NexusVeritas Research Report #2

**The Rise of Recurring Operators**

*Published: June 2026*

*Engine: NexusVeritas v0.8.0*

*Cases Analyzed: 42*

---

Executive Summary

This report documents findings from 42 real-world Solana token investigations — double the dataset of Research Report #1. The central finding is not about individual tokens.

It is about the people behind them.

After 42 investigations, a clear pattern emerged: the same operators appear repeatedly across independent token launches. One funding wallet (Operator A) was confirmed across 4 separate tokens. Seven operator profiles were identified in total. Insider wallet clusters — coordinated groups of wallets funded from a common source — were detected in 22+ cases, with coverage ranging from 3% to 74% of total token supply.

**The strongest signal was not unlocked liquidity, whale ownership, or concentration. It was the repeated appearance of the same operators across unrelated token launches.**

This is what distinguishes NexusVeritas from conventional token scanners. While most tools analyze tokens, NexusVeritas tracks the behavioral patterns of the people behind them.

---

Research Dataset

|--------|---------------------|---------------------|

---

Recurring Operators

The Core Finding

Most blockchain security tools treat each token as an independent event. NexusVeritas tracks the funding relationships between wallets — and after 42 cases, one operator appeared four times.

Operator A

**Wallet:** AgmLJBMDCqWynYnQiPCuj9ewsNNsBJXyzoUhD9LJzN51

**Balance:** ~733 SOL | **Transactions:** 1000+

|------|-------|-------|---------|----------|

**Key observation:** All four tokens scored MEDIUM — not CRITICAL. This suggests the operator deliberately uses smaller clusters and lower coverage to avoid triggering high-risk flags in conventional scanners. The pattern would be completely invisible without cross-token behavioral analysis.

---

Insider Network Analysis

22+ Networks Detected Across 42 Cases

Insider networks — coordinated wallet clusters where 3+ holders share a common funding source — were detected in more than half of all investigations.

Cluster Size Distribution

|-------------|-------|-------------------|

**The 8-wallet cluster appeared three times** (CASE_008, CASE_016, CASE_037) — across different funding wallets. This strongly suggests 8 wallets represents a preferred operational scale, not coincidence.

Coverage Records

|------|----------|---------|-------|

**Critical finding:** The record case (74% coverage, 4 wallets) scored only MEDIUM (35). A conventional scanner would not flag this token as dangerous. The insider cluster controlled nearly three-quarters of the total supply.

Low-Risk Tokens With Active Insider Networks

|------|-------|----------|-------|

**Insider detection and overall risk score are not correlated.** A token can score LOW while still containing a coordinated insider cluster controlling significant supply.

---

Serial Deployer Ecosystem

Top Serial Deployers Found

|------|-------------|-----------------|

**No serial deployer was found in isolation.** Every case with a serial deployer was accompanied by at least one additional major risk signal — typically young token age, extreme concentration, or an insider cluster.

The Launch Factory Pattern

Across multiple cases, a recurring launch structure emerged:

Serial deployer (20+ launches)
+ Insider cluster (5-8 wallets, 3-10% coverage)
+ Young token (< 1 hour old)
+ Unlocked LP
+ Zero or near-zero liquidity

This pattern appeared in CASE_008, CASE_029, CASE_033, CASE_035 — with different funding wallets each time. The consistent structure across independent operators suggests this is a standardized launch methodology, not isolated behavior.

---

Key Findings

**1. Recurring operators exist and can be identified.**

Operator A was confirmed across 4 independent launches using behavioral wallet analysis. This is impossible to detect with token-level analysis alone.

**2. The 8-wallet cluster is a recurring structure.**

Three independent cases (different operators, different tokens) all used exactly 8 wallets. This suggests a preferred operational scale across multiple actors.

**3. High insider coverage can coexist with low risk scores.**

CASE_038 (74% coverage, 4 wallets) scored only 35 MEDIUM. Conventional scanners would not flag it. NexusVeritas detected it.

**4. Serial deployers always combine with other signals.**

No high-frequency deployer (20+ launches) was found without at least one additional major risk factor.

**5. The Launch Factory Pattern is a real behavioral template.**

Multiple independent operators use the same launch structure: serial deployer + small insider cluster + young token + unlocked LP. The consistency suggests shared knowledge or tooling.

**6. Operator A deliberately avoids CRITICAL thresholds.**

All 4 of Operator A's linked tokens scored MEDIUM. The operator appears to calibrate insider cluster size and coverage to stay below conventional detection thresholds.

---

What We Learned After 42 Cases

The first 20 cases established that insider networks exist and can be detected.

The next 22 cases revealed something more important: **the people running these operations are not random. They have preferred structures, preferred scales, and in at least one case, they have been operating continuously across at least 4 separate token launches.**

The question is no longer whether coordinated behavior exists on Solana. It does. The question is: how many operators are there, and how many launches are they responsible for?

---

Methodology Notes

**Coverage threshold:** Clusters with < 3% supply coverage are detected but not scored — suppresses noise from large-cap tokens where small clusters hold negligible supply.

**Insider detection:** Top 8 holders analyzed. Funding source identified via first incoming transaction. Known exchange/service wallets filtered via whitelist. Clusters where 3+ holders share a funding source are flagged.

**All scores deterministic.** No AI-generated scores. Every point attributed to a specific on-chain signal.

---

Limitations

• Sample size (42) is sufficient for pattern identification, not statistical significance

• Coverage threshold may suppress real networks with dispersed holdings

• Operator A represents only confirmed recurring behavior — others may exist below detection threshold

• Token-level analysis only; smart contract audit not included

---

Future Research

Priority 1: Track Operator A across additional launches
Priority 2: Identify additional recurring operators
Priority 3: GET /risk/creator — analyze operator history directly
Priority 4: Cross-token trust graph
Priority 5: Temporal analysis — when do operators typically launch?

---

*NexusVeritas is an open-source behavioral risk intelligence platform for Solana.*

*42 real-world investigations. 7 operators. 1 confirmed recurring.*

*github.com/nexusveritas/nexusveritas-api*

*No AI-generated scores. Every signal derived from on-chain data.*