Glossary
2 min readPublished April 23, 2026

Fan-In Fan-Out

Fan-in fan-out describes a wallet that receives funds from many separate source addresses (fan-in) and then redistributes them to many separate destination addresses (fan-out), often in a short time window. The structure is common to both legitimate aggregation services and deliberate obfuscation.

Analysis Patterns
#on-chain-analysis
#monitoring

Fan-in fan-out describes a wallet that receives funds from many separate source addresses (fan-in) and then redistributes them to many separate destination addresses (fan-out), often in a short time window. The structure is common to both legitimate aggregation services and deliberate obfuscation.

Check a wallet before you act

Run a FreezeRadar scan for issuer-freeze signals, sanctions exposure, counterparty risk, and freezeable asset sensitivity before moving funds.

Scan a wallet

What it means

Legitimate examples include exchange hot wallets, which routinely fan in deposits from thousands of users and fan out withdrawals to just as many, the pattern alone is not evidence of wrongdoing. What distinguishes an illicit fan-in fan-out is context: unusually round timing, funds with no attributable legitimate business behind the wallet, or sources that themselves carry risk exposure.

The pattern is particularly associated with layering, deliberately breaking a clear one-to-one funding trail into a many-to-many structure specifically to make manual tracing harder. A single wallet that both aggregates and disperses funds acts as a mixing point even without using an actual mixer service.

Real-world example

An unlabeled wallet receiving from twenty unrelated addresses over one hour and dispersing to twenty different addresses shortly after, with no identifiable business purpose, is a textbook fan-in fan-out pattern worth investigating regardless of the amounts involved.

In FreezeRadar

FreezeRadar's pattern catalog flags fan-in fan-out structures at a wallet, weighting the finding by how quickly funds moved through and how much source-side risk exposure was already present.

Check a wallet now

Continue exploring FreezeRadar knowledge content.