Wallets above their normal outflow
countLabelled hot and warm wallets whose outflow in the latest complete hour is above their own baseline threshold.
Dashboard · VantagePlanned
Exchange Hot Wallet Monitor: Unusual Outflows by Exchange
Is any exchange hot wallet sending out far more than it normally does right now, and where are the funds going?
Outflows from exchange hot wallets hour by hour, against each wallet's own normal pattern, with the receivers of anything unusual.
ShareEmail it
Blueprint
What the dashboard will show.
The dashboard as it will open in Vantage. Each figure is named here and arrives with its receipt; until its data is published, its place stays empty.
Now
Hot wallets whose outflow in the latest hour is unusual for them.
Largest outflow against baseline
× baselineThe highest ratio of a wallet's latest-hour outflow to its baseline for that hour of the week.
Sent to fresh addresses, last hour
USDValue labelled hot wallets sent in the latest hour to addresses first seen within the day.
Hot wallets watched
countLabelled hot and warm wallets the monitor reads each hour on covered chains.
Flagged wallets now
Each flagged wallet's exchange, chain, outflow in the hour, baseline, ratio, tokens sent and its largest receivers with their labels.
Outflow against baseline, last 48 hours
USDHourly outflow of the selected exchange's wallets against their baseline band, so a break from routine shows at a glance.
History
Past flags, what they turned out to be and the breaches kept as reference.
Flags in the period
countWallet-hours flagged across covered exchanges in the selected period.
Flags later tied to a breach
countFlagged episodes in the period that an exchange or the incident registry later confirmed as a breach.
Flags by day and exchange
countFlagged wallet-hours per day for each exchange over the selected period.
Episodes and what they were
Each flagged episode with its exchange, chains, outflow, receivers and outcome: breach, cold storage move, rebalance or unexplained.
- Exchange
- Every labelled exchange
- Chain
- Every covered chain
- Period
- Last 7, 30 or 90 days
About
What it answers, and for whom.
When an exchange is breached, the first public sign is usually on-chain: its hot or warm wallets start sending far more than usual, often many tokens at once, to addresses never seen before. This dashboard watches labelled exchange hot wallets hour by hour and compares each one's outflow with its own normal pattern, so a spike stands out within the hour it happens.
A flag is a pattern, not a verdict. Exchanges also sweep funds to cold storage, rebalance between chains and pay out large client withdrawals. The dashboard shows where each flagged outflow went, whether to labelled exchange wallets, swap and bridge contracts or fresh addresses, so a reader can tell routine moves from the shape of past breaches.
Every flag opens the transactions behind it and the baseline it was compared with. Past breaches stay on the history page as reference episodes, so a new spike can be set beside the outflows that opened earlier incidents.
Method
How it will be measured.
Every figure will be read at a block, kept with its source and its exact read, and open a receipt anyone can re-check.
How receipts work →- Hot and warm wallets come from exchange-published reserve lists and from deposit sweeps seen on-chain, where many deposit addresses forward to one wallet, each label kept with its source.
- Outflows are native transfers from traces and token Transfer logs leaving each wallet, summed per hour and valued at oracle prices at the hour's last block.
- Each wallet's baseline is its own trailing thirty-day distribution of hourly outflows by hour of the week, so a busy exchange's Monday is never compared with a small exchange's Sunday.
- A wallet is flagged when an hour's outflow exceeds a high percentile of its baseline by a set multiple, or when it sends many different tokens to one new address within the hour.
- Receivers are classed as labelled exchange wallets, swap and bridge contracts or fresh addresses first seen within the day; transfers between one exchange's own wallets are left out.
The data it needs
Chain data, with some off-chain sources
- exchange_balances_dailyTo buildExchange wallet balancesBalances held in labelled exchange wallets per asset, chain and exchange at day end, and net flows in and out.
- whale_transfersTo buildLarge transfersTransfers above a size threshold per token and chain, with sender and receiver labels (exchange, fund, bridge, unknown).
- address_labelsTo buildAddress labelsLabels for known addresses: exchanges, bridges, protocols, funds, treasuries, sanctioned addresses and known attackers.
- native_prices_dailyTo buildOracle prices by dayReference prices of major assets read from on-chain oracle feeds (Chainlink latestRoundData) at each day's last block, with each round's update time.
- security_incidentsTo buildHacks and exploitsA registry of exploits, hacks and rug pulls: date, chain, protocol, attack type, amount lost and the transactions involved.
- Exchange-published reserve address lists and hot wallets identified by deposit sweeps (off-chain labels with sources)
- Native transfers from traces and token Transfer logs out of each labelled wallet, per hour
- First-seen block of each receiving address, for fresh-address checks
- Swap and bridge contract labels, to see where flagged funds go next
Questions
Questions people ask.
What is an exchange hot wallet?
The online wallet an exchange uses to pay out withdrawals quickly. It holds a working balance and is refilled from warm or cold storage, and because its keys are online it is the wallet attackers most often reach.
How can an exchange hack be spotted on-chain?
The common signs are outflows far above a wallet's normal level, many different tokens leaving at once, receivers that are brand-new addresses and quick swaps of drained tokens into ETH or transfers onto bridges. The dashboard checks each of these per wallet, per hour.
Does an unusual outflow mean an exchange was hacked?
No. Exchanges move funds to cold storage, rebalance between chains, migrate to new wallets and process very large withdrawals. A flag means the outflow is unusual for that wallet; the receivers and later confirmations decide what it was.
How is a wallet's normal outflow measured?
From its own history: the outflow of each hour of the week over the last thirty days. Comparing a wallet only with itself avoids flagging a large exchange for ordinary volume or missing a spike at a small one.
Which exchange wallets are covered?
Wallets that exchanges publish in their reserve lists and hot wallets identified by the sweeps of their deposit addresses. Each label shows its source, and wallets without a confirmed label are not monitored.
- Hot wallet
- An exchange wallet whose keys are online so it can pay withdrawals automatically; it holds a working balance.
- Warm wallet
- Storage between hot and cold: keys kept offline or behind extra approvals, used to refill hot wallets during the day.
- Baseline
- A wallet's own normal outflow for each hour of the week, from its recent history, used to judge whether an hour is unusual.
Related
More apps like this.
Crypto Exchange Hacks: Full List and Losses
Every known centralized exchange breach, when it happened, which wallets were hit and how much left them, tied to the on-chain outflows.
Multi-chainProof of Reserves Tracker: Exchange Wallet Balances
What exchanges hold in the reserve wallets they publish, chain by chain, read at each day's last block beside what they report owing.
Multi-chainBitcoinEthereum+1Crypto Whale Transactions: Large Transfers Today
The day's largest transfers of BTC, ETH, USDT, USDC and other major assets across chains, tagged when they move to or from an exchange.
Multi-chainBitcoinEthereum+2ETH Exchange Reserves: Ether Held on Exchanges and Netflow
ETH and WETH in labelled exchange wallets by exchange and day, the daily netflow and how much of the ETH supply exchanges hold.
EthereumBaseArbitrum+1Stolen Crypto Tracker: Where Hacked Funds Went
Follow a hack's stolen funds hop by hop into bridges, swap protocols, mixers and exchanges, or see what still sits in attacker wallets.
Multi-chainETH Rich List: Top Ethereum Addresses by Balance
The Ethereum addresses holding the most ETH: what kind of address each one is, who it belongs to where known and how its balance moved.
EthereumBuild Exchange Hot Wallet Monitor: Unusual Outflows by Exchange on verified data.
Start free in Voltfin Studio: boards, tables and reports where every number opens its receipt. Tell us which data you need first and we will build it next.