Exchange flows and whales

Every section so far was about what happens on an exchange: orders, trades, positions. The “Money” tab looks at what happens around it: which coins and dollars are brought onto exchanges, taken off them and moved between wallets away from exchanges.

A blockchain transfer is a record: so many coins left these addresses for those addresses. The record is public; anyone reading the chain sees it. EVA reads bitcoin from its own node: blocks and mempool with no intermediaries and no one else's retelling. But a record has no names — only addresses. To say “this is an exchange” you must know the address belongs to one.

We count as an exchange address only what the exchange published itself: Binance, Bitfinex, Bybit, BitMEX. Coinbase, Kraken and OKX do not publish their addresses, so EVA does not see their transfers as exchange transfers. We do not use bought labels like “this address is fund X”: no trustworthy “address → owner” list exists, and an invented label is worse than none.

Directions the “Exchange transfers now” feed distinguishes:

• to an exchange — from an unknown address to an exchange address;
• from an exchange — from an exchange address to an unknown address;
• between exchanges — from one known exchange's address to another's. Not counted in the net inflow: it is moving from one pocket to another, not new money in the market;
• within an exchange — between addresses of one exchange (say, hot wallet to cold). Not inflow either.

The “unconfirmed” mark means the transfer is visible in the mempool — the queue of transactions waiting for a block — but has not entered a block yet. It may never get there or may be replaced. When the transaction enters a block, the mark disappears. The “In the mempool” block gathers such transfers in one place: with a queue of several blocks they are visible tens of minutes earlier.

Only large transfers reach the feed: the threshold is named in the tab's help. Everything smaller is everyday venue noise and does not enter the totals at all.

The most common misconception on this tab: “2,000 BTC were brought onto an exchange, so they are being sold.” A transfer to an exchange means one thing: the coins are now where they can be sold quickly. Then different things can happen:

• the coins get sold — on spot or to close a position;
• the coins become collateral: margin for a futures position, which may well be a long;
• it is a custody change: a fund or custodian moved coins with no intention to sell;
• it settles an OTC deal that is already done and does not touch the book price;
• it is a shuffle between one's own accounts that we did not recognise as “within an exchange”.

Mirror case: a transfer from an exchange is not a purchase. Most often it is a move into custody, but it can also be a withdrawal for an OTC deal or a move to another venue.

What a transfer really gives is supply available for sale. If more coins are brought onto exchanges than taken off, sellers on the venues have more they could sell. Whether they will is shown by trades, delta and CVD (section 7), not by the transfer.

Two ways of looking at the same thing. The feed net is transfers to exchanges minus transfers from exchanges over a window: plus — more brought in, minus — more taken out. That is a flow, events. Exchange reserves are how much bitcoin sits on published exchange addresses right now. That is a stock, a state.

The stock is sturdier: a transfer can bypass the addresses we know and miss the feed, while the addresses' balance is visible whole and always. The reserve total is understated — exchanges have more wallets than they published — but the addresses are the same every time, so the change is honest even when the total is incomplete. Watch the change, not the size.

One more difference: the feed counts transfers of both bitcoin and the Ethereum network (ether and stablecoins), while reserves are bitcoin only. So on one day the feed can show inflow while the bitcoin reserve shows a decline, and there is no contradiction.

Stablecoins are tokens pegged to the dollar: USDT, USDC and others. The “Money” tab shows them two ways.

• Stablecoins on exchanges — how much USDT and USDC was brought to and taken from published exchange addresses on the Ethereum network over the window. A positive “difference” means exchanges gained dollars one can buy with. Brought in is not bought: stablecoins serve as collateral and move between one's own accounts. Stablecoins on other networks (Tron and others) are not visible here.
• Stablecoin issuance — how many exist at all, per the issuers' contracts. Rising — stablecoins are minted against incoming dollars; falling — they are burned and money leaves crypto for good. This is the only metric on the tab that answers “did new money arrive in crypto”: market cap also grows from repricing, while stablecoins multiply only when minted. Minting can run weeks ahead of buying.

If a source is silent, the block says since when there is no data instead of showing zeros. On 10.10.2026 the stablecoin block of the “Market in a day” page said exactly that: “no Ethereum-network transfers in the feed for this day — the source was silent”. Emptiness means “we don't know”, not “nothing happened”.

ETF flows — how much money went into and out of US spot bitcoin funds in a day. Next to it is the split by fund (IBIT — BlackRock, FBTC — Fidelity, ARKB — Ark, GBTC — Grayscale): the total can be zero when money leaves one fund and enters another.

Two things to remember always. First, the delay: funds publish after the US market close, i.e. almost a day later, and there are no rows at weekends. Second, an ETF inflow is not always demand. A sizeable part is cash-and-carry arbitrage: buying the fund while selling a CME future. The position is price-neutral but looks like inflow in the report. That is why the CME positions block sits next to it — a US regulator's report that describes Tuesday and comes out on Friday: the three-day lag is how the source works.

Hence the rule of the whole tab: data comes at four speeds. On-chain — one block of delay, about ten minutes (and the mempool even earlier). ETF flows — after the US close, almost a day. The CME report — three days. Dollar-system liquidity from FRED — a week. The blocks are kept apart and never added together. When two blocks disagree, the answer is almost always in the delay, not in the market.

Off-exchange whales are large bitcoin transfers where neither side is a known exchange address. The threshold here is higher than for the exchange feed on purpose: amounts of another order move between wallets. The word “whale” here is the size of a transfer, not a person: we do not know whose addresses these are and attach no names. It may be a fund's custody change, deal preparation, the split of a large holding or an exchange's own shuffle to unpublished addresses.

How the amount is counted. Change back to oneself is not counted: a transaction almost always has an output back to the sender, and without this rule the feed would consist of it. If the next transaction within two hours spends an output of a transfer already shown, that transfer becomes a link in a chain and leaves the sum — what counts is where the money stopped, and it reads “links in chain: N”. That is why a transfer younger than two hours is marked “preliminary”: it may still turn out to be a link. The “unconfirmed” mark is different: the transfer is still in the mempool, not in a block. These transfers enter the exchange inflow neither as plus nor as minus.

US government wallets are bitcoin addresses we link to the US government only through court documents. An address counts if its output, in a transaction the document calls a seizure or a transfer to the US Marshals Service (USMS), matched the amount in the document. The block header states how many cases and addresses are listed; below the rows — the case, document, paragraph, page and link. On 13.10.2026 the list held one case and 7 addresses.

These are not all government wallets — only those derived from the named documents, and “no movements” applies only to them. Whose the receiving address is, we do not know and do not name. What happens to the coins next does not follow from this data.

Hyperliquid whales are an entirely different source. Hyperliquid is an exchange that discloses positions publicly, so its large addresses show actual positions: amount long and short, number of positions, liquidation price. It is the only place in the terminal where specific participants' positions are visible rather than estimated — the hard levels on the liquidation map (section 13) come from here.

But it is a sample: only addresses we noticed through large trades, not the whole market. The “Hyperliquid whale results” block shows how their closed positions ended — losers included: a list of winners only takes an evening to make and is worth nothing. Sorting is by total result, not by share of winners. Profit is taken from the exchange itself. These addresses have no names either.