How CTO detection works on-chain

Updated 3 September 2026 · Belphor Research · the data behind this guide

A community takeover is not a rumor, it is a transaction. That single fact is what makes real-time detection possible: if an event must touch the blockchain to happen, a machine watching the blockchain can see it the instant it does. Here is the anatomy of that machine, from raw instruction to scored signal.

Step 1: watch the program, not the timeline

Most traders learn about takeovers from X, Telegram, or a screener, all of which are downstream of the blockchain by minutes at best. Detection systems invert this: they subscribe to the transaction stream of the pump.fun program itself. When a transaction carrying the takeover instruction lands, the system knows immediately which token changed hands and which wallet now controls it. There is no earlier place to learn this information, because this is where the information is created.

Step 2: verify before trusting

A takeover alone proves nothing. The seconds after detection are spent interrogating the token on-chain: Is the mint authority revoked, so nobody can print new supply? Is the freeze authority revoked, so holders cannot be locked? Is there real liquidity, and is it safe? Does the token carry transfer taxes? Cheap-looking takeovers of hollow tokens are common, and an automated checklist filters most of them before a human ever sees an alert.

Step 3: know the operator

The wallet executing a takeover has a history, and that history is public. Some wallets have run multiple takeovers before, and their past coins performed measurably better or worse than average. Tracking operators across events turns an anonymous transaction into a track record: a takeover by a wallet with three prior strong runs is a different signal from a first-timer, and the difference is quantifiable.

Step 4: compress everything into a score

Liquidity, safety checks, operator history, market conditions, holder distribution: no human can weigh all of it in the seconds that matter. A scoring model does, producing a single 0 to 100 number the moment of detection. The score is not a promise, it is a ranking: it says this event looks stronger than most, decide fast. What happens next, entries, exits, and outcomes, should be recorded and published, because a detection system that hides its misses is just marketing.

Why speed is the whole game

The value of takeover information has a half-life measured in minutes. At detection time, almost nobody knows; an hour later, everybody does. This is why serious detection is built on push infrastructure, webhooks firing at execution time, rather than polling or scraping, and why the honest measure of any signal service is the timestamp of its alerts against the timestamp of the on-chain event. Belphor publishes exactly that, along with every outcome, in a feed delayed for the public and real-time for members.