On-chain transaction volume reaches tens of trillions of dollars, yet active addresses are few—this is no secret in the stablecoin ecosystem. A McKinsey and Artemis joint report from February 2026 makes it clear: out of $35 trillion in annualized transaction volume, only $390 billion is real payments. The rest is exchange transfers, arbitrage bots, and contract loops. Large-value addresses are concentrated while users are scattered. The goal of identifying consolidation is not to count users—it is to follow the money.
First, the numbers: why large-value consolidation is normal in this industry
In real stablecoin payments, B2B makes up 58% ($226 billion, up 733% year over year). The rest comes from smaller use cases like payroll remittances and card spending. B2B payments are naturally large in single transaction size, low in frequency, and involve few parties. A few companies paying millions each year can look like 'large payment volume but few users', but that is a normal structure, not an anomaly.
So when is it abnormal? When a large-value address behaves unlike normal B2B financial operations—for example, when it receives funds and immediately splits them into dozens of small transfers to new addresses, or when the fund path crosses three unrelated chains.
How to identify large-value consolidation: three layers
Layer 1: Address clustering—link addresses that belong to the same entity
This is the most basic on-chain analysis skill. The core idea is called multi-input heuristics: if one transaction has multiple input addresses, they probably belong to the same entity—because only that entity can control the private keys of all those addresses at the same time.
How to do it:
Use tools like Dune or Nansen to check address links. See which other addresses share input transactions with the target address.
In June this year, Chainalysis proposed an 'address clustering ontology' standard. It splits clustering into two layers: transaction graph structure and confidence assessment, aiming to create unified rules for on-chain forensics.
Done when: you can link a large-value receiving address to 3–5 known exchange deposit addresses or project wallets, and tell who it most likely belongs to.
Layer 2: Exchange address identification—where the money finally goes
The most common endpoint of large-value stablecoin consolidation is an exchange. Identifying which addresses belong to centralized exchanges is key to tracing fund flows.
How to do it:
In April 2026, an IEEE study used machine learning models (random forest plus graph neural network) to identify exchange addresses on Ethereum and Optimism. Its core idea combines transaction volume, graph connectivity, and time patterns.
In practice, a simpler way is to check who the address interacts with. If a large-value address frequently sends money to deposit addresses of Binance, Coinbase, or OKX, it is likely an institution's consolidation wallet.
Done when: you can confirm which exchange's known address the large-value consolidation flows to, and trace it to the point where funds leave the chain.
Layer 3: Clustering algorithms to spot abnormal patterns—scan in batches, not by eye
If the traffic is too large or there are too many addresses to check manually, use algorithms for pattern recognition.
How to do it:
A 2025 IEEE paper proposed a clustering algorithm based on on-chain data. It extracts features from four dimensions—transaction amount, frequency, address linkage, and time series—and uses an improved density peak clustering algorithm to separate normal and abnormal transaction clusters. Experimental results showed identification accuracy over 90% and false positive rate below 5%.
In practice, Cobo's Payment API solution has turned smart consolidation into a product feature: the system automatically consolidates funds according to network conditions and strategies, reducing on-chain costs while providing fine-grained reconciliation interfaces.
Done when: run the wallet's transaction data from the past 3 months once. The algorithm outputs 10–20 'highly linked address clusters'. Manually check 2–3 of them to confirm the clustering logic is reasonable.
High-risk reminder
'Large-value consolidation' does not necessarily mean 'centralization risk'. B2B stablecoin payments are naturally large and low-frequency. B2B accounts for 58% of the $390 billion in real payments, so this structure itself creates the appearance of 'large transaction volume but few users'. The real purpose of identifying consolidation is to confirm whether the fund flow path is reasonable and whether there is unauthorized transfer—not to mark something suspicious just because the amount is large.
Final check
Pick the address with the largest receiving amount in your wallet and test it:
Use Dune or Nansen to check linked transactions for this address. See if you can find more than 3 related addresses that share input addresses.
Track the destination of the latest 5 large outgoing transfers—do they go to exchange deposit addresses, or to an address with no known label?
If it is the latter, run a clustering algorithm on the unknown address's linked network to see if it connects to more addresses.
Verification method: If you can answer 'Where did this large consolidated money finally go, and how many address layers did it pass through?' within 30 minutes, the identification chain works. If you cannot find the destination, your on-chain monitoring still has gaps.
