I just looked at an on-chain transfer. At first glance, it looked like a few coincidental split-and-merge transactions. But when I pulled up the path and traced it, I found that they were all inter-contract transfers between different contracts of the same protocol. They were deliberately split into different addresses to avoid detection. Put simply, a lot of so-called “mysterious addresses” or “coincidental transfers” are actually project teams running a matryoshka (stacked) arbitrage: staking, then restaking, then wrapping it into a new asset, and then shuffling returns back and forth across several contracts. Didn’t people keep talking about “shared security” from restaking lately? From what I’m seeing, this “shared security” is more like a path of “how do I stack the yield into your account and then run away.” Don’t care how fancy the on-chain data looks—the core point is one sentence: trace the cash-flow direction by looking at the longer path. If all the outflows go to the same multisig, then they’re just trying to fool people.