paranoic

§00 Abstract

paranoic is one model that never stops reading. It sits on every crypto stream it can reach: the X firehose with its reply trees, public Telegram call channels and groups, open Discord alpha servers. It joins all of it to the Solana ledger as it happens. Every message is resolved to the mint it talks about. Every author is resolved to the wallets they control. Every group of authors is checked against the money that moved before they spoke.

The output is not a feed and not a mood score. It is a living graph of who is about to say what, about which token, and whose wallet bought it first. Building it means doing two hard things at once, at stream speed: deep crawling of three social networks that do not want to be crawled, and on-chain forensics below the RPC layer.

it never sleeps

pipeline paranoic {
  ingest   x.stream  tg.mtproto  discord.gateway  sol.geyser
  resolve  mention -> mint
           author  -> persona -> wallet[]
  embed    message -> v(t)            streaming, never batch
  detect   ring(personas, mint)       before the first post
  map      narrative -> token[]       at mint time
  emit     verdict(mint) + evidence[]
}

§01 Social ingest

Three firehoses, one clock. On X: filtered streams and search backfill for every cashtag, every base58 string the length of a mint, every link to a launchpad, a pair page or a swap route. Reply trees and quote chains are expanded k hops, because the call is rarely the first post. On Telegram: user sessions joined to public call channels and open groups, . Forwards keep their origin channel, so a call can be walked back to the room where it was born. On Discord: gateway connections on the open servers that allow them, with create, edit and delete events.

Images are read too: OCR on chart screenshots, PnL cards and tracker screenshots, and a perceptual hash on every picture. Edits and deletions are kept. A deleted call is evidence, not noise.

deleted is not gone

stream x {
  match   cashtag | base58(len = mint) | url(launchpad | pair | route)
  expand  replies, quotes, reposts          depth k
  keep    edits, deletions, client, lang, media
}
stream tg {
  session mtproto/user
  scope   public channels ∪ open groups
  track   forward_from, edit, delete, pin
}
stream discord {
  session gateway
  events  MESSAGE_CREATE | MESSAGE_UPDATE | MESSAGE_DELETE
}
media   ocr(img) -> text        phash(img) -> h
clock   t_seen = min(source_ts, ingest_ts), skew-corrected per source

§02 Chain ingest

The chain side is read below the RPC. Geyser streams over gRPC carry every account write and transaction at processed commitment; shreds give order early, Geyser gives truth. Every swap on every venue is decoded into one shape: bonding curves, AMM pools, concentrated pools, aggregator routes. Every SPL transfer and every SOL transfer is kept, because funding is identity. New mints are embedded the moment their metadata lands. Jito bundles are grouped, so wallets that always land in the same bundle are read as one hand.

struct Swap {
  slot     Slot          tx     TxIndex
  venue    Curve | Amm | Clmm | Route
  mint     Pubkey        side   Buy | Sell
  wallet   Pubkey        size   lamports, amount
  bundle   BundleId?
  commit   processed -> confirmed -> finalized
}
struct Fund  { from Pubkey, to Pubkey, lamports, slot }
struct Mint  { mint, name, ticker, uri, image, born_at, creator }

§03 Mention to mint

Tickers collide; mints do not. A mention is resolved by evidence in order of strength: an exact contract address in the text or the image, a link target, an OCR hit on a screenshot, then ticker plus recency plus liquidity, then context, meaning which narrative the thread already lives in.

Unresolved mentions are not thrown away. They wait. A ticker that gets called before any mint carries it is the loudest tell in the dataset: someone knows a launch is coming.

resolve(m: Mention) -> (Mint, conf) | Pending
  c_addr   exact base58 in text ∪ ocr(media)
  c_link   url -> mint
  c_tick   ticker ∧ age(mint) < τ ∧ liq(mint) > ε
  c_ctx    argmax cos(v(m), v(narrative(mint)))
  score    c_addr » c_link » c_tick · c_ctx
  pending  re-resolve on every new mint

§04 Entity resolution

The hard part, and the reason this is not a sentiment dashboard.

Every author on every platform is a node. Every wallet is a node. A link between them is a hypothesis that has to earn its evidence: a wallet in a bio, a .sol name, an address read off a PnL card, a tip address, a referral link that embeds a wallet ; buys that land in the same short window before each of an author's calls, repeated across many calls; funding that traces back to a wallet the author once showed; sells that hit every spike the author caused.

Personas are merged across X, Telegram and Discord by handle reuse, avatar hashes, writing fingerprints and posting hours. Linkage is probabilistic, Fellegi–Sunter style weights, then refined by a graph network that checks every link against its neighbours. Every link carries its evidence and a confidence. Nothing is asserted bare.

same pfp, new name

link(a: Author, w: Wallet) = σ( Σ_k β_k · φ_k(a, w) )
  φ_disclose   bio | sns | pnl_ocr | tip | ref_code
  φ_lead       buy(w) ∈ [post(a) - Δ, post(a)]   over calls
  φ_fund       w ⇐ disclosed(a)                    hops ≤ h
  φ_dump       sell(w) | spike(post(a))
  φ_bundle     w ~ w' in same bundles, w' ∈ W(a)

persona(a, a')  handle ∪ phash(avatar) ∪ style(a) ∪ hours(a)
refine          gnn over (persona, wallet, mint), message passing
output          controls(persona, cluster, conf, evidence[])

§05 The wallet–caller graph

Personas, wallet clusters and tokens in one temporal graph. Edges: posts (persona to token), holds (wallet to token), controls (persona to wallet cluster), funds (wallet to wallet), echoes (persona to persona: reply, quote, forward, same text, same image). Every edge has a first-seen time and a slot. The graph is updated on every event and never rebuilt in batch.

One query against it answers what used to take a week of screenshots: who called this, which wallets are theirs, who bought before the call, who they always post with.

red = controls / funds · dashed = posts · solid = holds

node   Persona { handles[x | tg | dc], style, hours }
node   Cluster { wallets[], funders[], bundles[] }
node   Token   { mint, meta, emb, born_at }

edge   posts     Persona -> Token     t, text, media
edge   holds     Cluster -> Token     slot, size
edge   controls  Persona -> Cluster   conf, evidence[]
edge   funds     Wallet  -> Wallet    slot, lamports
edge   echoes    Persona -> Persona   reply | quote | fwd | dup

who funded the caller?

§06 Coordination detection

A shill ring is a set of personas whose wallets load a token before they talk about it, post in a tight burst with near-identical words or pictures, then sell into the attention they made.

The detector watches the money first. When wallets controlled by several personas accumulate the same fresh mint inside a short window, and the mint has no public mention yet, a ring hypothesis opens. Then the social side is watched for the burst. Posting intensity is modelled as a multivariate Hawkes process per persona; excitation between personas that is too strong and too synchronised is coordination. Near-duplicates are caught with MinHash over text and perceptual hashes over images. The ring is flagged before its first post lands, because the money always moves first.

the alert sits between the loading and the first post

ring.open(mint) when
    |{ p : controls(p, w) ∧ buys(w, mint, [t-Δ, t]) }| ≥ m
  ∧ mentions(mint, [t-Δ, t]) = ∅

ring.confirm when
    λ_j(t) = μ_j + Σ_i Σ_{t_i < t} α_ij · e^{-β(t - t_i)}
    α_ij > κ   for pairs inside the ring
  ∨ minhash(text_i, text_j) > ρ
  ∨ hamming(phash_i, phash_j) < η

emit RingAlert { mint, personas[], wallets[], loaded_at, first_post: ∅ }

the money moves first

§07 Streaming embeddings

Every message is embedded on arrival by an encoder tuned on trench language: slang, irony, sarcasm, copy-paste spam, multilingual threads, text plus image. There are no batch jobs. Embeddings fold into decaying state vectors per token, per persona and per community, so every message moves the state a little and old noise fades by itself. Online density clustering on the stream finds narratives as they form, not after they trend.

on message m:
  v = enc( text(m) ⊕ ocr(m) ⊕ img(m) )
  for s in { token(m), persona(m), community(m) }:
    S_s ← e^{-λ(t - t_s)} · S_s + w(persona(m)) · v
    t_s ← t
  cluster.update(v)                online, density based
  if cluster.born: emit Narrative { centroid, seeds[] }

§08 Narrative to token

A narrative is a moving cluster in embedding space: a meme, a news event, a public figure, a new agent, a joke that will not die. Every token, including one minted a moment ago, is embedded from its name, ticker, description, image and first holders. When a narrative heats up, the nearest tokens in the shared space are ranked, and the ones that already have ring wallets or caller wallets inside are marked. A fresh mint that matches a heating narrative is surfaced within seconds of its metadata landing.

on narrative.heat(c):
  cand = knn( centroid(c), token_space, k )
  for tok in cand:
    tok.fit   = cos( centroid(c), emb(tok) )
    tok.ring  = ring.active(tok)
    tok.loud  = { p : controls(p, w) ∧ holds(w, tok) }
  rank by fit › age › ring

it found the token before the timeline did

§09 Crowd state

Per token, the crowd is a small state: attention (new voices per window), conviction (holding language against flipping language), heat, fear, fatigue, and a phase. A hidden Markov model moves between phases, fed by the embedding state and by on-chain flow. The verdict is what the crowd is about to do next, not what it already did.

phase ∈ { whisper, call, chase, crowded, unwind, silence }
emit  e_t = ( S_token(t), flow(t), voices(t), ring(t) )
P( phase_{t+1} | e_{≤t} )      forward filter, online
verdict = argmax next phase, with evidence[]

§10 Adversaries

Bots, engagement farms, paid raids, rotating KOL lists, deleted calls, alt accounts, wallets that rotate after every call, fake PnL cards, cloned metadata on sniped mints. The model treats hiding as signal. Rotating wallets still share funders and bundles. Alt accounts still share writing fingerprints and hours. Deleting a call does not delete the buy that came before it.

evasion             still visible as
rotate wallets  ->  shared funder, shared bundle, same timing
alt accounts    ->  style(a) ≈ style(a'), hours(a) ≈ hours(a')
delete the call ->  buy(w) before post(a), kept
paid raid       ->  burst + dup text + fresh accounts
fake pnl card   ->  ocr(addr) vs ledger, mismatch flagged
cloned metadata ->  emb(meta) twin, different creator

they always leave a trail

§11 What you get

For every token: one word (quiet, whisper, loading, ring, chase, crowded, exit, dead) and the evidence behind it: personas, linked wallets with confidence, the first post, the loading window, the narrative. Look up a handle and see its wallets. Look up a wallet and see its voices. Alerts fire on ring.open, before the post.

GET  /token/{mint}      -> Verdict { word, phase, ring?, narrative, evidence[] }
GET  /persona/{handle}  -> { wallets[conf], calls[], rings[] }
GET  /wallet/{addr}     -> { personas[conf], funders[], bundles[] }
SUB  ring.open          -> RingAlert              soon
SUB  narrative.heat     -> Narrative + tokens     soon

§12 Limits

It reads people. It does not trade for you and it does not promise outcomes. Links are probabilities with their evidence attached. Only public channels, open groups and open servers are read; private messages stay private.

auto-trading      no
price targets     no
private chats     no
bare claims       no, every link shows its evidence

§13 Access

Closed for now. Every wallet that connects goes on the wall. It opens soon.

status    closed
wall      every connected wallet
release   soon

it knows whose wallet is behind every call.

How it knows