The three questions
Every Solana token scam needs at least one of three things to work, and each tool here interrogates one of them:
- A malicious or unsafe contract — live mint authority, freeze authority, honeypot mechanics. RugCheck's home turf.
- A concentrated or connected holder base — a few entities holding the float behind many addresses. Bubblemaps' home turf.
- A coordinated operation — wallets seeded by a common source, bundled launches, planned exits, a deployer with a graveyard of past launches. Cabal-Hunter's home turf.
RugCheck (rugcheck.xyz)
The default Solana token checker, and deservedly so — it's fast, free, integrated into half the Telegram bots on the chain, and its risk summary is readable at a glance. It has also been expanding beyond the contract: its Insider Networks beta flags suspicious connections between top holders.
Bubblemaps
The canonical "who really holds this" tool, on Solana and everywhere else. V2's Magic Nodes automatically expands the map beyond top holders to reveal hidden connections — real innovation, and its integrations into pump.fun and DexScreener put it in front of millions.
Cabal-Hunter (that's us)
One scan, one 0–100 Exit-Liquidity Risk score, one plain-English verdict — built for the moment before a buy, human or bot. The detection layers target coordination specifically: multi-hop funding-source tracing, first-buyer tracing (which keeps working after snipers exit), same-block bundle detection, live coordinated-dump detection, and the deployer's full launch history scored for serial rugging.
Side by side
| Capability | RugCheck | Bubblemaps | Cabal-Hunter |
|---|---|---|---|
| Mint / freeze authority, LP state | YES — best in class | no | yes |
| Honeypot / Token-2022 traps | YES | no | yes |
| Holder concentration | YES | YES — visual | yes |
| Holder connection graph | Insider Networks (beta) | YES — best in class | clusters, not a visual graph |
| Multi-hop funding-source trace, with evidence txs | no | holder-to-holder links | YES |
| First-buyer trace (works after snipers exit) | no | no | YES |
| Same-block (Jito bundle) launch detection | no | no | YES |
| Live coordinated-dump detection | no | no | YES |
| Deployer launch history scored | lists creator's tokens | no | YES — dead-launch rate |
| Single actionable verdict | risk list | visual | YES — score + sentence |
| Bot/agent integration | API | API (licensed) | REST + MCP, no key needed |
The case that separates them: a token with authorities revoked, LP burned, and a clean holder chart — but whose first buyers were funded from one source through intermediaries, took a double-digit slice at launch, and have already exited. RugCheck's contract report shows green. The bubble map looks clean because the snipers are gone from the holder list. The only place the operation still exists is the funding history of the first buyers — which is exactly what our early-buyer trace reads. This "unbundled launch" pattern is documented at scale; we wrote up the mechanics in our bundle-checker guide.
When to use which
- Browsing / first filter: RugCheck. Free, instant, catches the crude scams that are still most of the volume.
- Deep manual research on a serious position: Bubblemaps, alongside everything else.
- The last check before a buy — or inside a bot/agent: Cabal-Hunter. One call, one verdict, evidence attached:
# free tier: 250 scans/month, no signup, no API key curl "https://api.cabal-hunter.com/api/scan-cabal?mintAddress=<MINT>" "verdict": "AVOID — 6 wallets funded by the same source (7dK2…mQ4x), controlling 23.1% of supply. High probability of coordinated dump."
Or, for AI agents, the same engine as an MCP server: npx cabal-hunter-mcp.
Bottom line
Use all three; they overlap far less than the "vs" framing suggests. RugCheck tells you the contract won't trap you. Bubblemaps shows you who holds it. Cabal-Hunter tells you whether the people who hold it — or held it at launch — are one actor wearing many wallets. The expensive scams of 2026 are the ones that pass the first two checks. That third question is the one we built for, and our full comparison page goes deeper if you want the detail.