Analyze Token Holder Distribution: Step-by-Step
Token holder distribution is one of the earliest and most telling signals of a project's health—or its potential to implode. A handful of wallets controlling 90% of the supply can dump at any second, leaving latecomers with worthless bags. Yet many investors skip this check, dazzled by hype or a polished website. In this guide, you'll learn a repeatable, five-step process to dissect any token's holder base, using free tools like Etherscan and Bubblemaps. We'll move beyond just looking at the 'Top 10' and show you how to spot suspicious clustering, hidden team wallets, and the exact concentration metrics that predict rug pull risk.
By the end, you'll be able to independently assess any Ethereum-based (or EVM-compatible) token within minutes. We'll cover everything from fetching raw holder data to visualizing wallet connections, calculating simple but powerful concentration indices, and compiling a red-flag checklist. No paid tools required—just a browser and a willingness to look beneath the surface. Let's start.
- Always check token holder distribution before investing; high concentration (>50% in top 10) is a major risk factor for rug pulls.
- Use Etherscan to get the raw holder list, then calculate simple metrics like Gini coefficient or HHI to quantify inequality.
- Bubblemaps reveals hidden wallet clusters that a plain ranking cannot show—indispensable for detecting sybil attacks or team wallets.
- Cross-reference distribution data with liquidity depth, contract ownership status, and recent large transfers to get the full picture.
- Fresh wallets, deployer holdings, and non-renounced contracts are classic red flags that significantly increase rug pull probability.
- A single metric is never conclusive; always combine concentration numbers, visual clustering, and trading activity for a holistic risk assessment.
Why Token Holder Distribution Matters
A token's price is ultimately a function of supply and demand, but who holds that supply matters immensely. If the top 10 addresses control more than 50% of the circulating supply, they can coordinate a dump that crashes the market in minutes. This is the classic 'whale concentration' risk. Conversely, a broad, decentralized distribution suggests that many independent actors believe in the project, reducing the chance of a single entity pulling the rug.
Beyond pure dump risk, distribution clues you into the project's true governance and tokenomics. A team that holds 20% of the supply in a single wallet can veto any vote. A 'liquidity provider' wallet that holds 40% of tokens may actually be the deployer waiting to drain the pool. By analyzing distribution, you're essentially performing a forensic audit of power dynamics.
In practice, we've seen rug-pull tokens where the top wallet (often the deployer) held over 80% and then sold into a fake pump created by a few other wallets. The distribution chart looked 'healthy' at first glance because the top 10 were all different addresses—but those addresses were all funded from the same source. That's why we need more than just a ranked list; we need tools that reveal relationships.
Step 1: Fetch the Top Holders on Etherscan
Start by navigating to the token's Etherscan page. Look for the 'Holders' tab—it's usually in the row below the main token info. Click it, and you'll see a table of all addresses holding the token, sorted by balance descending. Etherscan paginates the holder list, and the top holders shown are usually sufficient for analysis. Copy the 'Address' and 'Quantity' columns into a spreadsheet (you can also export the first page via the 'Download CSV' link, though it's sometimes hidden behind the 'More' menu).
- Note the total supply: At the top of the Holders page, check the 'Total Supply' value. Be aware that some tokens have a 'circulating supply' that differs from total supply due to burned tokens, locked contracts, or vesting schedules.
- Exclude obvious contracts: Many holders are exchange wallets (Binance, Coinbase) or DeFi contracts (Uniswap LP, staking pools). These are usually benign, but you should still note the percentage they represent. A token with 30% on a single exchange isn't necessarily malicious—but that exchange can pause withdrawals or get hacked.
- Look for the deployer's address: Find the address that created the token contract (visible on the 'Contract' tab). Check if that address appears in the top holders. If the deployer holds a large percentage, that's a major red flag, especially if the contract isn't renounced.
At this stage, you have a raw list. Next we'll turn it into actionable metrics.
Step 2: Calculate Key Concentration Metrics
With the top holders in a spreadsheet, you can compute two essential metrics: the Gini coefficient and the Herfindahl-Hirschman Index (HHI). Both measure inequality, but in slightly different ways.
Gini coefficient (simplified): Sort holders by balance ascending. Calculate the cumulative share of holders (x-axis) vs cumulative share of tokens (y-axis). The Gini is the area between the Lorenz curve and the line of perfect equality. A value of 0 means perfect equality (all hold the same), 1 means all tokens are in one hand. For tokens, anything above 0.7 is extremely concentrated and risky. You can approximate Gini using online calculators or even Excel's built-in functions, but a quicker heuristic: if the top 10 hold more than 70% of the supply, Gini is likely above 0.8.
Herfindahl-Hirschman Index (HHI): Sum of the squares of each holder's market share (expressed as a percentage). For example, if one holder has 50%, their contribution is 2500. Two holders with 25% each contribute 625 each, total HHI = 1250. An HHI below 1000 is considered decently decentralized (but still check for relationships). Above 2500 is highly concentrated. For tokens, an HHI over 3000 is dangerous.
Keep in mind: these metrics treat all holders as independent. That's why they're only the starting point. Next we'll visualize connections.
Step 3: Visualize with Bubblemaps
Bubblemaps.io is a free tool that turns wallet holdings into an interactive map. Enter the token contract address, and it loads a bubble chart where each bubble is a holder; size represents balance, and connecting lines show funding relationships (e.g., wallet A sent ETH to wallet B). This exposes hidden clusters that a mere ranked list would never reveal.
- Cluster detection: Look for groups of bubbles that are all connected. This likely indicates a single entity using multiple wallets to appear decentralized. If those wallets together hold more than 30% of the supply, it's a strong warning.
- Liquidity pool bubbles: Bubblemaps often shows a large bubble labeled 'Uniswap V2' or similar. That's the liquidity pool contract—tokens there are not available for dumping but can be withdrawn by the LP provider. Click on it to see who added the liquidity.
- Burnt or dead addresses: Bubblemaps may highlight a zero address or burn address. If a huge percentage is burned, the actual circulating supply is lower, making the remaining holder percentages higher.
The visual approach is especially valuable for detecting 'sybil' attacks where an airdrop farmer claims tokens across 50 wallets. While not always malicious, such structure indicates that a few people control a large share. Bubblemaps also allows you to tag addresses (e.g., 'Team', 'Vesting', 'Exchange') to better understand the map.
Step 4: Identify Red Flags Beyond Raw Numbers
Even if concentration metrics look moderate, several patterns warrant extra scrutiny:
| Red Flag | How to Detect | Risk Level |
|---|---|---|
| Deployer holds >5% after launch | Check contract creator on Etherscan, compare to holders list. | High |
| Multiple top holders funded from same address | Use Bubblemaps; look for shared funding sources. | Critical |
| Large holder is a fresh wallet with no history | Click on the address; see if it was created just days before token launch. | Medium |
| Top 10 supply is >80% and includes non-exchange wallets | Check each address; if they're not exchanges or legitimate protocols, consider it risky. | High |
Also watch for locking / vesting tokens that are shown as 'held' by a contract but can be withdrawn by an admin. A common rug pull tactic: the team locks tokens in a vesting contract on-chain, then calls a function to withdraw early. Use a block explorer to check if the token's contract has a 'mint' or 'withdraw' function that could bypass locks.
Step 5: Cross-Reference with Liquidity and Trading Activity
Holder distribution alone doesn't tell the whole story. A token might be widely distributed but have very shallow liquidity, meaning a big sell order from any large holder will crash the price. Use a tool like DexScreener to see the size of the pools. If the total liquidity is less than the combined holdings of the top 5 wallets, those whales could drain the pool in one go.
Also analyze recent large transfers. Use a transaction explorer (Etherscan's 'Token Transfers' tab) filtered for large amounts. If a top holder is moving tokens to an exchange, that's a sell signal. If many large holders are selling simultaneously, the distribution is actively shifting.
Finally, check if the token contract has renounced ownership. If the ownership is renounced, the team cannot change the token's rules later. You can verify this on Etherscan under the 'Contract' -> 'Read Contract' section. If the 'owner' field is the zero address, that's a positive sign. But renounced ownership doesn't guarantee distribution isn't skewed—the deployer could have already sold their tokens.
Bringing It All Together: A Repeatable Checklist
After running through the steps above, compile your findings into a final assessment. Here's a simple checklist you can reuse for any token:
- Top 10 concentration: Under 30% = low risk; 30-60% = moderate; over 60% = high risk (if not exchanges).
- Bubblemaps clusters: No clusters = low risk; one cluster holding >15% = moderate; multiple clusters together >30% = high.
- Deployer holdings: 0% = low; 1-5% = moderate; above 5% (unless locked) = high.
- Contract ownership: Renounced = low; not renounced = high.
- Liquidity vs top holder size: If top holder can sell more than 50% of the liquidity pool in one trade, that's extremely risky.
- Fresh address concentration: If more than half of the top 10 were created within 30 days of launch, treat as suspicious.
No single metric is decisive, but when multiple flags turn red, the probability of a rug or coordinated dump rises sharply. Use this checklist to quickly triage tokens before deeper analysis.
Advanced: Using Dune Analytics for Historical Distribution
For deeper research (e.g., tracking how distribution changed over time), Dune Analytics provides customizable dashboards. You can query the entire holder history of a token—see how many new addresses were created each day, what percentage of supply moved during a pump, and whether large holders accumulated or distributed. This is beyond the scope of a quick check, but it's invaluable for detecting a classic 'pump and dump' pattern where the team accumulates before a marketing push.
To get started, search for 'holder distribution' on Dune and find a query for the token you're analyzing, or write your own using the 'erc20_balances' table. You can then graph the Gini coefficient over time—if it was healthy at launch and slowly centralized, that indicates one entity buying up supply. Conversely, if it started highly concentrated and is now distributing, the team may be slowly selling, which is also risky.
Remember: on-chain data is immutable. Use it to verify marketing claims like 'fair launch' or 'no presale.' If the distribution shows a single wallet claiming the entire supply and then sending to many addresses, that's a structured presale—not a fair launch. Armed with these techniques, you can navigate the crypto jungle with confidence.
Frequently asked questions
What is a 'safe' Gini coefficient for a token?
There's no absolute safe number, but for utility tokens, a Gini below 0.6 is reasonable, while above 0.8 is highly dangerous. Stablecoins and blue-chip DeFi tokens often have Ginis around 0.6–0.7.
Can a token with great distribution still be a rug pull?
Yes. A team might distribute broadly but retain the ability to mint new tokens or drain liquidity through hidden functions in the smart contract. Distribution is one layer of many.
Do I need to pay for Bubblemaps?
No—Bubblemaps offers a free tier that allows you to explore tokens with moderate supply caps. Paid plans unlock larger datasets and faster processing, but the free version is enough for initial checks.
Should I trust holder data from Etherscan if the contract has a 'burn' function?
Be careful. Some tokens auto-burn on transfers, which can make holder percentages appear smaller over time. Always check the actual total supply at the moment you take the snapshot.
Related reading
Track the entities behind the concepts
DeFi Intel maps 11,000+ protocols, tokens and companies to a typed knowledge graph — with live data, incidents and regulation.