Peel chains

As of September 2026: The technique itself is stable, but detection tools and court records evolve. The Bitfinex case facts above come from the February 2022 complaint; see the case page for later developments such as guilty pleas and sentencing.

Also called: peeling chains · peel chain layering.

What is a peel chain?

Think of peeling an onion, one thin layer at a time. In a peel chain, a large balance of bitcoin sits at one address. The holder sends most of it to a fresh address and sends a small amount somewhere else. Then the same thing happens again from the fresh address, and again, and again. Each transaction “peels” a small slice off the balance, and the rest moves to the next link.

A federal complaint from the Bitfinex investigation described it this way: a large amount of BTC at one address is sent through a series of transactions in which a slightly smaller amount is transferred to a new address each time. Some BTC peels off the chain to another address, frequently to be deposited into a virtual currency exchange, and the remaining balance goes on to the next address. The IRS agent who wrote it said that, in his training and experience, it is common for launderers to rely on peel chains to obstruct the movement of illicit money.

Peel chains belong to layering. They do not change what the coins are or who owns them. They add distance and volume so that finding the end of the trail takes time, patience, and software. They are also a lot simpler than the other crypto techniques on this site: no mixer, no bridge, no new coin.

How do peel chains work?

1. A large balance starts in one place. The coins may come from a hack, a darknet market, a ransomware payout, or scam proceeds. In the Bitfinex case the stolen coins first sat in one unhosted wallet, and most of them stayed there for years.
2. The holder spends the balance in a chain. Bitcoin transactions consume earlier outputs and create new ones, so sending most of a balance to a new address is a normal thing for a wallet to do. In a peel chain the chain goes on for many links, and each new address is used briefly.
3. Slices peel off to destinations. The small amounts go to exchange deposit addresses, to pass-through services, or to accounts opened for the purpose. In the Bitfinex complaint the slices were deposited gradually into AlphaBay accounts, which the agent called an indication of peel chain activity, and then withdrawn again.
4. The chain ends at cash-out. The final remainder, or the slices deposited across many exchange accounts, is converted into other assets or withdrawn to fiat.

A peel chain can also run the other way. In the Bitfinex complaint, withdrawals from several exchange accounts merged as they flowed through a peel chain and ended in one deposit to an account in Lichtenstein’s own name. Chains are a way to move value between accounts as well as to hide it.

Why do peel chains work?

They look like everyday wallet activity. Wallets pass change to new addresses all the time. A pattern that is common in ordinary use is hard to treat as suspicious on its own, which is why a chain has to be judged by where it started and where it ended.

They cost the investigator time. Every hop is on the public ledger, but a chain of many hops with side payments at each one is a large graph to follow. Automated tools help. Even so, an analyst has to decide which branches matter and which slices are noise, and each new address adds another lead.

They use small amounts. Small slices sent to exchange deposit addresses can blend in with ordinary customer deposits. That is the same reasoning as structuring, applied to a blockchain rather than a bank teller.

They pair well with other layers. In the Bitfinex complaint, agents said the defendants used peel chains alongside fictitious identities, automation, deposits into a darknet market, and conversions into other coins, a chain-hopping pattern. Each layer forced a different kind of analysis, and the combination bought time.

They do not hide anything permanently. This is the weakness. Peel chains sit entirely in the open on a public ledger. Time and money can be spent following them, and eventually they have to end somewhere that records identities.

Real case: Bitfinex

In August 2016, an intruder took about 119,754 BTC from the Bitfinex exchange in more than 2,000 unauthorized transactions. In February 2022, IRS-CI agents filed a complaint against Ilya Lichtenstein and Heather Morgan, describing how the stolen coins were traced. (At the time of the hack the coins were valued at about $71 million, the complaint said; it put their value at over $4.5 billion as of February 2022.)

The affidavit laid out the path. The stolen coins first went to an unhosted wallet containing over 2,000 addresses, where they stayed dormant until January 2017. From then on a portion of them moved into accounts at the darknet market AlphaBay, which the agent described as a pass-through: depositing and withdrawing there let the defendants break up the stolen coins’ trail. The early layering, the complaint says, used the peel chain technique, with funds deposited gradually into AlphaBay accounts. After that, coins flowed to accounts at several exchanges, and on to accounts belonging to the couple and their businesses.

Investigators did not need to break the peel chain’s design. They followed it. For example, withdrawals from multiple accounts at one exchange merged as they flowed through a peel chain and funded a deposit on or about February 13, 2017 to an account in Lichtenstein’s own name. The exchange had asked several account holders to verify their identity; those holders did not respond and the exchange froze the accounts, which held over $186,000. The accounts shared email providers and IP addresses, and a spreadsheet in Lichtenstein’s cloud storage listed the logins and marked several of them “FROZEN.” Agents also obtained his cloud storage file listing the 2,000 addresses and their private keys, and used it on January 31, 2022 to seize about 94,636 BTC, worth $3.629 billion, from the wallet where most of the stolen funds still sat.

The lesson is less about the peel chain than about what surrounded it. Public ledgers, exchange records, and ordinary mistakes with email addresses and spreadsheets are what connected a long, deliberately noisy trail to two people. Read the case page for the pleas, sentences and later developments.

How do peel chains get caught?

Chain analysis. Analytics tools can follow a peel chain automatically. They cluster addresses, look for the pattern of near-complete transfers with a small side payment, and carry the trace across many hops faster than a human could. The complaint’s charts are examples of how investigators display such flows.

Cash-out points. Peeled slices land at exchanges, and exchanges hold account records. The Bitfinex agents relied on exchanges that froze accounts when identity questions went unanswered, and on records showing who registered each account. This is where the detection machinery does its work.

Exchange screening. Regulated exchanges and other virtual asset providers can screen incoming deposits for exposure to addresses tied to hacks, darknet markets or sanctions, however many hops back. FinCEN’s kiosk notice makes a similar point about scam payments, saying blockchain analysis can connect payments made at different times by different victims.

Freezing and seizure. Once a chain is mapped, unspent balances can be seized under a warrant, as happened with the roughly 94,636 BTC in the Bitfinex wallet. Slices that already reached exchanges can be frozen if the exchange acts in time.

Standards. The FATF’s 2020 report on red flag indicators for virtual assets, based on more than 100 case studies from its network, lists technological features that increase anonymity and structured or systematic transfers as suspicious signs, and gives banks and platforms a framework for reporting them.

First published September 21, 2026 · Last updated September 21, 2026 · Legal statuses current as of September 2026