Whales, Smart Money, and Cohort Analysis

Following capital flows. The pitfalls of follow-trading. Cohort retention, diamond hands vs flippers, and real-world cases (Wintermute, 3AC, Bybit Lazarus).

35 min · advanced · part of On-Chain Analytics: Reading the Tape

Whales, Capital, and the Promise of Following

Crypto distributes returns more unevenly than almost any market in history. A small number of wallets control a vast share of supply on most chains and tokens. On Ethereum, the top 100 non-exchange addresses control a meaningful single-digit percentage of total ETH; on memecoin contracts the top 10 often hold above 30% of supply. These large holders — "whales" — move markets with their decisions. When a whale exits, price drops. When a whale accumulates, price tends to rise. The signal is real. This creates a natural strategy: watch whales, follow whales. If you can identify capital that has been consistently early to winning trades, perhaps you can ride along behind it. Nansen built a business around exactly this premise with its Smart Money labels. Many Twitter accounts publish "whale alerts" continuously. Tools like Lookonchain, ZachXBT (forensics flavor), Spot On Chain, and OnchainLens have turned wallet-watching into media. The problem is that follow-trading is harder than it looks. By the time you can see a whale's trade, it has already executed; you are buying after the move. Smart Money labels are sticky even when the wallet stops being smart. Reflexivity — your own follow-buying contributing to price impact — means the trade often works only because everyone watching is reinforcing it, until they all turn around. Distinguishing "this whale knows something" from "this whale is wrong but everyone assumes they know something" is most of the work. This lesson covers how capital flows are actually read on-chain, where the pitfalls in follow-trading lie, how cohort analysis (diamond hands vs flippers, first-day vs late) supplements raw whale watching, and three real cases — Wintermute as recurring liquidity, the Three Arrows recovery process, and the Bybit Feb 2025 Lazarus flow — that illustrate what good on-chain analysis looks like in practice.

Also in this lesson

What "Capital Flow" Actually Means On-Chain
The Pitfalls of Follow-Trading
Cohort Analysis: Beyond Whale Watching
Case 1: Wintermute as Recurring Liquidity
Case 2: The Three Arrows Recovery
Case 3: The Bybit Lazarus Heist (February 21, 2025)

Key terms

Whale: A wallet holding a large absolute or relative position in a token or protocol. Movements move price; on-chain visibility makes them watchable.
Capital flow: The directional movement of value across wallets, contracts, exchanges, chains, or asset classes. Read precisely from on-chain data (inflows/outflows, stablecoin supply, bridge volumes).
Reflexivity: A market dynamic where the act of observation changes the observed behavior. In follow-trading, watchers buying behind whales reinforce the move, making it look like the whale had alpha when really the watchers created the move.
Cohort retention: The fraction of holders from a given entry cohort still holding any of the asset after N days. A core measure of token health and "diamond hands vs flipper" mix.
Diamond hands: Holders who retain positions through volatility, typically defined as holding for extended periods (90+ days) despite drawdowns or rallies.
Flippers: Holders who exit quickly, often within hours or days of acquiring a token, typically at the first 2-5x gain (or any first profit).
Wintermute: Major crypto market maker whose public on-chain wallets serve as a reference case for market-maker flow patterns. Hacked September 2022 for $160M via a Profanity vanity-address vulnerability.
Three Arrows Capital (3AC): Multi-billion-dollar crypto fund that collapsed June 2022 during the Terra/LUNA crisis, triggering a cascade that took down Celsius, Voyager, BlockFi, and contributed to FTX's November 2022 failure.
Lazarus Group: North Korean state-sponsored hacking group responsible for many of the largest crypto thefts including the February 2025 Bybit hack ($1.46B), Ronin Bridge ($625M, 2022), and others.
Supply-chain attack: An attack where the adversary compromises a tool or dependency the victim uses (signing UI, library, build system) rather than the victim's keys or contracts directly. The Bybit Feb 2025 hack exploited a compromised Safe front-end.

Continue this lesson — 6 more sections in the CryptoBipto app.

Open lesson

Educational only — not financial advice.