Last night I came across a bunch of "coincidental transfers" again, looking like random payments, but in fact most of the paths can be explained: first transferring a batch from the exchange's hot wallet to a relay, then dispersing to new addresses for one or two small interactions, and finally looping back to the same collection address. Basically, it's just pretending to be "new users." When new L1/L2 incentives boost TVL, I can understand old users criticizing mining, withdrawal, and selling... the on-chain traces are just too consistent.

Now I don't jump to conclusions right away; I first flatten the timeline: the same batch of gas, the same set of amount suffixes, created within the same period, then check if there are common funding sources. The page always needs to refresh/retry to load the graph, which is a bit frustrating, but not clarifying the details makes me more anxious.