There's a well-known trick in banking. Deposit $9,800 instead of $12,000, because at ten thousand the bank has to file a report. Do it across several accounts on several days and no single deposit ever trips the threshold. It's called structuring, it has been in every anti-money-laundering course for forty years, and doing it on purpose is itself a crime in many countries.

So naturally everyone assumes crypto criminals do the same thing. Take the stolen money, break it into even pieces, fan it out across wallets. It's in the vendor decks. It's in the training material. It's the first thing anyone tells you.

So we checked it properly. Against the sanctioned wallets (the addresses on lists such as the OFAC sanctions list) we set 2,576 completely ordinary ones: same chain, same period, nothing special about them at all.

• 9.1% of ordinary wallets split money into even pieces.

• 8.5% of sanctioned wallets did the same.

A "split" here means spreading money across three or more addresses in a short window. Sanctioned wallets do it slightly less than everybody else.

And the bigger the fan-out, the worse it gets for the theory. Spreading money across five or more addresses: ordinary wallets did it 2.7% of the time. Sanctioned wallets, zero. Not rarely. Never.

The banking version exists because of the ten-thousand-dollar reporting line. Take the line away and the behaviour has no reason to exist. Crypto doesn't have one. There's no threshold to duck under, so nobody ducks.

What the money actually does is the opposite of subtle. In one state-linked group, the typical transfer was $6.1 million. The largest was $98.7 million. Odd amounts, one at a time, no rhythm to them. Nobody is carefully slicing anything.

The one place we did find neat even splits was people topping up fresh wallets with gas money: three dollars each to fifteen or so addresses, one batch fired off in 24 seconds. Worth catching. But it was one operator out of thirty-eight, and it's a housekeeping habit, not a laundering method.

Structuring is a rule written for banks. The chain never had the rule, so the behaviour never showed up.

Sanctioned money doesn't sit still. It arrives and it leaves, fast, and it leaves all at once.

• 39% of the money moving through sanctioned wallets was passed straight on.

• 13% was passed on by ordinary wallets.

The typical gap between arriving and leaving was under seven minutes, and the typical amount forwarded wasn't most of it. It was all of it, to the last decimal.

Then we tried to make the rule stricter, by also requiring that the amount going out matched the amount coming in. Seemed obvious. It made detection worse, and it cut how many cases we could see from 56% to 45%.

The amounts are noise. The clock is the signal. Every extra condition borrowed from the folklore cost us cases.

Everyone expects fresh, throwaway addresses. Sanctioned wallets in our set were old, typically around 265 days. Treating an established wallet as a safe one is how you walk past them.

Emptying an address completely looks like tradecraft. It's slightly more common among ordinary wallets.

Machine-like, evenly spaced transactions were about twice as common in ordinary wallets. The bots are everyone else.

Most of what this industry "knows" about following dirty money was never checked against ordinary people doing ordinary things. When you finally check, the rules about amounts fall over and the rules about timing hold up.

Running that comparison takes an afternoon. Shipping a rule that turns out to be a coin flip costs you a year of chasing innocent wallets.

If you screen wallets for compliance, zScreen gives you a Clear, Review or Flagged verdict for any address, and Zeru builds the wallet scoring and screening behind it.

What is structuring in AML? Structuring means breaking money into smaller amounts so that no single payment trips a reporting threshold, such as the ten-thousand-dollar bank reporting line.

Do sanctioned crypto wallets split funds into equal amounts? Not more than ordinary wallets. In our comparison, 8.5% of sanctioned wallets split money into even pieces, against 9.1% of 2,576 ordinary wallets.

What is the strongest signal of a sanctioned wallet? Speed. Sanctioned wallets typically passed money on in under seven minutes, and 39% of the money moving through them was forwarded, against 13% for ordinary wallets.