Wallet Balances

He sent me a screenshot.

One wallet. A Solana balance. A few memecoins. Find the wallet, he said.

No address. No transaction hash. No exchange account. No starting point. Not even the date the screenshot was taken.

Just a screenshot.

He also told me that several technicians and analysts had already looked at it and come up with nothing. My first thought was that it would be quick: write a query for every wallet that held that exact combination of tokens, match the balances down to the last decimal, and there is your wallet. A simple exercise.

Then I opened the screenshot, and saw the real problem.

The memecoins weren’t uniquely identifiable. On Solana, dozens of tokens can share the same name. Many share the same logo. Some are outright impersonations of one another.

The screenshot showed only the displayed names, logos, balances and position values. No token addresses, which is the one thing that actually tells two identical-looking coins apart.

So before I could search for anything, I first had to work out which assets the screenshot was even showing.

I started from the balances. Each holding showed both a quantity and a value, so I divided one by the other to get the price of a single token. That one number did a lot of the work: if a suspect coin had never traded at that price at any point in time, it could not be the one, and I dropped it. This was the slow part, mostly by hand, because the look-alikes ran into dozens and dozens.

Only then could the real search begin.

Even after the price filter, some of the memecoins still had more than one possible match. So I built a single query that took every surviving combination of candidate tokens and searched, in one pass, for wallets that had held that exact set at the same time. Every possible match landed in one dataset.

The result was still enormous. Thousands of wallets. (Please, do not trade memecoins…)

Then I went through all of those wallets with a Python script. For each one, it followed how the amount of a reference token in that wallet rose and fell over time, and threw the wallet out as soon as it was clear that no moment in its history matched the screenshot.

My terminal was printing “excluded” every second. One by one they fell away. I actually found the match before I was even halfway through. I cracked open a Super Mario Actimel to celebrate, then let the program run to the end for completeness.

Only one wallet was left.

Then came validation. Did the token balances match? Did the timing match? Did the order of the assets match? Did the surrounding activity make sense?

Everything lined up. That single wallet was the one.

A wallet identified from nothing more than a screenshot. No address. No hash. No starting point. No time window, beyond the obvious fact that every coin involved already existed. Just a set of balances and a moment frozen in time. And it was sitting on millions.

What looked like a simple query turned into one of the more tedious identifications I have done. The culprit was the memecoins: around eighty knockoffs of one another, barely any reliable historical price data (even on Dexscreener), what little existed scattered all over the place, the price feeds themselves carrying broken history, and far too many people holding memecoins to begin with. But the answer was always in there.

People think blockchain investigations are about finding information. More often, they are about realizing how much was already in front of you.

The screenshot wasn’t a picture. It was a set of constraints.

And constraints are enough to find the truth.

Next: Guess Who? (On-chain)