How Many Crypto Tokens Are Just Clones?

Most new tokens are not written; they are copied. When you compare deployed bytecode at scale, the same contracts reappear thousands of times, stamped out from a handful of templates. Orixa fingerprints each contract it scans and groups the near-identical ones into families. This report is what those fingerprints show — and why "have I seen this code before?" is one of the most useful questions a scanner can ask.

The measurement

Across 41,537 distinct tokens in Orixa's ledger to August 2026, a bytecode family could be assigned to 41,036 of them — 98.8%. Almost nothing is genuinely one-of-a-kind. Those tokens sort into 1,748 families, and the similarity is not loose: the median max-similarity to a family is 1.00, and 39,143 tokens (95%) sit at 0.90 or higher. In plain terms, the overwhelming majority of tokens are near-exact copies of something already deployed.

A few templates dominate

Families are not evenly sized. A small number are enormous:

The top eight families alone account for roughly 21,600 tokens — more than half of everything scanned. A single template, deployed over and over with a new name and logo each time, can be responsible for thousands of listings.

Why this is the opposite of reassuring — and why it's useful

Reuse is not automatically malicious; standard token templates are copied for entirely legitimate reasons. But two facts make code lineage a decisive signal:

1. Scams are redeployed, not reinvented. When a malicious contract works, its operator ships it again — same trap, new wrapper. Over 5,100 of the high-risk tokens in the ledger belong to a family, which means a match to a known-bad fingerprint is a strong, early warning before any market data exists.
2. A fresh name proves nothing. Because 98.8% of tokens are clones, the name, ticker, and site tell you almost nothing about the contract. The fingerprint sees through the branding to what the code actually is.

This is why "similarity to known-bad code" appears as evidence in a contract report (see Crypto Contract Scanner: Reading a Risk Report) and why it is one of the on-chain signals that actually matter. A close match to a family that has produced honeypots or rugs is a reason to stop, regardless of how polished the presentation looks.

What to do with it

Treat novelty as neutral and lineage as informative. If a token's code matches a family already associated with traps, that is a stronger signal than a clean-looking chart. If it matches a benign, widely-used template, that is mild reassurance — not proof of safety, because identical code can still be run by an honest or a malicious deployer. Either way, the contract's live permissions and liquidity decide the outcome; see What Makes a Token High-Risk: The Flags Behind the Data.

Figures are from Orixa's scan ledger as of August 2026 and change as new tokens are scanned. Fingerprints group contracts by similarity; a family match is evidence, not a verdict. Run a contract through Orixa to see its family and its live risk flags together. Orixa is decision support, not a guarantee of safety.