An alert pops up: “2,000 BTC transferred from unknown wallet to Exchange X.” Replies fill up with “dump incoming.” Before you react, it helps to know that an alert like this contains two very different kinds of information. The amount and the time are facts recorded on the blockchain. The words “unknown wallet” and “Exchange X” are labels, and labels are someone’s inference about who controls an address. Most of the skill in whale tracking is separating those two things.
This guide uses that one alert as a running case: what you can verify, what you have to infer, and what the transfer could plausibly be.
Part 1: What is on the chain, and what is a label
A blockchain records addresses, amounts and timestamps. It does not record names. Every name you see on an explorer or analytics dashboard was added afterwards by a data provider, using some mix of these methods:
- Disclosure. An exchange or fund publishes its addresses, for example in a proof-of-reserves report, or tells a data provider directly.
- Public evidence curated by people. Etherscan’s public name tags are added by its curators, usually with a link to the source, and are only shown for individuals who have publicly claimed an address. Etherscan also notes that tags can be removed when a claim later turns out to be false.
- Heuristics and clustering. Analysts follow money flows to group addresses that appear to be controlled by one entity. A classic example: a user deposits to a unique exchange deposit address, and the exchange later sweeps that address into its known hot wallet. Every address that sweeps into the same hot wallet gets grouped under the exchange.
- Crowdsourced or AI-assisted tagging. Arkham, for instance, describes combining machine-learning pattern recognition, in-house research and community-submitted intel that is reviewed before it is added.
Each method has blind spots. Glassnode’s exchange data transparency notice is unusually candid about them: its exchange balances are built from verified addresses, vetted public tags and clustering; they are deliberately conservative, so they are largely lower bounds; and they can be revised retroactively when new addresses are identified. In other words, the “exchange balance” you saw last month may not be the same number today, and two providers can disagree about the same exchange.
Why “unknown wallet” is not a clue
“Unknown” just means the provider has no label. It is not evidence of a private individual or a hidden whale. Many institutional custody wallets, OTC desk wallets and new exchange cold wallets sit unlabeled for long periods.
Part 2: Checking the alert, step by step
Here is the procedure for our 2,000 BTC example. You need only a free block explorer plus whatever labeling service generated the alert.
- Open the transaction itself. Copy the transaction hash from the alert into a block explorer. Confirm the amount, the time and the destination address. Alert bots sometimes count change outputs as part of the “transfer,” so check which output actually went where.
- Check the label source. Click the destination. Is it labelled as an exchange by more than one provider? Is the label a deposit address, a hot wallet or a cold wallet? These mean different things (see below).
- Look at the destination’s history. A deposit address usually receives funds and then forwards everything to one larger address within hours. A cold wallet receives large amounts and rarely sends. A hot wallet sends and receives constantly.
- Look at the source’s history. Did the “unknown” wallet receive these coins from the same exchange days earlier? If so, this may be coins coming back after custody, collateral or an OTC settlement, not a fresh seller.
- Size it against the market. At an illustrative price of $100,000, 2,000 BTC is $200 million. If combined daily spot volume across major venues were, say, $40 billion (an illustrative figure; check a current aggregator before using one), the transfer is about 0.5% of one day’s volume. Large in absolute terms, but not automatically decisive.
- Write it down before you watch price. Record the time, amount, label, your interpretation and your confidence. That record is what lets you learn from these alerts later (more on this below).
Part 3: What the transfer could be
| What you see on-chain | Possible explanations | What would help tell them apart |
|---|---|---|
| Unlabeled wallet to an exchange deposit address | Holder preparing to sell; posting collateral for derivatives; moving to the exchange’s custody product; OTC settlement routed through the exchange | Whether the coins are later swept to a hot wallet, and whether order book depth or spot volume changes around the time |
| Exchange cold wallet to the same exchange’s hot wallet | Internal rebalancing to meet withdrawals | Both addresses labelled as the same entity; usually no sale involved |
| Exchange wallet to a new unlabeled address | A customer withdrawal to self-custody; the exchange creating a new cold wallet; a custodian moving coins | Whether the new address later sends to other known exchange wallets |
| Wallet labelled as a fund, ETF custodian or miner to an exchange | Redemptions, creations, treasury management, or a sale | Public flow data for ETFs; miner reserve trends; see our guides to ETF inflows and miner reserve outflows |
Only some of these involve selling, and none of them is proven by the transfer alone. A deposit to an exchange raises the possibility of selling; it does not tell you whether, when, or at what price. Our article on exchange inflow spikes covers the aggregate version of this signal, which is usually more informative than any single transfer.
Where whale tracking goes wrong
Mislabels and stale labels
Clustering is an inference, not an identity check. Shared infrastructure creates false links: one custodian or payment processor can hold coins for many unrelated clients in the same omnibus wallet, so “whale moved coins” may really be many small users. On Bitcoin, CoinJoin transactions break the assumption that all inputs to a transaction share an owner. On Ethereum and similar chains, smart contracts, bridges and aggregators can make unrelated users look like one wallet. Labels that were correct a year ago can be outdated if an exchange retires wallets.
Coins that move off-chain
Once coins are inside an exchange, trades between customers happen in the exchange’s internal ledger and never reach the blockchain. A whale can sell 2,000 BTC already sitting on an exchange without any new on-chain transaction. Conversely, a large deposit may never be sold at all.
Selection bias in your memory
People remember the deposit that came before a sharp drop and forget the ten that were followed by nothing. Social media accounts that post alerts tend to highlight the hits. This is the strongest reason to keep your own log.
Reacting at the worst moment
Alerts often arrive during volatile periods, when spreads are wide and stops cluster. Entering on the alert itself means trading at the moment liquidity is thinnest, with no edge you have measured.
A simple tracking log you can keep
If you want to know whether large transfers matter for the markets you trade, measure it. Create a spreadsheet with these columns:
| Column | Example entry (illustrative) |
|---|---|
| Date and time (UTC) | 2026-10-14 13:05 |
| Asset and amount | BTC, 2,000 |
| From label / to label (and which provider) | Unlabeled / Exchange X deposit (two providers agree) |
| Your classification | Possible sell-side deposit, low confidence |
| Price at alert | $100,000 |
| Price change after 4h and 24h | Fill in later |
| Follow-up on-chain | Swept to hot wallet after 2h / not swept |
Set a fixed threshold in advance (for example, every BTC transfer above a size you choose that touches a labelled exchange) and log every one, not just the interesting ones. After 30 to 50 entries, compare the price changes after deposits with the price changes after random times of day. If you cannot see a difference in your own data, that is a useful result too. Our trading journal guide covers how to review a log like this without fooling yourself.
The short version
Amount and time are facts; names are inferences. Check the transaction yourself, find out what kind of exchange address it is, consider the non-selling explanations, size the transfer against normal volume, and log the outcome. Used that way, whale tracking becomes a way to ask better questions about the market rather than a stream of alarms.
Financial disclaimer: This article is for educational purposes only and is not financial, investment, or trading advice. Trading involves substantial risk of loss. Example figures are illustrative.
1 thought on “Whale Wallet Tracking Basics: How to Check an Alert Yourself”