Exchange flow monitoring
A team that needs to know when large transfers reach known exchange wallets can run rules on the from_type and to_type fields. Coverage is narrow: 23 exchange addresses in the label set, and only transfers of $100,000 or more in curated tokens.
#Workflow
- List the labeled wallets:
GET /labels?type=exchange. Filter it withchainto see the entries for one chain. - Write rules in the rule tester for each direction.
- Save the rules in the console with a webhook URL. Set the cooldown, because matches during a cooldown are dropped. The default is 300 seconds, so a busy rule needs a low value such as 60 seconds.
- Dedupe by
data.uidin your handler, because a retry can send the same event twice. - Once an hour or so, poll
GET /transfers?address=...for each wallet you care about, to catch anything your endpoint missed.
#Rules
Each was tested with POST /rules/validate at 2026-11-04T19:21:20Z against the newest 1,948 stored rows, about 18 minutes of data.
| Rule | Purpose | Matches |
|---|---|---|
to_type == "exchange" and usd >= 1m | Into any labeled exchange | 1 |
from_type == "exchange" and usd >= 1m | Out of any labeled exchange | 1 |
to_type == "exchange" and token in ["USDC","USDT","DAI"] and usd >= 500k and sampled == false | Stablecoins into exchanges, Solana excluded | 2 |
from_type == "exchange" and to_type == "exchange" | Between labeled exchanges | 0 |
The match counts come from a very short window, so they do not show a typical rate.
#Real sample
GET /transfers?address=0xA9D1e08C7793af67e9d92fe308d5697FB81d3E43&limit=10 at 2026-11-04T19:24:48Z, for the wallet labeled Coinbase 10. Addresses are shortened here. The table shows the newest five rows.
| Time (UTC) | Token | USD | From | To |
|---|---|---|---|---|
| 19:23:11 | USDT | 400,682 | Coinbase 10 | 0x119a...3220 |
| 19:22:11 | USDT | 188,170 | 0xdf2a...afc1 | Coinbase 10 |
| 19:18:11 | USDT | 748,178 | 0x2624...9834 | Coinbase 10 |
| 19:18:11 | USDT | 400,673 | Coinbase 10 | 0xf930...4a7a |
| 19:16:11 | USDT | 151,091 | 0x97bc...f51a | Coinbase 10 |
The times end in the same seconds because ts on EVM log events is estimated from the head block time. Use transaction lookup for the exact block time.
#Reading the result
| What you see | What it can mean | What it does not prove |
|---|---|---|
| Transfer to an exchange wallet | Funds moved to an address with that label | A sale. Exchanges also move funds internally and hold customer deposits |
| Transfer from an exchange wallet | A withdrawal or a treasury move | A purchase or a long-term hold |
| Many rows from one address | Several separate transfers | One actor. Farbeam does not cluster addresses |
| Zero rows | No matching stored row | No flow. The address may be unlabeled, the token not curated, or the amount below $100,000 |
A well-known exchange uses far more addresses than the label set holds. Deposit addresses are not labeled, so a deposit normally appears first as a transfer between two unlabeled addresses.
#What this will not do
- It does not measure net exchange flows. It sees only labeled wallets and stored rows, so a sum of rows is not an exchange's flow.
- It does not cover BTC, Tron or any chain outside the coverage list.
- It is not complete on Solana, where every event is
sampled: true. - A cooldown drops matches, so a rule is not a complete list of events. Use
GET /transfersto get the full stored list. - It is not a market signal. Farbeam gives no view on what a flow means for price.