We Mapped Luno and VALR. The Deposit Layer Isn't What the Headlines Say.

AfriFlux has now mapped Luno and VALR, wallet by wallet — the first two South African venues in our coverage, and the first step in extending our on-chain money map beyond Nigeria. We read deposit addresses directly on-chain rather than taking a reported figure on trust. And the first finding is a shape, not a headline: the deposit layer is far more concentrated than the customer count makes it look.

Start with the number most people would quote. Between them, the two venues show a customer book of about $877.8M across roughly 128,800 deposit addresses. That's the part we can confidently call customer stablecoin deposits. Sitting next to it is $24.67B of deposit-address activity we can observe but won't responsibly call customer money — and it rides on just 400 addresses. The chart at the top of this page is the whole argument in one frame: 0.3% of the addresses, 96.6% of the dollars.

This piece is about those 400.

Most addresses are small. A few pull the average up.

Inside the customer book, the typical deposit is tiny. The median included address holds about $395 at VALR and $274 at Luno — a broad base of small deposit addresses. But the average included address is far higher: about $6,590 at VALR and $7,229 at Luno. Most addresses are small; a relatively small number of larger ones pull the average up, even inside the customer book.

These are address-level measurements, not people. One person can hold several addresses, and a P2P merchant address can front many — so read it as the average included deposit address, not "the average customer deposits $6.6K." The median shows the breadth of the base; the average shows how hard the larger addresses pull.

VALR and Luno are not the same book

Put the two side by side and something jumps out. VALR's customer book is about 1.7× Luno's, and its customer address count about 1.8×. So far, VALR just looks like a bigger Luno. Then look above the customer book: VALR's excluded layer is $22.93B, Luno's is $1.74B — roughly 13×.

VALR accounts for roughly 93% of all the activity outside the combined customer book. The difference isn't simply customer scale — it's the shape of the layer outside the book. VALR's spreads across five chains, and its single biggest piece is a $7.12B USDC provisioning pipe running through nine Avalanche addresses. We'll get there. We report what the wallet data supports and nothing beyond it.

So what are those 400 addresses?

A large deposit address can be any of several things: a genuine institutional customer or market-maker; the venue's own liquidity or treasury; inter-exchange or OTC flow passing through; or something we can't confidently place. The amount alone doesn't tell us which.

So we don't do the two easy things. We don't count every large box as a customer — that inflates the number by an order of magnitude. And we don't throw them all away — that erases real institutional customers. We investigate the wallet relationships. They fall into three outcomes: one the evidence resolves cleanly, one it half-resolves, and one it can't resolve at all.

VALR: the large address that isn't a customer

The clean case. One VALR address has routed roughly $323M in stablecoins. By size, it looks like an enormous customer. Follow the wallet graph and the classification changes completely: it's a Gnosis Safe that is part of VALR's own reserve / proof-of-reserves infrastructure. This is money the exchange moves between its own wallets, not money a client deposited.

It's venue infrastructure, not a client deposit. We can prove that, so we exclude it — it never enters the customer book.

A box that looks like a customer, until the wallet graph proves it's the exchange's own reserve. Ambiguity resolved by evidence.

Luno: the same problem, a harder angle

Luno gives us the half-resolved case. Its single largest box — about $391M — is funded almost entirely by one counterparty, which the evidence points to as a major licensed market-maker. It's a two-way loop: the counterparty funds the box, Luno sweeps it into its hot wallet, and Luno sends roughly $234M back to that same counterparty — a net of about $158M into Luno.

Here's what we won't paper over. The chain shows the relationship — A funds B, B returns to A — but not the commercial direction. We can't establish from on-chain evidence alone whether Luno is sourcing liquidity from the market-maker, or the market-maker is using Luno as its venue. Those are different economic facts, booked differently. The wallet graph is observable; the deal behind it is not.

The $1M line

Only now the rule — because you've already seen the distribution: thousands of small addresses, a tiny tail of enormous ones, a reserve Safe, an unresolved counterparty relationship. We needed one consistent boundary.

The customer book is stablecoin activity we can confidently attribute to customers or businesses under the current methodology. Addresses below $1M lifetime are included by default. Addresses at or above $1M are included only when we can independently attribute them to a genuine customer; otherwise they're excluded and remain reviewable. Provable venue-owned infrastructure is excluded regardless of size.

The line isn't "customers can't hold more than $1M," and it isn't "every box under $1M is one retail person." It's the point past which we require independent evidence before calling flow customer money.

Restated against that boundary, the honest ledger looks like this:

The $7.12B Avalanche pipe

The deeper cut shows where VALR's tail is concentrated. Its $22.93B layer outside the customer book is spread across several chains: $7.12B on Avalanche, $7.01B on Tron, $6.71B on Ethereum and $2.08B on Solana. Luno's $1.74B is 87% Ethereum. But the Avalanche number is the most revealing part of the map.

Follow the nine Avalanche addresses and they collapse to two deposit boxes in rotation, with one handed off to the next in late 2025. Together they carry 99% of the $7.12B. The money in roughly equals the money out — net ~zero held. It isn't a balance; it's throughput.

One wallet supplies $5.45B of the flow; Circle — the USDC issuer — supplies most of the rest. We traced that supplying wallet directly: 89% of what it receives is freshly-minted USDC. It then pushes 87% into VALR's two Avalanche boxes and burns the remainder. The mechanism is clear — mint, route into VALR, redeem the excess. What we can't identify is the operator behind the wallet: it's unlabelled, its own funding is minting rather than an identifiable source, and public attribution services don't recognise it.

We can watch USDC being minted and pumped into VALR, and still can't say whose desk it is. That is exactly what "excluded and reviewable" is for.

So the three large-address cases line up like this:

Large ≠ customer. Large ≠ venue-owned. Large ≠ automatically institutional. Sometimes the chain proves which. Sometimes it doesn't.

What this says about South Africa

Carefully: this is what the first two major venue mappings in our coverage reveal, not a census of the South African stablecoin market. What they show is a deposit layer with two very different scales of activity on the same rails — a broad base of smaller deposit addresses, and a tiny number of enormous addresses whose economic role can't always be established from the chain.

That's why raw "exchange deposit" numbers can be misleading. You can measure the flow precisely and still be wrong about what it is, unless you go to the wallet level. When the evidence runs out, we show the ambiguity rather than manufacture certainty — and we show exactly where the line is.

Get the next investigation in your inbox. The Sweep is our Monday newsletter — one attributed on-chain number a week, with the method attached. Subscribe →

Methodology & limits

AfriFlux measures stablecoin (USDT/USDC) deposits by reading venue deposit addresses directly on-chain, across up to five chains per venue. This is the flow across the two South African venues currently in our coverage — Luno and VALR — not a census of the whole market.

The customer book is activity attributable to customers or businesses under the current methodology: addresses under $1M lifetime are included by default; $1M-and-above is included only when independently attributable, otherwise excluded and reviewable. Provable venue-owned infrastructure is excluded regardless of size. Figures are lifetime through 2 October 2026, measured address by address and independently reproducible from public chain data. Where a large address can't be resolved from the chain — the Luno counterparty's commercial direction, the Avalanche provisioning operator — we say so rather than guess.