How Iris traces a SideShift swap, and other instant exchanges

SideShift, ChangeNOW, FixedFloat and the other instant-swap services do one thing: you send them one coin, and they send you another, with no account. On-chain, that looks like a dead end. The coin goes in through an address made for one order, gets swept into the service's hot wallet, and a different coin comes out of a different wallet. No transaction links the two ends.

That's why they're a favourite last step for stolen funds. But the swap doesn't change two things: what the money was worth, and when it moved. Iris uses both. Here's a real SideShift swap it reversed.

The evidence: the case report and the Explorer board.

What happened

• Oct 1, 14:02 UTC. The wallet 7dS4…nVyw sent 4.15747497 SOL to a SideShift deposit address, 5cNg…edpq, created for this one order.
• The sweep. The deposit address passed the SOL straight on to SideShift's Solana hot wallet, ABNL…muyf, as SideShift does with every order.
• Oct 1, 14:28 UTC. SideShift's hot wallet sent 488.8411 USDT to 7JKS…vNJY, a personal wallet.

At the SOL price of the time, 4.16 SOL was worth about $490. The payout is that value, less SideShift's spread. Iris links the two wallets at 48%.

How a swap service looks on-chain

Every order follows the same three steps:

1. A one-time deposit address. The service gives each order its own address. It receives one deposit, then empties itself.
2. The sweep. The deposit is forwarded to the service's hot wallet, where it mixes with every other order.
3. The payout. The hot wallet sends the coin the user asked for, often on another chain, to the address they gave.

Following transactions gets you to step 2 and stops: the hot wallet pays thousands of people. The link has to be found another way.

How Iris reverses it

By value. Iris prices what went in at the moment of the deposit, then looks at what the service paid out in the following minutes. A swap service keeps a spread, usually 0.3% to 3%, so the payout is worth slightly less than the deposit. Every payout that fits is a candidate. Iris ranks them by how closely the value fits and how soon they came, across coins: SOL in, USDT out is the same as SOL in, SOL out once both are priced.

By SideShift's own record. SideShift publishes its latest completed swaps, with the exact amount in, the exact amount out and the coins, for every order. It keeps only the most recent ones, so Iris records them every two minutes. For a swap in that record, the match is exact, to the last unit, even when the payout lands on another chain: SOL in, ETH out on Ethereum, or USDT out on BNB Chain.

The deposit address gives itself away. Iris doesn't need the deposit address to be labeled. An unknown wallet with only a few transactions that forwards nearly everything it received to a SideShift hot wallet within the hour is recognised as a SideShift deposit address, and the trace starts from there.

Why 48%, and how to read it

This swap happened before Iris started recording SideShift's swaps, so the link comes from value and timing alone. The payout came 25 minutes after the deposit, a window wide enough for other SideShift payouts of similar value. 7JKS…vNJY is the best fit, not the only possible one.

So 48% is a lead, not proof. It tells an investigator where to look next. A second, independent link would settle it, such as a direct transfer between the two wallets, a shared funding source, or the same exchange account behind both.

What this means

An instant-swap service changes the coin and the wallet. It doesn't change the value or the timing, and on Solana it leaves its own deposit addresses on-chain. In Iris, open a wallet that paid SideShift in the Explorer and click Trace, or ask your AI assistant to run trace_transfer over MCP. ChangeNOW, FixedFloat, SimpleSwap, StealthEX and Changelly are traced the same way, by value, wherever their wallets are known.

See the evidence

The full case, with every link backed by its transactions: the case report.

The board itself, to explore the wallets and flows: the Explorer board.

Iris traces the same way through mixers: read how it linked four Cloak withdrawals and two Privacy Cash withdrawals back to their depositors. Paste any wallet at iriscan.app to start.