Fan-out and rapid forwarding
Two shapes in a wallet's activity that Forensia flags for review, with the exact thresholds, and why neither is an accusation.
#Plain languageIn plain terms
Some patterns of movement are worth a second look. Money arriving and leaving again within the hour. One wallet paying many different addresses in a short burst. Launderers do both. So do payroll runs, airdrops, exchanges and market makers.
Forensia flags these shapes as leads. A lead means "look here", not "this is wrong". Each one comes with the rule that triggered it so you can judge it yourself.
#How it worksHow it works
Both detectors work only on records the lookup already holds, and only on transfers that pass strict checks. Anything failed, conflicting or ambiguous is left out before the pattern is tested.
#Technical detailThe exact rules
Fan-out: one wallet, many recipients
Runs for wallets only. A contract paying many addresses is usually doing its job.
| Window | Distinct recipients needed | Starting confidence |
|---|---|---|
| 24 hours | 5 | Medium |
| 7 days | 6 | Low |
- Take the wallet's outgoing transfers of one asset that have a timestamp.
- Drop recipients that are known public contracts.
- Slide a window along them and count distinct recipients, using each recipient's first transfer.
- The first window that reaches the threshold is reported.
Two extra checks describe the amounts. The amounts are near-equal when every one is within 10% of the middle value. They are chunked when at least 3 are within 5% of the same value. Confidence stays at the window's level only when one of those holds and every transfer is receipt-confirmed. Otherwise it is low.
Finding: finding:fan-out-distribution, class lead. Each asset is tested separately. When more than one asset matches, the later findings carry the asset's key after the same ID.
Rapid forwarding: in, then out
- Take an incoming native transfer that is receipt-confirmed.
- Collect the wallet's receipt-confirmed outgoing native transfers in a strictly later block, with a strictly later time, within 3,600 seconds.
- Add up their amounts as exact integers.
- The pattern matches when the total is at least 90% of the incoming amount.
Only the first matching window is reported. Finding: finding:rapid-drain-v1, class lead, confidence low.
Earliest indexed funding
Where a transfer index is available, the oldest incoming native transfer above zero that it returns for the wallet is shown as finding:earliest-indexed-funding, class observed. It is the oldest record the index returned, not a claim about the wallet's first ever activity.
#LimitsWhat it does not tell you
- The outgoing transfers in a forwarding match may spend funds the wallet already had. Overlapping deposits are not separated.
- Fan-out compares raw token units. It is not a valuation.
- History is partial, so a pattern can be missed, and a short window can look more concentrated than it is.
- There is deliberately no "dormant wallet" detector. No available source proves a complete absence of activity.
- Payouts, airdrops, market making, custody and treasury operations all produce these shapes.