blog · nansen · updated 2026-10-04

Sixty of sixty-two wallets share one funder

8,093 agents on Monad point at one deleted document, registered by 7,962 different wallets. A wallet count says how many. It cannot say whether that is thousands of operators or one. Nansen can.

The cluster

Our operators page groups agents by the registration document they point at, not by wallet. Grouped that way, the largest cluster in the registry is one URL on a Vercel preview deployment that has since expired. Asking it today returns HTTP 404.

8,093 agents across 7,962 distinct wallets registered the same document, which answered HTTP 404 — The live operators page. Every one of those registrations is still on chain, still hash-perfect and still listed by every tool that reads the registry. The only thing describing them has gone.

Grouping them is already useful. The next question is the one a buyer actually has: are these 7,962 independent operators who reused a template? Or one hand behind many addresses? The registry has no way to answer that. Every wallet is a fresh address with nothing in common but the document.

Who sent each wallet its first gas

A new wallet on Monad cannot register anything until something sends it MON for gas. Whoever sent it that first MON is its first funder. That is one of the relations Nansen's profiler returns. We call profiler/address/related-wallets on Monad for a sample of the cluster's wallets, read the entry tagged First Funder and record it with the funding transaction.

endpoint	`profiler/address/related-wallets` chain: monad, relation: First Funder
cost	1 credit per wallet, paid per call over x402 71 credits for the run below
sample	62 of the 7,962 wallets ordered by md5(address), so a rerun asks the same wallets
not used	address labels 100 credits per wallet, not affordable at this scale

The integration, stated so it can be checked and repeated.

Who funded those wallets, from Nansen: 60 of 62 sampled wallets first funded by 0x97cd…0996 — The result on the operators page. 60 of the 62 sampled wallets were first funded by one address. The same panel shows the smaller clusters, where a single funder is behind every wallet sampled.

Every row carries a funding transaction, so none of this rests on trusting Nansen or us. Here is the first one, opened on Monad:

$ cast tx 0x04d8d5f83e3785ec892ac9f7ef06908c73b0c864a45284ed709b2460134f069b --rpc-url https://rpc.monad.xyz
blockNumber  55949903
from         0x97cD97CFE21799bacBf39D0a53469e5f82f30996
to           0xfCADC1758a2a473A9DcbFA77747B66Cc1849016d
value        11000000000000000000

11 MON from the shared funder to one of the cluster's wallets. The other funding transactions have the same shape.

Where it is used

It is not a side panel. Twin, our shared-document agent, carries the first-funder line in its paid answer, so a buyer asking about an agent in this cluster learns it shares one funder with thousands of others. Every cluster page shows the same with its transaction links. A daily job spends the remaining credit budget on the next clusters and keeps a reserve, so the sample grows rather than arriving in one burst.

The request shapes and the credits spent are written up on the developers page, so anyone can repeat the run.