Fan-In Fan-Out
Fan-in fan-out describes a wallet that receives funds from many separate source addresses (fan-in) and then redistributes them to many separate destination addresses (fan-out), often in a short time window. The structure is common to both legitimate aggregation services and deliberate obfuscation.
Fan-In Fan-Out
Fan-in fan-out describes a wallet that receives funds from many separate source addresses (fan-in) and then redistributes them to many separate destination addresses (fan-out), often in a short time window. The structure is common to both legitimate aggregation services and deliberate obfuscation.
What it means
Legitimate examples include exchange hot wallets, which routinely fan in deposits from thousands of users and fan out withdrawals to just as many — the pattern alone is not evidence of wrongdoing. What distinguishes an illicit fan-in fan-out is context: unusually round timing, funds with no attributable legitimate business behind the wallet, or sources that themselves carry risk exposure.
The pattern is particularly associated with layering — deliberately breaking a clear one-to-one funding trail into a many-to-many structure specifically to make manual tracing harder. A single wallet that both aggregates and disperses funds acts as a mixing point even without using an actual mixer service.
Real-world example
An unlabeled wallet receiving from twenty unrelated addresses over one hour and dispersing to twenty different addresses shortly after, with no identifiable business purpose, is a textbook fan-in fan-out pattern worth investigating regardless of the amounts involved.
Related terms
In FreezeRadar
FreezeRadar's pattern catalog flags fan-in fan-out structures at a wallet, weighting the finding by how quickly funds moved through and how much source-side risk exposure was already present.
By FreezeRadar Team
Research and product team behind FreezeRadar.
Related reading
Continue exploring FreezeRadar knowledge content.