Addresses, Entities, and Labels

2.1 Is that a whale?

Mint saw an alert on social media: "Whale moves 5,000 BTC to an unknown wallet!" The post had thousands of reactions, with people predicting a crash.

An hour later, someone pointed out that both addresses belonged to the same exchange, which was simply moving coins between its own wallets.

"So nothing happened?" said Mint.

"Nothing that mattered," said Hash. "This is why the most important skill in on-chain analysis isn't reading charts. It's knowing who the addresses actually belong to, and how confident you can be."

2.2 Addresses versus entities

An address is a single location on a blockchain. An entity is the real-world person or organisation that controls one or more addresses.

One entity can control thousands or millions of addresses. As Module 3, Chapter 3 explained, Bitcoin wallets create new change addresses with each transaction. Exchanges manage huge numbers of deposit addresses, one per customer. Funds and institutions spread holdings across many wallets for security.

So counting addresses tells you little about how many people or organisations are involved. Most useful on-chain metrics try to work at the level of entities, which requires grouping addresses together.

2.3 Clustering

Clustering is the process of grouping addresses that likely belong to the same entity. Analysts use several techniques, called heuristics: rules of thumb that are usually, but not always, correct.

Common-input ownership (Bitcoin). When a Bitcoin transaction spends several UTXOs as inputs (Module 3, Chapter 3), all of them must usually be signed by the same wallet. So the addresses holding those inputs likely belong to the same entity.

Change detection (Bitcoin). In a transaction with two outputs, analysts try to identify which output is the change returning to the sender, for example based on address type or round numbers.

Deposit address patterns (exchanges). Exchanges typically give each customer a unique deposit address, then sweep funds from those addresses into larger wallets. Following these sweeps reveals the exchange's wallet structure.

Funding sources (Ethereum and similar chains). If a new address receives its first ETH from a known address, they may be related. Many addresses funded from the same source, around the same time, may belong to one entity, a pattern often seen with airdrop farmers (Module 5, Chapter 4).

Behavioural patterns. Addresses that act at the same times, interact with the same contracts, or follow identical sequences of actions may be related.

Heuristic	Typical confidence
Common-input ownership	Usually high, except for privacy techniques like CoinJoin
Exchange deposit sweeps	High
Change detection	Moderate
Shared funding source	Moderate; many unrelated users are funded from exchanges
Behavioural similarity	Low to moderate

Chapter 2 · Addresses, entities, and labels

Several separate addresses are grouped into a single exchange entity through clustering heuristics. A transfer between two of the entity's own wallets is internal and not market-moving, whereas a transfer to an outside entity carries signal. Clustering confidence can be high, moderate, or low.

2.4 Privacy techniques break heuristics

Some users deliberately break these patterns. CoinJoin transactions combine inputs from many different people into one Bitcoin transaction, so the common-input heuristic would wrongly group strangers together. Privacy-focused tools and protocols on other chains also obscure links between addresses.

Analytics platforms try to detect these patterns and adjust. But it's a reminder that clustering is inference, not fact.

2.5 Labels

A label is a name attached to an address or cluster: "Exchange X hot wallet," "Fund Y," "Bridge contract," "Hacker." Labels come from several sources: public disclosures by companies and funds, proof-of-reserve publications from exchanges (Module 1, Chapter 7), investigations of known events, such as hacks, crowd-sourced tagging by users and researchers, and analysis by commercial analytics firms.

Labels are extremely useful, and also a frequent source of error.

Label risk	Example
Outdated	An exchange migrated to new wallets, but the old label remains
Incomplete	Only some of an entity's addresses are labelled
Wrong	An address is mislabelled based on a weak inference
Inconsistent	Different platforms label the same address differently
Unlabelled	Most addresses have no label at all

"So an 'unknown wallet' might be an exchange, a fund, or just someone moving coins to cold storage," said Mint.

"Exactly," said Hash. "'Unknown' means the platform doesn't know. It doesn't mean it's mysterious or dangerous."

2.6 Internal transfers

The whale alert in Mint's story was an internal transfer: an entity moving funds between its own addresses. These are extremely common. Exchanges move coins between hot and cold wallets. Custodians rebalance. Funds consolidate UTXOs (Module 3, Chapter 3).

Before reacting to a large transfer, ask:

1. Are both addresses labelled, and do they belong to the same entity?
2. Is the receiving address new, and was it funded only by the sender?
3. Does the transfer match a known pattern, like a regular cold storage rotation?
4. Did the funds move onward to an exchange deposit address, or just sit?

Large movements that end in cold storage are very different from large movements into exchange deposit addresses.

2.7 Smart contracts are addresses too

On Ethereum and similar chains, smart contracts have addresses just like users. A large token balance held by a contract might belong to a staking contract, a bridge, a lending pool, a vesting contract, or a DEX pool (Module 5, Chapter 4).

Block explorers show whether an address is a contract. Before interpreting a big balance as a "whale," check what kind of address it is.

2.8 Confidence, not certainty

Node summarised it. "So every on-chain metric that talks about exchanges, whales, or miners depends on how good the labels are."

"Every one of them," said Hash. "Good analysts always ask how the entities were identified, and how much the conclusion would change if some labels were wrong."

A useful habit: when you see a strong claim based on on-chain data, try to verify the key addresses yourself on a block explorer, and check whether more than one platform agrees.

2.9 Try it yourself

Find a large transaction alert from a public whale-tracking account. Look up both addresses on a block explorer. Are they labelled? Is either one a smart contract? Where did the funds go next? Decide whether it was a meaningful move or an internal transfer.

Then look up the same addresses on two different analytics platforms. Do their labels agree?

Key takeaways from this chapter

1. An address is a location on the blockchain; an entity is the person or organisation controlling one or many addresses.
2. Clustering groups addresses into entities using heuristics such as common-input ownership, deposit sweeps, funding sources, and behaviour.
3. Heuristics are inferences, and privacy techniques like CoinJoin can break them.
4. Labels are essential but can be outdated, incomplete, wrong, or inconsistent across platforms.
5. Many large transfers are internal movements between an entity's own wallets.
6. Smart contracts hold large balances too. Check the address type before calling it a whale.
7. Treat on-chain conclusions with appropriate confidence, and verify key addresses yourself.