KALLISTI
?
Investigation Catalogue
About
Kallisti is an independent forensic research project built out of necessity to do better than currently available mainstream AML checkers. The Catalogue hosts our on-chain and due diligence research portfolio. It is also the evolving foundation for a broader AI-native forensic intelligence platform we are building.
t.me/KallistiKorp — Inquiries & Contact @kallisti_forensics_bot — Buy credits & request investigations kallisti_corp@proton.me
Intelligence Map — 29 Wallets · 21 Entities · 98 Counterparties
Forensic Intelligence · Blockchain Analytics · Due Diligence

Investigation Catalogue

On-chain forensic reports and company due diligence investigations. Each report is published as an interactive HTML document; PDF export is available on every entry.

Showing 0
Bitcoin · P2SH — Anonymous OTC Settlement Vault · Rich List #58
36X44rmLtk218sXACZ3gFpNMFENi6dQ2n3
Low
Bitcoin rich-list rank #58 globally by balance — ₿13,556 (~$874M) retained after 77 days of operation. Received ₿20,969 across 70 inbound events from 139 unattributed counterparties; a single-day OTC settlement burst on 2026-03-31 swept ₿7,413 to two unattributed P2SH addresses, with pure accumulation and zero outflows since. Complete counterparty opacity across all five intelligence sources. AML: LOW — no confirmed contamination. Probable operator timezone UTC+2 to UTC+4.
Held₿13,556 (~$874M)
TXs70 IN / 2 OUT · 139 counterparties
Active Since2026-03-30 · 77 days
RoleAnonymous Cold Storage — OTC Settlement
AttributionUnattributed — 0% resolved (H1: 65% OTC vault)
2026-06-15
View Report
{{Bitcoin · P2WPKH — Institutional Cold Storage}}
bc1ql49ydapnjafl5t2cp9zqpjwe6pdgmxy98859v2
{{Low|Low–Med|Medium|Critical|Clear}}
{{Two-to-three sentence card blurb — plain text, no HTML, no line breaks. Use the S20_PE as a starting point.}}
Held{{₿X,XXX (~$XXXm)}}
TXs{{N IN / N OUT}}
Active Since{{YYYY-MM-DD — N-day dormancy}}
Role{{Institutional Cold Storage — Terminal Accumulator}}
Attribution{{Unattributed — No entity (H1: 65%)}}
{{YYYY-MM-DD}}
View Report
ETH Address · USDT Transit — OKX Deposit
0x126fFb737f37e0d57e3C00d8F227F1a7706bCaF9
Low
Unattributed Ethereum EOA active for 9 minutes on 2025-10-03 — received Ξ0.00009013 ETH gas and swept ~$207,083 USDT to an OKX Hot Wallet (Arkham-attributed). No outgoing ETH transfers; residual balance Ξ0.00003255 (~$0.05). Gas funder 0x58a1…e765 unattributed. No sanctions, fraud, ransomware, or mixer exposure; USDT upstream origin unresolved. Consistent with a purpose-built single-use exchange deposit address.
USDT Swept~$207,083
AttributionUnknown — 0 of 4 sources
AML RiskLow — OKX destination confirmed
2026-06-10
View Report
TRON USDT · Bybit Exchange Hot Wallet
TU4vEruvZwLLkSfV9bNw12EJTPvNr7Pvaa
Low
Confirmed Bybit DepositAndWithdraw_6 hot wallet holding $260.8M USDT — attributed by four independent blockchain intelligence services (Arkham, OKLink, Tronscan, Tokenview). Primary finding: istories.media (2024-03-28) documents ISIS-K terrorist financing funds transacted through this address in connection with the March 2024 Moscow Crocus City Hall attack. Address is not OFAC/EU/UN designated; TokenScope MIXER flag assessed as false positive for exchange hot wallet patterns.
Balance$260.8M USDT
AttributionBybit DepositAndWithdraw 6
AML RiskLow–Med — ISIS-K Media Record
Lifetime TXs73.2M on-chain
2026-06-07
View Report
TRON · Short-Lived Unattributed Relay Wallet
TJ45EBCYKxRuxXhWUnWvpTYKfudbPDtunS
Low–Med
Unattributed TRON TRX wallet active for 21 days in March–April 2021; dormant for 4+ years with a 4.24 TRX residual balance. Receives 663 TRX from a single dominant source (75.4%), redistributes 396 TRX across five unattributed destinations in near-round disbursements, then ceases operation — consistent with a purpose-built relay or short-term intermediary. Null OSINT result; no sanctions, fraud, or darknet exposure detected. Key open items: dominant funder identity and a Hop2 USD data anomaly ($94,923 attributed vs. ~$128 TRX-layer capacity) requiring TRC-20 verification.
TRX Throughput663 TRX in · 396 TRX out · 30 events
Active Period21 days · Mar–Apr 2021 · dormant 4+ years
AttributionUnattributed · null OSINT
Dominant Funder...Yz9EqpAtaZbu · 75.4% · $2.46M sampled TRC-20 flow
AML RatingLow–Med — unattributed relay; no confirmed adverse finding
2026-06-05
View Report
TRON · Iran-Linked Sanctions Network — Upstream Funding Node
TD2BiYkihphjrK35YQy1QGxGotSo86vVnk
Critical
Unattributed TRON TRX wallet operating February 2022 to February 2023 as an intermediary aggregation node within an Iran-linked USDT sanctions evasion network. Named as a key upstream funder in the 344 million USDT TRON freeze event; Hop2 analysis confirms $272M routed through a one-hop hub to OKLink-confirmed Sanction endpoints. Wallet decommissioned consistent with the enforcement period; activated on the same date co-network wallet TZ3xL5jeBXyo8jPDvh2veBtJZCJozHq81t was retired — 7-minute relay handoff.
TRX Throughput4,725 TRX in · 3,890 TRX out · 280 events
Hop2 USDT Flow~$272M to OKLink Sanction addresses
Active PeriodFeb 2022 – Feb 2023 · 382 days
AttributionUnattributed · Iran-linked (OSINT)
AML RatingCritical
2026-06-05
View Report
TRON · Iran-Linked Sanctions Network — Direct Sanctions Endpoint Transactor
TZ3xL5jeBXyo8jPDvh2veBtJZCJozHq81t
Critical
TRON relay node active August 2021 to February 2022 with confirmed direct Hop1 bidirectional contact with two OKLink-confirmed Sanction addresses collectively holding $344M USDT. Named co-upstream funder contributing ~$16.5M in the 344 million USDT TRON freeze event linked to OFAC Iran sanctions. Final transaction occurred 6 minutes 51 seconds before co-network wallet TD2BiYkihphjrK35YQy1QGxGotSo86vVnk activated on the same date, confirming a deliberate relay handoff within a coordinated evasion network.
Sanctions ContactDirect Hop 1 — 2 Sanction/Blocked addresses
USDT at Sanction Endpoints$131M + $213M USDT
Active PeriodAug 2021 – Feb 2022 · 186 days
AttributionUnattributed · Iran-linked
AML RatingCritical
2026-06-05
View Report
Bitcoin · Native SegWit P2WSH · 3-of-5 Multisig — Institutional Cold Storage
bc1qq7pmeh3ca5895xw03hyx8fms0a90pa4yzne5fezu2zjcnth542csfx4mu6
Low
P2WSH 3-of-5 multisig received ₿4,000 (~$284.9M) in a single precision transfer 2026-04-20, sourced from a relay that simultaneously disbursed ₿6,500 across four outputs at the same block. Both this address and its direct funder confirmed 3-of-5 multisig — institutional custody standard. Five upstream hops fully unattributed at institutional scale throughout; no exchange or entity tag at any layer. OSINT null. 43-day dormancy at time of report consistent with cold storage or escrow hold. No sanctions, mixer, or darknet exposure. AML LOW. Primary hypothesis: institutional cold-storage distribution (65%).
Balance₿4,000.0000 (~$284.9M)
Flow1 IN / 0 OUT · 1 counterparty · 43-day dormancy
AttributionUnattributed — no entity at 5 hops (65%)
RoleInstitutional Cold Storage — Terminal Accumulator
NotesSingle-receipt 3-of-5 multisig · dormant since 2026-04-20
2026-06-02
View Report
Bitcoin · Native SegWit P2WPKH — BTC Whale / Kraken Partial Liquidation
bc1q2778ztaa48crjdxx6wpa28l5gr0a24dlrvar9t
Low
Unattributed P2WPKH single-signature address received ₿1,699 (~$120.9M) 2026-02-12 and held for 108 days before a full sweep 2026-05-31: ₿1,549 (91.2%) routed to a new cold-storage address; ₿150 (8.8%) to confirmed Kraken deposit 3NyqB7db...PxzJx. Funder concurrently sent ₿300 to the same Kraken address (total 450 BTC Kraken exposure). Outbound timestamp 22:24 UTC matches a co-profiled wallet inbound to the minute — shared operator or automation platform indicator. No sanctions, mixing, or darknet exposure. AML LOW. Primary hypothesis: institutional investor with partial Kraken liquidation (70%).
Balance$0.00 — fully swept 2026-05-31
Flow₿1,699 lifetime (~$120.9M) · 1 IN / 2 OUT · 108-day hold
AttributionUnattributed / BTC Whale — Kraken partial liquidation (70%)
RoleStrategic Hold — Partial Exchange Liquidation
NotesSwept to Kraken after 108-day hold · fully liquidated
2026-06-02
View Report
TRON · TRC-20 USDT — HitBTC Energy Delegate / Exchange Pass-Through
THDW2bQZicUiuJxkWHhtmva9b37JFWnMf4
Low
TRON energy delegate attributed to HitBTC by on-chain analysis. $511.74M USDT received across 132 inbound events; $509.69M disbursed via 126 outflows over 785 days — 99.6% pass-through ratio consistent with exchange clearing infrastructure. Single unattributed relay (TYtRsvRY...) supplies 77.1% of inflows and receives 7.5% of outflows, forming a circular relay topology. WhiteBIT confirmed as 18.4% inflow source ($94.2M). Feb 2026 batch drawdown of ~$421M via exact $5M lots raises structuring-pattern indicator (MEDIUM); no confirmed contamination, no sanctions or fraud exposure. AML risk LOW overall.
Balance$2.05M USDT
Flow$511.74M IN / $509.69M OUT · 132 IN / 126 OUT
AttributionHitBTC Energy Delegate — probable (MED-HIGH)
RoleExchange Pass-Through — Energy Delegate
Notes99.6% throughput efficiency · TRX energy provisioning function
2026-06-01
View Report
Bitcoin · Nested SegWit P2SH-P2WPKH — Structured Accumulator / Unattributed Cold Storage
3PX3LdJ5kgbHXoy2iRjgKjapBfFicco4uj
Low–Med
Pure accumulation terminal: ₿3,299.9993 (~$243M) received across 11 exact round-integer deposits (₿10–₿1,910) via single-use relay wallets. ₿2,809.9993 (~$207M) retained; ₿490 partially exited 2026-04-24 in two transactions. All 16 counterparties unattributed. Thursday-dominant cadence (54%; 7/13 txs). WalletExplorer cluster 5bf1322de7. No sanctions hits, no confirmed mixer or ransomware exposure. AML risk LOW on confirmed contamination; qualitative risk elevated by complete source opacity, relay wallet architecture, and structured deposit pattern consistent with deliberate layering. Source of funds unverified; ownership identity unknown.
Balance₿2,809.9993 (~$207M)
Flow₿3,299.9993 IN / ₿490 OUT · 11 IN + 3 dust / 2 OUT
AttributionUnattributed — illicit treasury / OTC hypothesis (65%)
RoleStructured Accumulator — Unattributed Cold Storage
NotesStructuring-consistent input pattern · no VASP contact on chain
2026-05-29
View Report
TRON · TRC-20 USDT
TTiDLWE6fZK8okMJv6ijg42yrH6W2pjSr9
Critical
State-affiliated treasury reserve attributed to the Central Bank of Iran (CBI) — OFAC SDN designated 2026-04-24 as part of Operation Economic Fury. $141.2M USDT received from three unattributed addresses (96.8% of inflow). $131.3M frozen by Tether 2026-04-23 — largest single-wallet stablecoin sanctions action on record. Single confirmed on-chain link to sister CBI address TNiq9AXBp9 ($8.6M transfer 2022-01-07). Active 1,750 days; no mixer exposure; terminal accumulator pattern consistent with sovereign reserve custody.
Balance$131,292,308 USDT — FROZEN
Flow$141.2M IN / $9.7M OUT · 88 IN / 24 OUT
AttributionCentral Bank of Iran — OFAC SDN 2026-04-24
RoleState Treasury Reserve — OFAC Frozen
NotesDesignated SDN 2026-04-24 · Tether freeze enforced
2026-05-17
View Report
Bitcoin · Native SegWit P2WPKH — Institutional Accumulator / Structuring Indicator
bc1qw344rmvdss4yx3qytpr9lwdlcn0cvl4kuycj7a
Low–Med
Active accumulation wallet: ₿2,150.003 (~$152.7M) across four exact round-lot deposits — 1,300 / 250 / 100 / 500 BTC — over 145 days (2025-11-06 → 2026-04-01). All nine transactions fall Mon–Fri; zero weekend activity. Peak UTC hours 14–16 map to North American or European business hours. Two consistent source wallets fund 76.7% and 23.3% of balance; 5-hop origination trace is fully unattributed at institutional scale throughout (Hop 2 holds 5,049 BTC). No sanctions, no mixer, no darknet exposure. AML LOW-MEDIUM: round-lot weekday-only pattern is a structuring indicator requiring attribution of the two dominant funder wallets to resolve. Primary hypothesis: OTC desk or institutional accumulation (55%).
Balance₿2,150.003 (~$152.7M)
Flow8 IN / 1 OUT · 145-day active span
AttributionUnattributed / BTC Whale — OTC / institutional (55%)
RoleInstitutional Accumulation Terminal — Active
NotesStructuring-consistent input pattern · no adverse finding
2026-06-01
View Report
Bitcoin · P2PKH — Deep Cold Storage / 12-Year Dormant Whale
1LdRcdxfbSnmCYYNdeYpUnztiYzVfBEQeC
Low
One of the largest known single-address Bitcoin holdings globally: ₿53,880.067 (~$3.83B) received in a single genesis transfer on 2014-05-27 with zero outflows in 4,378 days (~0.257% of total BTC supply). Fully unattributed across all blockchain intelligence sources — no entity label, no exchange attribution. 259 of 260 total transactions are a confirmed automated address poisoning campaign from 259 distinct counterparties spanning 2014–2026; near-uniform day-of-week distribution confirms scripted multi-operator probing. Wallet controller has not initiated any on-chain action in 12 years. No sanctions, mixer, or darknet exposure. AML LOW. Identity and key-access status indeterminate; most probable scenario: deep cold storage or lost keys (60%).
Balance₿53,880.067 (~$3.83B)
Flow260 IN / 0 OUT · 259 are dust/poison probes
AttributionUnattributed — no identity confirmed
RoleDeep Cold Storage — Fully Dormant
NotesDormant since 2014-05-27 (4,378 days) · 259 address-poison probes
2026-06-01
View Report
Bitcoin · P2SH — U.S. Government Seized Asset — Chen Zhi / Prince Group
3CybbwzZmteP8gSwk5c7r8jirMziPVGkqw
Critical
U.S. Government civil forfeiture custody — Operation Prince. ₿8,611.057 (~$611.7M) consolidated in a single seizure deposit on 2024-07-05; zero outflows in 567 days. Primary source address independently confirmed as a “Hack address” by on-chain intelligence; “U.S. Government: Chen Zhi Seized Funds” (Government entity tier). Part of the largest cryptocurrency forfeiture in U.S. history — 127,271 BTC total (~$15B) — arising from Chen Zhi’s Prince Group TCO operating forced-labour pig-butchering scam compounds in Cambodia (DOJ indictment Oct 14 2025). Funds traced to LuBian mining pool theft (2020). Static hold consistent with active civil forfeiture proceedings; first outbound transaction will signal case resolution.
Balance₿8,611.057 (~$611.7M)
Flow13 IN / 0 OUT · 567-day legal hold
AttributionU.S. DOJ / FBI — Chen Zhi / Prince Group (HIGH)
RoleGovernment Forfeiture Custody — Active Legal Hold
NotesSeized 2024-07-05 · Chen Zhi criminal forfeiture (E.D.N.Y.)
2026-06-01
View Report
TRON · TRC-20 USDT
TNiq9AXBp9EjUqhDhrwrfvAA8U3GUQZH81
Critical
Central Bank of Iran — OFAC SDN designated state treasury wallet. $228.65M received across 166 inbound events; $212.92M USDT remains unfrozen and fully liquid despite active SDN status. Funds routed through relay node TCXfhTDMuS (72.8% of inflows, including a single $111M transfer). Weekend-dominant scheduling and dual UTC operating windows confirm automated treasury software; operator timezone IRST (UTC+3:30). Any interaction constitutes a strict-liability OFAC violation.
Balance$212,922,653 USDT
Flow$228.65M IN / $15.73M OUT · 166 IN / 61 OUT
AttributionCentral Bank of Iran — HIGH
RoleState-Owned Treasury — Sanctions Network Node
NotesOFAC sanctions exposure · network-linked to frozen treasury TTiDL
2026-05-30
View Report
TRON · TRX Collateral Reserve
TPcnRbpuB89eKKkfH2E7iJooAqeEZPpdGb
Low
USDD MultiSig Signer — TRON DAO Reserve collateral wallet holding 1.964B TRX ($687.2M). Zero outbound transfers across 1,445 days. Capitalised via 11 batch deposits on 2025-03-02 ($130.8M tracked); remaining balance entered via smart-contract collateral mechanism (TriggerSmartContract type-31). AML risk LOW. Attribution HIGH (dual-source corroboration).
Balance1.964B TRX (~$687.2M)
Flow108 txs · 42 TRX in · 0 TRX out
AttributionTRON DAO Reserve — HIGH
RoleUSDD Algorithmic Stablecoin Collateral Reserve
Notes867-day dormancy (2022–2025) · MultiSig governance signer
2026-06-01
View Report
TRON · USDT Treasury — Unattributed
TFvuXyB7AhCV7jZcC9uukZDqrqCvsZQMJh
Low
$146M USDT treasury accumulating from four structurally identical feeder wallets (99.6% of $221M inflows unattributed). Day-of-week and hourly pattern point to a Gulf-region operator (Islamic business calendar, UTC+3/+4). Two outflow events ($60M + $15M) route through a pass-through relay with $716M lifetime throughput to an unidentified TDXb-prefixed cluster. 222-day dormancy following first outflow. Address poisoning targeting confirmed. AML risk LOW.
Balance$146.04M USDT
Flow70 txs · 40 USDT in · 6 USDT out · 518-day span
AttributionUnattributed — Gulf-region timezone signature
RoleUSDT Treasury — Long-Term Accumulator
NotesDe minimis Binance inflow ($7,166) · no confirmed entity
2026-06-01
View Report
TRON · TRC-20 USDT
TG9n9mHxbYfwVjizac1WaEoQ8ELfExPBCp
Low
Confirmed Bybit TRON USDT reserve address used for Proof of Reserves attestations. $275M received across 21 inbound events; $243.5M disbursed in 6 outbound sweeps; $31.5M current balance. 410-day active span, exclusively institutional counterparties, round-sum batches. AML CLEAR — 100% attributed exchange infrastructure. Merkle-tree PoR attestation confirmed via Bybit quarterly publication.
Balance$31.5M USDT
Flow$275.0M IN / $243.5M OUT · 29 txs
AttributionBybit — HIGH
RoleProof of Reserves Reserve Address
NotesBybit Merkle PoR attestation · published reserve address
2026-05-30
View Report
TRON · TRC-20 USDT
THHiKCHNQKxrZiRy4rrqy5jitSP3nUvhJY
Medium
Unattributed USDT treasury with $148.9M on-chain. $168.9M received across 60 inbound transfers over 528 days from five relay-only counterparties — zero VASP contact at two verified hops. Single $20M outflow on 2026-04-21 routed through a 10-transaction pass-through wallet with immediate full-balance forward — layering flag. Tuesday-concentrated scheduling (47% of transfers) and UTC+7/+8 batch-window pattern indicate automated institutional operation.
Balance$148,900,488 USDT
Flow$168.90M IN / $20.00M OUT · 60 IN / 2 OUT
AttributionUnattributed — zero VASP contact at 2+ hops
RoleUSDT Treasury — Staging Wallet
Notes146 total events · no confirmed entity · no sanctions contact
2026-05-30
View Report
TRON · TRC-20 USDT
TXNYeYdao7JL7wBtmzbk7mAie7UZsdgVjx
Critical
Tether-blacklisted USDT treasury with $83.77M balance frozen. $137.08M accumulated across 43 inbound events from 37 fully unattributed counterparties over 914 days. Eleven round-figure disbursements totalling $53.30M. Blocked status confirmed on target and primary outflow destination (...Jd6wuZkG2ZiN, 48.8% of outflows). Seven of eight AML criteria score HIGH or CRITICAL — mandatory reporting trigger under US, EU, and UK frameworks.
Balance$83,771,084 USDT — FROZEN
Flow$137.08M IN / $53.30M OUT · 43 IN / 11 OUT
AttributionUnattributed — Tether blacklisted
RoleIllicit USDT Treasury — Tether Frozen
NotesTether blacklist enforcement active · no OFAC designation
2026-05-29
View Report
Bitcoin · Legacy (P2PKH)
1Cr7EjvS8C7gfarREHCvFhd9gT3r46pfLb
Low
Institutional cold-storage treasury. ₿6,320.61 held (~$465.97M); ₿52,038.69 received across 114 inbound events over 8.38 years. Primary source (2013-era Legacy address) transferred ₿17,523.23 in January 2018. All outflows in round-figure amounts to four unattributed destinations. Confirmed Bitstamp attribution via Merkle proof-of-reserves attestation (Nov 2023).
Balance₿6,320.61 (~$465.97M)
Flow₿52,038.69 IN / ₿45,718.08 OUT · 114 IN / 7 OUT
AttributionBitstamp — HIGH (Merkle PoR attestation)
RoleProof of Reserves Cold Storage
NotesFCA FRN 928850 · Nov 2023 Merkle attestation · AML CLEAR
2026-05-29
View Report
TRON · TRC-20 USDT
TPTkSyuoX7awZLYCCjjywWG9Hz7VQLaaki
Low–Med
Active OTC desk / cross-exchange routing hub. $46.07M in / $43.83M out across 192 counterparties over 365 days; $2.24M retained. Defining feature: 64+ confirmed trigger-signal pairs — micro-USDT deposits (0.01–10 USDT) trigger large outflows (up to $10M) within seconds. Inflow sourced from Binance and OKX hot wallets; 45.9% of outflow ($20.10M) delivered to a single Kraken User address. Enterprise energy management: 92 Delegate/Undelegate cycles. 55.5% of inflow from two unattributed addresses — provenance unresolved.
Balance$2.24M USDT
Flow$46.07M IN / $43.83M OUT · 244 IN / 140 OUT
AttributionUnattributed — mixed-exchange counterparty pattern
RoleOTC Desk / Payment Hub
NotesBinance / OKX inflow → Kraken outflow routing pattern
2026-05-29
View Report
Bitcoin · Native SegWit (P2WPKH)
bc1qf8kep70t232jtajg2x4r8dhtuvtd7kuea8ve9w02qy5k4wncyl7spmnfme
Clear
OKX. Cold Wallet_87 — confirmed OKX exchange cold storage. 244 days active, ₿30,770 throughput (~$2.26B). Primary counterparty bc1qn2cpj0 confirmed OKX. Hot Wallet_41442 (46.9% in / 69.6% out); all remaining counterparties OKX. User addresses. Automated 24/7 operation with dominant UTC evening peak (20–21 UTC, 43% of transactions). No sanctions, no mixer exposure. AML: Clear (licensed exchange cold storage, all counterparties attributed).
Balance₿1,695.8615 (~$124.4M)
Flow₿30,770.35 IN / ₿29,074.49 OUT · 237 IN / 120 OUT
AttributionOKX Cold Wallet_87 — HIGH
RoleExchange Cold Storage — Cycling Reserve
NotesConfirmed entity tag · AML CLEAR
2026-05-28
View Report
Bitcoin · Legacy (P2PKH)
1gtmmzwhqUzhb8XoShHwgyrzbJwdZ47ok
Clear
Long-dormant BTC whale storage. Active since September 2017, holding 2,328 BTC (~$218M) with ~$1.9B lifetime throughput across 87 transactions. Genesis 4,884 BTC deposit followed by six years of dormancy (2018–2023), then a controlled partial exit in 2024 distributing ~2,500 BTC to unidentified counterparties. Consistent with private HNW or early-adopter holder; no exchange, mixer, or sanctioned-entity exposure. AML score: Clear.
Balance₿2,328.445 (~$218M)
Flow₿11,072 IN / ₿8,744 OUT · 67 IN / 20 OUT
AttributionUnattributed — no confirmed entity
RoleHNW Whale Storage — Early Adopter
NotesLong-horizon holding pattern · no adverse finding
2026-05-27
View Report
TRON · TRC-20 USDT
TRSKhXD5qSekLUxfwYxR1zA5kwTLhke2Rx
Low
High-value TRON accumulator holding $99.89M USDT across 213 active days. $119.65M received in 20 inbound events — 100% from two unattributed sources (TDbvit 66.6%, TQWWJF 33.4%). Three outbound events totalling $19.76M; $9.76M returned to primary funder TQWWJF (bidirectional flow — consistent with OTC settlement or coordinated multi-wallet management). Pre-loaded with three $5 test deposits before first material capital arrived — professional operation signal. TWJf98 test sender confirmed as Brasil Bitcoin TRON deposit/withdrawal address (on-chain label). No sanctions exposure, no fraud reports, no mixer interaction, no Tether blacklist status. AML score 18 (Low) — no confirmed adverse indicators; provenance of material inflows unresolved. Ownership identity unknown.
Balance$99,888,293 USDT
Flow$119.65M IN / $19.76M OUT · 20 IN / 3 OUT
AttributionUnattributed — HNWI / OTC Broker hypothesis (45%)
RoleActive Accumulator — Periodic Disbursal
NotesNo sanctions contact · operator pattern suggests OTC activity
2026-05-27
View Report
TRON · TRC-20 USDT — Tether Blacklisted / Unattributed
TSDHK2dr4iAeDRTsmSMXz2kLgJdK1jnhyd
High
Unattributed TRON TRC-20 address with confirmed Tether Limited blacklist — independently corroborated by multiple intelligence sources. $1,791,526.83 USDT received 2024-06-20 via a two-hop relay chain and permanently frozen; zero outflows across 710 days. The balance is irrecoverable absent a formal Tether reversal. AML HIGH (Fraud/Scam 0.85). Primary hypothesis: fraud-proceeds deposit with Tether intervention (75%).
Balance$1,791,526.83 USDT — FROZEN
Flow36 IN / 0 OUT · 710-day dormancy
AttributionUnattributed — Tether blacklisted (75%)
RoleFrozen Terminus — Two-Hop Relay End-Point
NotesSingle $1.79M receipt 2024-06-20 · Tether freeze enforced
2026-06-02
View Report
TRON · TRC-20 USDT — CoinEx DepositAndWithdraw_6
TS98H6jSx6uv1gG1vx6CJZMeYGkMZXgQ7K
Clear
Confirmed CoinEx exchange DepositAndWithdraw_6 hot wallet — independently confirmed by multiple blockchain intelligence sources. 4,050,365 lifetime transactions; 977,066 TRX operational float (~$324.7K). 12-hour scrape window captured 1,996 USDT transfer events. All fund flows within the CoinEx ecosystem. AML CLEAR — no adverse findings at any counterparty layer. Standard VASP counterparty classification applies.
Balance$5,375,741 USDT
Flow4.05M+ txs · high-velocity D&W routing
AttributionCoinEx DepositAndWithdraw_6 — HIGH
RoleExchange Hot Wallet — Customer D&W Hub
Notes977,066 TRX float (~$324.7K) · standard exchange infrastructure
2026-06-02
View Report
TRON · TRC-20 USDT — OKX Hot Wallet_116 — Phishing Counterparty
TBwBJwj81yXc4DNKS19GJcpUUzfSWRbBzS
Low
Confirmed OKX exchange Hot Wallet_116, created 2026-05-28 (5 days old at scrape). $52.15M in / $80.86M out across 96,386 transactions in 5 days. CRITICAL FINDING: TMj17yryskb2aP7H9BMgb2qhXKNNaN89Gs (confirmed phishing address) received $22.76M — 28.2% of all outflows. Inflows 100% OKX institutional; phishing exposure is Third-Party Risk to OKX customers, not the wallet itself. AML LOW overall; Third-Party Risk ELEVATED (0.25).
Balance$3,625,353 USDT
Flow$52.15M IN / $80.86M OUT · 5-day active window
AttributionOKX Hot Wallet_116 — HIGH
RoleExchange Hot Wallet — Customer Withdrawal Hub
NotesTMj17 phishing contact — $22.76M (28.2% of outflows)
2026-06-02
View Report
TRON · TRC-20 USDT — Bitget Cold Wallet_5
TWpNmnuq6EFMRnxWQTGGf47gjkkbtYJdbm
Clear
Confirmed Bitget exchange Cold Wallet_5 — confirmed by multiple blockchain intelligence sources. 675-day active lifecycle cycling $2,688.60M inbound / $2,674.51M outbound; $14.10M residual balance. Exclusive hub counterparty: TJ7hhY (Bitget DepositAndWithdraw_4). Round-number outflows ($10M–$100M); 2025-01-17 peak: 4× $100M = $400M single day. UTC+8 timezone confirmed (Singapore dead zone 17:00–21:00 UTC). Dormant since 2026-05-25. AML CLEAR.
Balance$14,095,990 USDT
Flow$2,688.60M IN / $2,674.51M OUT · 675-day lifecycle
AttributionBitget Cold Wallet_5 — HIGH
RoleExchange Cold Wallet — Treasury Liquidity Cycling
NotesDormant since 2026-05-25 · AML CLEAR
2026-06-02
View Report
Bitcoin · P2PKH Legacy — Unattributed Cold Storage
1AkJq3KKGpKQDVRzVYR6SxdzToM47nopdV
Low
Unattributed Bitcoin P2PKH legacy cold storage holding ₿6,061.836 (~$403.7M). Single inbound transaction 2022-11-16 — exactly 5 days after the FTX bankruptcy filing (2022-11-11). Zero outflows in 1,188 days. Funded exclusively by 1LVBnipcnkwqHKaXcHeV9gcbPMvByaJkqk (active since 2017-07-31). Subsequent activity limited to 6 probe / inscription dust inputs. No exchange, darknet, mixer, or sanctions exposure. AML LOW. Primary hypothesis: FTX-era asset preservation cold storage (60%).
Balance₿6,061.8364 (~$403.7M)
Flow7 IN / 0 OUT · 1,188-day dormancy
AttributionUnattributed — FTX-era preservation hypothesis (60%)
RoleCold Storage — Long-Term Terminal Hold
NotesFirst TX 2022-11-16 (5 days post-FTX bankruptcy) · dormant since
2026-06-03
View Report
TRON · TRX Cold Storage — Justin Sun Attribution
TXNL4eGs4QkXdaBVhcedRkaV6KoydPD752
Clear
Principal TRX cold storage reserve tentatively attributed to Justin Sun (TRON founder). 940.17M TRX (~$313.5M) received exclusively from Binance institutional addresses (Binance DepositAndWithdraw + Binance Withdraw_18); zero TRX outflows across 1,161 days. CoinCarp TRON rich list #39. JustLend USDT activity (85.53M USDT, Apr 2024) confirms active treasury management. AML CLEAR — no adverse findings. Attribution MODERATE (community corroboration via Binance Square).
Balance940.17M TRX (~$313.5M)
Flow89 txs · 48 TRX in · 0 out · 100% Binance inflow
AttributionJustin Sun — tentative attribution
RolePersonal Cold Storage — Long-Term Hold
NotesTRON rich list #39 · 100% institutional Binance source
2026-06-03
View Report
TRON · TRC-20 USDT — Bybit Cold Wallet_2
TKhXDEshLkYEYfaPzvKfEj8zCztSqDNUw2
Clear
Bybit Cold Wallet_2 — $100M USDT institutional reserve, capitalized in four equal $25M tranches on 2025-12-22 from Bybit DepositAndWithdraw_6 and dormant since. Dual-source attribution: multiple intelligence sources at HIGH confidence. Single-counterparty architecture; UTC+8 (Singapore) operator timezone. AML CLEAR — 100% attributed institutional flows. 95/100 PROFICIENT.
Balance$100.00M USDT
Flow4× $25M capitalization · 2025-12-22 · Bybit D&W_6 (100%)
AttributionBybit — HIGH
RoleBybit PoR Cold Reserve
NotesMerkle attestation confirmed · AML CLEAR
2026-06-04
View Report
Bitcoin · P2WSH 3-of-N Multisig — Unattributed Relay / Treasury
bc1qhjhqlxl90spcmcxm0k5d7dqduawzlcrdy08m0f8vrr2tgzvtzhaqkyaph5
Low-Med
P2WSH 3-of-N multisig that received ₿3,603.69 (~$230M) across a 22-day window (2026-05-06 to 2026-05-28), retaining ₿1,456.84 (~$93M). All five counterparties unattributed across Arkham, OKLink, and WalletExplorer. Counterparty network includes a confirmed Whirlpool-tagged address (dust contact, OKLink #Whirlpool) and a ₿690.0000 round-figure outflow to an address active since 2022 — consistent with a pre-negotiated OTC block trade settlement. Same-day receive-and-forward on 2026-05-28 indicates pre-coordinated fund movement. No sanctions, ransomware, or fraud hits. AML LOW-MEDIUM (Mixer/CoinJoin MONITOR, Structuring MEDIUM). Primary hypothesis: institutional OTC cold storage or treasury relay (H1, 55%); layering pass-through (H2, 30%) not excluded.
Balance₿1,456.8444 (~$93M)
Flow₿3,603.69 in (5 events) / ₿2,146.84 out · 22-day window
AttributionUnattributed — no entity at any hop (55% institutional)
RoleInstitutional Treasury / OTC Settlement — 3-of-N Multisig
NotesWhirlpool dust contact · ₿690 round-figure outflow · AML LOW-MED
2026-06-08
View Report
Showing 0
Individual · US citizen (declared) · DOB 1989-10-26
Christopher Nicholas Wright
ID No. FZZ0206H · Palau Digital Residency · NC Director GBD (confirmed) · RUC Partners HK (confirmed) · BlackRock unverified
Identity document review — Palau Digital Residency ID submitted for KYC purposes
US-declared individual presenting a Republic of Palau Digital Residency ID (No. FZZ0206H, issued July 2025, valid to 2030) as primary KYC documentation. The Palau programme is a commercially purchased digital residency product specifically marketed as a crypto-exchange KYC workaround for US persons and is not accepted by US-regulated financial institutions. Employment as Director Global Business Development at Nomad Capitalist (Hong Kong SAR) is confirmed via LinkedIn (slug: chrisnwright), team citation at Consensus Hong Kong 2025, and The Org. BlackRock employment claim is unverified and inconsistent with confirmed Hong Kong base and independent advisory operations. Three typological pattern matches noted: identity document substitution for regulatory arbitrage; credential inflation; and investment migration professional presenting alternative identity.
BlackRock employment claim unverified — no open-source confirmation in SEC filings or public recordsPalau Digital Residency ID is commercially purchased and explicitly marketed for US-person crypto KYC circumvention — not a conventional national identity document"SAMPLE" watermark on submitted ID card — authenticity and live status unconfirmedNo confirmed sanctions hits on preliminary open-source search — formal screening required
Entity TypeIndividual (US citizen, declared)
JurisdictionUnited States · Republic of Palau (digital residency)
DocumentPalau Digital Residency ID · FZZ0206H · ISS 2025-07-21
SanctionsUnconfirmed — formal screening required
2026-06-10
Documents DD Report
Ltd. · British Columbia, Canada
Titan Global Holdings Ltd.
BC0987199 · British Columbia Registry · LOI Analysis — Cash-on-Pallets / Advance Fee Typology
Inbound LOI — USD 30 Billion Physical Currency Transaction (300 Pallets)
BC-incorporated holding company (BC0987199, est. December 2013) operating from a virtual-office address at 401 Bay St., Suite 2702, Toronto. Website launched July 2023 — nearly ten years post-incorporation. Three phone numbers across three countries (Sweden, France, Canada) appear in different sources; the LOI bears a Swedish mobile. The entity submitted a Letter of Intent dated 2026-06-02 proposing the purchase of 300 pallets of USD banknotes at Brinks, Zurich, at a 25% discount to USD 30 billion face value, with commission structured under an IMFPA. Total face value is physically implausible: 300 pallets at USD 100M each would require approximately 3 billion individual $100 bills. The IMFPA framework, TTM (Table-to-Table Meeting) in Zurich, USDT wallet as proof of funds, and pallet-denominated currency quantities are documented markers of cash-on-pallets advance fee fraud per FBI IC3, Interpol, and FATF typologies. The entity’s website describes “Titan Preferred Shares” backed by 5,000 kg of ultrafine copper powder stored in an unspecified Western European warehouse, valued at approximately €10 billion, certified by ISE Lucerne — a pattern repeatedly documented in connection with forged ISE certificates and failed bank-pledging schemes. A website testimonial is attributed to actress Amanda Seyfried. Bloomberg listing claim in the LOI is malformed (unclosed parenthesis, no ticker) and conflates a private-company data index entry with a regulated exchange listing. All six UK companies linked to director Bertil Olsson are dissolved. All three UK companies linked to director Philippe Palide are dissolved. Director Frank Ude has zero open-source footprint in any jurisdiction searched. No sanctions hits on entity or directors.
LOI transaction structure matches cash-on-pallets advance fee fraud typology — FBI IC3 / FATF documentedIMFPA commission framework cited — ICC has publicly stated it does not produce or endorse IMFPA documentsUSD 30 billion in 300 pallets physically implausible — would require ~3 billion individual $100 billsPreferred share structure matches documented ISE copper powder certificate fraud patternWebsite testimonial attributed to American actress Amanda Seyfried — no basis identifiedBloomberg listing claim malformed and unsubstantiated — no exchange listing, prospectus, or public float foundDirector Frank Ude — zero open-source footprint in all jurisdictions searchedNo sanctions hits — OFAC / UN / EU / UK HMT on entity or all named directorsIntermediary Hartmut Bretschneider-Altgenug listed in Deutsche Anwaltauskunft — no disbarment or adverse findings
Entity TypeLtd. (BC-incorporated)
JurisdictionBritish Columbia, Canada
RegistrationBC0987199 — Active (aggregators)
Incorporated2013-12-03
DirectorsOlsson · Werk · Palide · Ude
Transaction ClaimedUSD 30B · 300 pallets · Brinks Zurich
SanctionsClear — OFAC / EU / UN / UK HMT
2026-06-04
Documents DD Report
GmbH · Limeshain, Hessen, Germany
Cockpitsonic GmbH
HRB 3505 · Amtsgericht Friedberg · Counterparty verification — Corporate Information Summary
CIS Review — KYC Onboarding / Banking Credentials
German GmbH (formerly Broadway Computer Service GmbH, est. 27 Aug 1993; renamed Cockpitsonic GmbH by resolution of 05 Sep 2013) registered at Amtsgericht Friedberg (Hessen), HRB 3505. Sole managing director and UBO: Mathias Röhr, Limeshain, DOB 29 Dec 1963, German national. Operationally active as a niche manufacturer and supplier of flight simulation hardware (A320, B737, B747 cockpit replicas and components) since at least 2001; 150+ simulators delivered to 30+ countries per company website. Share capital EUR 34,600. Last published balance sheet (2020): ~EUR 600k total assets — consistent with a single-director micro-enterprise. Passport (No. C5T62KFXF5D, issued 17 Oct 2018, expiry 16 Oct 2028, issuing authority Gemeinde Limeshain) independently verified via MRZ decode; DOB, document number, and expiry date internally consistent across biographical page and MRZ. Bank account at HSBC Trinkaus & Burkhardt AG (now HSBC Continental Europe S.A., Germany branch), Hansaallee 3, Düsseldorf — BaFin-regulated institution. IBAN DE98 3003 0880 7754 2056 22 passes ISO 7064 mod-97 checksum; embedded BLZ 30030880 confirmed as HSBC Trinkaus Düsseldorf. SWIFT TUBDDEDDXXX independently verified. No sanctions hits. No adverse financial crime media identified. Advisory items: Handelsregister extract in CIS dated Feb 2019 (six years old); registered corporate object (computers/software, last updated 2013) does not reflect current flight simulator business; creditworthiness change (Bonitätsveränderung) flagged by Companyhouse.de as of 01 Jan 2026 — direction and severity unconfirmed without paid credit bureau access; no Transparenzregister UBO extract provided; website, email, and phone fields blank in CIS template.
Registration & passport independently verified — all data points consistentIBAN checksum valid — BLZ confirms HSBC Trinkaus DüsseldorfCreditworthiness change flagged 01 Jan 2026 — nature unconfirmedHandelsregister extract in CIS dated Feb 2019 — six years oldCorporate object (computers/software) not updated since 2013 — does not reflect flight simulator businessNo Transparenzregister UBO extract provided
Entity TypeGmbH
JurisdictionGermany (Hessen)
Principal / UBOMathias Röhr (sole)
Incorporated1993 (renamed 2013)
Company StatusActive — HRB 3505
SanctionsClear — OFAC / EU / UN / UK
BankingHSBC Continental Europe — BaFin-regulated
2026-05-25
Documents DD Report
S.A. de C.V. · Villahermosa, Tabasco, Mexico
Comercializadora Geotrac S.A. de C.V.
RFC CGE190628FX8 · EDD-2026-GEOTRAC-001 · ICPO transaction — EN-590 10PPM diesel, CIF Puerto Veracruz
ICPO Transaction Review — Petroleum Supply / Commodity Trade
Mexican S.A. de C.V. (RFC CGE190628FX8, incorporated June 2019, Villahermosa, Tabasco) presenting as a hydrocarbon drilling, transportation, and export specialist. Document package consists of a self-produced company profile and an ICPO dated 01 May 2026 (three-day validity) for 1,150,000 MT of EN-590 10PPM diesel at USD 640/MT CIF Puerto Veracruz — stated contract value USD 32,000,000. The ICPO letterhead names "Comercializadora Geotrac Simmons & Edeco (Mexico) S.A. de C.V." — incorporating the brand of Simmons Edeco Mexico S.A. de C.V. (RFC M150922910), a separately registered and unrelated oilfield services company; no corporate relationship is established. Sole identity document provided is a Mexican passport (Abisael Núñez Falcón) whose MRZ decodes to an expiry of approximately July 2008 — approximately 18 years prior to the transaction date. Named supplier ("Proveedor de Combustible de Mozambique para África, LDA", Maputo) has no verifiable corporate existence; Mozambique has no known refinery capacity for EN-590 10PPM at the volumes specified. SBLC #2 is purportedly issued by JPX International Investments, Inc. (Florida profit corporation, not a bank) for USD 250M, backed by funds claimed at HSBC London — unconfirmed. Buyer's banking reference names KXERS, INC — a Florida corporation registered at a residential apartment address — as account holder in lieu of Geotrac. Payment terms are MT103/TT wire transfer rather than documentary Letter of Credit. The transaction structure, document sequence, and instrument characteristics match the EN-590 diesel CIF advance-fee fraud typology documented by the FBI IC3, FinCEN, and commodity fraud researchers, and the fake SBLC / prime bank fraud typology documented by the FBI IC3 (PSA190318) and prosecuted in US federal courts. Five entities across four jurisdictions; none is a regulated financial institution or licensed commodity trader. Every document in the package is self-produced; no independent third-party verification of any element was obtained.
⚠ EN-590 CIF advance-fee fraud typology — full structural match (FBI IC3, FinCEN)Fake SBLC / prime bank fraud typology — non-bank SBLC issuer, MT760 claim (FBI IC3 PSA190318)Signatory passport expired ~July 2008 — ~18 years before transaction dateNamed supplier (Mozambique LDA) has no verifiable corporate existence; jurisdiction has no EN-590 refinery capacityICPO letterhead incorporates Simmons Edeco brand — separately registered, unrelated companySBLC #2 issued by Florida investment company, not a regulated bankBuyer's banking reference names KXERS, INC (residential-address Florida shell) — not GeotracPayment via MT103/TT — atypical for legitimate large-volume CIF commodity tradeThree-day ICPO validity window; all commercial contact via personal Gmail accountsCompany logo subtitle "Geosynthetics & Industrial Supplies" inconsistent with stated hydrocarbon activities
Entity TypeS.A. de C.V.
JurisdictionMexico (Tabasco / Veracruz)
PrincipalAbisael Núñez Falcón
IncorporatedJune 2019
Entity VerifiedNO — RFC unconfirmed
SanctionsClear — screening limited by KYC gaps
Document IntegrityFAIL — expired passport; brand impersonation
2026-05-16
Documents DD Report
Investment LLC / Crypto Wallet · Wyoming, USA
Paragon 4 Investments, LLC — Paragon-Solutions
EIN 33-3010455 · WY SoS ID 2024-001440585 · Counterparty verification — crypto wallet / private banking
Crypto Wallet / Private Banking — Paragon Wallet (paragon-solutions.io)
Wyoming LLC (orig. Delaware, 14 Apr 2023; re-domiciled WY 11 Apr 2024) operating Paragon Wallet, a crypto-to-fiat private banking and Visa card platform. Sole member: Gregory Charles Baum ("Tuffy"), Herriman, UT. Registered address is a commercial mail-drop (Capital Administrations LLC, same building). EIN assigned Jan 2025 — 21 months post-formation. Website copyright reads ©2020–2024, predating entity formation by ~3 years. Website HTML source references <code>logo_savvy</code>, indicating direct code continuity with Savvy Wallet LLC — Baum’s prior co-owned platform. Savvy Wallet is documented in civil court filings (OC Superior Court, Jan 2023) as having introduced The Traders Domain to Batched Merchant Services and channelled funds into the scheme; the CFTC complaint against Traders Domain FX Ltd. (S.D. Florida, filed 30 Sep 2024, $283M Ponzi) references a Utah-based crypto payment processor handling $16M+ in customer deposits. Baum is not a named defendant in the CFTC complaint at the time of this report. Material document inconsistency: CIS states passport no. 545818116; passport copy in same bundle bears no. A37406061 — unreconciled. No MSB/VASP registration identified. No sanctions hits. CIS references Swiss Criminal Code Art. 305 as applicable KYC framework — inapplicable to a US LLC.
⚠ Passport number mismatch — CIS (545818116) vs. document provided (A37406061)Principal co-owned Savvy Wallet — documented conduit for $283M Traders Domain Ponzi (CFTC, 2024)No MSB / VASP registration identified — offering money services and crypto-to-fiat conversionWebsite code continuity with Savvy Wallet (<code>logo_savvy</code> in HTML source)Registered address is commercial mail-drop — no independent operational substanceEIN issued 21 months post-formation; website copyright predates entity by ~3 yearsCIS boilerplate cites Swiss Criminal Code Art. 305 — inapplicable to US LLC KYC
Entity TypeLLC (single-member)
JurisdictionWyoming (orig. Delaware)
PrincipalGregory C. Baum ("Tuffy")
Incorporated14 Apr 2023 (DE) / 11 Apr 2024 (WY)
Company StatusActive (Wyoming)
SanctionsClear — OFAC / EU / UN
Licence / Reg. StatusNo MSB / VASP registration identified
2026-05-12
Documents DD Report
Law Group, PLLC · Washington DC, USA
Kernan and Associates Law Group
EIN 86-1963480 · DC Bar No. 1013336 · Counterparty verification — legal services
Legal Services — US Government Contracts Advisory
Washington DC-based PLLC (est. 2013, EIN 86-1963480) specialising exclusively in US federal, state, and local government contracting law. Operationally anchored to a single named attorney, Patrick Bernard Kernan (DC Bar 1013336) — former US Army JAG Corps Lieutenant Colonel, DOJ attorney, and DHS Chief Counsel, who entered private practice in 2012. Active website with published matter outcomes in 2025. One federal civil action filed in EDNY November 2023 (David Grossman & Associates PLLC and Dank Capital Sapi de CV v. KALG, 2:23-cv-08231) concerning a funds/escrow dispute involving a Mexican counterparty; terminated September 2024 with no judgment against KALG. CIS (Jul 2025) discloses JP Morgan Chase IOLTA account details alongside three cryptocurrency receive addresses (USDT ERC-20, USDT TRC-20, BTC) — no explanatory context provided; DC Bar Rule 1.15 applicability unaddressed. CIS regulatory boilerplate references Swiss Criminal Code Art. 305 and “US Patriot Act of 2006” — both inapplicable to a US law firm’s KYC obligations. Separate NY entity (DOS ID 4975112, Whitesboro NY) relationship to DC PLLC unconfirmed. No bar disciplinary records, sanctions hits, or PEP exposure identified.
CIS boilerplate cites Swiss Criminal Code & “Patriot Act 2006” — inapplicable to US firm KYC2023 EDNY escrow dispute — cross-border counterparty (Dank Capital, Mexico)NY entity (DOS 4975112, Whitesboro) — relationship to DC PLLC unconfirmed
Entity TypePLLC
JurisdictionWashington DC / NY
PrincipalPatrick B. Kernan
Incorporated2013
Company StatusActive
SanctionsClear — OFAC / EU / UN
Licence / Reg. StatusDC Bar 1013336 — not independently verified
2026-05-11 &middot; v2
Documents DD Report
Attorney / Boutique Practice · Miami, FL — CA-Licensed
Eric Forrest Galen — Galen & Partners PA
CA Bar No. 211553 · FL Reg. 10135088 · Counterparty verification — legal services
Legal Services — Web3 / Entertainment / Technology Advisory
California-licensed attorney (Bar No. 211553, admitted Dec 2000) operating Galen & Partners PA (FL Reg. 10135088) from Miami, FL. 25-year background across entertainment law, Web3 advisory, and venture dealmaking; formerly at Paul Hastings, Manatt Phelps, and Greenspoon Marder. Current roles include GC of Ethena Foundation (DeFi, $100M raise Dec 2024) and Director of VGX Foundation (Cayman Islands) — the orphaned token of collapsed crypto brokerage Voyager Digital (Ch.11, 2022; liquidated Jan 2023). VGX token US securities classification post-bankruptcy remains unresolved. Website explicitly acknowledges meme coin advisory (projects unnamed). Dual legal/executive roles across commercially linked entities (RFLXT / VGX Foundation) without disclosed conflict protocols. Bar status disputed: allcaliforniaattorneys.com states “no longer eligible to practice” while CA State Bar profile remains live with no disciplinary entries. No Florida Bar admission identified despite Miami-based practice. Passport (No. 655006974, valid to Apr 2031) and CIS received; identity documents internally consistent.
No Florida Bar admission identified — practising from MiamiVGX token (Voyager Digital collapse) — US securities status unresolvedMeme coin advisory acknowledged — projects not disclosedDual legal/executive roles — RFLXT & VGX Foundation (commercially linked, no conflict protocol)
Entity TypeProfessional Association
JurisdictionMiami, FL (CA-licensed)
PrincipalEric F. Galen
IncorporatedFL Reg. 10135088
Company StatusActive (website operational)
SanctionsClear — OFAC / EU / UN
Licence / Reg. StatusCA Bar 211553 — status disputed; FL Bar not identified
2026-05-11
Documents DD Report
Oil Services & Investment LLC · Sultanate of Oman
Mazoon for Oil Services and Investment LLC
CR No. 1059951 · Counterparty verification — petroleum supply
Deal Context — Petroleum Supply / Counterparty Verification
Omani LLC (est. 2009) operating as a Sohar micro-enterprise until May 2025, when it acquired a petroleum wholesale licence and relocated on paper to Muscat. A Tunisian national (Abderrazak Chafrouda) was admitted as 50% partner with unlimited sole signing authority in June 2025 — raising Tasattur (nominee-fronting) concerns under Omani law. The company website trades under a different legal name and markets JP54, D2, D6 Virgin Oil, and Mazut — the canonical product menu of refined-petroleum advance-fee fraud. GPS coordinates in the official CR record resolve to Sohar (~199 km from the claimed Muscat address). Neither UBO has any verifiable oil-trading background. Four AML typologies confirmed.
⚠ JP54 / D2 / Mazut — advance-fee fraud patternTasattur (nominee) structure — foreign UBO, unlimited signing authorityGPS mismatch — CR record resolves to Sohar, not claimed MuscatAged-CR repurposing — 2009 entity, petroleum licence acquired May 2025Website trades under different legal name
Entity TypeLLC
JurisdictionSultanate of Oman
Principal / UBOs2 UBOs (incl. Tunisian national)
Incorporated2009
Company StatusActive
SanctionsClear — OFAC / EU / UN
Licence / Reg. StatusPetroleum wholesale — acquired May 2025
2026-05-09
Documents DD Report
✉ Inquiry / Investigation Request

Describe what you need investigated. Your message will open in your email client pre-addressed to Kallisti Blockchain Forensics.

This will open your default mail client addressed to kallisti_corp@proton.me — no data is transmitted through this site.

Due Diligence — Restricted Access
This section is protected. Enter the access key to continue.
Your memory serves you well