Peel chain: peeling the onion

The peel chain (literally "peeling the layers off an onion") is one of the oldest and still-working laundering techniques in UTXO networks, primarily in Bitcoin. Its essence is simple: a large "dirty" sum is not withdrawn all at once, but run through a long string of addresses, "peeling off" a small portion for cash-out at each step while sending the main remainder onward to a fresh address. Let's break down the mechanics bone by bone, learn to see this figure on the graph, and distinguish it from innocent wallet activity.

▶ Video lesson: typologies on the graph (English narration).

Where the name comes from and what the idea is

Picture an onion: to reach the core, you peel off layer after layer. In a peel chain the "core" is the main mass of stolen or criminal funds, and each "layer" is a small offshoot (peel) that at a given hop goes off to the side: to an exchange, to a swap service, into an OTC deal, to pay for goods. The attacker does not try to hide the entire sum in one leap — they stretch it out in time and space so that no single transaction looks large and suspicious.

A key mechanical detail is tied to the UTXO (Unspent Transaction Output) model. In Bitcoin, when you spend coins, the transaction input is entirely "burned", and on the output two (or more) new outputs are created: one to the recipient (peel), and a second — the "change", which returns to the sender's control but now on a new address. It is precisely this change mechanism that makes the peel chain natural for Bitcoin: a wallet already spawns change addresses on every spend, and all the attacker has to do is deliberately stretch this chain out and give it the desired rhythm.

A classic peel chain: the main flow (thick line) runs along a chain of change addresses, and at each hop a small offshoot (peel) is pinched off for cash-out.

Step-by-step mechanics

1. The starting "fat" UTXO. At the start there are one or several large outputs — the result of a hack, a scam collection, a withdrawal from a darknet platform.This is the original "onion" in its entirety.
2. The first spend with a split. A transaction is created: a small output (peel) goes to an "exit point" — a deposit address of an exchange, a swap service, a mixer — while the large "change" lands on a fresh, previously unused address of the same owner.Outwardly this looks like an ordinary purchase with change.
3. Repeat on the new address. From the fresh change address they spend again: again a small peel to the side, again a large change onward. And so dozens, sometimes hundreds of times.Each hop lengthens the chain and "ages" the origin.
4. Cashing out the offshoots. The small peel amounts accumulate at various exchanges and swap services, often from different IPs and to different accounts (frequently mules), where they turn into fiat or move to another network.Each individual withdrawal is small and stays below the thresholds of enhanced monitoring.

How to recognise a peel chain on the graph

On a visual transaction graph a peel chain looks very distinctive — like a "comb" or a "fish spine": a long straight highway of the main flow, from which short "rib" offshoots branch off to one side at even intervals. Here is what to look at specifically:

• Linear topology with no branching backThe main flow goes "in one direction": each address has exactly one significant input and one large output onward plus a small offshoot. There is no convergence of many sources — this distinguishes a peel chain from consolidation.
• A steadily decreasing highway balanceThe sum on the "spine" decreases monotonically and gradually from hop to hop — by exactly the amount of the peels pinched off plus fees. This is the key numerical sign.
• Fresh single-use change addressesEach address of the highway is used once: received — spent — forgotten. A zero final balance, no reuse.
• Rhythm and even offshootsThe offshoots are often close in size and follow at a similar interval — a sign of automation by a script, not a live person spending as the need arises.
• Offshoots converge on cash-out pointsIf you trace the peel outputs, they cluster at deposit addresses of exchanges/swap services — that is, they pinch off not "for living expenses" but for cashing out.

How to distinguish it from ordinary activity

The danger for an inexperienced analyst is to see a peel chain where there is none. Ordinary wallets also spawn change addresses and make spends with change. The difference is in the systematic nature and intent, and you have to be able to argue it.

• A live wallet branches, it does not stretch into a single lineA real user receives funds from several sources (salary, sales, transfers) and spends irregularly. A "bush" arises, not a one-dimensional comb across dozens of hops.
• Irregularity of amounts and timesLive spends are of different sizes and at different times of day. Even offshoots at even intervals are a marker of a script.
• The nature of the offshootsFor an ordinary person an "offshoot" is a payment to a real merchant or a transfer to an acquaintance. In a peel chain the offshoots almost always run into liquidity: exchanges, swap services, bridges, mixers.
• The origin of the rootA peel chain by definition begins with a "bad" source. If the root of the chain is clean (a salary exchange, a mining pool), a long sequence of spends is just an active wallet, not laundering.

Bottom line: a peel chain is not some exotic curiosity, but a workhorse of laundering in Bitcoin, exploiting the routine UTXO change mechanism. It is recognised by its linear "comb", its monotonically decreasing highway, single-use change addresses, and rhythmic offshoots to cash-out points. What lets you distinguish it from a wallet's ordinary life is an analysis of branching, regularity, and — above all — the origin of the root. In the next lesson we break down a related but topologically opposite technique — structuring (smurfing), where instead of a long chain a wide "fan" is at work.

This material is educational.