How CTO detection works on-chain

Updated 22 October 2026 · by AtroX · Belphor Research · the data behind this guide

A community takeover on pump.fun is a transaction, so detecting one means watching the pump.fun program for the instruction that executes it, then verifying and scoring the coin in the seconds after. Since 12 September 2026 that instruction is admin_cto, and only one of its two forms is a takeover. Of the 352 takeovers Belphor detected in the 90 days to 3 October 2026, 53% reached +50% at some point after detection.

Step 1: watch the program, not the timeline

Most traders learn about takeovers from X, Telegram, or a screener, all of which are downstream of the blockchain by minutes at best. Detection systems invert this: they subscribe to the transaction stream of the pump.fun program itself. When a transaction carrying the takeover instruction lands, the delivery says which token changed hands and which wallet now controls it, before anything else is read. There is no earlier place to learn this information, because this is where the information is created.

What changed on 12 September 2026

A detector is only as good as its list of instructions. On 12 September 2026 pump.fun updated its program: it removed admin_set_creator, the instruction every takeover Belphor had counted until then ran through, and added admin_cto. Belphor recorded the new instruction from the first day as an unknown admin event; it was identified, and the 89 rows written under it between 12 and 17 September relabelled from the chain, on 17 September.

pump.fun replaced the takeover instruction on 12 September 2026. Belphor recorded the new instruction, admin_cto, unpromoted while it was measured against the old record (n 38: 47 percent reached +50 percent against 48 to 54 under the earlier instruction; 21 percent were down 80 percent or more against 18 to 21). From 11 October 2026 its new-creator form is alerted and counted as a takeover, behind the liquidity, mint safety and rug registry gates. Holder-reward events are recorded as their own type and are not takeovers.

The new instruction comes in two forms, and only one of them is a takeover:

A holder-reward coin has no team taking anything over, so it is not a takeover in the sense this guide means, and its outcomes are measured apart. The new-creator form is alerted on and counted as a takeover from 11 October 2026; the holder-reward form is not. The weekly table counts them separately: in the seven days to 3 October 2026, the weekly record lists 19 unpromoted admin_cto and rare_admin rows. This is not a count of all holder-reward events.

Step 2: verify before trusting

A takeover alone proves nothing. The seconds after detection are spent interrogating the token on-chain: Is the mint authority revoked, so nobody can print new supply? Is the freeze authority revoked, so holders cannot be locked (mint and freeze authority, explained)? Is there real liquidity, and is it safe? Does the token carry transfer taxes? Cheap-looking takeovers of hollow tokens are common, and an automated checklist filters most of them before a human ever sees an alert.

Step 3: know the operator

The wallet executing a takeover has a history, and that history is public. Some wallets have run multiple takeovers before, and their past coins performed measurably better or worse than average. Tracking operators across events turns an anonymous transaction into a track record: a takeover by a wallet with three prior strong runs is a different signal from a first-timer, and the difference is quantifiable. The holder-reward form has no operator to profile, one more reason it is kept apart.

Step 4: compress everything into a score

Liquidity, safety checks, operator history, market conditions, holder distribution: no human can weigh all of it in the seconds that matter. A scoring model does, producing a single 0 to 100 number the moment of detection. The score summarizes selected inputs. The current takeover record does not show higher score bands producing better outcomes, so it should not be presented as a validated ranking. How the score relates to outcomes is a measured question, answered in does the Belphor score predict outcomes. What happens next, entries, exits, and outcomes, should be recorded and published, because a detection system that hides its misses is just marketing.

What detected takeovers did next

Every takeover Belphor detects is followed afterwards, and the result is published whether it flatters the detector or not. As of 3 October 2026, over the previous 90 days:

Fetched from the public JSON on 3 October 2026. The live table refreshes daily; this article is a dated snapshot of it. How each column is measured: how Belphor measures outcomes.

The full breakdown, by market cap as well as by month, is in how often a pump.fun takeover reaches +50%.

What speed can and cannot show

Belphor records event and alert times. Those timestamps can measure delivery delay; the public entry-timing sample is too small to establish how quickly any trading advantage decays. Belphor's detection is built on push infrastructure, a webhook on the program itself rather than polling or scraping, and, since 24 September 2026, a poller behind it for anything the webhook drops; the measure of any signal service's speed is the timestamp of its alerts against the timestamp of the on-chain event. The poller came out of a real gap: from 20 September 21:51 UTC to 24 September 09:11 UTC the delivery path to Belphor's recorder was down, and the ten takeover instructions that landed in that window were recovered from the chain afterwards. What waiting costs is measured in when to buy after a pump.fun takeover. Belphor publishes the alert timestamps in a feed delayed for the public and real-time for members, and its public record publishes measured outcomes with their sample sizes, windows and missing readings.