# Exchange Hot Wallet Monitor: Unusual Outflows by Exchange

> Monitor exchange hot wallets hour by hour: outflows against each wallet's own baseline, flagged spikes, fresh receiving addresses and the assets leaving.

Markdown copy of https://voltfincrypto.com/apps/exchange-hot-wallet-monitor

**Question:** Is any exchange hot wallet sending out far more than it normally does right now, and where are the funds going?

- Kind: Dashboard in Voltfin Vantage
- Topic: [Wallets and whales](https://voltfincrypto.com/topics/wallets)
- Chains: Ethereum, Bitcoin, Tron, BNB Chain, Solana, Arbitrum, Base
- Status: Planned. The data is not published yet, so this page states no figure; each figure will open its receipt when it is.

When an exchange is breached, the first public sign is usually on-chain: its hot or warm wallets start sending far more than usual, often many tokens at once, to addresses never seen before. This dashboard watches labelled exchange hot wallets hour by hour and compares each one's outflow with its own normal pattern, so a spike stands out within the hour it happens.

A flag is a pattern, not a verdict. Exchanges also sweep funds to cold storage, rebalance between chains and pay out large client withdrawals. The dashboard shows where each flagged outflow went, whether to labelled exchange wallets, swap and bridge contracts or fresh addresses, so a reader can tell routine moves from the shape of past breaches.

Every flag opens the transactions behind it and the baseline it was compared with. Past breaches stay on the history page as reference episodes, so a new spike can be set beside the outflows that opened earlier incidents.

## Blueprint

### Now

Hot wallets whose outflow in the latest hour is unusual for them.

- **Wallets above their normal outflow** (count): Labelled hot and warm wallets whose outflow in the latest complete hour is above their own baseline threshold.
- **Largest outflow against baseline** (× baseline): The highest ratio of a wallet's latest-hour outflow to its baseline for that hour of the week.
- **Sent to fresh addresses, last hour** (USD): Value labelled hot wallets sent in the latest hour to addresses first seen within the day.
- **Hot wallets watched** (count): Labelled hot and warm wallets the monitor reads each hour on covered chains.
- **Flagged wallets now**: Each flagged wallet's exchange, chain, outflow in the hour, baseline, ratio, tokens sent and its largest receivers with their labels.
- **Outflow against baseline, last 48 hours** (USD): Hourly outflow of the selected exchange's wallets against their baseline band, so a break from routine shows at a glance.

### History

Past flags, what they turned out to be and the breaches kept as reference.

- **Flags in the period** (count): Wallet-hours flagged across covered exchanges in the selected period.
- **Flags later tied to a breach** (count): Flagged episodes in the period that an exchange or the incident registry later confirmed as a breach.
- **Flags by day and exchange** (count): Flagged wallet-hours per day for each exchange over the selected period.
- **Episodes and what they were**: Each flagged episode with its exchange, chains, outflow, receivers and outcome: breach, cold storage move, rebalance or unexplained.

Filters: Exchange (Every labelled exchange); Chain (Every covered chain); Period (Last 7, 30 or 90 days).

## How it will be measured

- Hot and warm wallets come from exchange-published reserve lists and from deposit sweeps seen on-chain, where many deposit addresses forward to one wallet, each label kept with its source.
- Outflows are native transfers from traces and token Transfer logs leaving each wallet, summed per hour and valued at oracle prices at the hour's last block.
- Each wallet's baseline is its own trailing thirty-day distribution of hourly outflows by hour of the week, so a busy exchange's Monday is never compared with a small exchange's Sunday.
- A wallet is flagged when an hour's outflow exceeds a high percentile of its baseline by a set multiple, or when it sends many different tokens to one new address within the hour.
- Receivers are classed as labelled exchange wallets, swap and bridge contracts or fresh addresses first seen within the day; transfers between one exchange's own wallets are left out.

## Data it needs

- `exchange_balances_daily` (to build): Balances held in labelled exchange wallets per asset, chain and exchange at day end, and net flows in and out.
- `whale_transfers` (to build): Transfers above a size threshold per token and chain, with sender and receiver labels (exchange, fund, bridge, unknown).
- `address_labels` (to build): Labels for known addresses: exchanges, bridges, protocols, funds, treasuries, sanctioned addresses and known attackers.
- `native_prices_daily` (to build): Reference prices of major assets read from on-chain oracle feeds (Chainlink latestRoundData) at each day's last block, with each round's update time.
- `security_incidents` (to build): A registry of exploits, hacks and rug pulls: date, chain, protocol, attack type, amount lost and the transactions involved.
- Source: Exchange-published reserve address lists and hot wallets identified by deposit sweeps (off-chain labels with sources)
- Source: Native transfers from traces and token Transfer logs out of each labelled wallet, per hour
- Source: First-seen block of each receiving address, for fresh-address checks
- Source: Swap and bridge contract labels, to see where flagged funds go next

## Questions

### What is an exchange hot wallet?

The online wallet an exchange uses to pay out withdrawals quickly. It holds a working balance and is refilled from warm or cold storage, and because its keys are online it is the wallet attackers most often reach.

### How can an exchange hack be spotted on-chain?

The common signs are outflows far above a wallet's normal level, many different tokens leaving at once, receivers that are brand-new addresses and quick swaps of drained tokens into ETH or transfers onto bridges. The dashboard checks each of these per wallet, per hour.

### Does an unusual outflow mean an exchange was hacked?

No. Exchanges move funds to cold storage, rebalance between chains, migrate to new wallets and process very large withdrawals. A flag means the outflow is unusual for that wallet; the receivers and later confirmations decide what it was.

### How is a wallet's normal outflow measured?

From its own history: the outflow of each hour of the week over the last thirty days. Comparing a wallet only with itself avoids flagging a large exchange for ordinary volume or missing a spike at a small one.

### Which exchange wallets are covered?

Wallets that exchanges publish in their reserve lists and hot wallets identified by the sweeps of their deposit addresses. Each label shows its source, and wallets without a confirmed label are not monitored.

## Glossary

- **Hot wallet**: An exchange wallet whose keys are online so it can pay withdrawals automatically; it holds a working balance.
- **Warm wallet**: Storage between hot and cold: keys kept offline or behind extra approvals, used to refill hot wallets during the day.
- **Baseline**: A wallet's own normal outflow for each hour of the week, from its recent history, used to judge whether an hour is unusual.

## Related apps

- [Crypto Exchange Hacks: Full List and Losses](https://voltfincrypto.com/apps/crypto-exchange-hacks-list)
- [Proof of Reserves Tracker: Exchange Wallet Balances](https://voltfincrypto.com/apps/proof-of-reserves-tracker)
- [Crypto Whale Transactions: Large Transfers Today](https://voltfincrypto.com/apps/crypto-whale-transactions)
- [ETH Exchange Reserves: Ether Held on Exchanges and Netflow](https://voltfincrypto.com/apps/eth-exchange-reserves)
- [Stolen Crypto Tracker: Where Hacked Funds Went](https://voltfincrypto.com/apps/stolen-crypto-tracker)
- [ETH Rich List: Top Ethereum Addresses by Balance](https://voltfincrypto.com/apps/eth-rich-list)

Build it in Voltfin Studio: https://app.voltfincrypto.com/signup?next=%2F