Cipher: insider detection

This is the one we've been building toward.

Cipher is running. Every new token launch is monitored for insider wallet activity from the moment it's created. The results are embedded directly in every token response — no extra call, no separate tool.

Most coordinated dumps follow the same pattern: wallets funded from the same source buy on the bonding curve, transfer tokens to clean wallets that never touched the curve, and those wallets dump when momentum builds. The buy wallets look like normal traders. The dump wallets look like they appeared from nowhere. Without tracing the transfers, you can't connect them.

Cipher traces the transfers. Every wallet-to-wallet SPL token transfer on a newly launched token is captured. Wallets that receive tokens without buying on the curve are flagged. Funding sources are traced. The full pipeline is reconstructed.

On every token now: insider count, insider supply %, sniper count and supply %, dev wallet status, CEX funding source where identifiable.

/insiders command in Relay: full report for any token — pipeline breakdown, timeline of the attack sequence, cross-token repeat offender tracking.

Signal filtering: volume surge, holder velocity, curve approaching, and buy pressure signals are now checked against Cipher's risk data before reaching you. Tokens that don't pass are removed. What comes through is clean.