The Hidden Order Flow: How a Tiny Cluster of Solana Bots Routed Around the Crowd
Over a 40-day window, 244,733 contract calls on Solana exposed something most traders would rather ignore: a cluster of just 12 addresses flipped WSOL balances in their favor 62.3% of the time when routing through a proprietary AMM called HumidiFi. The same group, using ordinary public routes, only managed a 21.01% positive result rate. That is a 2.97x gap, not because these bots have better models, but because they know a path the rest of the market cannot see.
The study, accepted at ASE 2026 and built on a sample of 200 MEV-like addresses and 586 open-source bot repositories, is an uncomfortable snapshot of Solana’s DEX layer. It is not a story about a token. It is a story about market microstructure, and about who gets to see the liquidity first.
Context matters here. The researchers tracked 463,411 non-noise transactions from 200 addresses, using Solscan annotations to map program IDs to specific venues. They labeled clusters by behavior: some concentrated on Pump.fun, others connected to popular bot services like Trojan and SolanaMevBot. The 12-address cluster repeatedly routed through Jupiter, yet HumidiFi kept appearing as a destination outside the standard public route set. That is the key signal. HumidiFi is not a public DEX you open in a browser. Its liquidity is not broadcast to Jupiter’s aggregate route list in the same way Raydium or Orca are. It sits there, quietly, available to those who know it exists.
The core insight is not that HumidiFi is magic. It’s that route visibility is now a more important alpha source than execution speed. Public AMMs are fought over by hundreds of searchers, so price deviations disappear in milliseconds. A closed venue has fewer visitors, fewer failed transactions, and almost zero sandwich risk, because the bots themselves are not exposed to the same predatory queue. Our MEV analysis in the 2020 DeFi summer taught me that oracle manipulation and front-running are not just technical issues; they are information asymmetry problems. Based on my audit experience in Lagos, the first question I always ask about any DeFi venue is: who else can see this pool? HumidiFi’s edge is not a smarter price curve. It is a visibility gap.
But the causality is not proven. The researchers are careful to say this is correlation, not causation. The 12-address cluster may simply trade at different times, with different fees, or with better execution habits. That means the 2.97x advantage could be a narrative artifact, not a structural guarantee. Still, the data tells us something real: Solana’s execution layer is already tiered. Public routes, aggregate routes, and proprietary routes are not equal, and ordinary traders are the last to learn the difference.
The contrarian angle is uncomfortable. The market assumption has been that Solana’s open DEX ecosystem offers fair, transparent execution. This study suggests the opposite: a small cohort operates in what amounts to a dark pool, extracting a measurable edge from a venue that has no public audit trail. That is not a revolution. It is an evolution toward the same institutional playbook that exists in traditional finance. If proprietary AMMs become the standard for professional trading teams, on-chain value extraction will not disappear. It will just move from public front-running to private internalization, making it harder for retail to see the loss coming. Every scar in the market teaches a new rule, and the rule here is simple: if you cannot see the route, you cannot price the risk.
I have lived this lesson before. When the sETH/ETH pool slipped in 2020 due to oracle manipulation, our community saved 85% of capital because we monitored the feed, not just the yield. Trust is the only asset that survives the crash. The same principle applies to Solana today. The issue is not that bots make money. The issue is that a proprietary pool with no public verification can quietly become a fee machine for insiders. Solana’s transparency is the shield against the next bubble, but only if the community insists on seeing what happens inside these closed venues. Right now, HumidiFi has no published audit, no governance token, and no obligation to explain its routing.
We also need to talk about WSOL. The study measures profit in wrapped SOL, not stablecoins. That means a 62.3% positive result rate is real in SOL terms, but absolute returns still depend on SOL’s price trajectory. In a bull leg, this edge compounds. In a bear leg, it can evaporate quickly. Professional MEV teams know this, which is one more reason the advantage may be temporary. As more searchers discover HumidiFi, or as Jupiter expands its route coverage, the 2.97x gap will compress. The real lasting change is structural: Solana DeFi is shifting from a liquidity-driven market to a route-quality-driven market. Execution paths themselves are becoming a competitive dimension.
What should a retail trader take from this? Not a buy signal for SOL, and certainly not a call to copy the 12-address cluster. Instead, treat this as a verification checklist. Ask whether your DEX router actually sees all venues. Ask whether a pool has been audited. Ask whether the people sustaining a high yield are bots, not organic flow. Protect the flock, not just the profits. We walk away from greed, we stay for trust, and trust requires visibility.
The next debate will not be about Layer 1 speeds. It will be about best execution on-chain. Who decides which routes are fair? Which venues must be public? The researchers gave us a replicable method to expose hidden order flow. The industry now has a choice: embrace that transparency, or let the dark pools multiply. As for me, I am watching Jupiter’s route lists and every new proprietary AMM that appears. The next edge will not come from a better indicator. It will come from seeing the liquidity that everyone else was told not to ask about.