Module 6: On-Chain Analysis
Network Activity and Health
Chapter 10 of 12 · about 5 minutes
10.1 A million users, or one?
A new blockchain announced it had passed one million daily active addresses. Its token rose 20% on the news.
Hash looked into it. Most of those addresses had been created in the past two weeks, each made a single tiny transaction, and many were funded from the same few sources.
"So it's not a million people," said Mint.
"It might be a few bots, chasing a rumoured airdrop," said Hash. "Network activity is one of the most quoted on-chain metrics, and one of the easiest to inflate. Let's learn how to read it properly."
10.2 Common activity metrics
| Metric | What it measures |
|---|---|
| Active addresses | Unique addresses that sent or received transactions in a period |
| New addresses | Addresses appearing for the first time |
| Transaction count | Number of transactions |
| Transaction volume | Value transferred |
| Fees paid | What users spend to use the network (Module 3, Chapter 2) |
| Block space usage | How full blocks are |
These give a rough picture of usage. Growth in activity can signal adoption. Decline can signal fading interest.
10.3 Why activity metrics mislead
| Problem | How it inflates numbers |
|---|---|
| One user, many addresses | Bitcoin change addresses, wallets creating new addresses, and privacy practices (Chapter 2) |
| Bots and automated activity | Trading bots, arbitrage, and MEV bots generate huge numbers of transactions |
| Airdrop farming | Users create thousands of addresses to qualify for rewards (Module 5, Chapter 4) |
| Spam and dust | Tiny transactions sent to many addresses, sometimes for scams (Module 2, Chapter 9) |
| Cheap fees | On low-fee chains, generating millions of meaningless transactions costs very little |
| Internal transfers | Exchanges and custodians moving funds between their own wallets |
Because of these issues, raw activity numbers are hard to compare across chains, especially between expensive and cheap networks.
10.4 Better quality signals
Analysts use several techniques to see through inflated activity:
Entity-adjusted metrics. Count entities instead of addresses, using clustering (Chapter 2).
Sybil filtering. Exclude addresses that show bot-like or farming patterns, such as identical behaviour or shared funding sources.
Value thresholds. Count only addresses or transactions above a minimum value, to exclude dust.
Fees as a filter. Fees are harder to fake, because they cost real money. Activity backed by meaningful fees is more likely to be genuine.
Retention. Measure how many addresses remain active weeks or months after first appearing. Farmers and spam disappear; real users return.
| Metric | Raw value (illustrative) | Quality-adjusted value |
|---|---|---|
| Daily active addresses | 1,000,000 | 120,000 after sybil filtering |
| Addresses active 30 days later | 35,000 | |
| Daily fees | $40,000 | $40,000 |
Chapter 10 · From raw activity to real users
Three bars drawn to scale, narrowing like a funnel. Raw daily active addresses: 1,000,000. Removing bots, airdrop farmers, and one user with many addresses leaves 120,000 after sybil filtering. Removing addresses that never come back leaves 35,000 still active 30 days later, highlighted. Below, a note says daily fees are $40,000 both raw and adjusted, because fees cost real money. Figures are illustrative.
"The fees don't change," said Mint. "That's the hardest number to fake."
"That's why many analysts weight fees so heavily," said Hash.
10.5 Network value to transactions, revisited
In Module 5, Chapter 8, you met the NVT ratio: network value divided by transaction volume. It's sometimes called crypto's version of a price-to-earnings ratio.
A rising NVT means the network's value is growing faster than its on-chain transaction volume, which some read as overvaluation. A falling NVT means usage is growing faster than value.
On-chain transaction volume itself needs care. It includes internal transfers and change outputs, which can be adjusted for, and it misses activity on exchanges and Layer 2 networks. Use NVT to compare a network with its own history, rather than across different networks.
10.6 Bitcoin activity
For Bitcoin, useful activity signals include:
| Signal | What it suggests |
|---|---|
| Rising fees and full blocks | Strong demand for block space |
| Mempool size | Backlog of transactions waiting (Module 3, Chapter 4) |
| Entity-adjusted transfer volume | Real economic value moving on-chain |
| Lightning Network capacity | Adoption of off-chain payments (Module 3, Chapter 9) |
| New uses of block space | New types of transactions, sometimes driving fee spikes |
10.7 Ethereum and Layer 2 activity
For Ethereum, activity increasingly happens on Layer 2 networks (Module 3, Chapter 8). Looking only at mainnet can give a misleading picture of declining usage, when users have simply moved to cheaper layers.
| Metric | Why it matters |
|---|---|
| Mainnet fees and burns | Supply effects on ETH (Chapter 7) |
| Layer 2 transactions and users | Where most user activity now happens |
| Layer 2 data costs paid to Ethereum | How much Layer 2s pay Ethereum for security (Module 5, Chapter 9) |
| Total activity across mainnet and Layer 2s | The ecosystem's overall usage |
When comparing Ethereum with other networks, include its Layer 2 ecosystem, or explain that you're excluding it.
10.8 Comparing chains fairly
Node wanted to compare two blockchains. "Chain A has ten times the transactions of Chain B. So it's ten times more used?"
"Look at fees, stablecoins, retention, and value transferred first," said Hash. "Transaction counts on a chain where each transaction costs a fraction of a cent tell you very little on their own."
| Comparison metric | Why it's more reliable than raw transactions |
|---|---|
| Total fees | Costs real money |
| Stablecoin supply and transfer volume | Reflects real economic value |
| DEX and lending activity | Reflects actual financial use |
| Retained users | Filters out temporary farming |
| Developer activity | Reflects ongoing building (Module 5, Chapter 12) |
10.9 Try it yourself
Find the daily active addresses and daily fees for two blockchains over the past six months. Calculate fees per active address for each. Then check whether either chain had a recent spike in active addresses, and look for an explanation such as an airdrop campaign.
For Ethereum, compare mainnet transactions with total Layer 2 transactions over the past year.
Key takeaways from this chapter
- Active addresses, transactions, volume, fees, and block space usage give a rough picture of network usage.
- Raw activity metrics are inflated by multiple addresses per user, bots, airdrop farming, spam, cheap fees, and internal transfers.
- Entity adjustment, sybil filtering, value thresholds, fees, and retention give a truer picture.
- Fees are among the hardest activity metrics to fake.
- NVT compares network value with transaction volume and works best against a network's own history.
- Ethereum's activity must include Layer 2 networks to be understood properly.
- Compare chains using fees, stablecoins, real financial activity, retention, and developers, not raw transaction counts.