How to read a wallet flow graph

2026-11-04 UTC · Farbeam research

A flow graph draws addresses as nodes and transfers as arrows. Many analytics products offer one. Farbeam does not have a flow graph tool yet Planned, so this guide teaches how to read a graph from any product, then shows how to do a small trace by hand with the wallet explorer.

#The parts of a graph

Element	What it usually shows	What to check
Node	One address, or a cluster the tool has merged	Is it one address or an inferred group?
Edge	One transfer, or a sum of many	Is the width a sum? Over what dates?
Arrow	The direction value moved	Which asset? Some graphs mix assets
Label	A name from the tool	Is the source named? How sure is it?
Color	A category, such as exchange or bridge	Who assigned it?

Before you read anything, find the settings: time range, assets, minimum value and hop depth. A graph with a $10,000 minimum looks very different from one at $1,000,000, and it can hide the smaller transfers an actor uses.

#Five mistakes to avoid

Reading a path as a connection between people. Two wallets that touch the same exchange wallet have no link to each other. Exchanges, bridges and routers connect to almost everyone. Treat high-degree nodes as ends of a path. Do not walk through them.

Trusting a cluster as a fact. Clustering is inference. It relies on patterns such as shared funding, and these can be wrong. Ask what evidence the tool gives for a merge.

Counting flow twice. A transfer through a router may appear as several edges. Summing the edges overstates the value that moved.

Assuming a swap is a transfer. When value enters a DEX pool and a different token comes out, the graph may stop or may jump. Value changed form, and the two sides are often not linked in a simple way.

Reading an arrow as intent. A graph shows that value moved. It does not show why. A deposit to an exchange could be a sale, or a move to a custody account.

#A trace by hand

You can do a small trace with lookups only. This example is real and uses ordinary activity, with no suggestion of wrongdoing. All calls ran on 2026-11-04 between 19:24:40Z and 19:24:48Z.

#Start from a transaction

A rule test returned a transfer of 12,000,000 USDC to the wallet labeled Coinbase 10. Open it in the transaction tool, or call the API.

curl

curl -s "https://farbeamlabs.com/api/v1/tx/ethereum/0x635ceb5456c60caf1364b4499ab484d762c8ca9b02e3f3ed55e6e12c89b48091"

The result: success, block 26343447, method transfer, from 0x3d927af0b7ebbf5c593f45e324f9d0c23bc5d4b4. The node to examine is the sender.

#Examine the node

curl

curl -s "https://farbeamlabs.com/api/v1/wallets/0x3d927af0b7ebbf5c593f45e324f9d0c23bc5d4b4"

Field	Value	Reading
`label`	null	Not in the Farbeam label set
`is_contract`	false on all chains	A normal account
`tx_sent`	1 on Ethereum, 0 on the rest	It has sent one transaction
`tracked_usd`	$0.01 on Ethereum	Almost empty after the transfer

#Follow the edge back

curl

curl -s "https://farbeamlabs.com/api/v1/wallets/0x3d927af0b7ebbf5c593f45e324f9d0c23bc5d4b4/activity?chain=ethereum"

blocks_scanned was 5,000, and it returned two items.

Block	Direction	Amount	Counterparty
26343447	out	12,000,000 USDC	Coinbase 10
26343432	in	12,000,000 USDC	`0x33566c9d8be6cf0b23795e0d380e112be9d75836`

#Draw it

Text

0x3356...5836  --12,000,000 USDC, block 26343432-->  0x3d92...d4b4  --12,000,000 USDC, block 26343447-->  Coinbase 10

You just drew a small flow graph, and you know how every part of it was produced.

#Stop, and write what you know

Statement	Status
`0x3d92...d4b4` received and sent 12,000,000 USDC, 15 blocks apart	Fact from chain data
The recipient is an address labeled Coinbase 10	Label from a curated list
`0x3d92...d4b4` is a deposit or pass-through address	Possible, not established
`0x3356...5836` and `0x3d92...d4b4` have the same owner	Not established

To continue, repeat the same steps on 0x3356...5836. Stop when you reach a labeled exchange, a bridge or a router, or when the trail leaves the data you can see.

#Limits of the by-hand method

Wallet activity reads only curated tokens, over at most 5,000 blocks on one chain. So a move in another token will not appear, and on a fast chain the window is short.
Stored transfers cover 7 days and only $100,000 or more.
Internal ETH transfers do not appear.
Every hop costs 6 units: 3 for the wallet and 3 for activity. The anonymous limit is 30 units per minute.
A transaction lookup decodes every ERC-20 Transfer in that transaction, up to 60, so it is the most complete view of one step.

An explorer has the full history. If you need graphs and clustering today, use a dedicated analytics product.

Nothing here identifies an owner, and nothing here is financial advice.