Reading a fund-flow trace

A fund-flow trace looks simple on the surface: wallet A sent to wallet B, which sent to wallet C. The value isn't in the list of hops — it's in knowing which hops matter and where the trace should stop.

Each hop is a decision point

At every hop, a few questions matter: is this an intermediate wallet with no other activity, or does it belong to something recognizable — an exchange, a bridge, a known protocol contract? Intermediate wallets that exist only to pass funds along are usually worth continuing through. Recognized entities change the picture entirely.

Where the trace should stop

Once funds reach a known exchange deposit address, continuing the trace stops being useful — the exchange's internal ledger, not on-chain data, determines what happens next. A trace that keeps walking past a CEX deposit and starts including unrelated wallets that also happened to interact with that exchange is producing noise, not evidence.

The same logic applies to mixers and other services designed to break the link between source and destination. Marking the trace as stopped at that point, with the reason attached, is more useful than pretending the trail continues cleanly.

What a good trace communicates

A trace that's useful for an investigation doesn't just show a path — it shows which hops are structurally connected wallets, which are known infrastructure, and where confidence in the path drops off. The destination matters more than the hop count. A four-hop trace that lands on a labeled exchange deposit is more actionable than a fifteen-hop trace that ends on an unlabeled wallet with no further activity.