Deep Dive: Hubs, Connectors & Sybil Forensics

When analyzing token distributions, the most important actors are rarely the isolated holders; they are the Connectors — the nodes that act as routing points for liquidity. The Aegis graph engine automatically runs forensic analysis to identify these actors.

Hubs (The Mega-Connectors)

A "Hub" is defined as a super-node that participates in more than 10% of all transfer edges in the entire graph.

• Examples: Major centralized exchange (CEX) hot wallets, prominent DEX routers (like Ekubo or Jediswap), and canonical bridges.
• Visual Treatment: Because Hubs interact with almost everyone, leaving them in standard clusters would ruin the visual graph. Aegis automatically strips Hubs from the standard Louvain clustering, tagging them as Cluster -1 (gray), allowing the true retail and insider clusters to emerge clearly.

Dispensers & Sybil Drones (The Airdrop Farmers)

Connectors aren't always benevolent exchanges. Stark Lens tracks distinct structural patterns to detect Sybil rings:

• The Dispenser: A central wallet executing 1-to-many transfers to dozens of smaller wallets.
• The Drone: The recipient wallets that show exactly one inbound transfer (from the Dispenser) and minimal outbound activity.

Mixing Chains (Wash Trading Connectors)

To hide liquidity movements, bad actors often create A → B → C → D transfer chains. Our engine detects linear chains with highly correlated transfer amounts (within a 2% variance margin) and chronological timestamps, identifying them as unified Mixing Chains.