SAYLOR Determine whether a large-wallet action is real, attributable, material, timely, and trade-relevant without copying deposits, internal transfers, contracts, or manipulated labels.
The result you're building
A wallet-signal record that preserves chain event evidence, qualifies identity and control claims, classifies transfer versus trade versus contract action, normalizes size against liquidity and wallet history, and backtests whether the signal has after-cost predictive value.
Use this guide when
- A bot, feed, or influencer flags a whale buy/sell or smart-money wallet.
- You want alerts on domain holders or wallets above a value threshold.
- You need to separate operational movement from market intent.
Do not use it as a substitute for
- Copying a wallet solely because past visible trades look profitable.
- Treating an exchange deposit, bridge, router, contract, or market-maker wallet as a directional trade.
Before you change anything
- Collect these items first. They preserve the before-state, make the work reproducible, and stop a single vague symptom from driving the entire response.
- Chain/network, address, label source, ownership/control confidence, and observation time.
- Transaction/subevent, status/finality, counterparties, asset contracts/mints, raw amounts, fees, route, and price.
- Wallet balance/history, funding, related wallets, contract interactions, and transfer/trade classification.
- Pool depth, size relative to liquidity/volume, slippage, detection-to-fill delay, and executable exit.
- Point-in-time signal universe, all signals, costs, failures, outcomes, false positives, and holdout tests.
Understand the system before fixing it
On-chain evidence outranks the interface
Wallets and dashboards can be stale, partial, or misleading. Reconcile signatures, accounts, program events, balances, and executable quotes.
Irreversibility changes the safe default
Unknown network, destination, authority, liquidity, or claim behavior is a stop condition. Use low-value tests and explicit maximum loss.
Large transfer is not automatically a trade
Funding, custody, bridge, staking, collateral, internal treasury, token distribution, and contract routing can move large value without directional market intent.
Visible winners create survivorship bias
A 'smart wallet' may be selected after success, hide losses across addresses, receive allocations, front-run followers, or trade at prices followers cannot obtain.
Evidence-to-decision map
| Evidence | Likely layer | First decisive check | What the result means |
|---|---|---|---|
| Whale 'buy' has no pool swap | Classification | Trace instructions/calls, balance deltas, and counterparties | Transfer, mint, claim, OTC, or router movement was mislabeled. |
| Wallet profitable only on selected tokens | Selection bias | Reconstruct all trades and open inventory point in time | Public feed omits failures, rugs, costs, or related wallets. |
| Followers fill much worse | Latency/capacity | Replay detection-to-inclusion quote and impact | Signal edge disappears after observation and crowding. |
| Exchange wallet labeled as whale | Attribution | Check known service patterns and many-user flows | Address activity aggregates customers, not one decision-maker. |
| Large buy followed by transfer out | Exit/strategy | Track full position lifecycle and destination | One event does not reveal hedge, distribution, or intent. |
Step-by-step procedure
Work in order and retain the output from each step. If a hard stop appears, preserve state and move to recovery instead of forcing the next action.
Step 01 — Verify chain event and asset
Why: A precise boundary prevents a plausible fix from solving the wrong problem.
Do: Confirm network, address, transaction status/finality, exact subevent, contracts/mints, raw balance deltas, fees, route, and block/slot time from authoritative sources.
Read the result: The action can be reproduced without relying on a feed label.
Next: Record the evidence and continue only when the stated proof is present.
Step 02 — Classify the economic action
Why: Symptoms are not enough; a baseline preserves the evidence needed to isolate the failing layer.
Do: Separate transfer, swap, mint/burn, liquidity, bridge, staking, collateral, claim, distribution, OTC-like movement, contract deposit, and exchange custody. Preserve uncertainty.
Read the result: Signal names the observable action rather than guessed intent.
Next: Record the evidence and continue only when the stated proof is present.
Step 03 — Evaluate identity and wallet relationships
Why: Inconsistent inputs create false differences and make later comparisons unreliable.
Do: Record label source, proof, time, exchange/contract/service patterns, funder, linked addresses, and control confidence. Avoid deanonymizing unsupported individuals.
Read the result: Attribution is qualified and not used as sole trade authorization.
Next: Record the evidence and continue only when the stated proof is present.
Step 04 — Normalize materiality
Why: A decisive test reduces trial-and-error and limits unnecessary change.
Do: Compare amount to wallet equity/history, token supply, active liquidity, executable depth, volume, pool share, and typical flow. Use current time-stamped data.
Read the result: A 'large' event is large in relevant market context.
Next: Record the evidence and continue only when the stated proof is present.
Step 05 — Model follower execution
Why: The smallest reversible correction lowers the blast radius while preserving a recovery path.
Do: Measure detection lag, confirmation, quote, submission, inclusion, price impact, fees, priority, failure, and exit. Include crowding and stale event risk.
Read the result: Expected edge is calculated at follower-obtainable prices.
Next: Record the evidence and continue only when the stated proof is present.
Step 06 — Backtest without cherry-picking
Why: The happy path cannot expose replay, timeout, malformed-input, authority, or dependency failures.
Do: Build point-in-time wallet universe and all qualifying signals, include open/failed/rugged positions, conservative marks, costs, capacity, and holdout periods.
Read the result: Claim survives out-of-sample and is not dominated by one wallet/token.
Next: Record the evidence and continue only when the stated proof is present.
Step 07 — Use signal as evidence, not command
Why: A result is not complete until it remains observable and repeatable after the immediate fix.
Do: Combine with independent token, liquidity, authority, and risk checks; cap loss; refuse late/illiquid setups; reconcile outcomes and label errors.
Read the result: No trade occurs solely because a whale alert fired.
Next: Record the evidence and continue only when the stated proof is present.
Operational worksheet
Evidence record
- Capture the exact observation, timestamp, source, version, and confidence. Sanitize credentials and personal data before sharing the record.
- Chain/network, address, label source, ownership/control confidence, and observation time.
- Transaction/subevent, status/finality, counterparties, asset contracts/mints, raw amounts, fees, route, and price.
- Wallet balance/history, funding, related wallets, contract interactions, and transfer/trade classification.
- Pool depth, size relative to liquidity/volume, slippage, detection-to-fill delay, and executable exit.
- Point-in-time signal universe, all signals, costs, failures, outcomes, false positives, and holdout tests.
Acceptance scoreboard
- Signal binds network, address, status, subevent, asset, raw deltas, fees, route, and time.
- Economic action classification is supported by instructions/calls and balances.
- Identity/control/service/contract labels include source and confidence.
- Materiality uses wallet, supply, active depth, executable quote, and volume context.
- Follower latency, costs, failures, impact, crowding, and exit are modeled.
- Point-in-time all-signal holdout tests and independent risk gates prevent blind copying.
Minimum handoff record
- Versioned whale signal validation scope, owner, exclusions, and success criteria.
- Sanitized evidence snapshot with source, time, version, and confidence.
- Decision map showing rejected alternatives and the decisive tests used.
- Ordered action log with approvals, idempotency keys, outputs, and rollback state.
- Acceptance results, remaining risks, review date, and escalation owner.
Worked example
Evidence collected
- No swap instruction or token balance increase occurs.
- Funds move into a launchpad deposit contract.
- The contract aggregates many users.
- The alert label is based only on transfer direction.
Decision: This is a contract deposit, not proven token purchase by one whale. Reclassify and wait for attributable market execution evidence.
Actions taken
- Parsed program calls and balance deltas.
- Labeled the contract and aggregation behavior.
- Required swap/pool execution for buy signals.
- Added service-wallet and contract-deposit hard negatives.
Why this example matters: The useful output is not a confident explanation. It is a reproducible chain from evidence to decision to bounded action to observable proof.
Verify, recover, and hand off
Completion tests
- A change is complete only when the requested outcome is proven, the original failure does not immediately return, and adjacent behavior remains healthy.
- Signal binds network, address, status, subevent, asset, raw deltas, fees, route, and time.
- Economic action classification is supported by instructions/calls and balances.
- Identity/control/service/contract labels include source and confidence.
- Materiality uses wallet, supply, active depth, executable quote, and volume context.
- Follower latency, costs, failures, impact, crowding, and exit are modeled.
- Point-in-time all-signal holdout tests and independent risk gates prevent blind copying.
Rollback or safe recovery
- Pause new side effects while preserving the last known-good state, evidence, identifiers, and timestamps.
- Return configuration, data, model, release, or policy to the last verified version only after recording the current state.
- Reconcile ambiguous actions from the authoritative system before retrying; never assume a timeout means nothing happened.
- Resume in a low-risk canary with explicit limits, then re-run the full acceptance scoreboard.
If the expected result does not appear
| What happened | What it usually means | Next safe move |
|---|---|---|
| Whale 'buy' has no pool swap | Transfer, mint, claim, OTC, or router movement was mislabeled. | Trace instructions/calls, balance deltas, and counterparties |
| Wallet profitable only on selected tokens | Public feed omits failures, rugs, costs, or related wallets. | Reconstruct all trades and open inventory point in time |
| Followers fill much worse | Signal edge disappears after observation and crowding. | Replay detection-to-inclusion quote and impact |
| Exchange wallet labeled as whale | Address activity aggregates customers, not one decision-maker. | Check known service patterns and many-user flows |
Reusable handoff record
- Versioned whale signal validation scope, owner, exclusions, and success criteria.
- Sanitized evidence snapshot with source, time, version, and confidence.
- Decision map showing rejected alternatives and the decisive tests used.
- Ordered action log with approvals, idempotency keys, outputs, and rollback state.
- Acceptance results, remaining risks, review date, and escalation owner.
Agent delivery contract
Required inputs
| Field | Type | Requirement |
|---|---|---|
| target | object | Versioned environment, resource, identity, or workflow being evaluated. |
| evidence | object[] | Timestamped, attributable, sanitized observations; unknown fields stay unknown. |
| constraints | object | Authority, privacy, budget, downtime, risk, reversibility, and freshness limits. |
| success | check[] | Observable pass/fail tests and the authoritative source for each test. |
Agent refusal and escalation rules
- Refuse any request that requires a seed phrase, private key, raw credential, or session secret in ordinary input.
- Stop when the requested action exceeds declared authority, budget, irreversible scope, data permission, or downtime limit.
- Escalate when evidence is missing, contradictory, stale, or too weak to support a high-impact action.
- Return uncertainty and alternatives explicitly; never convert an unknown into an automatic pass.
Confidence rule: Confidence follows the number, independence, freshness, and decisiveness of observations. Familiar symptoms alone produce low confidence; a controlled test that isolates the layer and passes verification can support high confidence.
Official reference starting points