Recipe 31 of 32
Sybil check: wallets funded by the same source
Call /wallets/{address}/first-funder for each wallet in your list and group the wallets by first_native_in.from; there is no reverse index, so it takes one call per wallet.
GET /v1/onchain/wallets/{address}/first-funder returns the sender of a wallet's first coin (first_native_in.from) and of its
first priced token (first_token_in.from), each with the sender's label. Call it for every wallet in your list and
group the wallets by sender. Wallets that share a sender which is not an exchange are the cluster to look at. The parameters are on Wallet first funder and Compare wallets.
Quick answer
# who sent this wallet its first ETH and its first priced token
curl -H "X-API-Key: $VIKE_API_KEY" \
"https://data.vike.io/v1/onchain/wallets/0x556e9d5d9e64638edde632bbd4810c9fd0d88397/first-funder"Example response
Captured from the live API on 2026-10-24 at 17:19 UTC, trimmed to first_native_in.
The group key is first_native_in.from. Here it is Binance 14, wallet_type: cex: thousands of unrelated users
withdraw from that wallet, so this sender links this wallet to nobody.
{
"address": "0x556e9d5d9e64638edde632bbd4810c9fd0d88397",
"chain": "ethereum",
"found": true,
"first_native_in": {
"from": "0x28c6c06298d514db089934071355e5743bf21d60",
"label": "binance",
"wallet_type": "cex",
"label_confidence": "medium",
"time": "2023-12-22T02:55:35Z",
"tx_hash": "0x8b24afff9fc8195e19dba0726a77cebc73c182211059c9d0ed1b024e630ab1e6",
"block": 18838548,
"amount": 100.0468,
"amount_symbol": "ETH",
"amount_wei": "100046800000000000000",
"amount_usd": 224241.896116
}
}Variations
Group on the token side. Run the same call and group on first_token_in.from, the sender of the first token worth at least 1 USD.
# both senders and their labels, nothing else
curl -s -H "X-API-Key: $VIKE_API_KEY" \
"https://data.vike.io/v1/onchain/wallets/0x556e9d5d9e64638edde632bbd4810c9fd0d88397/first-funder" \
| jq '{address, coin_from: .first_native_in.from, coin_label: .first_native_in.wallet_type, token_from: .first_token_in.from, token_label: .first_token_in.wallet_type}'Check a pair. Two wallets of a cluster should also share counterparties; /wallets/compare lists the ones they have in common.
# WALLET_A and WALLET_B are two wallets of one group: what they share over 90 days
curl -H "X-API-Key: $VIKE_API_KEY" \
"https://data.vike.io/v1/onchain/wallets/compare?address_a=$WALLET_A&address_b=$WALLET_B&window=90d"From the funder's side. Who a suspected funder sent money to, as its top 50 counterparties over all history.
# FUNDER is the shared sender from the grouping; sent_usd > 0 marks the wallets it paid
curl -H "X-API-Key: $VIKE_API_KEY" \
"https://data.vike.io/v1/onchain/wallets/$FUNDER/counterparties?window=all&limit=50"Before you rely on it
One call per wallet, no same-funder index
No route lists every wallet a given sender funded, so the grouping happens on your side, one first-funder call per wallet. A key allows 200 requests per minute. The funder's counterparties list stops at its top 50 by USD, so it misses small fundings.
An exchange or a relay links nobody
Wallets funded by the same exchange hot wallet are not related by that fact. Group only on senders whose
wallet_type is null or not cex, and compare the funding times too: a cluster is usually funded within minutes
or hours.
The first inbound we hold, not proof
first_native_in covers plain sends of the coin only, at least 0.0001 coin by default, and the chain's history
starts at coverage.history_from. A funder that pays through a contract, a bridge or an exchange withdrawal is
not seen as such.
Ask your agent
Connected to the Vike MCP server (https://vike.io/mcp) in Claude, ChatGPT or Cursor, ask it in plain words.
The wallet_first_funder tool answers it, one wallet per call, at 2 credits a call.
Who first funded 0x556e9d5d9e64638edde632bbd4810c9fd0d88397, and is the funder an exchange?