Lately I've been looking at addresses with "tags/clusters/funding flow" profiles, to be honest, they can be a useful reference, but trusting them blindly is a quick way to get burned. Clustering is often just a bunch of heuristics: combining inputs in the same transaction, common change addresses, transaction rhythm... When it comes to exchange hot wallets, custodians, cross-chain bridges, or even MEV bundling, it can easily distort the "profile." The other day, a cross-chain bridge was hacked, with a bunch of stolen funds moving back and forth across the bridge, making the fund flow look very "reasonable," but if you treat tags as conclusions, you're basically just following the scammers.

Now I pay more attention to "price feeds/delays/anomalies"—hard signs: a quick price fluctuation within the same time window, deviations in on-chain transactions, suspicious liquidation trigger sequences... Especially recently, everyone keeps shouting "wait for confirmation," which is actually a consensus formed by being conditioned to abnormal quotes: don’t rush to conclusions, wait for more signals to align. Anyway, I won’t talk about how to write rules now; my only principle is: profiles are clues, not evidence.