Clusters
Telling one operator running ten wallets from ten traders having a good day.
A leaderboard is a target. Anyone who wants to appear on this one can run a script across twenty addresses, trade a token they control, and manufacture twenty perfect records.
Detecting that is a detection problem with two opposite failure modes, and the first two attempts each landed in one of them.
Following the money does not work
The obvious approach is to trace funding. Wallets controlled by one person were funded by one person, so build the funding graph and the arms fall out of it.
Measured against this chain, it found nothing. Operators seed each arm from a different source, which costs them almost nothing and defeats the entire method. Funding graphs catch the careless and nobody else.
Following the behaviour works
What an operator cannot hide is that their wallets do the same thing at the same time, because that is the point of running a script.
So wallets are grouped by the exact shape of what they did. Same favourite token, same number of closes, same number of wins, same trade count. A group has to be at least three wallets to count at all.
That catches operators reliably. It also, in its first version, caught a great deal of nothing.
Failure one, grouping the ordinary
The first rule folded 175 unrelated wallets into a single imaginary operator.
They shared a shape, technically. Each had traded once and lost. That is the most common thing a wallet on this chain does, and a rule that groups by shape alone will group every wallet that had an average day into one enormous syndicate.
Failure two, judging by rarity
The obvious correction is to weight by how unusual the shape is. Rare shape, real cluster. Common shape, coincidence.
This is wrong in the opposite direction, and it is wrong in the direction that matters more. A syndicate wide enough makes its own shape look ordinary. Run forty wallets through the same script and that shape now has forty examples on the board, which is not rare, so a rarity test hides the largest operators by construction. It catches small ones and lets big ones through.
Both versions were plausible. Only measuring told them apart.
What actually works is concentration
A group counts as one operator when it holds at least half of every wallet on the board carrying its shape.
The reasoning is about where a shape lives rather than how often it occurs. A common shape is scattered across hundreds of different tokens, because a lot of unrelated people each traded once and lost on whatever they happened to buy. A script's shape exists nowhere except on the token its arms were pointed at.
So the question is not how many wallets share this shape. It is what fraction of everyone with this shape is sitting in this one group, on this one token.
On a board of 12,249 wallets, this left one cluster, fifteen wallets with fifteen wins across thirty three trades. The rarity version had produced twenty one groups, most of them garbage.
What it looks like on the board
A detected cluster is folded into one expandable row, marked amber, carrying the combined figures. Expand it to see the individual arms.
Folding rather than flagging is the important part. A ten wallet operator unfolded occupies ten of the top fifty rows and pushes real traders off the board, so the leaderboard becomes mostly one person even when every row is correctly labelled.
The live example that motivated the whole feature was exactly that. Ten wallets, each showing a perfect forty five from forty five, sixty four thousand dollars between them, sitting across the top of the board looking like ten of the chain's best traders.
An empty cluster column is a normal reading
Detection running correctly does not mean clusters appear every day. After the concentration rule landed, the live board carried zero rows with a cluster size above one for a stretch.
That is the rule working. The version that always found something was the broken one.
What it does not claim
It does not identify people, and it does not accuse anybody of anything. It reports that a set of addresses moved in lockstep on one token, which is a statement about the addresses.
There are legitimate reasons for that pattern, including one desk trading from several addresses for ordinary operational reasons. The amber marker means treat these rows as one actor for the purpose of reading a leaderboard. It does not mean fraud.
Gas being subsidized until roughly the end of September 2026 makes the manufactured version cheaper than it will be afterwards, which is worth remembering when reading any track record built during this period.