Direct and indirect exposure
Exposure measures how much of the value reaching an address can be traced back to a category of concern, and how far away that category sits. The further away, the more of the figure is methodology rather than observation.
Exposure is the share of value reaching an address that a vendor can trace back to a category it treats as concerning. A wallet that received 10,000 USDC, of which 3,100 came from a mixing service, has 31% exposure to mixing.
The figure sounds like a measurement. Part of it is, and part of it is a set of choices somebody made about how to follow money through places where money is pooled.
One hop is a fact
Direct exposure means the funds came straight from the source of concern to the address you are looking at. There is one transfer, it has a hash, and the path is not in question. Whether the source is correctly attributed is a separate question, and one the attribution date should answer.
More hops is a method
Indirect exposure means the funds passed through something else first. Two hops, five, twenty. Each hop the path crosses something that pooled the money with other people’s, and from that point on no particular coin can be followed. What a vendor reports is the result of a rule for apportioning value through a pool.
Three common rules, and they disagree
- Proportional
Treat the pool as fully mixed. If 4% of what went in was concerning, 4% of everything coming out is.
- First in, first out
Treat the pool as a queue. The earliest funds in are the earliest out, so some withdrawals carry all the exposure and others none.
- Last in, first out
The reverse queue. Picks out a different set of withdrawals as the concerning ones, from identical data.
None of these is wrong. They answer a question the chain does not answer, and they answer it differently. Two vendors applying two rules to the same pool will hand you two figures, both defensible.
Same chain, same funds, same source. The two rules now differ by 17 percentage points, and both are defensible. Which one produced a figure is as much a part of it as the number.
Illustrative figures. Change the hop depth: at one hop the two rules agree exactly, and the gap widens from there.
What to ask of an exposure figure
| Question | Why it changes the answer |
|---|---|
| How many hops were followed? | A cap of five and a cap of twenty produce different numbers from the same chain. |
| What sits between? | A licensed exchange in the path weakens the inference far more than an unhosted wallet does. |
| Which apportionment rule? | Proportional and first in, first out can disagree by an order of magnitude. |
| How old is the attribution? | The category at the far end was assigned on a date. Services change hands. |
What this changes
Treat direct exposure as something you can write down and indirect exposure as something you have to qualify. When an exposure figure is carrying weight in a decision, record the vendor, the hop depth and the date alongside the number. A figure quoted without them cannot be checked later, and a figure that cannot be checked will not survive a review.
Related
What KYT is
Know your transaction screens onchain activity against categories of concern. It tells you about the money an address has touched, and nothing at all about the person holding it.
What a transfer is
A transfer moves value from one address to another and records it permanently. What counts as one transfer differs by chain, which is why two honest counts of the same activity can disagree.
What a typology is
A typology is a named pattern of financial crime, written down precisely enough that two people looking at the same case reach the same view about whether it fits.
Last checked against the product on .