Large movement shift
Monitor: Track transfers, deposits, withdrawals, and bridge events that clear both a minimum size floor and a multiple of the same address's recent baseline.
Classify: Classify as a size shift when the move is materially larger than the address's trailing 30-day median movement.
Surface: Only keep it if the move touches a tracked protocol, claim route, bridge, or maintenance workflow with a plausible next step.