Whales, Smart Money, and Cohort Analysis

What you'll learn

• Whales, Capital, and the Promise of Following
• What "Capital Flow" Actually Means On-Chain
• The Pitfalls of Follow-Trading
• Cohort Analysis: Beyond Whale Watching
• Case 1: Wintermute as Recurring Liquidity
• Case 2: The Three Arrows Recovery
• Case 3: The Bybit Lazarus Heist (February 21, 2025)

Key terms

Whale

A wallet holding a large absolute or relative position in a token or protocol. Movements move price; on-chain visibility makes them watchable.

Capital flow

The directional movement of value across wallets, contracts, exchanges, chains, or asset classes. Read precisely from on-chain data (inflows/outflows, stablecoin supply, bridge volumes).

Reflexivity

A market dynamic where the act of observation changes the observed behavior. In follow-trading, watchers buying behind whales reinforce the move, making it look like the whale had alpha when really the watchers created the move.

Cohort retention

The fraction of holders from a given entry cohort still holding any of the asset after N days. A core measure of token health and "diamond hands vs flipper" mix.

Diamond hands

Holders who retain positions through volatility, typically defined as holding for extended periods (90+ days) despite drawdowns or rallies.

Flippers

Holders who exit quickly, often within hours or days of acquiring a token, typically at the first 2-5x gain (or any first profit).

Wintermute

Major crypto market maker whose public on-chain wallets serve as a reference case for market-maker flow patterns. Hacked September 2022 for $160M via a Profanity vanity-address vulnerability.

Three Arrows Capital (3AC)

Multi-billion-dollar crypto fund that collapsed June 2022 during the Terra/LUNA crisis, triggering a cascade that took down Celsius, Voyager, BlockFi, and contributed to FTX's November 2022 failure.

Lazarus Group

North Korean state-sponsored hacking group responsible for many of the largest crypto thefts including the February 2025 Bybit hack ($1.46B), Ronin Bridge ($625M, 2022), and others.

Supply-chain attack

An attack where the adversary compromises a tool or dependency the victim uses (signing UI, library, build system) rather than the victim's keys or contracts directly. The Bybit Feb 2025 hack exploited a compromised Safe front-end.