Accumulation Clusters & Sybil Detection

What are Accumulation Clusters?

An accumulation cluster is formed when 3 or more tracked wallets buy the same token within a 72-hour sliding window. The detection logic runs continuously — as each new swap is processed, Ramaris checks whether the buying wallet, token address, and timestamp fall within an existing or new cluster window.

Dynamic thresholds apply to high-volume tokens. For tokens with deep liquidity and high daily trading activity, the minimum wallet count threshold adjusts upward to reduce noise from tokens that receive broad, routine buying interest. For lower-volume tokens, the standard threshold of 3+ wallets within 72 hours applies.

Clusters progress through a status lifecycle:

How Clusters are Detected

Detection runs inline with swap processing. When a swap event arrives:

1. The token address and buyer wallet are extracted from the swap
2. Ramaris checks for an existing ACCUMULATING cluster for that token within the 72-hour window
3. If a cluster exists, the wallet is added as a member
4. If no cluster exists and this wallet’s buy would bring the count to the minimum threshold, a new cluster is created
5. When a cluster member sells, the cluster transitions to EXIT_DETECTED

The firstBuyAt timestamp anchors the 72-hour window. All subsequent buys of the same token are evaluated against this anchor. If buying resumes after a window expires, a new cluster is created rather than extending the old one.

Sybil Detection

Raw wallet counts can be misleading. A single entity operating multiple wallets inflates the apparent breadth of accumulation. Ramaris runs a 5-signal sybil detection pipeline to estimate how many independent entities are behind a cluster’s wallet count.

Signals

Weights are auto-normalized based on which signals are available. If funding source data has not yet been fetched for some wallets in a cluster, the composite score is computed from the available signals only, with weights re-scaled proportionally.

Composite Scoring

Each wallet pair in a cluster receives an individual composite score:

composite = sum(signal_score * signal_weight) / sum(available_weights)

This produces a score between 0.0 and 1.0 for each pair, representing the estimated probability that the two wallets are operated by the same entity.

Entity Grouping

Ramaris uses a Union-Find (Disjoint Set Union) data structure to group wallet pairs into entities:

1. Composite scores are computed for all wallet pairs in the cluster
2. Any pair with a composite score above 0.60 is merged into the same entity
3. The number of resulting connected components is the estimatedEntities count

Confidence

Reading Cluster Data

Key Fields

Interpreting the Numbers

A walletCount of 13 with an estimatedEntities of 3 means the pipeline identified approximately 3 independent actors spreading their activity across 13 wallets. This is analytically different from 13 genuinely independent actors.

When estimatedEntities equals walletCount, either no sybil patterns were detected or insufficient data was available. A confidence level of unknown indicates the analysis has not yet completed or lacked enough wallet history to score meaningfully.

The entityGroups field maps wallet indices (from the members array) into groups. Wallets that appear in the same group scored above the 0.60 merge threshold against each other.

Example Response (Agent API)

{
  "data": [{
    "id": 1,
    "token": { "address": "0x...", "symbol": "cbBTC" },
    "status": "ACCUMULATING",
    "walletCount": 13,
    "totalUsdVolume": 45000,
    "sybil": {
      "estimatedEntities": 3,
      "confidence": 0.82,
      "entityGroups": [[1,2,5,8,9,10,11,12], [3,4,6], [7,13]],
      "signalsUsed": ["temporal", "funding", "nonce", "gasStation", "contractOverlap"],
      "analyzedAt": "2026-02-23T12:00:00Z"
    }
  }]
}

Feature Availability

ULTRA plan users see sybil entity data directly in the cluster view on the Ramaris dashboard. Agent API responses include full sybil data at $0.05 per request regardless of subscription tier.

See Pricing for a full plan comparison.

Agent API

The Agent API exposes cluster data with sybil analysis for programmatic consumption by AI agents and automated workflows.

Endpoint: GET https://api.ramaris.app/agent/v1/clusters

Pricing: $0.05 per request via x402 micropayment. No subscription or API key required — payment is handled at the HTTP layer.

What’s included:

• All active ACCUMULATING clusters
• Full sybil analysis fields (estimatedEntities, confidence, entityGroups, signalsUsed)
• Cluster metadata: token address, symbol, wallet count, total USD volume, status, timestamps

For AI assistants and code generation tools, pass the full API schema to your tool of choice:

https://www.ramaris.app/llms-full.txt

This file contains the complete endpoint definitions, request/response schemas, and authentication details. See also the API Documentation page for interactive docs and OpenAPI spec.

For informational purposes only. Not financial advice. Sybil entity estimates are probabilistic heuristics based on on-chain behavioral signals. They do not constitute certainties about wallet ownership or operator identity.