Look at any DEX token's volume rankings and you'll find some tokens with 24-hour trading volumes easily exceeding tens of millions of dollars, yet their communities are dead quiet. Most likely, MEV bots are generating massive noise through arbitrage, front-running, and sandwich attacks. To see how much volume actually comes from real users, all you need is an on-chain data tool and a full set of filtering logic.
I'll break down the filtering process into four steps, all centered around Ethereum mainnet and EVM-compatible chains. The tools are Dune Analytics public dashboards and Etherscan queries you can run yourself. No complex models—just strip out three types of typical bot volume.
Step 1: Pull the Token's Raw Swap Records and Flag MEV Traits
Don't just look at volume numbers. Pull every DEX swap record one by one and identify which trades bear clear MEV signatures.
- Open Dune Analytics, enter the token's contract address in the search bar, find community-maintained "DEX trades" dashboards (like @hildobby's DEX volume/price board), or create a new query yourself.
- In the query, join the dex.trades table and filter where token_bought_address or token_sold_address equals the target token address.
- Add a key field: analyze tx_hash context. MEV arbitrage and front-running trades almost always happen within the same block, and often the same from address buys then sells or sells then buys in that block.
Completion criteria: You'll be able to distinguish two types of trades: same address completing a reverse swap pair in the same block (typical arbitrage or liquidation), and multiple addresses attacking the same trading pair in succession within a single block (side trades of a sandwich attack).
⚠️ Risk reminder: Never click on third-party websites that claim to "remove MEV volume in one click" and ask you to connect your wallet. Filtering MEV only requires reading data; you never need to give out your private key or sign anything on-chain. If a dashboard demands a wallet connection to "show real data," close the page immediately.
Step 2: Remove Pure Arbitrage MEV Bot Volume
Pure arbitrage bots follow a fixed pattern: they use flash loans or complete a "buy → sell" loop within a single atomic transaction to capture tiny price spreads. This volume is completely irrelevant for real users and must be excluded entirely.
- Using the records flagged in Step 1, filter for the same tx_hash that contains both a buy and a sell of the target token.
- Further filter those where the buy and sell amounts are nearly identical (difference < 0.5%) and the bought and sold quantities almost completely match. These are almost certainly bot arbitrages.
- Add a filter in your Dune query:
abs(buy_amount - sell_amount) / buy_amount < 0.005andbuyer = seller. - Exclude all volume from these trades—keep nothing.
Completion criteria: After subtracting the dollar value of these arbitrage trades from the raw daily volume, the remaining number will look noticeably "cooler." If a token's volume drops by half or even 80% after filtering, it means the previous large volume spikes were mostly MEV-driven, and the real user base is tiny.
Step 3: Strip Out Sandwich Attack Side Trades, Keeping Victim Swaps
Sandwich attacks leave three footprints: the attacker's front-run trade, the victim's genuine swap, and the attacker's back-run trade. Together they inflate volume, but only the victim's trade comes from a real user and should be kept. The attacker's side trades must be removed, otherwise volume can appear over twice as high.
- Still based on the Step 1 query, now filter for groups of three or more swaps for the same trading pair within the same block.
- Identify "front-victim-back" patterns: attacker address A buys (or sells), then victim address B buys (or sells), then address A immediately sells (or buys) the opposite direction. Attackers might use different nonces or signers from the same bot, so also check if the from address is a known MEV bot contract.
- In practice, you can directly use EigenPhi or Dune dashboards that already label MEV trades (e.g., @eigenphi's MEV data). If you do it manually, open the adjacent transactions on Etherscan, compare the Input Data and the called router contract to see if it's a common MEV bot (like Banana Gun, Flashbots builder, etc.).
- When stripping, keep only the victim's trade and deduct all attacker buy and sell volume from the total.
Completion criteria: After keeping only isolated victim trades, the fake volume chewed up by sandwich attacks disappears. You'll get a cleaner "non-MEV side trade volume" number. If 90% of a pool's swaps are nested in sandwich patterns, then almost all users are exposed to sandwiches and the pool's liquidity authenticity is terrible.
Step 4 (Optional): Filter High-Frequency but Non-MEV 'Fake User' Addresses
Some volume-padding addresses aren't MEV bots, but market makers or project-hired self-trading address clusters. They don't close loops within one block, but instead repeatedly make small, same-price buy and sell trades spread over hours or days. This is common for newly listed tokens or low-liquidity meme coin pools.
Situation A: You only want to remove MEV bots and don't care about artificial wash trading.
- Stop at Step 3. Step 4 is not required.
Situation B: You want to further filter out suspected self-trading addresses to get "high-confidence genuine retail volume."
- Extract all addresses that have swapped the token and calculate each address's buy/sell ratio. If an address makes over 20 buy and sell transactions in 24 hours, each amount nearly identical, or it buys then immediately sells the entire amount when the price barely moves, flag it as suspected self-trading.
- Also check whether these addresses are financially connected to the project deployer or early LP addresses using Etherscan's free address relationship tracing. If there's a direct transfer of initial tokens or ETH, mark them as connected wash-trading addresses.
- Exclude all volume from such addresses.
Completion criteria: After filtering, if volume drops further but steadily, the remaining volume is very likely genuine active trading by token holders and retail users. You can compare this number to the same token's spot volume on centralized exchanges. A deviation within 5x is normal; if it still exceeds 10x, there may be other hidden volume-inflating methods at work.
Common failure reasons: Many people simply filter "same block reverse trades" on Dune and think they've cleaned all MEV. The problem is some arbitrage bots split trades into multiple transactions, or even cross blocks using different bundlers (though uncommon). Only filtering intra-block reverses misses complex cross-block arbitrage. If volume still looks inflated after filtering and you can't figure out why, check if the token is being used as a transit currency in unrelated trading pairs, routed through circular arbitrage paths. This is especially common for long-tail tokens and requires examining the full call tree of the arbitrage contract to completely identify.
Next: Wait for On-Chain Data to Stabilize and Cross-Verify
After filtering, don't immediately assume your volume number is the truth. MEV bot activity varies wildly with market conditions. Wait at least 4 hours, run the same filtering logic again, and see if the exclusion ratio is stable. If at different times of the day the ratio jumps from 30% to 90%, bots are concentrating on that token, and genuine user volume could be even lower than your filtered number.
Cross-verification channels:
- Compare the filtered DEX volume with the token's centralized exchange daily volume on CoinGecko or CoinMarketCap (source: CoinGecko, 2025-04-10). If the CEX shows only tens of thousands of dollars but filtered DEX still shows millions, there's likely noise you haven't removed yet.
- Check the token's official Discord/Telegram community activity. Real trading volume usually correlates with discussion heat. If volume remains high but the community is completely silent, stay skeptical.
FAQ
Q: Can I just look at trades on DexScreener and manually identify bots?
A: Only as a rough estimate. DexScreener shows consecutive swaps by the same address but lacks block-level context analysis. You can note suspicious addresses and then check their full block transactions on Etherscan. If all those transactions call the same contract and amounts follow a pattern, you can manually label them as bots. But it's inefficient for hundreds of addresses. Good for spot-checking small-cap coins, not for continuous tracking.
Q: Can MEV bots disguise themselves as regular traders?
A: Currently, most MEV bots don't bother disguising transaction amounts to save gas; they just aim to close loops in the shortest time. However, in fiercely competitive on-chain environments, new private transaction channels (like Flashbots Protect) let bots hide their intent, making on-chain traces look more like normal user trades. Against such advanced camouflage, on-chain public data alone cannot 100% filter them out. In that case, you can only indirectly judge by correlating oracle data with volume.
Q: Are there MEV filtering tools that don't require writing SQL?
A: You can try Zerion or DeBank token detail pages; they down-weight some obvious arbitrage trades by default. However, their filtering rules are opaque and the actual exclusion rate is low. If you just want a rough idea on your phone, it's enough. But for research or trading decisions, you must go back to Dune or Flipside and query the raw data yourself.
