Identify Large Fund Wallets on Ethereum using On-Chain Analysis
Decentralized Retail Trading:
The Future of Finance and Retail Trading with On-Chain Strategies
By: Patrick Gorrell, Patrick Doyle, Roman Krasiuk
“We assumed we knew nothing about investing in digital assets and we sought to find the wallets that seemingly knew everything because they had access to information that nobody else had”
- Patrick Gorrell
TLDR;
Since our early inception, FRST has used on-chain data to find specific patterns of activity that would give us a competitive edge when investing in digital assets. The mantra our team followed was simple and humble. FRST believed the wallets with money knew more than we knew. In doing so, we set out to find the wallets that seemed to be moving the markets. Although we could not detect the trades that were occurring behind the scenes of centralized exchanges like Binance, Poloniex or Kraken, we could detect the wallets that were depositing and withdrawing the most value.
Using conventional analytics tools made it nearly impossible to conduct a historical search for the types of patterns we were looking for; so we had to make our own. Along the way, we were able to identify all of the largest depositors on exchanges and follow where they were originating their funds. FRST began working with Capital Markets Trading Digital (CMT Digital) in Chicago to understand the flow of value and the personas of trading activity behind the wallets. In doing so, CMT and FRST have successfully been able to target opportunities that would otherwise go unnoticed.
Identifying Funds Heuristic
When searching through the vast number of wallets that exist on Ethereum, there are very few tools available that provide the specific wallet details necessary for spotting funds. The idea behind the heuristic is to find the largest depositing and withdrawing wallets into centralized exchanges. We assume that many large funds take advantage of price differences between exchanges so it was very likely that we could spot the movements between their accounts. About 87% of the wallets on Ethereum exist between exchanges. This means that a majority of the activity on Ethereum is token transfers from one exchange to another. By identifying wallets that act as treasury wallets, you can begin to map out all of their customer’s deposit and withdrawal wallets.
“If you want to find the funds, just look for the large depositors.”
- Patrick Gorrell
Understanding how exchange wallets work
Most centralized exchanges manage funds on account-based chains differently from UTXO chain. Ethereum’s account-based model allows for more transparency into how exchanges manage funds for their internal treasury wallets and customer custodial wallets. There are 3 basic types of wallet personas that are associated with most centralized exchanges.
- Exchange Custodial Wallets (Customer Deposit Wallets)
- Exchange Treasury Wallets (Exchange Primary Wallets)
- Exchange Withdrawal Wallets
The wallets that are most important to identify are the custodial (deposit) wallets of an exchange. By locating the large depositors, we can find that funds typically move large value transfers either from one exchange directly to another or, they move funds from a wallet outside of exchanges from a cold wallet.
The second most important type of wallet to follow is the withdrawal wallets. As stated before, roughly 87% of wallets on Ethereum exist in between exchanges. We believe this is due to a large number of wallets that interact with the exchanges and them trading assets on more than one exchange. This means that a majority of the time, a withdrawal wallet is, in fact, a custody wallet to another exchange.
Typically, there are treasury wallets that are specific to deposits & withdrawals as well as types of assets on Ethereum. Binance, for example, has multiple addresses that they use to source customer funds from custodial wallets and others that are used to manage withdrawals, whereas Poloniex has wallets for different assets like Ethereum-based REP, ZRX, BAT & STN.
Transactional Patterns
After working closely with many of the large firms in digital asset trading, our team soon discovered that most funds have something called a clearing function. A clearing function is a designated individual who clears the transaction for any deposit into an exchange. Additionally, we assume that funds would be very wary of moving large value transactions without sending an initial test transaction. An easy way to predict when a large transaction is about to occur is by looking for wallets that pass enormous amounts of value that send test transactions before every new type of asset allocation to the exchange.
Transaction Filtering
The above image shows transactions for all three wallet personas we have been discussing that are within the deposit, withdrawal & treasury proximity of Binance. The columns in the table are as follows:
- Transactions ID
- Age of transaction
- Token
- Amount of tokens transferred
- USD Value of the transaction
- From Address
- From Exchange Proximity
- To Address
- To Exchange Proximity
By tagging every transaction on Ethereum with an exchange proximity tag, you can all transactions based on their proximity to a specific exchange.
- No From Proximity -> Binance(0) denotes a large deposit transaction
- Binance(0) -> Binance(0) denotes an internal treasury transfer
- Binance(0) -> No To Exchange Proximity denotes a large deposit
In the above image, we have filtered out all of the transactions to the last 6 months by their historical value greater than $10MM USD.
Hours of Activity
Since most funds operate within the traditional working hours, a telling sign of when the funds are operational is easy to explore by using a heat map to track the hours and days of the week that transactions occur. In the example below, a heat map is used to describe the transactions of a large fund’s custodial wallet depositing into Binance. The columns represent the respective time of the day and rows are the days of the week. The cross-section of dark spots indicates that this wallet is non-operational during normal US market hours. This fund is likely operating in Asia.
When comparing the above heat map to an exchange like Binance, you can begin to understand the total volume of activity that occurs within exchange wallets as noted in the image below. The darker the color of the heat map quadrant denotes the most active periods of the wallet compared to the lighter which signifies less active periods.
Historical Volume & Holdings
Once a target wallet has been identified, the next step is trying to understand what type of assets and volume have passed through the wallet historically. It is rare to find wallets that have a one-time use. Most often you will find wallets are used for multiple assets over their lifetime. By observing the token history of a wallet, you begin to trace the investment portfolio of the wallet and begin to identify the fund’s performance over time.
Historical Wallet Relationships
Ethereum activity acts much like a social network. Wallets only interact with other wallets, contracts or entities that they are familiar with. Many times you will find that large funds have moved their primary allocation to a new wallet. We assume it is either because of security or an attempt to create privacy. FRST has created tools that make it easier to follow the flow of value from one wallet to another. The chart below shows a flow diagram of value being passed from previous wallets and being distributed out to different exchanges.
If you expand the number of relationships, it becomes apparent that funds can move investments around frequently to take advantage of price points on different exchanges. By backing tracking out of the custodial wallets and observing wallets that lay outside the perimeter of an exchange more often than not, you will find cold storage wallets that are used to house token holdings. We call these perimeter wallets and they are typically Ledgers, Trezors or some other form of cold wallet storage. Mapping perimeter wallets allow you to identify investments such as exchanges, DApps, ICO’s, token sales, lock contracts and other types of decentralized products that these funds have participated in.
Conclusion
Finding funds starts with identifying wallets that are moving large dollar values into and out of centralized cryptocurrency exchanges. Once those wallets are identified we can begin to analyze their historic holdings to understand the wallet's investments and projects & protocols that they are interested in. Then we analyze the wallets hours of normal activity. By doing this we can start to identify the wallet's geographical location. Finally, we study how the fund wallet has moved its tokens between different wallets. This is crucial to clustering other wallets that may still be owned and managed by the fund.
Tell Me More about FRST
The FRST platform was built with professional traders, data scientists, and blockchain researchers in mind. Our current customers include major digital asset exchanges, hedge funds with dedicated crypto desks, venture capital funds, audit/compliance/KYC functions within institutions, and university and government research efforts in the blockchain space.
If you are interested in getting in touch with us or learning more about our team, please visit frst.com or email info@frst.com. We are a friendly group of motivated folks, and we are always looking to add more rock stars to our team and community.
