The Coordination Map: Detecting Synchronized Wallet Behavior in Bittensor

The question, and the method

A network can look decentralized on the surface and be steered by a few hands underneath. Our earlier work measured concentration at the level of validators and subnets. This report goes one level deeper, to the wallets themselves, and asks a blunt question: how many of the wallets that appear independent are actually moving together?

The raw material is every staking action recorded on the network across roughly ten months: 8,147,892 events spanning add_stake, remove_stake, move_stake and nine other operation types. The detection idea is simple to state. Wallets operated by the same entity, or driven by the same script, tend to act in the same narrow windows of time. Find the pairs of wallets that co-occur far more often than chance would predict, and you have found coordination.

The hard part is the phrase "more than chance would predict." Naive co-occurrence does not work. The busiest bots on the network fire thousands of times a day, so they appear together constantly for no reason other than sheer activity. A first pass on raw co-occurrence surfaces exactly those high-frequency traders and tells you nothing.

The fix, and the credibility anchor of this entire report, is NPMI, normalized pointwise mutual information. Instead of counting how often two wallets appear together, NPMI measures how often they appear together relative to how often each acts on its own. A pair of hyperactive bots that happen to overlap scores low. A pair of otherwise-quiet wallets that fire in lockstep scores near the maximum. NPMI strips out the activity confound and leaves only pairs whose synchrony is genuinely anomalous.

One thing this method does not do, and we are explicit about it throughout: it does not prove identity. We detect coordination signatures, statistical evidence that wallets act in concert. On-chain data shows behavior, not ownership. Where we say "an operator," read it as "a coordinated set," not a proven single person.

What we found, honestly

After clustering, the network resolved into 420 coordinated clusters, containing 1,928 core wallets and 3,176 orbit wallets. Core wallets are the tightly synchronized center of an operation; orbit wallets are looser satellites that move with the core but less rigidly.

Here is the honest headline that most chain-analysis threads would bury: the majority of these clusters are not interesting. Of the 420, some 285 are what we classify as mass-exit clusters, crowds of wallets leaving the same subnet in the same window during a decline. That is correlated reaction to a shared event, not coordination in any meaningful sense. When a subnet sells off, many unrelated holders head for the door at once. We demote those.

The real signal is the minority that survives that filter: 14 shufflers, 72 accumulators, 29 mixed-signature clusters, and 20 multi-subnet operations. And even inside that group, we had to separate genuine gaming from ordinary delegation, which we cover in section five.

The shufflers are the story. A shuffler relocates staked alpha between hotkeys over and over, the move_stake operation, in tight synchrony. They are few, but they are not small. Here is what that handful actually accounts for.

Sixty-one wallets, 0.08 percent of the 74,067 distinct wallets on the network, account for 10.9 percent of all stake-shuffling. The full coordinated population, 3,178 wallets or 4.29 percent of the network, drives 12.2 percent. A cohort moving stake at roughly 130 times its population weight is not a fringe curiosity. It is a structural feature of how alpha gets relocated on Bittensor.

The map

This is the evidence, not the argument. Every dot is a wallet. Wallets that move together are pulled together and linked by the strength of their NPMI score, so a tight cluster is a coordinated set. Color marks what the cluster does. Size marks capital. Mass-exit clusters are greyed as context; the genuine operations glow.

Use it to verify, not just to look. Expand it, search for a cluster by number or subnet, and click into any operation to see its real numbers. The point of putting it here is that you do not have to take our word for cluster #225; you can open it yourself.

Anatomy of one operation

Cluster #225 is the cleanest coordinated operation in the dataset, so it is worth taking apart in full. It runs on SN66 (ninja) and consists of two core wallets plus five orbit wallets.

The two core wallets, 5G72tRNv... and 5HeALgDB..., executed 14,311 move_stake operations between them, 100 percent of them on SN66, with 96 percent firing within five blocks of each other. That is not two people who happen to trade the same subnet. That is one operation running two keys in lockstep.

The shape of the activity is the tell. Across the full seven-wallet cluster:

Read that as a funnel. Alpha is pulled in from 175 different source hotkeys and concentrated into just seven destinations, with zero overlap between the two sets. The structure scales cleanly: two core wallets feed two destinations, the full seven-wallet cluster feeds seven, roughly one destination per wallet. Then a large amount is extracted out to TAO, far more than is being cycled internally. This is a coordinated funnel-and-extract operation, not random churn.

What it is not

The interesting question is why. We tested three explanations and ruled each one out, which matters more than the answer we landed on.

• Not validator weight-gaming. The destination hotkeys do not rank as validators on SN66, or anywhere we can see in the validator records. They are not collecting validator emissions.
• Not trading profit. Zero of these wallets appear in the network's top 107 traders by realized PnL. Whatever this is, it is not a profitable directional strategy.
• Not pure wash. A wash operation cycles stake among its own hotkeys and nets to roughly zero. This one pulls from 175 external sources with no overlap into its destinations, and extracts 213,337 alpha to TAO. The money leaves.

What remains is a coordinated funnel-and-extract: consolidate alpha scattered across many hotkeys into a few, then liquidate to TAO. The leading inference is sophisticated coordinated position consolidation or liquidation. We stop there, because intent cannot be proven from on-chain data alone. We can show you exactly what the wallets did. We cannot read the operator's mind, and we will not pretend to.

Is it systemic

One clean operation could be an outlier. It is not. The same funnel-and-extract signature recurs across four named subnets: SN17, SN66 (ninja), SN85 (Vidaio), and SN103 (Djinn). Cluster #26 on SN17 ran 41,809 move operations funneling 143 sources into 13 destinations and extracted 154,972 alpha. Cluster #250 on SN85 ran 7,834 moves, 92 sources into 5 destinations. The pattern is consistent enough to be a recognized technique, not a one-off.

The distinction that matters

Here is where most analysis goes wrong, and where we spent real effort getting it right. Not every cluster that funnels stake is gaming anything. Some are ordinary delegation: nominators consolidating stake onto legitimate, named validators. The two look structurally similar on a graph, so we had to tell them apart.

The tell is whether the destination hotkeys are named. We found a large accumulator cluster, #219, that funnels roughly 70,000 TAO from many wallets into a handful of destinations. On the graph it looks like coordination. But 97 percent of its flow lands on named root validators, including tao.bot, Tensorplex, Taostats, 1T1B.AI and Yuma. That is not gaming. That is delegation working exactly as designed, and we excluded it. Same for clusters funneling to SN64 (Chutes) and SN105 (Beam) validators, where the destinations are fully named.

Genuine gaming funnels to unnamed hotkeys. After removing the delegation false-positives, the operations that remain target unnamed destinations on those four named subnets. Drawing that line, named versus unnamed destination, is what separates a real finding from an accusation, and it is a distinction most coordination analysis skips entirely.

Independent informed wallets

Coordination clusters are operators running many keys. There is a separate question worth asking: are there individual wallets that consistently time the market well, independent of any cluster?

We built a second lens for this, and it required the same discipline as the first. A naive version just surfaces hyperactive wallets that touch everything and are therefore trivially "early" on whatever later moves. After normalizing for activity, scoring by precision rather than raw count, a real signal survives: 136 wallets that entered subnets ahead of inflow surges with high consistency, and 37 that exited ahead of declines, none of them members of the coordination clusters. These look like genuinely separate informed actors.

One wallet stands out within that bound: 5GTF4f2F... exited 35 of 38 subnets ahead of declines, a large enough sample at high enough precision that it is unlikely to be luck. It is not in any cluster. Whether that is skill, a good momentum model, or access we cannot see, the data does not say.

What it means, and the edge

Three things hold up under scrutiny. Coordination on Bittensor is real and detectable at scale. It is concentrated: a 61-wallet cohort drives more than a tenth of all stake-shuffling. And it spans a spectrum, from benign delegation that we were careful to exclude, to opaque funnel-and-extract operations on named subnets whose intent we can describe but not prove.

This connects directly to the rest of the franchise. Reports 002 and 003 showed concentration at the validator and subnet level. This report shows it persists down at the wallet level, hidden behind the sheer number of addresses. And as Report 004 argued, if influence keeps concentrating, the tools to see who is actually moving in concert matter more, not less.

We will be straight about what this is not. We cannot tie these specific operations to price movement, because most of them completed before our price data begins, and we are not going to manufacture a market-impact claim the data does not support. What we have is a method that finds coordination others miss, a concentration result that needs no caveats, and one operation taken apart to the last hotkey. That is enough.