How to read a Bitcoin whale move

The chain is public. Interpretation is hard. This is a plain-language guide to reading large Bitcoin transactions — and to what they can and cannot tell you.

1. What a transaction actually is

Bitcoin has no accounts and no balances. It has unspent transaction outputs (UTXOs). A transaction does two things: it consumes existing outputs (as inputs) and creates new outputs (as outputs). The sum of the inputs minus the sum of the outputs is the fee a miner collects to include the transaction in a block.

Every input is a reference to a specific prior output — you don't spend "from an account," you point at specific coins and prove you can unlock them. Each output names an address (more precisely, a locking script) and an amount in satoshis. Once created, an output is either spent later (becomes someone else's input) or stays unspent. The "balance" an explorer shows for an address is just the sum of unspent outputs locked to it — a convenience, not a thing that exists on-chain.

2. Reading the shape of a move

The number and arrangement of inputs and outputs reveal the shape of a move, which is usually more telling than the total. Four patterns cover most large transactions:

  • Consolidation — many inputs, one output. Someone (often an exchange or large holder) sweeps many small outputs into one — to tidy up, before a big spend, or to reduce future fee exposure.
    many inputs ──▶ ONE output
  • Distribution / batch send — one input, many outputs. A single pot paying out to many recipients: withdrawals, payroll, a service batching payouts.
    ONE input ──▶ many outputs
  • Peel chain — one input, one main output (plus change), repeated. Value peels off one output at a time down a chain. Common in hot-wallet flow and deliberate obfuscation.
    A ──▶ B ──▶ C ──▶ D … (a little peeled off each hop)
  • Simple transfer — one input, one main output (+ change). The closest thing to "A sent to B."
    ONE input ──▶ ONE output (+ change)

A note on change: when an input is spent, the whole output is consumed. Any value not sent to an intended recipient returns to the sender via a change output — a new output the sender controls. So even a "simple transfer" often shows two outputs: the payment and the change.

3. Size isn't identity

A "whale" here is a size threshold (≥10 / 50 / 100 / 500 BTC), not a person or an institution. A 5,000-BTC transaction might be one individual moving cold storage; it might equally be an exchange rebalancing between its own wallets — an internal shuffle with no economic meaning. Big ≠ significant. Filtering by size is a useful first cut, but it overstates how much you actually know.

4. What public data can and can't tell you

The chain is public, so you can see: amounts, the input/output structure, fees, the address each output locks to, and confirmation status. With a sourced label, you can sometimes attach an entity name to an address.

You cannot see: who owns an address, why a transaction was made, whether an output is a payment or change, or whether several addresses belong to the same actor. Tools that "trace clusters" guess at that last part heuristically — sometimes well, sometimes badly. CoinJoins and mixers deliberately break the heuristic; exchange internal accounting happens off-chain and never appears as a transaction at all. Treat any confident statement about identity or intent as a claim to be sourced, not a fact.

5. How labels work here

This site's label directory maps specific addresses to known entities by exact match: if an address is in labels.json, outputs to it get labeled; otherwise they don't. Each entry carries a public source and a confidence level (high / medium / low). There is no clustering and no guessing. The consequence: the large majority of addresses are unlabeled, and most whale outputs will show no entity at all. That's honest, not a gap. Browse the directory at /labels/.

6. Using the three tools

  • Radar — /radar/. Watch the live mempool tip; it retains what it sees during your visit. Whales are rare, so give it time.
  • Brief — /brief/. Paste any txid and get a plain-English read with the logic and a certainty level.
  • Labels — /labels/. Check whether an address is a known entity, with sources.

Ready to see this on real transactions? Three decoded whale movements →

7. The honest version

The chain is public; interpretation is hard. These tools make large movements legible — what they are, structurally — without pretending to know who is behind them or why. If a claim isn't sourced, it's labeled with uncertainty, or it isn't here.