Investigation Catalogue

Tier-1 liquidity router — Binance/OKX exchange treasury. Currently holds 2,403 BTC (~$174M) with $1.85B lifetime throughput across 259 transactions. Behavioural fingerprint is unmistakable: automated 500 BTC peeling between 03:00–04:00 UTC daily, mass round-sum batched outflows, exchange-cluster counterparties. CEX attribution 95% confidence. Clean across all AML criteria — pure exchange operational wallet.

Long-dormant BTC whale storage. Active since September 2017, currently holding 2,392 BTC (~$167M) with ~$700M lifetime throughput across 140 transactions. Genesis 4,884 BTC deposit followed by six years of dormancy (2018–2023), then a controlled partial exit in 2024 distributing ~2,500 BTC to unidentified counterparties. Behaviour consistent with private HNW or early-adopter holder; no exchange, mixer, or sanctioned-entity exposure. Single-sig custody on a nine-figure cold wallet is the primary residual risk.

Institutional vault — exchange treasury infrastructure. Holds $104.65M USDT after $114.65M in / $10M out across 38 transactions. Network throughput exceeds $700M when aggregated with closely-clustered sister wallet TWrmh883 (which received $35M in parallel inflows). 70% confidence exchange-attribution per behavioural analysis. Active address-poisoning campaign confirmed; operator response has been clean (no interaction with phishing tokens).

Active USDT payment hub / OTC desk. 1,251 transactions across 289 days; $37.2M in / $30.8M out / $6.4M held; $68M total throughput. Operates a unique trigger-signal mechanism: a tiny incoming USDT deposit auto-releases settlements of up to $10M to predetermined recipients. TAzsQ9 Binance hot wallet sent $4.2M on day one — strongest attribution signal pointing to either an OTC desk operating from Binance liquidity or an unregulated exchange clone.

Largest single-wallet USDT freeze in TRON history. Frozen by Tether on 2026-02-10 with $83.77M USDT permanently locked. Lifetime: $137M received / $53.3M sent across 249 transactions over 898 days. eXch (no-KYC exchange) confirmed as upstream source — the strongest illicit-finance link in the catalogue. Specter Analyst identified a linked $20M wallet still active and not yet frozen; that lead is the highest-priority follow-up.

Anonymous HNW / private treasury cold storage. 6,320 BTC currently held (~$531M); 22,915 BTC received and 16,595 BTC sent across 103 transactions over 8.2 years. Genesis cluster 1e1da78a5c145680 sent 17,523 BTC in January 2018 and remains unattributed. New cluster 7eca99a2794f3eef received $294M during 2025. The largest custodial concentration in the series — a single-sig key controlling over half a billion dollars is the dominant residual risk, not any AML concern.

Anonymous BTC cold storage — the canonical Kallisti reference report. 3,299.9993 BTC accumulated (~$221M) across 11 transactions in 89 days during Jan–Feb 2026, with zero outflows since. Cluster a4ed11121df6e9e7; Group A controller responsible for 1,920 BTC (58.2%) confirmed via UTXO chain analysis. Staging address 3ARXDSCE flagged at MatchSystems 35/100. This investigation established the 20-section Kallisti standard now used for all subsequent reports.

USDT accumulator with zero outflows. 147.23M USDT (~$147.2M) accumulated across 158 transactions over 527 days, with not a single outflow recorded. TX42iZ identified as probable cluster operator; energy delegation infrastructure links the wallet to a broader operational footprint. Accumulation-only pattern combined with operational sophistication elevates risk above LOW despite the absence of any explicit AML-flagged behaviour.

Bybit cold storage hot wallet. A high-throughput USDT operational address attributed to Bybit exchange infrastructure, processing ~$518.5M lifetime volume across 57 transactions and currently holding $31.5M USDT. Behaviour patterns — round-sum institutional batches, regular sweep cadence, exchange-typical counterparties — match Bybit treasury operations. Clean profile across all AML criteria; no sanctions, mixer, or darknet exposure. Earliest report in the series; pre-Kallisti format.

Layering hub / wash node — five confirmed AML typologies. Highest-risk address in the catalogue. $228.65M USDT received from 60+ unattributed senders, $15.73M out to 20+ unattributed recipients, ~$212.92M held. TCXfhTDMuS delivered 72.8% of inflows ($166.6M including a single $111M transfer) and received $11.2M back — same operator both ends. A closed-loop wrap-token cycle generates artificial volume between sister addresses. Zero DeFi interaction across $212M and 5.1 years. Not frozen — remains active. Recommendation: REJECT / SAR.

USDD MultiSig governance signer (USDDmultisig2). Signer #2 of 7 in the TRON DAO Reserve's 5-of-7 governance framework, holding 1,964,182,490 TRX (~$644M, ~2.07% of TRX supply, #6 on TRON Rich List). Zero TRX outflow in 1,447 days — every outgoing call is a zero-value governance signature. Clean across all binary AML checks. One unresolved item: the March 2026 XCOM token relay (47M in/out in 111 seconds) — first novel behaviour in the wallet's four-year history.

High-volume TRON USDT wallet — $220.1M received, $75.0M sent, $145.1M held. Classified as USDT Whale. All four primary inflow sources are unattributed; a $60M outflow to an unknown address was missed by automated screening tools and only surfaced through manual review. A delivery of 136,959,514 stUSD in March 2026 from an unverified issuer requires token identity confirmation before the held amount can be treated as a liquid asset.

WhiteBIT exchange hot / liquidity wallet. Active since March 2024; $511.7M received, $469.7M sent, ~$42.0M held across 571 transactions. Classic CEX hot-wallet signature: 24/7 automation, 1 USDT test deposits before large round-sum movements, genesis funded by a verified Paribu Exchange address. Dune Analytics labels the address and its primary funder "Possibly affiliated to WhiteBIT." Feb 2026: $381M distributed in 72 hours in automated treasury rotation. Clean across all AML criteria.