All patternsSee all crime patternsRun a wallet scan
Layering
Typical severity: MEDIUM
Rapid Pass-Through
A meaningful share of an inbound transfer leaves the wallet again shortly after arriving.
Why it matters
Fast pass-through behavior can indicate the wallet is being used primarily as a transit hop rather than a genuine holder — a hallmark of layering infrastructure.
How we detect it
Match inbound transfers to closely-following outbound transfers and flag cases where a meaningful share of the inbound amount passes through quickly.
Example evidence
An inbound transfer followed shortly after by one or more outbound transfers covering a meaningful share of the same value.