A hop is a single transfer from one address to another. Counting hops is how analysts describe distance: one hop means funds moved directly between two parties, three hops means they passed through two addresses on the way. Distance changes how a reviewer reads a connection. It does not remove the connection, because every hop is itself a public, permanent transaction.
Hop distance is the difference between a finding and a question. Funds that came to your counterparty straight from a darknet market are a fact about that counterparty. Funds that reached them after passing through two exchanges and a payment processor are a fact about a public ledger where almost everything eventually connects to something.
Reviewers use the distance to decide how much of their day an alert deserves, and desks write it into policy so the decision is not re-argued every time. The word itself comes from tracing work, where an analyst walks a trail one transfer at a time and counts the steps between the address in front of them and the one they care about.
| Distance | How a reviewer reads it |
|---|---|
| Direct, one hop | Your counterparty transacted with the flagged party themselves. The hardest kind to explain away, and the kind that stops settlements. |
| Two to three hops | Worth asking about. Common for services that pool customer funds, so the attribution of the parties in between usually settles it. |
| Further out | On a public chain, distance alone is not an accusation. It goes in the file as context, not as a driver. |
Every hop is a transaction, and every transaction is published the moment it confirms. Sending funds through fresh wallets adds steps to a trail that anyone can read; it does not shorten it. Worse, the pattern has names of its own — peel chain, chain hopping — and those names are categories in their own right, which means the attempt is more visible than the original problem.
The same is true across chains. A bridge moves value to another network and leaves a record on both sides. A swap produces a new token and a new address, and the transfer into it is public.
What actually improves your position is unglamorous: know where the funds came from, be able to show it, and check the counterparty before you accept rather than after.
The result states whether the connection is direct or through intermediaries, names the party at the other end where it is attributed, and names the category in plain words. Paste an address into the Telegram bot for that answer in seconds, free, three checks a day. In the workspace the same result is a case, a queue filter and a signed report.
No. Each transfer is public and permanent, so the extra addresses add steps to the trail rather than breaking it, and rapid chains of onward transfers are a recognised pattern with their own category names.
It varies by tool and by the question being asked. The practical answer for a desk is that a result tells you whether a connection is direct or through intermediaries and names the party at the other end.
A cross-chain transfer is a traceable step with a record on both networks. The funds change network; the history does not disappear with them.
Also available in: · · ·
No. Confirmations measure how settled a transaction is on its own network. Hops measure how many transfers separate two parties.
Send any wallet to the Telegram bot and get a verdict in seconds. Three checks a day, free, no signup. Desks that screen every deposit run it on plans from $199/mo.