A unified Solana wallet-transfer stream for SOL and SPL tokens
Tracking wallet activity on Solana means combining two streams that look the same on paper and behave very differently in practice. SOL moves through the System Program (11111111111111111111111111111111) via Transfer and TransferWithSeed. SPL tokens move through TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA via Transfer and TransferChecked, plus the equivalent on Token-2022. Two programs, four instruction discriminators, two account-layout conventions, and the inconvenient truth that a single user transaction often emits both: a SOL transfer to fund the destination's rent, then a TransferChecked to actually move the token. Subscribe to one program and you only see half the wallet's life. We merge them into one parsed stream over gRPC, with the source, destination, mint (or SOL), amount in raw units, amount in human units, and the slot timestamp on every event. p50 ~12ms.
- System Program11111111111111111111111111111111, Native SOL transfers via Transfer and TransferWithSeed. Also creates accounts
- SPL Token programTokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA, Original SPL token program. Transfer and TransferChecked move tokens between ATAs
- Token-2022 programTokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb, Token-2022 with extensions. TransferChecked is required when fee or hook extensions are active
- Associated Token Account programATokenGPvbdGVxr1b2hvZbsiqW5xWH25efTNsLJA8knL, Creates ATAs on demand. Often appears alongside the first transfer to a wallet
Try it live: SOL & token transfers
decoded solana events over grpc · click Run to see live data
1grpcurl -H "x-api-key: YOUR_API_KEY" \
2 -d '{"topic":"prod.rpc.solana.system.transfers","format":"JSON"}' \
3 stream-1.nln.clr3.org:443 nln.stream.v1.StreamService/SubscribeSee real data
Click Run to stream 5 live SOL & Token Transfers messages
Pro: 2 streams $49/mo · Ultra: 20 streams $199/mo · pre-parsed, zero infra
The transfer events you can stream
every System Program and SPL Token transfer, decoded
| Event | Type | Description | Frequency | Latency |
|---|---|---|---|---|
| Transfer (System Program) | instruction | Native SOL transfer. Carries source, destination, and lamports. The cleanest "wallet sent SOL" signal. | Very high | 12ms |
| TransferWithSeed (System Program) | instruction | SOL transfer from a derived address. Used by program authority pubkeys; surfaces program-controlled SOL flows. | Low | 12ms |
| Transfer (SPL Token) | instruction | Legacy SPL Transfer. Carries amount in raw units; you need decimals from the mint to humanize. | Very high | 12ms |
| TransferChecked (SPL Token) | instruction | Decimals-checked SPL Transfer. Carries amount and decimals in the instruction itself, eliminating the mint round-trip. | Very high | 12ms |
| TransferChecked (Token-2022) | instruction | Token-2022 transfer. Required when transfer fees or transfer hooks are active on the mint. | High | 12ms |
| TransferCheckedWithFee (Token-2022) | instruction | Token-2022 transfer with explicit fee accounting. The fee accumulates in a withheld balance the authority can later withdraw. | Low | 12ms |
| Create (ATA program) | instruction | Associated Token Account creation. Often paired with the first inbound transfer to a wallet. | High | 14ms |
| CloseAccount (SPL Token) | instruction | Closes an empty token account and returns the rent. Useful as a wind-down signal in wallet activity. | High | 14ms |
Wallet-transfer streaming performance
last reviewed 2026-04-28
System Program Transfer vs SPL Token Transfer
The first thing most newcomers to Solana get wrong is treating “a transfer” as one thing. It isn't. SOL and SPL tokens move through different programs with different account conventions and different instruction shapes.
| Property | System (SOL) | SPL Token |
|---|---|---|
| Program | 11111111111111111111111111111111 | TokenkegQ...VQ5DA |
| Source | Wallet address directly | ATA owned by wallet |
| Destination | Wallet address directly | ATA owned by wallet |
| Amount unit | lamports (1e-9 SOL) | raw mint units |
| Decimals | fixed at 9 | per-mint, fetch separately |
| Recommended ix | Transfer | TransferChecked |
The SPL side has the extra step of resolving Associated Token Accounts back to their wallet owners. The Token program transfer instruction names the source ATA, the destination ATA, the authority, and the amount, but it doesn't name the human wallets. That mapping lives in the transaction's preTokenBalances and postTokenBalances metadata, which the validator emits alongside the instruction list. Our parsed event resolves the ATA-to-owner walk for you, so the field you read is fromOwner, not fromATA.
Why one unified stream beats two separate ones
Real wallet activity blends SOL and SPL flows in the same transaction routinely. The most common case: you send USDC to a wallet that doesn't have a USDC ATA. The sender pays ~0.00204 SOL via System Program Transfer to fund the new ATA's rent, and then the SPL TransferChecked moves the USDC. Both instructions land in one signature.
If you subscribe to the two programs separately, you see those as two unrelated events arriving on different sockets. Reconciling them after the fact is annoying, error-prone at scale, and adds latency. A single subscription that includes both programs and parses transfers from both into a uniform shape lets you treat the transaction as one event with two legs.
Other patterns where the merge matters:
- Bot fee + token swap. A trading bot wraps SOL, swaps via Jupiter, and unwraps SOL all in one signature; the wrap and unwrap are System Program transfers, the swap leg is SPL.
- NFT purchase. SOL flows to the seller, SPL transfers move the NFT mint and any royalty token; both inside one tx.
- Stablecoin payouts. Some payroll programs settle SOL gas reimbursement and USDC salary in the same tx for efficiency.
The unified stream surfaces these as a single event with both legs attached. You decide downstream whether to dedupe by signature, group by sender, or count each leg as its own movement.
Filtering by destination wallet (and why exchange-deposit detection works)
Yellowstone gRPC supports two filter axes that matter here: accountInclude (which programs the tx must touch) and accountRequired (which addresses must appear in the tx, in any role). Combine them and you've got a precise per-wallet feed.
For exchange deposit detection, the pattern is one subscription with accountInclude set to System and SPL Token, plus accountRequired set to the list of exchange hot-wallet addresses you care about. We've sustained tests at 50,000+ wallets in the required list on a single subscription with no measurable latency hit; accountRequired is OR'd at the validator level, so the cost is mostly fixed.
The same pattern works for whale tracking, treasury monitoring, smart-contract treasury accounts, and protocol fee accounts. Subscribe once, get only the transactions touching addresses you care about, decode the transfer leg.
A common gotcha: if you put a wallet in accountRequired but forget the SPL Token program in accountInclude, you'll only see SOL movements, not token movements. Always include both programs when watching wallet activity.
SOL fan-out patterns and what they tell you
The same address spraying SOL to many destinations in one tx is a high-signal pattern. The interpretation depends on context, but the shape is usually one of these:
Sniper farm prep
One funder wallet sends a small amount of SOL to many fresh wallets, often with sequential gas amounts. Those fresh wallets are about to spawn parallel sniper bots on a launch. Catch this pattern and you can warn for a coordinated entry before the launch tx lands.
Wash-trading prep
Same shape, different goal: the funder is seeding wallets that will trade against each other in a target token to manufacture volume. Common in low-liquidity memecoins.
Airdrop or payout
Legitimate fan-out: a project wallet distributing rewards or an exchange paying out withdrawals. Distinguishable by the destination diversity (long-tail wallets, not fresh ones) and the funder's history.
Pre-rug funding
Token creator splitting future-rug proceeds across a tree of wallets ahead of the actual liquidity pull. Pair this with the Token Creations stream and you get the strongest pre-rug signal available on chain.
The stream gives you the events; the classifier is yours. We don't score wallets for you because the right scoring is domain-specific (a sniper-detection product wants different weights than a compliance product).
What teams build with the wallet-transfers stream
We see five durable categories of consumer for this feed.
Whale trackers and copy traders. Watch a curated set of high-PnL wallets, post their swaps and transfers to a Discord, copy the trades on a separate execution wallet. Latency matters: most of the alpha decays inside 30 seconds. gRPC at ~12ms is the right transport.
Exchange flow analytics. Net deposits to / from CEX hot wallets, tracked in real time, charted alongside price. Useful internally for trading desks; useful as a public dashboard for engagement.
Compliance and AML. Sanctioned wallet monitoring, mixer-output tracking, sanctions-list deposits to exchanges. The stream is the ingestion layer; the rules engine sits downstream.
Wallet apps. In-app push notifications for incoming transfers. The stream lets a wallet provider notify a user before the transaction even shows up in their explorer of choice.
Treasury monitoring. DAO treasuries, protocol fee accounts, foundation wallets. Real-time visibility on every movement, with optional Slack/email alerts for thresholds.
Frequently asked questions
Related products
Full System Program coverage including account creation, allocate, and assign, beyond just Transfer.
Pair with wallet transfers to catch creator pre-mines and rug-precursor flows.
Every decoded Solana program we expose, including System, SPL Token, Token-2022, and ATA.
The streaming layer behind every NoLimitNodes wallet-transfer subscription.
A turnkey wallet-tracking product built on this same stream, with a managed UI and alerts.
18 curated topics across DEXes, lifecycle, and system events. The catalog hub.
Start streaming wallet activity in under 60 seconds
Pro plan from $49/mo includes 2 parsed streams. Wallet Transfers counts as one stream and merges System Program, SPL Token, and Token-2022 transfers in a single feed. Ultra adds 20 streams.