Whale behavior is the entity-size cohort framework in on-chain analysis: partitioning Bitcoin's holder population by entity balance and tracking how the largest cohorts position across market cycles. The canonical Glassnode bands are shrimp (<1 BTC), crab (1-10), fish (10-100), shark (100-1,000), whale (1,000-10,000), and humpback (10,000+); colloquially "whale" covers everything from 1,000 BTC upward. The framework captures positioning behavior that age-based decompositions (HODL waves, Long-term vs short-term holder behavior) average over: large entities have distinct signatures — strategic accumulation, disciplined distribution, sometimes coordinated activity. Since 2024 the framework is substantially more complex: ETF custodial wallets dominate the humpback category in ways that reflect ETF operational mechanics rather than economic positioning, so distinguishing exchange and ETF whales from self-custody whales is a critical contemporary refinement. It is particularly useful for detecting institutional accumulation, late-cycle distribution dynamics, and structural-supply analysis.
Why this note matters
Whale behavior is load-bearing for the on-chain section in three respects:
- Captures entity-size-cohort dynamics no other framework does. Age-based frameworks (Long-term vs short-term holder behavior, HODL waves) partition by holding duration; velocity frameworks (Coin Days Destroyed) capture spending intensity. None directly partition by holder size.
- Primary lens for institutional-Bitcoin analysis. As corporate treasuries, ETFs, and sovereign holders enter the population, the entity-size composition shifts substantially.
- Essential for the post-2024 ETF regime. Coinbase Custody, Fidelity, and others now hold hundreds of thousands of BTC; their signatures reflect basket creation/redemption rather than holder economic decisions. Disentangling ETF whales from self-custody whales is critical for interpreting contemporary signals.
The framework requires more analytical care than age- or velocity-based frameworks because entity-clustering is imperfect, but operational value for institutional and market-structure interpretation is substantial.
What the framework defines
The entity-size cohort bands (Glassnode convention).
| Cohort label | Balance range | Approximate population |
|---|---|---|
| Shrimp | < 1 BTC | Millions of addresses |
| Crab | 1-10 BTC | ~600K-800K addresses |
| Fish | 10-100 BTC | ~100K-150K addresses |
| Shark | 100-1,000 BTC | ~10K-15K addresses |
| Whale | 1,000-10,000 BTC | ~1,000-2,000 addresses |
| Humpback | 10,000+ BTC | ~80-150 addresses |
The cohort labels are colloquially used somewhat loosely; “whale” often refers to anything 1,000+ BTC, while “humpback” is used for the largest cohort specifically. The thresholds are conventional, not derived from any structural property.
Entity vs address. A critical distinction: an address is a single Bitcoin address (one identifier); an entity is an inferred holder grouping multiple addresses controlled by the same actor. Entity-clustering algorithms (Glassnode entities, Chainalysis attributions, various academic frameworks) attempt to map addresses to entities using transaction patterns, common-spend heuristics, and external attribution data. The whale framework is most informative at the entity level — a single individual or institution may control hundreds of addresses, each below the whale threshold individually but collectively well into whale territory. Entity-clustering quality affects all whale-behavior analysis.
Wallet attribution categories. Beyond raw entity size, whale analysis typically further partitions by wallet purpose:
- Self-custody whales — large entities controlling their own keys; the historical retail/individual long-term-holder pattern
- Exchange whales — large entities representing exchange cold storage (Coinbase, Kraken, Binance, etc.); behavior reflects exchange operational mechanics and aggregated customer funds
- ETF custody whales — large entities representing ETF custodians (Coinbase Custody holdings backing IBIT, FBTC, others); behavior reflects ETF basket creation/redemption flows
- Corporate treasury whales — entities representing publicly-disclosed corporate treasury holdings (MicroStrategy/Strategy, Tesla historically, Metaplanet, others); strategic-treasury behavior pattern
- Sovereign/government whales — entities representing seized-asset government holdings or publicly-disclosed sovereign holdings (US government, El Salvador, Bhutan); episodic-distribution behavior pattern
- Unidentified whales — entities not clearly attributed; mixed population
Each attribution category has distinct behavioral signatures. The framework’s operational value depends on accurate attribution.
How the framework operates
The basic cohort metrics.
- Cohort-specific supply share: the fraction of total circulating supply held by each entity-size cohort over time
- Cohort-specific transaction activity: spending patterns of each cohort
- Cohort-specific accumulation rates: net positive-or-negative balance changes per cohort per unit time
- Cohort migration: entities moving between size bands (e.g., a fish entity accumulating to shark status)
Net-position-change as the primary signal. For whale-behavior analysis, the most operationally informative quantity is typically the net change in whale-cohort supply over a rolling window:
- Net positive whale-cohort supply growth signals accumulation by large entities
- Net negative whale-cohort supply decline signals distribution
The signal is most informative when restricted to self-custody whales (excluding ETF and exchange custodial wallets), where the supply changes reflect genuine economic positioning rather than operational mechanics.
ETF flow-adjusted whale dynamics. Since 2024, ETF custodian wallets have grown to dominate humpback-cohort dynamics:
- Coinbase Custody’s holdings backing IBIT, GBTC, and other ETFs total hundreds of thousands of BTC
- Net ETF inflows produce humpback-cohort supply growth that reflects ETF demand, not individual whale decisions
- Net ETF outflows produce humpback-cohort supply decline that reflects ETF redemption, not individual whale distribution
The framework’s operational value increasingly requires explicitly separating ETF flows from non-ETF whale dynamics. Specifically:
- Net ETF flows (separately tracked)
- Self-custody whale net positioning (whale-cohort changes excluding ETF custodial wallets)
- Exchange whale net positioning (exchange custodial wallets, related to but distinct from ETF custody)
The three together provide a richer picture than aggregated whale-cohort dynamics alone.
Coordinated-whale-move detection. Specific analytical use: detecting coordinated large-entity moves (multiple humpback wallets transacting in correlated patterns) that may signal coordinated distribution or accumulation. The framework’s age-and-size dimensions can be combined: large old-coin moves from humpback wallets carry stronger structural-supply signals than smaller or newer moves.
Whale realized price. Cohort-specific realized price for whale-cohort UTXOs — the average cost basis of supply held by whale-or-larger entities. The metric provides a cohort-specific structural-support level analogous to LTH realized price but partitioned by entity size rather than UTXO age. Whale realized price has historically been a higher-conviction support level than aggregate realized price during deep corrections.
What it tells you
Institutional accumulation detection. Sustained self-custody whale-cohort supply growth signals institutional accumulation. Historical episodes:
- 2020-2021: rapid self-custody whale growth during the institutional adoption wave (MicroStrategy, Tesla, Square, others)
- 2023-2024: renewed whale growth ahead of and through the ETF approval period
- 2024-2025: continued institutional accumulation through ETF flows and corporate treasury expansion
The framework provides early-warning content: institutional accumulation visible on-chain often precedes broader market recognition.
Late-cycle distribution detection. Sustained whale-cohort supply decline preceding cycle peaks. The pattern has held across multiple cycles:
- 2017 cycle: whale supply declined through H2 2017 into the late-2017 peak
- 2021 cycle (April peak): whale supply declined through Q1 2021
- 2021 cycle (November peak): whale supply declined through late H2 2021
- 2024-2025 cycle: whale distribution visible into the August-2025 top, at attenuated magnitude
The signal complements LTH cohort distribution; large entities and old-coin cohorts often distribute simultaneously, providing cross-validation.
Structural-supply analysis. The framework supports analysis of the long-term supply distribution:
- Concentration risk: what fraction of supply is held by the largest 100 entities? Has it grown or declined over time?
- Decentralization metrics: Gini-coefficient-style measures of holder distribution
- Custodial concentration: what fraction of supply sits in custodial structures (exchanges, ETFs, corporate custody) vs self-custody?
These metrics are operationally useful for understanding Bitcoin’s evolving market structure and for assessing structural risks (regulatory pressure on custodians, custodial-concentration concerns).
Sovereign-and-government activity tracking. Specific operational use: tracking known government-controlled wallets (seized-asset holdings, publicly-disclosed sovereign accumulation). US Marshals seized-asset auctions, El Salvador’s strategic reserve, and various other government holdings produce visible on-chain events that affect market dynamics. The framework provides the analytical infrastructure for tracking these.
Specific cycle-positioning signals.
| Whale cohort behavior | Cycle context | Operational reading |
|---|---|---|
| Sustained self-custody whale accumulation | Accumulation; pre-bull setup | Institutional positioning; structural supply tightening |
| Whale-cohort balance peak followed by decline | Late-cycle distribution territory | Large entities taking profits; cycle-top risk elevated |
| Coordinated humpback distribution events | Climax distribution | Near cycle peak; aggressive profit-taking |
| Stable or declining whale supply during corrections | Structural support | Large entities not capitulating; bottom-formation signal |
| Whale realized price approached or briefly broken | Deep capitulation | Major structural support level tested |
Empirical track record
Institutional accumulation visibility (2020-2021). The corporate-treasury adoption wave was visible on-chain through whale-cohort dynamics:
- MicroStrategy: visible wallet attribution; tracked accumulation from 2020 through 2026 has produced one of the largest single-entity Bitcoin positions (multi-hundred-thousand BTC)
- Tesla (2021): visible accumulation in Q1 2021 followed by partial distribution in Q2 2022
- Square/Block (2020-2021): smaller-scale corporate treasury accumulation, visible on-chain
- Various smaller corporate treasury entities: cumulative effect visible in self-custody whale dynamics
The framework’s operational value during this period was substantial: institutional accumulation was visible weeks-to-months before broader market recognition.
ETF flows (2024+). The post-2024 ETF era has produced new dynamics:
- Coinbase Custody whale wallet: grew from minimal pre-2024 to several-hundred-thousand BTC by 2026, almost entirely reflecting ETF basket creations
- Net ETF flows: tracked separately from non-ETF whale dynamics; provides a distinct demand-side signal
- Custodial-cohort growth dominates humpback-band totals: aggregate humpback-cohort supply growth is now driven primarily by custodial-and-ETF inflows rather than individual whale economic decisions
The framework requires explicit ETF-flow separation for meaningful contemporary analysis. Aggregate whale-cohort metrics from before 2024 are not directly comparable to post-2024 readings without this adjustment.
Late-cycle distribution signals. Cross-cycle pattern of whale distribution preceding cycle peaks:
| Cycle peak | Whale-cohort supply behavior preceding peak |
|---|---|
| 2017 Dec | Substantial whale distribution through H2 2017 |
| 2021 Apr | Whale distribution through Q1 2021 (preceded short-cycle peak) |
| 2021 Nov | Whale distribution through Q3-Q4 2021 (preceded cycle peak) |
| 2024-2025 (Aug top) | Whale distribution into the August-2025 top; cross-validated by LTH distribution and CDD spikes |
The pattern has been reliable but the specific magnitudes have attenuated cycle-over-cycle.
Cross-validation with other metrics. Whale-cohort distribution events typically align with extreme readings in LTH-SOPR (long-term holder profit-taking), CDD spikes (old-coin movements), and MVRV extremes. The cross-validation strengthens cycle-positioning signals.
Government-action tracking events. Specific large government-action events have produced visible on-chain CDD-and-whale signatures:
- US Marshals Silk Road auctions (multiple events 2014-2015): visible humpback-cohort distributions
- German government BKA seized-asset distributions (mid-2024): produced clear on-chain whale-distribution events
- El Salvador strategic reserve accumulation (2021-2026): smaller-scale but trackable on-chain
- Various exchange hack and recovery events: produce humpback-level movements with specific timing
Limitations
Entity-clustering quality is imperfect. The framework depends on grouping addresses into entities. Entity-clustering algorithms have known false-positive (grouping unrelated addresses) and false-negative (failing to group related addresses) rates. Glassnode and Chainalysis use proprietary heuristics; academic frameworks differ. The quality affects all whale-behavior analysis.
Attribution gaps. Wallet-purpose attribution (self-custody vs exchange vs ETF vs corporate treasury vs unidentified) is incomplete. Some major wallets remain unidentified; analysts rely on circumstantial evidence and public disclosure. Misattribution can produce misleading whale-cohort dynamics.
ETF-era contamination. Pre-2024 whale-cohort metrics reflect a predominantly self-custody holder population; post-2024 metrics are increasingly dominated by ETF custodial flows. Cross-period comparisons require explicit adjustment. Many published whale-cohort analyses don’t make this adjustment carefully.
The “whale” colloquial usage is loose. Different analyses use different size thresholds for “whale” (1,000 BTC, 100 BTC, top-100 entities, etc.). Cross-analysis comparisons require checking definitions.
Cohort-band thresholds are conventional. The Glassnode bands (shrimp/crab/fish/shark/whale/humpback) are convention, not derivation. Alternative band structures would produce different cohort populations and different operational signals.
Coordinated-behavior detection is difficult. Distinguishing genuine coordinated distribution from independent simultaneous distribution is analytically hard. The framework can detect correlated patterns but interpretation requires care.
Sovereign-and-government wallets have unique behavioral patterns. Government-controlled wallets often distribute via auctions or in coordinated tranches that don’t reflect ordinary market dynamics. Major government events can swing whale-cohort metrics significantly without the swings being interpretable as ordinary holder behavior.
Lost-whale-coin contamination. Some humpback-cohort wallets may contain genuinely lost coins (Satoshi-era addresses, exchange-hack-lost coins that haven’t moved). These show up in absolute-level whale metrics but are inert in terms of behavioral signals. The framework cannot distinguish.
Privacy techniques can obscure whale behavior. CoinJoin (Wasabi, Whirlpool, Wabisabi) and other privacy techniques can fragment whale wallets across many smaller outputs, distorting entity-clustering. The framework’s signal is degraded for privacy-aware holders.
Cycle attenuation affects magnitude calibration. Like all cycle-positioning frameworks, whale-cohort metric extremes have attenuated cycle-over-cycle. Specific thresholds need ongoing recalibration.
Counter-arguments and tensions
Entity-clustering quality affects everything
The argument: The framework’s analytical content depends entirely on entity-clustering quality. False positives (grouping unrelated addresses) inflate apparent whale counts; false negatives (missing related addresses) understate them. Glassnode’s proprietary clustering is opaque; academic frameworks disagree on key heuristics. Without ground-truth entity attribution, the framework’s signals carry substantial uncertainty.
Response: Substantively right and worth taking seriously. The framework is best understood as operating on entity-clustering proxies for true entity-level data. Multiple-provider cross-validation (Glassnode + Coin Metrics + Chainalysis) reduces but doesn’t eliminate the dependence. The honest reading: whale-cohort signals are useful directional indicators, not precise quantitative measurements. Users should treat cohort-level supply changes as approximate and confirm signals through multiple metrics.
ETF-era distortion is severe
The argument: Since 2024, ETF custodial wallets dominate humpback-cohort dynamics. Aggregate whale-cohort growth and distribution patterns increasingly reflect ETF operational mechanics — basket creation/redemption, periodic rebalancing — rather than holder economic decisions. The framework has been broken by institutional adoption; pre-2024 patterns don’t carry forward.
Response: Partially right but overstated. ETF flows do dominate aggregate humpback dynamics. The mitigation: explicitly separating ETF custodial wallets from non-ETF whales recovers most of the lost signal. The framework needs adaptation (and the adaptation is well-codified by Glassnode and Checkonchain), not abandonment. Users should engage post-2024 whale-cohort metrics through the ETF-adjusted lens.
”Whale tracking is just market manipulation by sophistication”
The argument: The framework caters to a specific market dynamic: smaller holders trying to “follow the whales” by tracking large-entity movements. This dynamic produces front-running by sophisticated whale-watchers, distorts market behavior, and may produce self-fulfilling patterns that aren’t fundamentally meaningful. Whale-cohort signals could be epiphenomena of the whale-watching market segment rather than genuine economic information.
Response: Partially right at the very-short-timescale level. Single whale moves can trigger speculative reactions in real time; this is a real market dynamic. At cycle scales (weeks-to-months), the whale-cohort signals reflect genuine economic positioning by large entities — the “whales acting on information” framing is more accurate than the “speculators front-running whales” framing for longer-horizon analysis. The framework should be deployed at appropriate timescales.
Sovereign-and-government wallets distort the framework
The argument: Government-controlled wallets (seized-asset holdings, sovereign reserves) often distribute via coordinated auctions or strategic tranches. These events produce visible whale-cohort movements that aren’t representative of ordinary holder behavior. Including them in aggregate whale metrics produces misleading signals.
Response: Right as critique of unfiltered aggregate analysis. The framework’s operational use requires filtering known government-action events from analytical whale-cohort dynamics. Major events (US Marshals auctions, German BKA distributions, El Salvador strategic moves) are typically publicly disclosed and can be filtered. Less-prominent events are harder to filter. The honest reading: whale-cohort metrics for cycle-positioning purposes should explicitly account for known government activity.
The framework reinforces concentration concerns
The argument: Whale-cohort metrics highlighting the supply share held by largest entities can be used both as analytical content and as decentralization criticism (“Bitcoin is becoming concentrated”). The framework can produce alarmist narratives that don’t reflect the actual market-structure picture.
Response: The framework’s neutral content (entity-size distribution and changes) is analytically useful; specific interpretations (decentralization-good or concentration-bad) are normative overlays. The honest reading: the framework reports market-structure facts; normative interpretation requires separate framework engagement. Concerns about ETF-and-custodial concentration are legitimate; concerns about individual-whale concentration are typically less load-bearing for Bitcoin’s monetary properties.
Cohort migration can be operational rather than economic
The argument: Entities can move between size bands for many reasons — wallet reorganization, multi-wallet management, custodial movements, security upgrades, BIP-85 child wallet creation. The “fish to shark” migration may reflect operational wallet restructuring rather than genuine economic accumulation. The framework’s cohort-migration signals can be misleading.
Response: Right at the individual-entity level. Aggregate cohort-migration patterns (many entities migrating in the same direction over weeks-to-months) carry meaningful signal because operational restructuring is roughly random in direction; economic accumulation is directional. The framework’s operational value is at the aggregate level, not the individual-entity level.
”Coordinated whale moves” detection is hard to verify
The argument: Identifying coordinated whale activity (multiple humpback wallets transacting in correlated patterns) is appealing but difficult to verify. Many apparent coordinated patterns are statistical artifacts; genuine coordination is hard to distinguish from independent simultaneous activity.
Response: Right. The framework can flag potentially-coordinated patterns; classification as genuine coordination requires additional evidence (timing across wallets, on-chain transaction-pattern signatures, external attribution). Users should treat coordinated-whale-move claims as hypotheses requiring confirmation rather than as confirmed signals.
Cycle attenuation affects whale-cohort signals too
The argument: Whale-cohort metric extremes have attenuated cycle-over-cycle. Distribution magnitudes preceding cycle peaks have declined; accumulation magnitudes have similarly attenuated. The framework’s specific thresholds are migrating.
Response: Real. The directional pattern (institutional accumulation visible in advance of broader market recognition; whale distribution preceding cycle peaks) is more stable than the magnitudes. Users should focus on direction-and-acceleration rather than absolute thresholds.
Open questions for further development
- How should the framework be adapted for the post-ETF regime systematically? Explicit attribution conventions (ETF custodial vs exchange custodial vs self-custody whale subcategories) are emerging; codifying them as standard reporting categories would strengthen the framework.
- What is the appropriate way to handle privacy-aware whale behavior? As CoinJoin and other privacy techniques mature, whale-watchers will see less direct entity-level data. The framework’s reach is structurally bounded by privacy adoption.
- Can entity-clustering quality be improved with new heuristics or external attribution? Ongoing research direction; better entity-clustering would strengthen all whale-behavior analysis.
- How does the framework engage Strategy (formerly MicroStrategy) and other corporate-treasury-acquisition dynamics? Strategy alone now holds a substantial fraction of total Bitcoin supply; their accumulation patterns warrant dedicated analytical treatment.
- What is the appropriate sovereign-wallet-tracking framework? Multiple sovereign entities now hold meaningful Bitcoin positions (El Salvador, Bhutan, various seized-asset holdings); their activity patterns are increasingly relevant.
- How does whale-cohort dynamics interact with macro extremes? The integration with Bitcoin and global liquidity and Bitcoin and the ISM PMI cycle is the topic of Using on-chain data for macro positioning.
- Can the cohort framework be extended to cover decentralization measurement explicitly? Gini coefficients and similar concentration metrics may complement whale-cohort tracking for market-structure analysis.
Canonical sources for this note
Primary framework sources
- Glassnode research, various pieces introducing and refining the entity-size cohort framework — the canonical source for shrimp/crab/fish/shark/whale/humpback bands
- Glassnode entity-clustering methodology documentation — the foundation for entity-level whale analysis
- Coin Metrics, various analyses of wallet-balance distribution and large-entity behavior
- Chainalysis attribution data and reports — complementary entity-attribution framework
- Checkonchain platform — James Check’s analytical framework integrating whale dynamics with cohort analysis
Practitioner literature
- James Check, extensive Glassnode Week On-Chain newsletters during the 2020-2023 tenure — applied whale-cohort analysis through institutional adoption waves
- James Check, ongoing Checkonchain platform analysis 2024+ — refined ETF-aware whale framework
- Ryan (On-Chain Mind), various video analyses applying whale-behavior framework
- Willy Woo, various pieces on supply-shock and whale-cohort dynamics
ETF-era specific literature
- Various Glassnode pieces on ETF flows and custodial-wallet whale dynamics
- Specific analyses of Coinbase Custody, Fidelity custody, and other ETF-backing wallet behaviors
- BitMEX Research and various practitioner analyses of post-2024 entity-cohort changes
Corporate treasury and sovereign tracking
- MicroStrategy / Strategy public disclosures and on-chain attribution analyses
- Tesla, Metaplanet, and other corporate treasury holder analyses
- US Marshals auction and government holding analyses
- El Salvador strategic reserve tracking
Adjacent on-chain literature
- Various decentralization-and-concentration metric analyses
- Entity-clustering academic literature (multiple papers on heuristics and quality)
- Privacy-technique effect on whale-watching analyses
Critical perspectives
- Engagements with entity-clustering quality limitations
- Critiques of whale-watching as market-manipulation-by-sophistication
- Within-Bitcoin debates about ETF-era contamination of whale-cohort signals
Related notes
- On-chain analytics and market psychology — sub-MOC parent
- Long-term vs short-term holder behavior — age-based cohort framework; complementary partition to entity-size whale framework
- HODL waves — supply-by-age distribution; complementary to entity-size distribution
- Coin Days Destroyed — velocity-and-age metric; whale moves often produce CDD spikes
- Realized price — definitional foundation; produces whale-cohort realized price variants
- MVRV ratio — produces whale-cohort MVRV variants
- NUPL — produces whale-cohort NUPL variants
- SOPR — produces whale-cohort SOPR variants
- Exchange flows — custodial-flow framework; related to exchange-whale dynamics
- Miner flows — miner-cohort framework; related entity-size category
- Sentiment indicators — off-chain sentiment proxies
- Psychological phases of the market cycle — synthesis where whale dynamics mark phase transitions
- Using on-chain data for macro positioning — operational bridge to macro frameworks
- The Power Law model — longer-horizon trajectory framework
- Four-year halving cycles — cycle structure whale-cohort dynamics characterize
- Diminishing returns thesis — cycle-over-cycle attenuation framework whale-cohort swings empirically demonstrate
- Bitcoin and global liquidity — macro framework
- Monetization S-curve — adoption framework
- Bitcoin fixed supply and issuance schedule — supply foundation
- Portfolio approaches to Bitcoin — practical allocation framework whale-cohort signals inform
- James Check — primary contemporary anchor; whale-cohort framework developer
- Ryan - On-Chain Mind — adjacent contemporary anchor
- Dylan LeClair — adjacent on-chain voice
- Giovanni Santostasi — Power Law modeler; adjacent
- Plan B — S2F framework (engaged critically)
- Michael Saylor — Strategy (MicroStrategy) corporate-treasury whale; load-bearing for late-2020+ institutional accumulation analysis