder to follow.

Step 2: Build the bundle. The creator packages the token launch transaction together with buy orders from all those wallets into a single Jito bundle. Every buy is sequenced to execute immediately after the token goes live.

Step 3: Submit and execute. The bundle hits the blockchain. In one block, the token is created and the insider wallets already own a chunk of the supply. Nobody else had a chance.

Step 4: Wait and dump. As regular traders discover the token and start buying, the price goes up. The bundled wallets sell into that demand. According to research from Pine Analytics, 85% of these insider wallets dump within five minutes. 90% sell in just one or two transactions.

You're not trading against other retail buyers. You're buying the bags that insiders packed before you arrived.

How Common Is This? More Than You Think

Pine Analytics published a report analyzing Pump.fun launches and found that deployers systematically funded sniper wallets across over 15,000 token launches. The operation involved more than 4,600 sniper wallets and 10,400 deployers, extracting over 15,000 SOL in realized profit.

Those sniper wallets had an 87% success rate. Let that sink in. While most retail traders lose money on memecoins, the insiders who bundle snipe their own launches win nearly 9 times out of 10.

And this is just the confirmed manipulation. Pine Analytics estimates about 1.75% of all Pump.fun launches show clear evidence of deployer-funded sniping. The real number is almost certainly higher, because sophisticated operators use mixing and intermediate wallets to hide the connection.

In January 2026, CoinDesk reported on a trader who turned $285 into $627,000 in a single day by sniping a memecoin called ZREAL. Blockchain data showed the wallet executed hundreds of market sell orders over roughly 10 hours, a pattern consistent with bundle sniping.

What Drill's Data Shows About Bundlers

Here's where it gets interesting for anyone actually trying to trade.

I track bundler concentration (the percentage of a token's supply held by wallets that bought via bundles) across every token the algo evaluates. Over the last 7 days, among the 25 tokens that passed all of Drill's security and market health filters, the average bundler concentration was about 29%.

That's in what I'd call the dangerous zone. Anything above 15% means a significant chunk of the supply is sitting in wallets that got in at the absolute floor. Those wallets are ticking time bombs for sell pressure.

For context, here's how bundler concentration maps to risk:

Under 5% is healthy. You're mostly trading against organic buyers. Between 5% and 15% is a warning sign. Someone got in early and is sitting on cheap tokens. Above 15% is dangerous territory. A meaningful portion of the supply could dump at any moment.

29% average on selected tokens (the ones that passed every other filter) tells you something important: even the "good" tokens on Pump.fun have significant insider supply baked in from launch. It's not a dealbreaker by itself, but it changes how you should think about your exit strategy.

How to Spot a Bundled Token

You can't prevent bundle sniping. It's built into how Solana works. But you can learn to recognize it before you buy.

Check the bubble map. Tools like Bubblemaps and RugCheck show you how the top wallets are connected. If the biggest holders all received SOL from the same source wallet, or all bought in the same block, that's a bundle.

Look at wallet age. Bundled wallets are almost always brand new. Zero transaction history before the launch. If the top 10 holders are all wallets created in the last hour, you're looking at a coordinated operation.

Check the timing. If multiple wallets bought in the first 1 to 2 blocks (under a second) after the token went live, they were almost certainly bundled. Humans don't react that fast. Neither do most regular sniper bots.

Trace the funding. Follow the SOL that funded the buying wallets. If they all trace back to a common origin, you've found the deployer. Some tools like DeFade automate this analysis and show you the total bundle supply percentage.

Bundle Sniping vs Regular Sniping

Not all sniping is bundle sniping. Regular sniping is when independent bots race to be the first buyer after a token launches. That's competitive but not necessarily dishonest. The sniper doesn't control the token. They just have fast infrastructure.

Bundle sniping is different because the person launching the token is the sniper. They're not racing against anyone. They've rigged the sequence so their wallets buy in the same transaction as the launch itself. There's no competition because the outcome was determined before anyone else could participate.

Some creators will argue they bundle their own first buy to "protect against external snipers." And in some cases, that's legitimate. A small creator bundling a 2% allocation to prevent bots from grabbing 20% is arguably defensive. But when the bundled wallets hold 30% or more of the supply? That's not protection. That's the exit strategy.

What You Can Actually Do About It

Look. Bundle sniping isn't going away. The tools to do it are freely available on GitHub. The economics are too good for scammers to stop. So here's what you should actually do.

Check bundler concentration before you buy. This is the single most useful number. If bundled wallets hold more than 15% of the supply, know that you're buying into concentrated sell pressure. It doesn't mean the token will rug, but it means someone can dump a lot of tokens on your head whenever they want.

Don't buy in the first few minutes. The fastest money is also the most dangerous money. If a token is still holding up after 30 minutes with organic buying, the risk from bundled wallets drops significantly (they tend to dump early).

Watch for the drip sell. Bundled wallets rarely dump everything at once. They sell in small chunks to avoid crashing the price. If you see steady selling from wallets that bought in block 1, that's the drip. The price might look stable while supply is quietly being offloaded onto new buyers.

Use tools that flag bundles automatically. RugCheck, Bubblemaps, DeFade, and Drill all track wallet connections and bundler activity. Checking before you buy takes 30 seconds. Losing your money takes less.

Real Talk

Memecoin trading already has terrible odds. Drill's data from the last 30 days shows that out of 3,357 tokens tracked, only 125 passed all the algo's filters. That's a 3.7% selection rate, and even among those, the median outcome was 1.74x. Not 10x. Not 100x. 1.74x.

Now layer bundle sniping on top. Almost a third of the supply in even the "good" tokens was claimed by insiders before anyone else could buy. The game isn't fair. It's never been fair. But at least now you know exactly how it's unfair.

And that's worth something. Because the traders who get wrecked aren't the ones who understand the mechanics and trade anyway. They're the ones who never knew the game was rigged in the first place.