Spotting a Pump-and-Dump Before It Happens: What On-Chain Data Shows

A pump and dump crypto scheme can leave signs on-chain before the price starts to spike. Things like wallet concentration, liquidity, and wallets being funded in similar ways can all be checked on-chain if you know what to look for. This guide looks at the signals you can check before buying, rather than waiting until the price has already crashed.

Key summary

What Is a Pump-and-Dump Crypto Scheme?

A pump and dump crypto scheme usually follows the same basic pattern, even when the token is different. First, the people behind it quietly buy a large amount of a low-liquidity token before the wider market notices. Once they have enough, they start the pump. They buy more and promote the token heavily on social media, which pushes the price up and gets more people interested.

Then FOMO kicks in and retail buyers start buying. This is usually when the people behind the scheme start selling their tokens. Once the selling picks up, the dump happens. The price can fall very quickly, leaving people who bought near the top with a token that's worth far less than what they paid within minutes or hours.

This is a form of market manipulation, and it's worth understanding as a pattern rather than a one-off event, since the same basic structure repeats constantly across low-cap tokens, particularly on chains where launching a new token costs very little and requires no vetting at all.

On-Chain Signal One: Wallet Concentration

Checking how a token's supply is actually distributed across wallets is one of the clearest on-chain signals available before ever buying in. Most block explorers, Etherscan for Ethereum and Solscan for Solana among them, offer a holders view showing exactly how supply breaks down across addresses.

If a small number of wallets hold most of a token's supply, the risk of a coordinated pump and dump crypto scheme is higher. Those wallets have enough tokens to push the price up once other buyers start coming in, and they can then sell into that demand. If the supply is spread across many different wallets, it's harder for one person or a small group to control the price.

Checking this usually takes only a minute or two. You don't need any special tools. A regular block explorer is enough, so it's an easy check to make before buying a new token.

On-Chain Signal Two: Thin Liquidity

Liquidity shows how much money is available for people to buy and sell the token. When liquidity is low, even a small buy can push the price up a lot. A small sell can then send it back down just as quickly. This makes thin liquidity useful for anyone running a pump and dump crypto scheme because they don't need as much money to move the price.

Checking a token's total value locked and comparing it against trading volume gives a rough sense of how vulnerable it is to this kind of manipulation. A token with very little liquidity relative to the volume it's suddenly seeing is a meaningful warning sign, since that combination often means price is being pushed around by a small number of large, coordinated trades rather than genuine broad-based demand.

On-Chain Signal Three: Sudden Volume Spikes Without a Catalyst

A big jump in trading volume can be a warning sign. If there’s no news, exchange listing, or partnership that explains it, take a closer look at what’s going on.

Real demand usually has something behind it, such as a product update, a new exchange listing, or a genuine partnership announcement.

A pump and dump crypto scheme instead produces volume that appears out of nowhere, often within a very short window, with nothing external to justify it. That disconnect between a token's actual news flow and a sudden explosion in trading activity is worth treating as a genuine red flag rather than an opportunity to chase, since it's frequently a sign of coordinated buying rather than organic discovery.

On-Chain Signal Four: Fake or Misleading Liquidity Locks

Many token projects talk about a "liquidity lock" to make buyers feel safer. The idea is that the team can't pull the liquidity and disappear. But it's still worth checking the lock yourself.

A lock that ends in a few days or weeks doesn't offer much protection. The same goes for a lock that covers the liquidity pool but leaves a large team wallet outside of it. In those cases, the lock may not protect buyers as much as the project claims.

Checking a lock's actual terms directly on-chain, rather than trusting a project's own claim about it, is a genuinely important step. A pump and dump crypto scheme sometimes uses a real but short-dated or partial lock specifically to build false confidence during the accumulation phase, only for that protection to expire right around when the coordinated selling begins.

On-Chain Signal Five: Coordinated Wallet Funding Patterns

This is the hardest signal to spot manually, and often the most telling one. Before a coordinated pump begins, the wallets that will eventually buy in together are frequently funded from the same source, a single wallet distributing capital to several others shortly before all of them buy into the same token within a tight window.

Checked individually, each of those wallets looks unremarkable, a moderate purchase from an address with limited history. The pattern only becomes visible when you're watching several wallets at once and can see they were all funded from a common origin right before acting in near-identical timing. Spotting this by hand means manually tracing funding sources across multiple addresses simultaneously, which is realistic for one token you're specifically investigating, but effectively impossible to do continuously across a broad universe of tokens without some form of automated wallet monitoring.

Putting the Signals Together

One warning sign by itself doesn't prove that a pump and dump crypto scheme is happening. A new project with an anonymous team can still be legit. Anonymous or pseudonymous founders are common in crypto. A sudden rise in volume can also happen because of a real partnership that hasn't been announced yet. And a token with a few large holders isn't automatically a scam.

Things get more concerning when you see several of these signs at once. For example, a token with low liquidity, a sudden jump in volume, a few wallets holding most of the supply, and a strange liquidity lock deserves more attention than a token showing just one of these signs.

So don't rely on one signal alone. Check what else is happening around the token before making a decision.

Where SpotX Fits In

Catching coordinated wallet funding and accumulation patterns manually, across a broad universe of tokens rather than one you're specifically investigating, is genuinely difficult to do consistently by hand. This is exactly the kind of pattern SpotX is built to surface as informational context, not as a tool for executing anything, purely for recognizing coordinated activity before it becomes obvious.

SpotX watches wallet-level activity across four chains, Ethereum, Solana, Base, and Hyperliquid, looking for wallets moving together in size and timing, including the kind of pre-pump accumulation pattern described above. Every candidate runs through a scoring model built from seven weighted factors, including wallet track record and how independent a cluster of wallets is from each other. Anything scoring below 65 gets suppressed and logged, never published. Anything at 70 or above goes out as an alert, delivered through Telegram, Discord, or a webhook, carrying the wallet cluster, score, and the actual on-chain transaction hash behind it, so nothing is asked to be taken on faith. A 7-day free trial gives full access to see how that continuous, cross-wallet view compares against manually checking a token's concentration and liquidity yourself.