Groups Today: June 22, 2026 — Signal Types the Blackhat Network Is Surfacing

Signal Types the Blackhat Network Is Surfacing

If you’re in the Blackhat Telegram rooms, you’ve seen the alerts pile up today. The network is a noise filter — it surfaces patterns that are worth your time to verify, not to ape blindly. Here’s what’s lighting up and how to read each signal type without getting wrecked.

Multibuy Convergence

When multiple independent callers or tracked wallets buy the same token within a short window, the network flags a multibuy cluster. This is one of the stronger signals because it suggests coordinated attention — not just one random degen.

• What to do: Check the cluster size. A 3-wallet buy in 30 seconds is noise. A 15-wallet buy in 60 seconds with varying amounts is worth a deeper look.
• What to verify: Are the wallets fresh or aged? Fresh wallets can be wash-trading. Use GMGN to view the holders and see if the buys are from known KOLs or new addresses.
• Risk: Clusters can be staged. Always check if the token has a liquidity lock and a renounced mint before anything else.

Hype Tiers

The network assigns a hype tier based on social velocity, telegram group size, and caller reputation. Today, Tier 1 alerts are rare — most activity sits in Tier 2-3.

• What it means: A Tier 1 means multiple high-reputation callers are pushing the same token. That’s a red flag for potential exit liquidity, not a guarantee of gains.
• What to do: For Tier 2-3, treat it as a lead, not a signal. Do your own holder distribution check — if the top 10 hold over 30%, skip it.
• Link: Learn how to interpret hype tiers in the reference guide.

Caller Activity & Rescans

The network tracks when a caller posts a token and then rescans it hours later. A rescan with a “still holding” note is common. A rescan with a “sold” note is useful info — it tells you the caller took profit.

• What to watch: Callers who rescan with “added more” or “still holding” after a 50% drop are either diamond-handed or trying to pump their bags. Verify their past calls using the caller history feature in the alerts.
• Caution: If a caller posts a token, then rescans it within 2 hours with a new buy, that’s often a pump-and-dump setup. The first buy was for marketing, the second is for exit liquidity.

AI Wallet Alerts

The network now tracks AI-labeled wallets — addresses that trade with high frequency, sub-second timing, and no human pattern. These are bots, likely running MEV strategies or snipe-and-dump cycles.

• What the alert tells you: If an AI wallet buys a token, it’s usually early — sometimes before the public call. But it also sells fast.
• What to do: Check the wallet’s win rate and average hold time on GMGN. If the wallet sells within 10 minutes on 80% of its trades, don’t follow it in late.
• Link: Detailed explanation of AI wallet signals is in the alerts section.

What to Be Cautious Of Right Now

• Rescan floods: When multiple callers rescan the same token in a 10-minute window, it’s often a coordinated push. Check if the token has a telegram group with pinned buy links — that’s a honeypot setup.
• Low-liquidity clusters: A multibuy cluster on a token with less than $5k liquidity is a trap. The buys are likely from the deployer’s own wallets to create false volume.
• No socials: If the alert has a token but no website or twitter, skip it. Legit meme projects at least have a degen telegram.

Final Word

The Blackhat network gives you the raw data. Your job is to filter, verify, and protect your capital. Every signal can be faked. Every cluster can be staged. Treat each alert as a starting point, not a conclusion.

Memecoins are extremely high risk and most go to zero. No alert changes that. Use the tools, check the metrics, and never chase a rescan.

Read: 4 min read