Funding sources: tracing where a wallet's first money came from
Every wallet has a first day. The very first meaningful inflow — the first money — is the origin story of the address. Where it came from explains more about a wallet than almost any other single data point.
Why the first deposit matters
The origin of funds answers foundational questions:
- Exchange-linked? A wallet funded from a known exchange hot wallet is likely a retail or professional trader, not a protocol or a bot.
- Factory-made? Wallets funded from a single coordinating source in a batch are often part of a sybil cluster or a bot army.
- Self-funded cycle? Funds that originated from a prior wallet the same controller uses suggest a linked network of addresses.
How it shows in the data
Funding analysis looks for the earliest transaction within the analyzable window and traces its counterparty:
- Known exchange label — the counterparty resolves to a labeled hot wallet (Binance, Coinbase, Kraken, and dozens more).
- Known protocol or contract — the first money came from a staking pool, a launchpad, or a DEX router.
- Anonymous peer — an unlabeled wallet. Not suspicious by itself, but combined with other signals it matters.
SIGBOT surfaces the funding source in every report — "First money arrived from MXC (exchange) on 2023-12-08" — along with the funding wallet label when identifiable.
The honest caveat
Analysis is limited to the transactions in the observable window. If a wallet's true first deposit predates the window, SIGBOT says so explicitly rather than inventing a "self-funded" conclusion. An honest "pre-window" label is more trustworthy than a fabricated answer.
Chain your sources
Funding sources also reveal structure: a wallet funded by a fresh address that itself was funded by the same exchange in the same hour is a classic sybil pattern — multiple identities, one controller.