Wallet behavioral anomaly detection. Compares recent activity (default 24h window) against the wallet's own 180-day baseline. Surfaces tx-volume spikes, dormant-wakeup patterns, new-protocol interactions, and counterparty diversification. Catches compromised hot wallets, dormant whales, strategy shifts.