Flipside Docs
Search…
Finding Centralized Exchange Deposits and Withdrawals
Let's explore using Flipside's base label system to identify Centralized Exchange deposits and withdrawals.
Leveraging Flipside's base labeling system and on-chain events, you can easily see deposits and withdrawals from key exchanges.
Whenever you try to answer a complicated question like this, you're going to have several layers to your query, so it helps to build up small pieces.
If you haven't gone through the Getting Started with Ethereum Events guide or worked with labels in the Using Labels to Break Down Token Supply guide, yet, we recommend you do that first.
Let's start by look at ETH movement into exchanges for a week in October 2020.
1
SELECT
2
date_trunc('day', block_timestamp) as date,
3
to_label_type,
4
to_label_subtype,
5
round(sum(amount_usd)) as total_inflow
6
FROM
7
ethereum.udm_events
8
WHERE
9
to_label_type = 'distributor'
10
AND event_type = 'native_eth'
11
AND block_timestamp > '2020-10-01'
12
AND block_timestamp < '2020-10-08'
13
GROUP BY date,to_label_type,to_label_subtype
14
ORDER BY date, total_inflow DESC
Copied!
In this query, we:
  • select label type and subtype because we don't always know which level we need at first
  • filter native_eth transfers only
Each day give us results that look like this:
Date
To Label Type
To Label Subtype
Total Inflow
2020-10-01 00:00:00
distributor
distributor_cex
358172469
2020-10-01 00:00:00
distributor
distributor_dex
238906080
2020-10-01 00:00:00
distributor
distributor_cex_satellite
157460066
2020-10-01 00:00:00
distributor
distributor_dex_balancer
3563956
Since we are getting several different to_label_subtype values, that's a good clue to dig in more.

Expand Dimensions to See Senders and Receivers

Let's expand the results to see which types and subtypes are sending to exchanges.
1
SELECT
2
from_label_subtype as sender,
3
to_label_subtype as receiver,
4
round(sum(amount_usd)) as total
5
FROM
6
ethereum.udm_events
7
WHERE
8
to_label_type = 'distributor'
9
AND symbol = 'ETH'
10
AND contract_address IS NULL
11
AND block_timestamp > '2020-10-01'
12
AND block_timestamp < '2020-10-02'
13
AND to_label_subtype like 'distributor_cex%'
14
GROUP BY from_label_subtype,to_label_subtype
15
ORDER BY to_label_subtype, total desc
Copied!
By adding label categories to the "from" side, we're going to return a lot more rows, so let's modify the query to make the results easier to understand:
  • look at a single day
  • only look at activity to centralized exchanges to_label_subtype like 'distributor_cex%'
  • round the total amounts for each pair of senders and receivers
  • order the results by to_label_subtype and amounts descending
Sender
Receiver
Total
distributor_cex_satellite
distributor_cex
158462305
distributor_cex
distributor_cex
142227252
distributor_cex
55712865
other_single_use
distributor_cex
1595028
distributor_dex
distributor_cex
94677
operator_miner
distributor_cex
77774
operator_mining
distributor_cex
1424
project_contract
distributor_cex
1076
other_financial
distributor_cex
68
distributor_cex_satellite
102552982
distributor_cex
distributor_cex_satellite
31853513
other_single_use
distributor_cex_satellite
19357401
operator_miner
distributor_cex_satellite
1379866
distributor_cex_satellite
distributor_cex_satellite
1216738
other_financial
distributor_cex_satellite
609015
distributor_dex
distributor_cex_satellite
408611
project_contract
distributor_cex_satellite
45839
operator_mining
distributor_cex_satellite
25567
project_other
distributor_cex_satellite
10368
By we comparing each combination of sender and receiver, we have created an interaction matrix that can be used to categorize transfer activity.
Here are some possible transaction type examples, with caveats below:
Sender
Receiver
Transaction Type
any non-distributor label
distributor_cex_satellite
Deposit
distributor_cex
any non-distributor label
Withdrawal
distributor_cex_satellite
distributor_cex
Sweep
distributor_cex
distributor_cex
Inter-exchange transfers for liquidity
distributor_cex
distributor_cex
Intra-exchange hot wallet maintenance

Enrich Categories with Label Names

Now, especially with the last two cases, it may not be obvious what is going on until we expose the names of the exchanges involved.
We can do that with the from_label and to_label fields:
1
SELECT
2
from_label as sender,
3
to_label as receiver,
4
round(sum(amount_usd)) as total
5
FROM
6
ethereum.udm_events
7
WHERE
8
to_label_type = 'distributor'
9
AND symbol = 'ETH'
10
AND contract_address IS NULL
11
AND block_timestamp > '2020-10-01'
12
AND block_timestamp < '2020-10-02'
13
AND to_label_subtype = 'distributor_cex'
14
AND from_label_subtype = 'distributor_cex'
15
GROUP BY from_label,to_label
16
ORDER BY from_label, total desc
Copied!
There's a lot to dig into here with the labeled results, but this subset of Binance, Coinbase, and Kraken is representative of the typical patterns we see:
Sender
Receiver
Total
binance
binance
46424958
binance
coinbase
3527514
binance
coinswitch
157443
binance
shapeshift
18380
coinbase
coinbase
32781897
kraken
kraken
6590562
kraken
coinbase
384082
Notice that:
  1. 1.
    The largest row in each "from" label set for the most part are transfers within the same exchange, which confirms our "intra-exchange wallet maintenance" category above.
  2. 2.
    When we have cross-exchange activity, that could be exchanges providing each other with liquidity, but you would have drill down further into transactions to try to see that.
  3. 3.
    Hot wallets sending to Coinbase are a little more complicated to classify, since, on Ethereum, Coinbase does not use the same satellite wallet architecture as most other exchanges. In other words, these may be withdrawals to Coinbase user wallets, not inter-exchange transfers for liquidity.