Crypto Due Diligence
How to Check Crypto Holder Distribution Without Misreading It
2026-07-10 · BlockMind Research Team
Key takeaway: Do not judge token concentration from the explorer’s top-holder table alone. First verify the contract and supply denominator, then classify exchanges, bridges, liquidity pools, treasuries, vesting contracts, burn addresses, and likely independent wallets. Report both raw and adjusted concentration, trace changes over time, and state which labels are uncertain. One address is not necessarily one person, and one person can control many addresses.
Holder distribution answers a useful risk question: how much influence over liquid supply may be concentrated among a small number of economic actors? A raw address ranking does not answer it by itself.
It is one evidence category inside the full what to check before buying crypto workflow, not a standalone safety verdict.
An exchange omnibus wallet may represent thousands of customers. A liquidity-pool contract holds tokens on behalf of market participants. A vesting contract may be locked but economically allocated to insiders. A bridge escrow address may mirror supply on another chain. Treating all of them as comparable “whales” produces a precise-looking mistake.
What token holder distribution measures
For a standard ERC-20 token, the contract exposes totalSupply() and balanceOf(address). The standard defines those functions, while transfer events allow indexers to reconstruct balance changes (ERC-20 specification). Explorers and APIs turn those records into a ranked holder list; Etherscan, for example, documents an endpoint that returns current ERC-20 holder addresses and quantities (Etherscan).
The raw concentration formula is:
Top-N concentration = sum(balance of top N addresses) / chosen supply denominatorEvery term needs a definition. “Top N” before or after exclusions? Balance at which block? Total, circulating, or liquid supply? Are mirrored bridge balances double-counted? A result without those choices cannot be compared responsibly.
The nine-step holder-distribution workflow
1. Verify the canonical contract
Resolve the official contract from project documentation and cross-check it with the chain’s explorer and a reputable registry. Confirm chain, decimals, token standard, proxy or upgrade pattern, and whether the asset has native, wrapped, or bridged versions.
Ticker search is not enough. Scam tokens routinely reuse names and symbols.
2. Choose the observation block and timestamp
Current holder lists change. Record a block height and UTC timestamp so another researcher can reproduce the snapshot. If comparing two dates, use the same classification and denominator method.
3. Reconcile the supply denominator
Collect:
- on-chain total supply;
- reported circulating supply;
- maximum supply, if defined;
- burned or irrecoverable supply;
- locked and vesting allocations;
- bridge escrow and mirrored supply;
- treasury and protocol-owned balances.
Do not assume “circulating supply” is directly encoded in a token contract. It is often a provider or issuer calculation based on exclusions.
Report at least two views when material:
- Share of on-chain total supply for reproducibility.
- Share of estimated liquid or circulating supply with the exclusion method stated.
4. Classify the top addresses
Use explorer labels, contract code, project disclosures, transaction counterparties, and specialist entity data. Apply categories rather than simply deleting addresses:
| Category | Interpretation question |
|---|---|
| Burn/null | Is the balance provably inaccessible? |
| Exchange/custodian | Does one address represent many beneficial owners? |
| Bridge escrow | Is supply represented on another chain? |
| Liquidity pool | What share belongs to LPs, and how concentrated are LP tokens? |
| Vesting contract | Who is the beneficiary, and when can tokens unlock? |
| Team/treasury/foundation | Who controls keys and governance over transfers? |
| Staking/vault contract | Are depositors independently redeemable? |
| Protocol-owned liquidity | Is control centralized despite an AMM label? |
| Unknown EOA/entity | Could related addresses share one controller? |
Address labels add interpretation, not certainty. Nansen’s address-label endpoint, for example, exposes entity, behavioral, DeFi, and centralized-exchange labels (Nansen). Preserve “unknown” when evidence is weak.
The broader distinction between raw transfers, decoded actions, and entity inference is explained in what on-chain analysis is.
5. Calculate raw and adjusted concentration
Report several views rather than one magic threshold:
- top 1, 5, 10, and 20 addresses as a share of total supply;
- the same after excluding burn and clearly identified infrastructure;
- insider/treasury/vesting share separately;
- unknown top-holder share;
- liquid-pool and exchange custody share;
- concentration by labeled entity where clustering is defensible.
An adjusted formula might be:
Adjusted top-N concentration =
sum(top N independent/insider balances) /
(total supply - provably burned - non-circulating bridge duplication)Do not hide the raw number. Adjustments improve interpretation but add subjective choices.
6. Inspect control, not just ownership
For contracts and organizational wallets, ask:
- Is it a multisig, and what is the signing threshold?
- Are signers independent or controlled by one organization?
- Is there a timelock?
- Can an admin upgrade the contract or change transfer restrictions?
- Can tokens be minted, frozen, paused, or clawed back?
- Are vesting beneficiaries and schedules public?
- Can treasury governance be changed quickly by the same holders?
Distribution can look broad while effective control remains narrow.
7. Analyze changes, not only the snapshot
A trend often matters more than a single rank. Compare consistent snapshots and trace:
- team or vesting transfers;
- treasury outflows;
- deposits to and withdrawals from labeled exchanges;
- accumulation across clusters of addresses;
- liquidity migration;
- bridge movements;
- new mint or burn events.
A transfer to an exchange increases the possibility of sale; it does not prove a sale. A withdrawal may indicate self-custody, internal exchange reorganization, or another purpose. State the observation and inference separately.
8. Connect concentration to liquidity
A holder with 2% of supply can be more consequential than a holder with 10% if the tradable float and pool liquidity are tiny. Compare potential sell size with:
- pool reserves and active order-book depth;
- typical daily volume after suspected wash activity;
- unlock schedule;
- market-maker arrangements if disclosed;
- distribution across venues.
Holder risk is a relationship between control, float, liquidity, and behavior—not a universal percentage cutoff.
9. Write a reproducible conclusion
Use a format like:
At block X, the top 10 addresses held A% of on-chain total supply. After excluding the burn address, bridge escrow, two exchange custody wallets, and a liquidity-pool contract, the top 10 remaining addresses held B% of the adjusted denominator. C% remained in unknown top addresses. Team, treasury, and vesting-controlled balances accounted for D%, with the next material unlock on date E according to source F. Labels are heuristic; no sale is inferred from transfers alone.
How to interpret common patterns
One giant exchange wallet
This is custody concentration, not automatically investor concentration. It still creates operational and venue risk, but do not call every underlying customer one whale.
Many newly funded wallets with similar behavior
Nominal distribution may overstate independence. Look for common funding sources, synchronized transfers, identical timing, and shared counterparties. Clustering is probabilistic; do not claim common ownership without evidence.
A large locked vesting contract
Locked supply may not create immediate selling pressure, but it represents future economic allocation. Record beneficiary, cliff, cadence, admin powers, and whether the contract is immutable.
A large liquidity-pool balance
The pool address is not one holder. Inspect LP-token or position ownership, removable liquidity, and whether the project controls most liquidity. “Locked liquidity” also needs expiry, locker contract, and beneficiary verification.
Burn address balances
Only exclude supply that is provably inaccessible under the relevant chain and contract behavior. A branded “dead” wallet is not enough if someone can control it.
Cross-chain supply
Bridge escrow can look like a huge holder on the origin chain while tokens circulate on a destination chain. Reconcile canonical and wrapped supply to avoid double counting.
Why address count is not holder count
Glassnode’s entity research explains both directions of the problem: one entity can control multiple Bitcoin addresses, while one address—such as an exchange—can hold funds for many users (Glassnode). The same conceptual warning applies when interpreting token holders.
“Number of holders increased” can also reflect dust transfers, airdrops, sybil accounts, or users splitting custody. Combine it with balance distribution and economically meaningful activity.
Questions to ask an AI analyst
- “Resolve the official contract and stop if identity is ambiguous.”
- “Show raw top-holder balances at a stated block before applying labels.”
- “Classify each exclusion and cite the evidence.”
- “Calculate raw and adjusted top-10 concentration using both total and estimated liquid supply.”
- “Group only high-confidence related addresses and keep an ungrouped view.”
- “Trace material team, treasury, and vesting transfers without calling them sales unless swap or venue evidence supports that.”
- “List unknown wallets large enough to change the conclusion.”
BlockMind’s on-chain intelligence can help interpret holder structure and labeled flows. The output still needs the same methodological discipline.
Limitations and counterevidence
- Address labels can be incomplete, stale, or wrong.
- Privacy systems, centralized venues, and off-chain legal arrangements hide beneficial ownership.
- One entity can split balances to appear decentralized.
- An exchange address aggregates unrelated users.
- Supply APIs can disagree about circulating exclusions.
- A concentrated token can be legitimate; a dispersed token can still be coordinated or unsafe.
- Holder distribution says little about product quality by itself.
Do not use arbitrary rules such as “top 10 above 50% is always a scam.” Context can reverse the interpretation. Use concentration as one part of complete crypto due diligence.
The Bottom Line
The top-holder page is the beginning of holder analysis, not the conclusion. Verify the contract, freeze the snapshot at a block, reconcile supply, classify addresses, calculate raw and adjusted concentration, examine control and liquidity, and trace changes. Report uncertainty instead of converting every address into a person.
This is research, not financial advice. BlockMind’s agent can analyze on-chain evidence but never tells you what to buy or sell and cannot touch funds.