Get Suspicious Clusters

Find clusters with suspicious behavioral patterns.

Cross-joins entity_clusters + intent_detections + whale_txs. A cluster qualifies on actually-suspicious signals: wash-trading or distribution-prep intents (7d window), or cluster risk_score >= 50. Accumulation counts are returned as context but do not qualify a cluster on their own. Ranked by suspicion (wash weighted over distribution-prep), then risk score; member exit-volume to CEXes is evidence/tiebreaker, not the ranking.

Definitional bound (documented, not a silent filter): clusters whose own labels match known exchanges (Binance/Coinbase/... — see queries.EXCHANGE_LABEL_RE) are excluded. An exchange's cluster always trips member-intent heuristics by sheer size; it isn't "suspicious" for being itself. Pre-fix this surface ranked Binance 15 and Coinbase 44 (risk_score 0) as the top suspicious clusters.