Reading a peel chain without over-reading it
Peel chains look conclusive and frequently are not. A method for distinguishing a genuine peel from ordinary change behaviour, and the confidence a peel finding actually deserves.
What is a peel chain, and how is one identified?
A peel chain is a laundering pattern where a balance moves through many transactions, each peeling a small amount towards a cash-out point while the remainder forwards onward. Ordinary wallet change behaviour produces a similar shape, so the pattern alone is not evidence. Separating them means examining amounts, timing and destinations together.
A peel chain is a sequence in which a large balance repeatedly sheds small amounts, each peel going one way while the remainder moves on. It is a recognised pattern in laundering, and it is also, unfortunately, what ordinary wallet change behaviour looks like on a UTXO chain.
What actually distinguishes them
Four properties, considered together rather than individually:
- Regularity. Genuine peels tend toward consistent peel sizes or consistent intervals. Ordinary spending does not.
- Destination diversity. Peels going to many distinct fresh addresses is different from peels going to a small set of reused ones.
- Chain length. Three or four hops is not a peel chain. Twenty is.
- Terminal behaviour. Where the peels end matters more than the peels themselves.
The confidence a peel finding deserves
On its own: low. A peel pattern is a reason to look further, not a finding.
Combined with a known origin — funds that entered the chain from a reported theft — it becomes a medium-confidence characterisation of what happened to those funds.
It becomes high confidence only when the peels terminate somewhere that corroborates the reading, such as a consistent set of deposit addresses at one service.
A note on how this goes wrong
The failure mode is not analysts inventing peel chains. It is a low-confidence peel observation being written in a report without its confidence level, then quoted downstream as an established laundering finding.
This is precisely why findings are typed at the point of writing rather than at the point of review. A confidence level that is not recorded when the observation is made does not survive the journey.