Peel chains
A pattern where one large coin is spent again and again with a small amount shaved off each time, and how Forensia detects it.
#Plain languageIn plain terms
Picture someone with one large coin who wants to pay out many small amounts. They pay the first small amount and get a large coin back as change. They spend that change to pay the next amount. And again. The large coin shrinks a little with every step, like peeling layers off.
This leaves a recognisable chain of transactions. Forensia looks for it going forward from the transaction you searched.
#How it worksHow it works
- Follow the largest spent output forward, up to two more transactions.
- For each transaction in the run, check that most of its input value continues into one output.
- Check each step spends exactly the previous step's large output.
- Check the steps happened close together in time.
#Technical detailThe exact rules
| Requirement | Value |
|---|---|
| Linked transactions needed | 3 |
| Share of input value carried into the largest output | At least 80% |
| Time between consecutive steps | At most 3,600 seconds, by block time |
| Outputs per transaction | At least 2 |
For every step the arithmetic must close exactly: the outputs plus the fee must equal the inputs, in whole satoshis. A step with a missing input value or a newly mined coin breaks the chain. So does a step whose block time is earlier than the previous step's.
A match is given a score for display: 5,000 plus 750 per step plus a small coverage term, capped at 9,000 out of 10,000. For three qualifying steps out of three this is 8,250. It is a rule-match score, not a probability.
The finding is finding:bitcoin-peel-chain, followed by the transaction ID. Class lead, confidence low.
#LimitsWhat it does not tell you
- The minimum and the maximum are both three transactions, so a chain is found only when the searched transaction and the next two all qualify.
- It only looks forward. A transaction in the middle of a chain is not recognised from what came before it.
- A transaction with many inputs and one dominant output also qualifies. This is looser than the textbook definition.
- Unconfirmed transactions cannot qualify, because the time check needs a block time.
- Exchange treasury operations and market makers produce the same pattern.