A peel chain is a laundering method that moves a large balance through a long string of transactions, peeling off a small amount to a cash-out address at each step while the bulk rolls on to a fresh wallet. The trail of many small transfers is built to obscure the money and slip beneath monitoring thresholds one peel at a time.
What is a peel chain, in plain English?
Picture someone with a large stack of crypto they need to launder. Instead of moving it all at once, which would light up any monitoring system, they send it through a long sequence of hops. At each hop they peel off a small slice to an address that cashes out, while the large remainder moves on to a brand-new wallet. Repeat that dozens or hundreds of times and the big balance slowly drains into many small, dispersed exits.
The defining shape is a repeating two-output transaction: one small output that leaves the flow toward a cash-out point, and one large output that continues to the next fresh address. Hop after hop, the pattern looks like a single strand peeling off pieces of itself, which is where the name comes from.
The whole design is about defeating threshold-based monitoring. Each individual peel is small enough to fall under the amount that would trigger an alert or a report, so a system that only watches for large single transfers sees nothing worth flagging, even as a very large sum moves through in aggregate.
How a peel chain unfolds
The mechanics repeat the same simple move until the balance is drained:
- Load — Start with a large balance. Funds from a hack, scam, or other source sit in one wallet ready to be dispersed.
- Peel — Split off a small amount. A single transaction sends a small slice to a cash-out address and the remainder to a fresh wallet.
- Repeat — Roll the bulk onward. The new wallet repeats the peel, hop after hop, each small output slipping under thresholds.
- Exit — Reach the off-ramps. The peeled slices land at exchanges or services and cash out, dispersed across many small deposits.
Who is involved?
Who | Their role |
The launderer | Builds the chain, peeling small amounts off a large balance to disperse and obscure it. |
The cash-out addresses | Receive the peeled slices and move them into exchanges or services to reach fiat. |
The receiving exchange | Sees many small deposits that individually look harmless but trace back to one large source. |
The analyst | Recognizes the two-output shape and follows it step by step toward the off-ramps. |
What it looks like in practice
In practice
A large sum stolen in a scam lands in a single wallet. Rather than send it to an exchange in one lump, the operator starts a chain: each transaction peels a modest amount to a fresh deposit address at a different service and forwards the rest to a new wallet.
To an exchange watching only for big transfers, each incoming peel looks like an unremarkable small deposit. But an analyst tracing the source spots the tell: a long line of transactions, every one with a small output and a large continuing remainder. They follow the strand hop by hop, list the cash-out addresses, and alert the receiving exchanges so the small deposits can be linked back to the single illicit origin.
Why it matters to operators
Peel chains are a direct answer to threshold-only monitoring, and that is exactly why they matter. If your controls only fire on large single transactions, a peel chain walks straight past them while moving a substantial total. The individual peels are designed to look boring, so catching them means looking at the shape of the flow, not just the size of any one transfer.
The upside is that the pattern is distinctive once you know it. The repeating two-output structure and the long strand of fresh wallets are recognizable, and the peels eventually have to land somewhere real to cash out. Following the chain to those off-ramps is where you can actually intervene, link the small deposits to their source, and support a report.
What to watch for
- Two-output shape. A repeating pattern of one small output leaving and one large remainder continuing is the signature of a peel.
- Long strands of fresh wallets. Value passing through a chain of newly created addresses, each used once, points to deliberate dispersion.
- Small deposits from one source. Many modest inbound deposits that trace back to a single large origin are peels reaching your off-ramp.
- Under-threshold amounts. Peels sized just below alerting or reporting limits are a strong sign of intent to evade monitoring.
- Aggregate, not per-transaction. Judge the total moving through the strand, since no single peel looks large enough to flag.
Quick questions
How is a peel chain different from a mixer?
A mixer pools and shuffles many users' funds to break the link between input and output. A peel chain keeps one owner's funds moving through a strand of wallets, peeling small amounts off along the way. Different mechanics, same laundering goal.
Why is it called peeling?
Because each hop strips a small slice off the main balance, like peeling layers, while the bulk continues onward. Over many hops the large sum is peeled away into many small exits.
Why does threshold monitoring miss it?
Each peel is sized to stay under the amount that would trigger an alert or report. A system watching only for large single transfers never sees a flag, even though the total moving through is large.
Can you trace a peel chain?
Yes. The repeating two-output shape is recognizable, and analysts follow the strand hop by hop toward the cash-out points. The peels have to land at real services eventually, which is where you can act.
What is the change address here?
In each peel, the large continuing output is effectively the change returning to the owner's control on a fresh wallet, while the small output is the intended peel toward cash-out. Recognizing change is key to following the bulk.
How should a team respond?
Trace the strand to its off-ramps, list the cash-out addresses, and alert the receiving venues so the small deposits can be linked to the single source, then file a report on the flow.
Go deeper
- FATF ↗ — The global standard-setter for AML, counter-terrorist-financing, and counter-proliferation. Recommendations, guidance, and jurisdiction lists.
- OFAC, US Treasury ↗ — Administers US sanctions programs, the SDN list, and licensing.