Reading a fund-flow trace

A fund-flow trace lays out the path funds took from a source wallet to a destination, hop by hop. It looks simple to read, but the useful information is in the details of each hop, not just in the fact that a path connects two addresses.

Start with hop count. More hops usually means more deliberate obfuscation — a direct transfer from source to destination is unremarkable, but a chain of four or five intermediate wallets before funds land somewhere is a pattern associated with layering, whether or not that's the actual intent in a given case.

Next, look at what the final hop actually is. A trace that terminates at a labeled CEX deposit address is more actionable than one that dead-ends at an unlabeled wallet with no further activity — the former gives you somewhere to direct a request (e.g. to an exchange's compliance team); the latter just tells you funds are currently sitting somewhere unidentified.

Finally, check whether any intermediate hop is shared with other traces you've run. An intermediate wallet that shows up across several unrelated traces is often a known mixer, aggregator, or laundering hop rather than a coincidence — worth flagging even if it isn't yet in a known-destination registry.

A trace is evidence of where funds moved, not a verdict on intent. Two wallets three hops apart were connected on-chain; whether that connection is meaningful depends on context the trace alone won't give you — which is why every hop links back to the specific transaction that produced it, so you can check it yourself rather than take the path on faith.