How to Detect Insider Trading Onchain
Trace early buys, funding sources, and exact announcement timing (30 days before to 7 days after) to flag possible onchain insider trading.
To spot possible insider trading onchain, I trace early buys, check funding links, and compare trades with the first public announcement. I start with the token’s exact contract and a window from 30 days before the news to 7 days after.
Here’s what I check:
- Purchases and funding: Did the wallet’s activity differ from its usual trades?
- News timing and exits: Did buying happen before public clues, and was a later sale confirmed?
- Records and other explanations: Do transaction logs support the pattern, or could bots, rumors, or routine transfers explain it?
I keep the research read-only and separate facts from guesses. <u>A well-timed buy or exchange deposit does not prove wrongdoing.</u> My goal is a documented lead - not an accusation.
How to Detect Possible Insider Trading Onchain
Step 1: trace purchases and wallet funding
Once you’ve fixed the token and announcement date, trace who bought first and where their funding came from. Confirm the token’s exact contract address and chain using official project documentation or an official announcement. Record its decimals, then set a UTC window covering 30 days before the announcement through 7 days after.
Keep the investigation read-only. You don’t need to connect a wallet, sign transactions, or buy tokens.
Find early buyers with onchain tools
Use a chain explorer such as Etherscan to review transactions and contract calls. Check normal, internal, and ERC-20 transfers together so you don’t miss funds routed through contracts. Check swap logs, too: receiving tokens doesn’t always mean buying them. The tokens could come from a transfer or a liquidity-pool withdrawal.
Use Dune to query pre-announcement purchases and compare wallet flows across your chosen window. Nansen can add wallet labels and token-flow context, but coverage and feature access vary. Focus on first-time buyers and purchases that look unusually large compared with the wallet’s history or the pool’s size.
Follow funding sources and wallet links
Work backward from each relevant purchase to identify the assets that paid for it, including native tokens used for transaction fees. Follow intermediaries, bridges, DeFi protocols, and exchange addresses only where the trail is clear. Count the buyer’s wallet - not every contract the swap touched - or you could count the same purchase more than once.
Record funding times, purchase amounts, estimated execution prices, prior trades, and later transfers or confirmed sales.
Shared funding is a lead, not proof of common ownership. Shared gas sources and purchases that line up across wallets and dates warrant a closer look, especially when the pattern repeats across assets and dates. A shared exchange withdrawal wallet is particularly weak evidence: it may serve many unrelated customers.
Keep direct observations separate from interpretations, and mark where the funding trail becomes uncertain. These links feed into the timing check in the next step.
sbb-itb-0796ce6
Step 2: compare news timing and exchange deposits
Match trades to public announcement times
Check whether the wallets you traced traded around public news. Put purchases, funding, sales, deposits, and news events on one timeline. For each wallet and funding path, record the wallet address, transaction hash, block number, asset, amount, trade direction, and estimated U.S. dollar value.
Use block timestamps. On Ethereum, explorers show when a transaction was included in a block. Record times in UTC, then add U.S. local times and dates to avoid daylight-saving confusion. Use the earliest verified publication time, not the time of a repost.
Check listings, launches, unlocks, partnerships, governance votes, security disclosures, funding, and tokenomics changes. Separate scheduled events from unexpected disclosures. Before judging the timing, look for earlier project posts, governance proposals, rumors, price moves, and public calendar entries.
Compare activity 7 days, 24 hours, 6 hours, and 1 hour before the event. Include purchases later sold at a loss, canceled or reverted swaps, and post-announcement purchases - not just profitable trades.
Check warning signs and other explanations
Compare position size with the wallet’s usual trades, circulating supply, daily volume, and liquidity. Don’t rely on a fixed dollar cutoff. Check whether the broader market was rising, too.
For every dollar estimate, record the price source, timestamp, trading pair, and calculation method. Keep the trade’s execution price separate from any later spot-price estimate.
Use these checks to distinguish suspicious timing from normal market behavior.
| Signal | What it may indicate | Alternative explanation | Follow-up check |
|---|---|---|---|
| First-time purchase before unexpected news | Possible advance positioning | Public rumor or automated speculation | Earlier public signals and peer-wallet activity |
| Jointly funded wallets | Possible coordination | Shared exchange infrastructure or market-maker allocation | Synchronized trades and repeated destinations |
| Dormant wallet becomes active | Preparation for a planned trade | Rebalancing, key recovery, or migration | Older holdings, approvals, and other-asset activity |
| Fast realized gains | Possible use of advance information | News trading, arbitrage, or coincidence | Confirmed sales, costs, and unsuccessful trades |
| Token deposit to an exchange | Possible preparation to sell | Custody, collateral, rebalancing, or market making | Label verification and subsequent transfers |
Verify exchange labels with two reliable sources. Separate customer deposits from moves between an exchange’s own wallets.
A deposit does not prove a sale or insider trading, though it may support suspicion. Centralized-exchange trades happen offchain. Missing follow-up evidence weakens the case that a sale occurred, and onchain data alone cannot confirm execution.
Step 3: verify records and test your findings
After checking the timing, verify each transaction before treating the pattern as evidence.
Confirm transaction details and wallet labels
Open each transaction’s raw details and event logs. Check the chain, transaction hash, block number, block timestamp, sender, recipient, token contract address, token symbol and decimals, transferred amount, status, gas fee, and decoded function or action. Review ERC-20 Transfer events and traces, too. An explorer’s summary may omit movements you need to understand the transaction.
Label the transaction before calculating gains. A bridge may lock tokens on one chain and release them on another. Adding liquidity may send assets to a pool in exchange for LP tokens. Neither action automatically counts as a purchase or sale.
Keep unrealized gains separate from realized gains. Tokens still held after the announcement show unrealized gains - not realized profit. For sales, use one stated cost-basis method and account for fees and slippage only once.
Log each transaction’s hash, chain, block number, UTC time, wallets, token contract, amounts, price source, fees, labels, type, and uncertainty. Mark findings as observed, inferred, or unverified. Save exports and announcement records; screenshots alone are weak evidence.
Check wallet-attribution labels against public disclosures, official addresses, and independent reporting. A tag repeated across sources is not proof by itself.
With the records checked, test whether a routine explanation also fits the pattern.
Check routine explanations and identity claims
Check whether vesting, airdrops, incentives, grants, bot trading, bridges, or exchange rebalancing could explain the activity. Look for support in the relevant contracts and the wallet’s older transactions. Multiple wallets can serve legitimate purposes, and shared infrastructure can make unrelated activity look connected. Record which explanation the evidence supports and what remains unresolved.
Do not name a person based only on a wallet label or funding link. Separate what the wallet did from what you think it means. Blockchain records alone generally cannot establish who controls a wallet, access to confidential information, intent, or a legal violation.
Conclusion: review the facts before making a claim
After tracing wallets, timing, and transaction records, run one last check to separate a strong lead from coincidence.
Weigh the signals together. Early buying, linked funding, tight timing, and post-announcement exits can support a lead. One profitable trade, on its own, proves nothing.
Complete a final review checklist
Before sharing your analysis, check wallet history, funding links, exact UTC timing, exchange destinations, and later transfers or sales. Save the original announcement and look for earlier public clues.
Give every finding a source, a confidence level, and a plausible alternative explanation. Note gaps across bridges or chains, and verify the timeline against saved records. If a routine explanation fits just as well, label the result inconclusive.
Do not act on wallet signals alone. Frame the analysis as a documented lead, not a definitive accusation.
FAQs
How can I distinguish insider activity from bot trading?
Look at transaction timing and patterns. Insider activity often involves buying large amounts of tokens shortly before an official project announcement. These trades use nonpublic information that could affect prices, giving insiders an unfair advantage.
Bot trading works differently. MEV searchers, for example, react to pending transactions in the public mempool. They scan public data to carry out front-running or sandwich attacks and profit from price slippage.
How can I avoid cherry-picking suspicious trades?
Use double-conditioning: require volume to exceed both 30% of the monthly average and 60% of the highest recorded volume. An exponentially weighted moving average (EWMA) over a window such as 12 hours helps filter noise by comparing recent activity with historical trends.
Check onchain alerts against independent news sources. A volume spike alone doesn’t prove manipulation - it may reflect legitimate market activity.
What should I do if I find suspicious wallet activity?
Cross-check alerts with reliable news sources, social media, and official project updates. Use onchain analytics tools to check for unusual token concentrations or coordinated liquidity removals. If you suspect price manipulation, consider filing a formal report with the relevant U.S. authority.
Prioritize automated stop-loss orders to help protect your capital, but remember that execution prices aren’t guaranteed. Treat detection tools as warnings to protect your existing investments - not as opportunities to profit from suspicious activity.