When seeing a high concentration of top 10 holder addresses, many people immediately think "whale manipulation," "high risk," "stay away." But this judgment is often wrong — the top 10 often mix in exchange hot wallets, LP staking contracts, cross-chain bridges, and multisig governance addresses. These four types of addresses don't represent "whale holdings," yet they occupy most of the top 10 spots.
Only after removing them can you see the real market distribution.
Prerequisite: Find the "Holder Address List" on a Block Explorer
Whether you use Etherscan, BscScan, or Solscan, each token's contract page has a "Holders" tab. Clicking it shows the top 100 addresses by current holdings and their percentages.
After getting the list, exclude addresses according to the four types below.
Step 1: Exclude Exchange Hot Wallet Addresses — The Most Common Large Holders
Exchange hot wallet addresses appearing in the top 10 token holders is extremely common. This does not mean "the exchange is manipulating the market," but simply because many users keep their funds on exchanges, making the exchange's unified wallet a large token holder.
What to do: Identify and exclude hot wallet addresses belonging to centralized exchanges.
How to do it:
On Etherscan, exchange addresses usually have a "Name Tag." For example, tags containing "Binance", "Coinbase", "OKX", "Kraken" and similar keywords can be directly identified as exchange addresses.
On non-EVM explorers like Solscan, you can also check address labels. Most major exchange wallet addresses have been tagged by the community or explorer team.
If an address is not labeled but has extremely high transaction frequency and is involved with a very wide variety of tokens (thousands of types), this is usually characteristic of an exchange wallet.
When is it done: Mark all addresses with "exchange" tags in the top 10, group them separately, and exclude them from subsequent analysis.
Common failure reasons: Simply judging a large balance as a "whale address" without checking its transaction frequency. An exchange hot wallet may have tens of thousands of transactions per day, while a real whale address typically has far fewer.
Step 2: Exclude LP/Staking Contract Addresses — Liquidity Must Be Locked
Liquidity pools on DEXs (like Uniswap V2/V3, Raydium) and staking/locking contracts (like the Beacon chain staking contract, various liquid staking protocols) often hold large amounts of tokens. This is not "someone" controlling the market but a natural result of protocol mechanisms.
What to do: Identify addresses belonging to DEX LP pools, staking contracts, and locking contracts.
How to do it:
On Etherscan, contract addresses often have name tags with "Uniswap", "PancakeSwap", "Lido", "Stake" and similar keywords.
If an address name contains words like "LP", "Pool", "V2", "V3", "Staking", "Contract", and it has received many liquidity provider tokens or staking records, classify it as a protocol contract address.
On Ethereum mainnet, the Beacon chain's staking contract is itself one of the largest single ETH holders; this address does not reflect whale control.
When is it done: All contract addresses in the top 10 (LP pools, staking protocols, locking contracts) are marked and excluded.
Prerequisite: You need to distinguish "contract addresses" from "regular wallet addresses." On EVM explorers, contract addresses usually have a "Contract" label; regular EOA addresses do not.
Step 3: Exclude Cross-Chain Bridge and DeFi Protocol Aggregator Addresses
Contract addresses of cross-chain bridges (like Multichain, Synapse, Wormhole) and aggregator protocols (like 1inch, ParaSwap) may also hold large amounts of tokens — they are merely temporary holding points for "pass-through funds" and do not belong to any single entity's holdings.
What to do: Identify and exclude contract addresses of cross-chain bridges and multi-protocol aggregators.
How to do it:
Look for address tags containing "Bridge", "Multichain", "Wormhole", "Across", "1inch", "Aggregator" and other keywords.
You can also examine the address's transaction pattern: if it frequently "deposits → immediately withdraws" to different addresses, with each outflow amount close to the inflow, it can generally be identified as a cross-chain bridge or router contract.
If the address holds a large quantity of tokens but has almost no "active buying/selling" on-chain, only "distribution" and "aggregation" behaviors, also classify it as such.
When is it done: All cross-chain bridge and DeFi protocol aggregator addresses have been identified and excluded from the top 10.
Step 4: Exclude Multisig/Governance/Treasury Addresses — The Project's "Official Funds"
The last type of easily misinterpreted address is the project's multisig wallet (like Gnosis Safe), DAO treasury, or governance contracts. These addresses hold large amounts but represent the project's "public funds" and are unlikely to dump on the market like a whale.
What to do: Identify and exclude multisig wallets, DAO treasuries, and team-owned contract addresses.
How to do it:
On Etherscan, multisig wallets usually have tags like "Gnosis Safe", "MultiSig", or contain keywords like "Treasury", "Foundation", "Team", "Ecosystem" in the name.
If multiple addresses in the top 10 have highly consistent transaction patterns (e.g., buying the same batch of tokens at the same time) and frequent fund transfers among them, they are likely a multi-wallet combination controlled by a single entity — but this situation is closer to a "whale" and requires vigilance rather than simple exclusion. Multisig addresses themselves have multiple signers, slower decision-making, and differ in nature from EOA addresses controlled by a single whale.
When is it done: You've classified the top 10 addresses into three categories: to be excluded (exchanges, protocol contracts, cross-chain bridges), to be watched (multisig/treasury, depending on project credibility), and genuine market whales that require attention.
After removing these four types of addresses, if the remaining real individual holding proportion is still high, it constitutes a genuine concentration risk signal. Many tokens that appear to have "top 10 controlling 60%" may actually have a real concentration of less than 20% after exclusion.
How to Confirm Your Operation Is Correct?
After completing the check of the four types, recalculate the holding proportion of the remaining addresses. Sum up all the proportions of addresses to be excluded, subtract from the previous "top 10 total proportion," to get a "real market holding proportion."
If the real proportion is below 20%: The token's supply distribution is relatively healthy, and the manipulation risk from top 10 holdings is low.
If the real proportion exceeds 40% and is concentrated in 2-3 addresses: Be alert to potential market manipulation risks. The movements of these addresses are worth continuous tracking. On-chain analysis guides also point out that when whale distribution is highly concentrated and active addresses remain sluggish, it signals potential manipulation risk.
