October 20, 2026

Where did your money come from? Why a wallet's inflow and outflow are different risks

It happens: you receive USDT in a P2P deal, you check the buyer's address — "low risk". A week later your exchange holds the deposit and asks where the funds came from. How?

Often the answer is that a wallet has two histories: what came into it and what went out of it. They mean different things for you.

⬇️ INFLOW IS WHAT ENDS UP WITH YOU

The money sent to you reached the sender from somewhere else first. If their inflow included a mixer, a no-KYC swap or a sanctioned address, that trail moves down the chain — to you. The exchange where you later deposit the funds looks exactly there: where the money came from.

⬆️ OUTFLOW IS WHO THEY PAY

Outgoing transfers tell you how the owner behaves: do they pay scammers, do they run funds through a mixer. It's a signal of who you're dealing with, but it affects your deposit less.

⚖️ WHY ONE SCORE IS NOT ENOUGH

An overall risk score looks at the wallet as a whole. One suspicious source in the inflow can "dissolve" among a hundred clean transfers, and the total stays low. That's why the inflow is worth checking on its own.

✅ WHAT TO DO BEFORE THE DEAL

• Check the sender's address before you release fiat.
• Look at the inflow: mixers, no-KYC swaps, sanctioned addresses — and how close: direct or 2–3 transfers away.
• Risk in the inflow — ask them to pay from another address, e.g. a direct exchange withdrawal.
• Keep the chat and the transaction hash: if the exchange asks, you'll have what you need to explain the origin.

Our full check now scores inflow and outflow separately: how many operations and for how much, which counterparties and whether any are risky — with paths to the risk and a money-flow graph in the PDF.

Check an address for free (sanctions, freezes, labels, direct links): https://t.me/amlconsensus_bot?start=en What the extended and full checks include and what they cost: https://amlconsensus.com/en/#check-kinds