How to read on-chain data: a guide to on-chain analytics and its traps
What blockchains show and do not, the Bitcoin and DeFi metrics that matter, the tools behind them, the traps of the ETF era, and a worked example diagnosing the September 2026 rally.
Key takeaways
- On-chain data shows transfers between addresses, never people or intent: Arkham’s labelled BlackRock IBIT addresses held roughly 766,000 BTC in August 2026 on behalf of millions of fund holders.
- The best Bitcoin metrics describe the cost basis of supply, not price: on September 30, 2026 Glassnode put the short-term holder cost basis at $73,300, the true market mean at $77,200 and the mean MVRV price near $96,700, framing the $85,000 resistance.
- The 2026 bear market is the first in which Bitcoin never posted a daily close below its realized price, per Glassnode research of September 23, 2026, because ETF and treasury buyers with high cost bases absorbed supply.
- Exchange-reported figures can be understated: Coinglass counted more than $19 billion of liquidations across 1.6 million accounts on October 10, 2025, while noting Binance publishes only one liquidation per second per symbol.
- DeFi TVL rebounded to $95.4 billion by September 26, 2026 per DefiLlama, up 37.9% in a quarter, but TVL is a price-weighted stock that must be read alongside fees, revenue and incentive spend.
Who this is for: Analysts, allocators, founders and journalists who see on-chain charts daily and want to tell which metrics describe real behaviour, which are artefacts of how blockchains record data, and how to combine four of them to diagnose a market move.
Public blockchains are the only financial markets where the full ledger of balances and transfers is open to anyone. That transparency created an industry: Glassnode, CryptoQuant, Nansen, Arkham, Dune, Artemis, DefiLlama, Token Terminal, Messari and the compliance firms Chainalysis, Elliptic and TRM Labs all sell ways of reading the same raw data. It also created a new way to be confidently wrong. A chart of “whale accumulation” that is actually an exchange reshuffling cold storage, or a “total value locked” figure that counts the same ether three times, looks exactly as authoritative as a sound one.
The stakes rose through 2025 and 2026. Spot Bitcoin ETFs hold a large, visible slice of supply, the October 10, 2025 liquidation cascade showed how incomplete exchange data can be, and a hardware wallet vulnerability in July 2026 moved more than 200,000 long-dormant coins in a week, briefly breaking the most-watched holder metric. This guide explains what the chain shows and does not, the main metrics and their traps, the tools, how institutions use them, and closes with a worked example diagnosing the September 2026 Bitcoin rally with four metrics and real figures. For the instruments that now distort these metrics, see how spot Bitcoin ETFs work and Bitcoin treasury companies.
On-chain analytics by the numbers
What the chain shows, and what it does not
A blockchain records three things reliably: which addresses hold how much, which addresses sent value to which, and when. Everything else in on-chain analytics is inference layered on that record, and the gap is where misreadings happen.
Addresses are not people
One person can control thousands of addresses; one address can hold assets for millions of people. Bitcoin’s UTXO model makes this worse, because wallets create new addresses constantly and send “change” back to themselves. Analytics firms collapse addresses into entities with clustering heuristics: the common-input-ownership assumption (inputs spent together belong to one owner), change-address detection, timing patterns and dust tracing. These are good but imperfect, and they break when wallets avoid address reuse or use CoinJoin-style mixing.
Labels are a product, not a fact
When a dashboard says “Binance outflow” or “BlackRock inflow”, it relies on a label database the provider built from announcements, test deposits, withdrawal patterns and manual research. Labels are strongest for the largest exchanges and the spot ETF custodians, where a few Coinbase Prime and Coinbase Custody addresses recur. Arkham’s labelled IBIT cluster held about $60.55 billion or roughly 766,000 BTC on August 25, 2026, and the firm tracked six straight days of inflows worth $1.5 billion by watching 300 BTC transfers from Coinbase Prime hot wallets into those addresses. Labels are weakest for mid-tier venues, OTC desks and market makers.
Intent is never visible
A transfer from an exchange to an unknown address can be a customer withdrawing, an internal hot-to-cold move, or a hack. On September 24, 2026 Arkham flagged roughly $176 million leaving Bitget-labelled wallets in about 20 minutes, consolidating into one address, while users reported blocked withdrawals. The chain showed the movement; it could not say whether it was a breach or a reshuffle, and the exchange had not said either at publication.
The Bitcoin metrics and how to read them
Bitcoin has the deepest on-chain toolkit because its UTXO design preserves the history of every coin. The core idea is to treat supply as a ledger of cost bases: every coin last moved at some price, and the distribution of those prices shows who is in profit, who is underwater, and who is likely to sell.
Active addresses
Daily active addresses count unique addresses that sent or received in a day. Glassnode’s weekly average stood at 675,800 on October 5, 2026, up 6.1% on the week. It is a fair proxy for usage but is inflated by exchange batching, dust attacks and inscription activity that uses Bitcoin as a data layer. Read it as a trend, never as a headcount.
Realized cap and MVRV
Realized capitalization values each coin at the price when it last moved, approximating the aggregate cost basis of holders. Market cap divided by realized cap is the MVRV ratio: above 1 the average holder is in profit, below 1 in loss. Glassnode also publishes the realized price (realized cap over supply) and a “true market mean” that strips out lost and very old coins to estimate the cost basis of active supply. On September 30, 2026 the true market mean sat near $77,200 and the mean MVRV price, where the ratio has historically met resistance, near $96,700.
The defining feature of the 2026 bear market is that Bitcoin never posted a daily close below its realized price, per Glassnode’s September 23, 2026 report, even though the share of supply in profit fell at the June 2026 low to roughly its November 2022 level. In 2018 to 2019 and 2022 to 2023 price spent long periods below realized price. The difference is the ETF and treasury-company cohort that bought high and did not sell, lifting realized cap and the floor it describes.
SOPR
The Spent Output Profit Ratio divides the sale price of coins moved in a day by their acquisition price. Above 1, coins are sold at a profit on aggregate; below 1, at a loss. A reading of 0.994 on January 1, 2026, cited by Coinbase, captured sellers marginally underwater. Cohort versions matter more than the headline: long-term holder SOPR fell below 1 in the first week of June 2026 as holders realized $2.4 billion of losses in 48 hours, which CryptoQuant called an on-chain capitulation. Long-term holder is a fixed Glassnode definition, a UTXO older than 155 days, set in March 2020.
Long-term holder supply and realized losses
Rising LTH supply means accumulation; falling LTH supply means distribution. The structural weakness is that any reason to move old coins, even a defensive one, registers as distribution. After a Coldcard firmware vulnerability was disclosed in July 2026, about 233,000 BTC or roughly $15 billion moved from long-dormant wallets within a week by Checkonchain’s count, the largest weekly LTH decline since December 2024, yet only about 22,000 BTC went to exchanges. Pairing the LTH drop with exchange inflows corrected the read.
Realized loss metrics are more informative at turning points. Glassnode flagged in mid-July 2026 that 30-day realized losses by one-to-two-year holders had peaked above $75 million in early July and then declined, one of the earliest signals that forced selling was easing. Bitcoin traded around $64,200 on July 16, 2026, roughly 32% below the $125,708 record of October 5, 2025.
Exchange netflows and miner flows
Net inflows to exchange-labelled addresses are read as sell-side supply arriving; outflows as coins leaving for custody. Beyond the label problem, ETF custodians often sit inside the same Coinbase entity cluster, so a coin moving from Coinbase’s exchange wallets to Coinbase Custody for an ETF can look like a withdrawal to self-custody. Miner-to-exchange flows are watched because miners must sell to cover energy costs, but the signal weakened after the April 2024 halving cut the subsidy to 3.125 BTC: daily issuance is now about 450 BTC against ETF flows that ran near $1 billion a day in late September 2026.
ETF wallet tracking
Because US spot Bitcoin ETFs settle in kind through a handful of custodians, their holdings are visible on-chain with roughly a day’s lag. Glassnode even computes an “ETF MVRV”, 1.5 on October 5, 2026, meaning ETF holders were on average 50% in profit on their cost basis. The traps are creation and redemption timing and the reuse of custodial addresses across funds. Our ETF tracker compiles issuer-reported flows.
Stablecoins, DeFi and the double-counting problem
Stablecoin supply
Total stablecoin supply is one of the cleanest on-chain figures because issuers mint and burn transparently and the tokens are fungible. It crossed $320.6 billion on April 16, 2026 per DefiLlama, with USDT near 58% of the market and the top five issuers at 89% in Q1 2026; by September 26, 2026 it stood at $311.6 billion, flat on the quarter. Growth is read as dry powder entering; contraction as capital leaving. But a growing share now serves payments unrelated to trading: Chainalysis estimated $9.4 trillion of on-chain activity in the twelve months to June 30, 2026, down only 1.6% year-on-year while total crypto market value fell about half, because stablecoin transfers decoupled from asset prices. See what is a stablecoin.
TVL and why it double counts
Total value locked sums the dollar value of tokens deposited in a protocol’s contracts. Three problems follow. TVL is price-weighted: a 40% rise in ETH lifts Ethereum DeFi TVL 40% with no new deposits, a large part of why DefiLlama’s aggregate rose from $69.2 billion on June 30 to $95.4 billion on September 26, 2026. The same capital can be counted at several layers: ETH staked in Lido becomes stETH, deposited in Aave, borrowed against to mint a stablecoin that lands in a Curve pool, so naive sums count that ether three or four times. And protocols can lock their own governance token and report it as TVL.
DefiLlama handles this with toggles rather than one number. Its documentation states it does not double count within a protocol, that liquid staking protocols are tracked but not counted toward chain TVL by default, that native proof-of-stake staking is excluded, and that bridge TVL is kept separate. Users can switch “staking” (the protocol’s own token), “pool2” (pairs containing the governance token), “borrows” and “vesting” on or off. A TVL figure quoted without its toggles is not comparable to another.
DEX volume and wash trading
DEX volume is on-chain and auditable, but auditable is not organic. DefiLlama tracked $721.7 billion of DEX volume in Q3 2026, up 13.4%. On chains with near-zero fees, bots trade a token with themselves to manufacture rankings. The problem was documented in August 2024, when Solana’s monthly DEX volume of $55.8 billion first exceeded Ethereum’s $53.8 billion and Flip Research estimated the large majority of the chain’s transactions were inorganic; Kaiko has published similar findings on DeFi token issuers. The rule: weight volume by distinct, funded, aged wallets and by fee revenue, not notional alone. Our Solana guide covers the fee structure.
Fees, revenue and real economic value
Fees are what users pay; revenue is what the protocol or token holders keep; real economic value, a framing Blockworks popularised, subtracts the token incentives paid to attract that activity. The three diverge. Hyperliquid’s gross fees rose 31% to $419.3 million in the first half of 2026, per 21Shares’ August 20, 2026 analysis, while core protocol revenue fell 3.8% to $305.3 million because builder-deployed HIP-3 markets keep half their fees. Token Terminal, DefiLlama and Artemis publish fee and revenue series with different definitions; read the methodology before comparing two protocols. Our perpetuals guide explains where perp venue fees come from.
The tools and what each is for
No single platform covers everything. The table below maps the main providers to their strengths. Most offer free tiers that are enough for the metrics discussed here; the institutional tiers add API access, entity-level labels and custom alerts.
| Tool | Best for | Core method | Main limitation |
|---|---|---|---|
| Glassnode | Bitcoin and Ethereum cost-basis metrics (MVRV, SOPR, LTH, ETF MVRV) | UTXO and account-level cost basis, weekly research | Thin coverage beyond the majors |
| CryptoQuant | Exchange reserves, miner flows, netflows, contributor analyses | Exchange and miner labelling | Label quality varies by venue |
| Nansen | Wallet labels and smart-money tracking on EVM chains and Solana | Behavioural labelling of hundreds of millions of addresses | Labels are proprietary and probabilistic |
| Arkham | Entity tracking: ETFs, exchanges, governments, hacks | Entity explorer plus labelled address bounties | Public labels can be contested or wrong |
| Dune | Custom SQL over decoded chain data | Community-written queries and dashboards | Quality depends on the query author |
| Artemis | Cross-chain fundamentals: fees, revenue, active users, stablecoin flows | Standardised metrics across 50+ chains | Standardisation hides chain-specific quirks |
| DefiLlama | TVL, DEX volume, stablecoin supply, fees, hacks | Open-source adapters per protocol | TVL toggles must be stated |
| Token Terminal | Protocol financial statements, P/F and P/S style ratios | Fees, revenue, expenses standardised | Definitions differ from DefiLlama’s |
| Messari | Research, governance and asset profiles, quarterly reports | Analyst-written reports plus data | Less raw metric depth |
| Chainalysis / Elliptic / TRM | Compliance screening, sanctions, forensic tracing | Risk scoring of counterparties and funds | Not designed for market analysis |
How institutions use the data
Compliance and transaction monitoring
Regulated exchanges, custodians, banks and fund administrators screen deposits and counterparties against address-risk databases from Chainalysis, Elliptic or TRM Labs, using the same clustering heuristics to ask whether a wallet has transacted with a sanctioned entity, a darknet market or a known exploit. Chainalysis put illicit volume at $154 billion for 2025 in its January 8, 2026 report, up 162% on the revised 2024 figure but under 1% of all on-chain activity, with 84% denominated in stablecoins and North Korea-linked groups stealing about $2 billion including the roughly $1.5 billion Bybit theft of February 2025. The firm states its totals are a lower bound that rises as more addresses are attributed, which is the honest way to describe any label-based figure. See crypto custody explained.
Risk monitoring
Desks and lenders watch three live risks. Counterparty risk: the proof-of-reserves addresses and hot-wallet behaviour of exchanges they hold balances with, which is why the Bitget outflow of September 2026 travelled so fast. Collateral risk: the backing and venue-specific pricing of assets such as USDe, wBETH and BNSOL after the October 10, 2025 cascade, when Binance paid $283 million to users whose collateral was marked down in a 40-minute window. Liquidity risk: stablecoin redemptions, where more than $2 billion of USDe was redeemed within 24 hours of that event without the on-chain peg breaking. Dune dashboards have also become the default way protocols publish KPIs to token holders, making on-chain analytics a governance tool; see our DAO governance guide.
Common mistakes and manipulated metrics
- Treating labels as ground truth. A “whale” cluster may be an exchange cold wallet; an “exchange outflow” may be an internal transfer. Ask who made the label and when it was last verified.
- Confusing stocks with flows. TVL, exchange balance and LTH supply are stocks at a moment; volume, netflow and realized profit are flows over a period. A rising stock with falling flows tells a different story from the reverse.
- Reading dormant coin movements as sales. The 80,000 BTC moved from 2011-era addresses in July 2025, worth about $8.6 billion, went to new SegWit addresses, not exchanges, and Arkham traced no deposits.
- Trusting exchange-reported liquidation totals. Coinglass’s figure of more than $19 billion on October 10, 2025 depended on exchange feeds, and Binance’s one-per-second cap made it a floor. Hyperliquid’s founder argued under-reporting could reach 100x in some conditions.
- Comparing cycles without adjusting for the ETF cohort. MVRV and NUPL bottoms from 2015, 2018 and 2022 came from a retail-and-miner holder base. In 2026 net unrealized profit stayed positive through the whole drawdown, so NUPL never flashed its historical capitulation reading.
- Counting incentive-driven volume as adoption. Points programmes, airdrop farming and wash trading inflate active addresses and DEX volume on low-fee chains. Fee revenue per active wallet is the corrective.
- Ignoring the price feed. During the October 2025 cascade the same USDe was worth $0.65 on one venue and $0.99 on another.
The 2025 to 2026 state of on-chain data
ETF-era distortions
The spot ETFs, launched in January 2024, created a cohort that trades on a US equity schedule, settles through a few custodians and reports flows daily. Exchange netflow became less informative, since much demand never touches an order book, and ETF netflow became the most-watched daily number; the September 2026 rally in the worked example below is the clearest case. The caveat is that part of ETF demand is the long-ETF, short-futures basis trade, which adds no net spot exposure.
Dormant coins and the quantum narrative
In July 2025, 80,000 BTC dormant since 2011 moved to modern addresses, and some commentators linked the migration to fears of quantum computers exploiting exposed legacy public keys. In August 2026 six wallets dormant since 2011 to 2014 moved 553.59 BTC, with 40 BTC going to Boerse Stuttgart Digital; Galaxy Digital’s head of research said none of the whales the firm works with had cited quantum as a reason to sell. The more consequential event was the July 2026 Coldcard disclosure: Galaxy Research counted about 1,596 BTC stolen while an estimated 233,000 BTC moved to safety, a ratio one custody executive put at 10 to 100 times the theft. Dormancy metrics describe custody decisions as often as investment decisions.
How we got here: a timeline
Worked example: diagnosing the September 2026 rally
Scenario: Bitcoin rises to touch $86,000 by September 21, 2026, up more than 10% in a week, then stalls at $85,000 to $85,500 for a fortnight. An allocator wants to know whether the move is new demand that can extend or a squeeze being sold into. We use four metrics with figures Glassnode published between September 23 and October 5, 2026.
- Step 1, ETF netflow (who is buying). Inflows near $1 billion on each of September 21 and 22, the largest daily figures in about a year, and roughly $1.3 billion over the five sessions after the squeeze began, following two weeks of net outflows. Then the fade: $24 million on September 28 and $208.1 million for the week to October 5, down 87.7%. Conclusion: ETF-led, and the buyer stepped back within two weeks.
- Step 2, cost-basis levels (where holders sit). Short-term holder cost basis $73,300; true market mean $77,200; mean MVRV price $96,700. At $85,000 the average recent buyer is about 16% in profit (85,000 divided by 73,300, minus 1), active supply about 10% in profit, and the next statistical resistance 14% higher. Conclusion: price is where short-term holders historically take profit, with headroom to $96,700 only if new demand arrives.
- Step 3, realized profit (who is selling). Long-term holders’ realized profit nearly doubled week-on-week into September 30, and their share of total realized profit rose from 34% to 55%, yet weekly net realized profit stayed well below the average week at the 2024 and 2025 tops. The realized profit-to-loss ratio was 1.3 on October 5. Conclusion: patient holders are distributing into the ETF bid at a scale consistent with a mid-cycle rally, not a blow-off.
- Step 4, volume and positioning (is there fuel). Combined spot plus US ETF volume averaged about $6.4 billion a day in late September, near the bottom of its range since the ETFs launched. Futures open interest was $36.6 billion on October 5, down 3.8%, and options open interest $36.0 billion, down 14.7%. Conclusion: leverage is not building, so this is not a leverage-driven top, but there is no volume expansion to carry price through the sell wall Glassnode identified at $85,000 to $85,500.
| Metric | Reading | Date | Interpretation |
|---|---|---|---|
| ETF netflow | ~$1bn/day, then $208m/week | Sep 21 to Oct 5, 2026 | Demand surge that faded |
| STH cost basis / true market mean | $73.3K / $77.2K | Sep 30, 2026 | Price 10 to 16% above holder cost |
| LTH share of realized profit | 34% to 55% | Sep 30, 2026 | Patient holders selling into strength |
| Spot + ETF volume; futures OI | $6.4bn/day; $36.6bn | Sep 30 and Oct 5, 2026 | No fuel, no leverage excess |
Diagnosis: an ETF-driven squeeze absorbed by long-term holder distribution at a cost-basis resistance zone, with thin volume and easing leverage. Supports to watch are $77,200 (true market mean) and $73,300 (short-term holder cost basis); a daily close below the latter would put September buyers underwater, which historically brings SOPR-below-1 selling. Resistance is $96,700. This is not a price call but a map of where behaviour is likely to change. Assumptions: Glassnode’s ETF custody labels and 155-day LTH threshold; prices as Glassnode reported them on the dates given.
How to evaluate an on-chain claim: a checklist
- Whose labels? Ask which provider identified the entity and whether a second agrees. Disagreement between Glassnode, CryptoQuant and Arkham on an exchange balance is normal and bounds your confidence.
- Stock or flow? A balance is a stock; a transfer is a flow. Claims that mix them (“whales accumulated $2bn” with no period) are not testable.
- Which toggles? For any TVL figure, confirm whether staking, pool2, borrows and liquid staking were included. DefiLlama excludes liquid staking from chain TVL by default; other sites do not.
- Where did the coins go? Before calling a dormant-coin move a sale, check whether the destination is an exchange deposit or a new self-custody address. July 2025 and July 2026 were migrations.
- Is the data capped? Exchange liquidation feeds such as Binance’s one per second are floors. On-chain venues such as Hyperliquid publish complete data.
- Is the volume organic? Divide DEX volume by fee revenue and by funded, aged wallets. Volume generating near-zero fees from few wallets is likely wash trading or incentive farming.
- Does the cycle comparison hold? MVRV and NUPL have a different baseline since the ETF cohort arrived in 2024; a 2022 threshold may never be reached again for structural reasons.
- Can you reproduce it? The best claims link to a Dune query, a Glassnode chart or an Arkham entity page whose parameters you can change.
Risks and open questions
The largest risk is that the most-cited metrics were calibrated on a holder base that no longer exists. Spot ETFs, treasury companies and sovereign holders now sit between the chain and the end investor, and their behaviour is driven by equity flows, financing costs and mandates rather than the cost-basis psychology MVRV and SOPR model. Glassnode’s observation that Bitcoin never closed below realized price in the 2026 bear market may be the first sign that the old bottom signals will simply never fire.
Label dependence is the second risk. Every exchange netflow, ETF balance and compliance screen rests on proprietary attribution the user cannot audit. Chainalysis acknowledges its crime totals rise retroactively as more addresses are identified; the same is true of every balance figure, in both directions. Privacy technology cuts the other way: wider use of Taproot, silent payments, CoinJoin and privacy-preserving layer 2s would degrade clustering for analysts and compliance teams alike, and if the dormant-coin migrations of 2025 and 2026 become a durable trend of legacy holders upgrading address types, age-based metrics will be noisier for years.
What to watch next
- Weekly ETF netflows through Q4 2026. Whether inflows recover from the $208 million week to October 5 decides if the $85,000 wall breaks or the $77,200 true market mean is retested.
- Short-term holder cost basis, currently $73,300. A sustained close below it would flip September 2026 buyers into loss and is the level where STH-SOPR has historically dropped under 1.
- Chainalysis 2027 Crypto Crime Report, expected January 2027. It will restate the 2025 figure of $154 billion upward and give the first full-year read on illicit stablecoin flows under the US GENIUS Act regime.
- DefiLlama Q4 2026 TVL versus fee revenue. If TVL keeps rising with price while Q3’s $5.88 billion of protocol fees does not grow, the rebound is a price effect rather than adoption.
- Dormant supply movements into 2027. Further legacy-address migrations after the Coldcard episode would keep LTH supply data noisy and need exchange-inflow confirmation before being read as selling.
Glossary
- Clustering heuristic
- A rule used to group addresses into one owner, such as assuming all inputs spent in a single transaction belong to the same entity.
- Entity label
- A provider’s attribution of an address cluster to a named organisation such as an exchange, ETF custodian or hacker.
- Realized cap
- The sum of every coin valued at the price when it last moved; an estimate of the market’s aggregate cost basis.
- MVRV
- Market value divided by realized value. Above 1 the average holder is in profit; historically very high or very low readings mark cycle extremes.
- True market mean
- A Glassnode cost-basis measure that excludes lost and very old coins to estimate the average acquisition price of active supply.
- SOPR
- Spent Output Profit Ratio: the sale price of coins moved in a period divided by their acquisition price. Above 1 means profit-taking, below 1 loss realization.
- Long-term holder (LTH)
- In Glassnode’s definition, a coin that has not moved for at least 155 days. Short-term holders are younger coins.
- NUPL
- Net Unrealized Profit/Loss: the share of market cap that is unrealized profit. It stayed positive through the 2026 drawdown.
- Total value locked (TVL)
- The dollar value of tokens deposited in a protocol’s contracts. Price-weighted and prone to multi-layer double counting unless filtered.
- Wash trading
- Trading an asset with oneself or coordinated accounts to inflate reported volume.
- Real economic value
- Fee revenue minus the token incentives a protocol pays to generate that revenue.
Why it matters
On-chain data is the one informational advantage crypto markets have over every other asset class: the full ledger is public. The advantage only exists for readers who understand that the ledger records addresses and transfers, not people and motives, and that every useful metric is an inference built on labels, heuristics and off-chain prices. The events of 2025 and 2026, from the ETF cohort that rewrote the realized-price floor to the capped liquidation feeds of October 2025 and the defensive migration of hundreds of thousands of old coins, each exposed a metric read too literally.
The discipline that works is the one in the worked example: pick a few metrics that answer different questions, state sources and dates, and treat the result as a map of where behaviour is likely to change rather than a forecast. A label is strong evidence, not proof. CCS covers these datasets in our research hub and interview archive.
Sources
- Glassnode: BTC Market Pulse, Week 41, October 5, 2026
- Glassnode: The Week On-chain, Strength Meets a Wall, September 30, 2026
- Glassnode: The Week On-chain, Escape Velocity, September 23, 2026
- Glassnode: Breaking up On-Chain Metrics for Short and Long Term Investors, March 3, 2020
- DefiLlama: Documentation (TVL methodology and double counting), accessed October 6, 2026
- Arkham Research: BlackRock Records Six Straight Days of BTC Inflows, August 25, 2026
- The Block: Crypto crime topped $150 billion in 2025, Chainalysis, January 8, 2026
- 21Shares: Hyperliquid’s H1 2026 earnings, August 20, 2026
- Dwellir: State of DeFi Q3 2026 (DefiLlama data), September 26, 2026
- KuCoin Research: Stablecoin Liquidity Hits $320.6B Milestone, May 4, 2026
- Cryptonews: Bitcoin Price Never Closed Below Realized Price in 2026 Bear Market, September 26, 2026
- ForkLog: Glassnode, Bitcoin holders cease mass loss realization, July 16, 2026
- ForkLog: Bitcoin surpasses $125,000 to set new all-time high, October 5, 2025
- Coinspeaker via Yahoo Finance: On-Chain Capitulation, Long-Term Holders Bleed $2.4Bn, June 5, 2026
- Decrypt: After Coldcard Was Hacked, $15 Billion in Bitcoin Moved to Safety, August 12, 2026
- The Cryptonomist: Bitcoin dormant wallets movement, August 29, 2026
- The Quantum Insider: Did Quantum Fears Prompt a Bitcoin Whale to Make an $8 Billion Move?, July 8, 2025
- The Block: Hyperliquid founder criticizes CEXs for underreporting liquidation data, October 13, 2025
- The Defiant: The Ultimate 10/10 Crash Autopsy, October 10, 2025
- Crypto Coin Show: On-chain activity holds near $9.4 trillion as crypto market sheds $2.1 trillion, September 24, 2026
Disclosure: This guide is for education only and is not investment, legal or tax advice.
Frequently asked questions
What does on-chain data actually show?
It shows which addresses hold how much, which addresses sent value to which, and when. It does not show who controls an address, why a transfer happened, or any price. Everything else, including exchange labels, whale clusters and dollar values, is inference built by analytics providers on top of that raw record.
What is MVRV and why does it matter?
MVRV divides market capitalization by realized capitalization, which values each coin at the price it last moved. Above 1 the average holder is in profit, below 1 in loss. Glassnode's mean MVRV price sat near $96,700 on September 23, 2026, and the related true market mean was about $77,200, framing resistance and support zones.
What is SOPR?
The Spent Output Profit Ratio divides the sale price of coins moved in a period by their acquisition price. Readings above 1 mean holders are selling at a profit; below 1 they are realizing losses. Long-term holder SOPR fell below 1 in early June 2026 as holders realized $2.4 billion of losses in 48 hours.
Why is DeFi TVL said to double count?
The same capital can be deposited at several layers, for example ETH staked for stETH, lent on Aave, borrowed against and redeposited. Naive sums count it each time. DefiLlama excludes liquid staking from chain TVL by default and lets users toggle staking, pool2 and borrows, so any TVL figure should state which filters were applied.
Why were October 2025 liquidation figures disputed?
Coinglass counted more than $19 billion liquidated across 1.6 million accounts on October 10, 2025, but Binance reports only one liquidation per second per symbol and some exchanges publish no feed at all. Coinglass said the true total was likely much higher, and Hyperliquid's founder argued under-reporting could reach 100x in some conditions.
Do dormant coins moving mean whales are selling?
Not necessarily. In July 2025, 80,000 BTC from 2011-era wallets moved to new SegWit addresses rather than exchanges. In July 2026 a Coldcard vulnerability prompted about 233,000 BTC to move within a week while only around 22,000 BTC reached exchanges. Check destinations before reading a dormancy drop as distribution.
Which on-chain tool should I use?
It depends on the question. Glassnode and CryptoQuant for Bitcoin cost-basis and exchange flow metrics, Nansen and Arkham for wallet and entity labels, Dune for custom queries, DefiLlama and Token Terminal for TVL, fees and revenue, Artemis for cross-chain fundamentals, Messari for research, and Chainalysis, Elliptic or TRM for compliance screening.
How do institutions use on-chain analytics?
Compliance teams screen deposits and counterparties against risk databases from Chainalysis, Elliptic and TRM Labs. Risk desks watch exchange hot wallets, collateral backing and stablecoin redemptions in real time. Allocators track ETF custody balances and cost-basis metrics to see where the marginal buyer sits, and protocols publish Dune dashboards as governance reporting.
This explainer is reviewed and updated as the rules and the market change. Last reviewed October 5, 2026. It is educational content and not financial, legal or tax advice.