On-chain data: wallets, flows and what they can and cannot tell

What you will learn

• What data a public blockchain shows and what stays hidden.
• How common metrics are built: exchange netflow, active addresses, stablecoin supply and total value locked.
• How to separate price effects from real deposits in total value locked.
• Why address labels and "whale" alerts need careful interpretation.

Explanation

On-chain data is information recorded on a public blockchain: addresses, balances, transfers, contract calls, fees and timestamps. A block explorer is a website that displays this data. Analytics firms combine it with labels, which are guesses about who controls an address.

What you cannot see

• Identity: an address is not a person. One person can use hundreds of addresses; one exchange address can hold funds of millions of customers.
• Trades inside exchanges: centralised exchanges match orders in their own databases. Only deposits and withdrawals appear on-chain.
• Off-chain deals and intent: OTC (over-the-counter) trades, derivatives positions and the reason for a transfer are not visible.

Common metrics

• Exchange netflow = inflows to known exchange addresses − outflows. Inflows are sometimes read as selling intent, outflows as moving to storage. But an exchange moving coins between its own wallets, or a mislabelled address, can create false signals.
• Active addresses: addresses that sent or received in a period. Automated bots, airdrop farming and spam transactions can inflate this number, especially on networks with low fees.
• Stablecoin supply: total tokens issued. Growth shows that more stablecoins exist, not where they will be spent.
• Total value locked (TVL): the market value of tokens deposited in a protocol. TVL rises when token prices rise, even if nobody deposits more. It can also double count: a token deposited in protocol A, borrowed against and deposited in protocol B may appear twice.

Rules of thumb

• Ask: is this change caused by price, by a few large addresses, or by many users?
• Check whether a "whale" is a single investor or an exchange, custodian or bridge contract.
• Use on-chain data as context and as a risk check (for example: are team wallets moving tokens before an unlock?), not as a timing signal on its own.
• Historical relationships between a metric and price can break. A pattern in past data is an observation, not a forecast.

Worked example

Hypothetical example: a lending protocol reports TVL of $500 million at the start of the month and $600 million at the end. All deposits are in the protocol's own token, whose price rose 25% during the month. Fees and rewards are ignored.

1. TVL if no one deposited or withdrew = $500m × 1.25 = $625m.
2. Actual TVL = $600m.
3. Net flow of users at end-of-month prices = $600m − $625m = −$25m.
4. Interpretation: the headline "+20% TVL" hides a net withdrawal of about $25 million. Users were leaving while the price rose.

A second check: 40% of the deposits sit in three addresses. If one of them leaves, TVL can fall sharply. Concentration matters as much as size.

Common mistake

Practice activity

On paper: a protocol's TVL falls from $800 million to $720 million in a week. Of the starting TVL, 60% was in a volatile token that fell 20% in price; the remaining 40% was in stablecoins that kept their value. Calculate the TVL expected from price changes alone and the net user flow. Then write one sentence on what the headline "TVL down 10%" hides.

Key takeaways

• Blockchains show addresses and transfers, not identities, exchange-internal trades or intentions.
• Exchange flows and active addresses are easily distorted by internal transfers and bots.
• Split TVL changes into price effect and net user flow before drawing conclusions.
• Use on-chain data for context and risk checks, not as a stand-alone trading signal.

Next step

The next lesson turns to the legal framework: MiCA, licensed providers and the rights you have as an investor in the EU.