All patterns
Layering
Typical severity: MEDIUM

Rapid Pass-Through

A meaningful share of an inbound transfer leaves the wallet again shortly after arriving.

Why it matters

Fast pass-through behavior can indicate the wallet is being used primarily as a transit hop rather than a genuine holder — a hallmark of layering infrastructure.

How we detect it

Match inbound transfers to closely-following outbound transfers and flag cases where a meaningful share of the inbound amount passes through quickly.

Example evidence

An inbound transfer followed shortly after by one or more outbound transfers covering a meaningful share of the same value.

See all crime patternsRun a wallet scan