Peel chain

What is a peel chain?

In a peel chain, money moves through a long series of addresses, with a small amount skimmed off at each step, often to an exchange. It resembles peeling an onion: layer by layer, a little is removed. This setup makes the trail look fragmented, while the main flow can often still be followed with the right analysis.

Why do fraudsters use a peel chain?

A peel chain makes it harder to see at a glance where the money went, because the amount is spread across many transactions and addresses. With blockchain analysis the pattern can often still be recognised and unravelled.

What is a peel chain?

A series of transactions in which a small part is split off from a main amount each time, while the remainder moves on to a next address. The chain can repeat many times over.

Is a peel chain always suspicious?

No. Similar patterns also arise from automatic pay outs or from services that settle in parts. The meaning follows from the surroundings of the pattern.

How many steps does a peel chain usually have?

That varies from a few to dozens of steps. The number says less than the regularity: equal amounts, short intervals and a new address every time make a chain recognisable.

What does a peel chain mean for your file?

It makes the route longer but not unreadable. The chain can be recorded as a whole, with each step showing which part was peeled off and where the main amount continued.

How the pattern is read and where it ends

What makes this pattern recognisable is its rhythm rather than its size. A balance moves along a series of addresses, and at each step a modest portion is split off while the remainder continues. The small portions tend to go towards places where value leaves the chain, and the large remainder keeps moving. Read over a whole route it looks mechanical, which is the point: the sequence is designed so that no single step is large enough to stand out and no single address holds the funds for long.

For a file the useful part is not the pattern itself but where it terminates. Each split has to arrive somewhere, and sooner or later some of those destinations are services that keep customer records. Those are the points we record with amount, time and reference, because they are the only places an institution can act. The long chain in between is described in summary, since listing forty hops adds length without adding anything a reader can use. Where a route runs on past the point we can follow, the report says so instead of implying a conclusion.