Peeling Chain
A fund-obfuscation pattern in which a large balance is moved through a long sequence of transactions, peeling off a small amount at each hop.
A peeling chain is a transaction pattern, commonly seen in both legitimate wallet behavior and deliberate obfuscation attempts, where a large UTXO or balance is spent in a long sequence of transactions, with each transaction sending a relatively small amount to a new destination while routing the remaining, still-large balance forward to a fresh change address (see Kaavon's "Change Address" glossary definition). Visually, plotting these transactions resembles a long chain with small amounts being "peeled" off at each link.
Chain analysis (see Kaavon's "Chain Analysis" glossary definition) tools specifically look for peeling-chain patterns because they're a common signature both of normal wallet software making repeated payments and, in other cases, of an attempt to slowly distribute illicit funds across many addresses to obscure their ultimate destination. Distinguishing an innocent peeling chain (for example, a service repeatedly paying out from one large hot-wallet balance) from a deliberately obfuscating one typically requires additional context beyond the transaction pattern alone, such as the peeling chain's origin and destinations.
Examples
- An exchange's hot wallet paying out withdrawals one at a time from a single large balance naturally produces a peeling-chain pattern that looks superficially similar to deliberate fund obfuscation.
- Chain analysis firms specifically train pattern-recognition models to flag peeling chains as worth further investigation, since the pattern alone doesn't distinguish legitimate from illicit use.