Investigation Catalogue

This address is confirmed as Coinbase Cold Wallet #299, a dedicated cold storage treasury address owned and operated by Coinbase, not an individual user or customer account. This distinction is definitive: the ₿161,949 (~$10.1B) cumulative volume eliminates individual ownership at any plausible scale; the numbered naming convention (‘Cold Wallet_299’) reflects Coinbase’s internal numbered treasury series; the primary outflow destination (1LYha…Ffzpw, ₿413K+ total received) is Coinbase’s own hot/withdrawal wallet; multi-input UTXO consolidation sweeps are a treasury management pattern structurally absent from user deposit addresses, which coll…

$100.05M USDT cycled through 25 inbound and 11 outbound events across a 40-day operational window, retaining $22.45 on close — a near-total sweep indicating a full-disbursement model. The 25-to-11 consolidation ratio points to an aggregation-then-disburse architecture consistent with institutional treasury relay or OTC settlement. No public attribution, exchange tag, or sanctions contact has been identified across indexed sources.

This wallet has received $129.65M in USDT (a dollar-pegged stablecoin) across 21 separate deposits over 242 days, while sending out only $19.76M in 3 transfers — retaining 84.8% of all inflows as a current balance of $109.89M. The narrow counterparty circle of just 10 distinct addresses and the heavily one-sided deposit-to-withdrawal ratio point to a purpose-built institutional reserve or cold-storage account.

Bitcoin rich-list rank #58 globally by balance — ₿13,556 (~$874M) retained after 77 days of operation. Received ₿20,969 across 70 inbound events from 139 unattributed counterparties; a single-day OTC settlement burst on 2026-03-31 swept ₿7,413 to two unattributed P2SH addresses, with pure accumulation and zero outflows since. Complete counterparty opacity across all five intelligence sources. AML: LOW — no confirmed contamination. Probable operator timezone UTC+2 to UTC+4.

Unattributed Ethereum EOA active for 9 minutes on 2025-10-03 — received Ξ0.00009013 ETH gas and swept ~$207,083 USDT to an OKX Hot Wallet (Arkham-attributed). No outgoing ETH transfers; residual balance Ξ0.00003255 (~$0.05). Gas funder 0x58a1…e765 unattributed. No sanctions, fraud, ransomware, or mixer exposure; USDT upstream origin unresolved. Consistent with a purpose-built single-use exchange deposit address.

Confirmed Bybit DepositAndWithdraw_6 hot wallet holding $260.8M USDT — attributed by four independent blockchain intelligence services (Arkham, OKLink, Tronscan, Tokenview). Primary finding: istories.media (2024-03-28) documents ISIS-K terrorist financing funds transacted through this address in connection with the March 2024 Moscow Crocus City Hall attack. Address is not OFAC/EU/UN designated; TokenScope MIXER flag assessed as false positive for exchange hot wallet patterns.

Unattributed TRON TRX wallet active for 21 days in March–April 2021; dormant for 4+ years with a 4.24 TRX residual balance. Receives 663 TRX from a single dominant source (75.4%), redistributes 396 TRX across five unattributed destinations in near-round disbursements, then ceases operation — consistent with a purpose-built relay or short-term intermediary. Null OSINT result; no sanctions, fraud, or darknet exposure detected. Key open items: dominant funder identity and a Hop2 USD data anomaly ($94,923 attributed vs. ~$128 TRX-layer capacity) requiring TRC-20 verification.

Unattributed TRON TRX wallet operating February 2022 to February 2023 as an intermediary aggregation node within an Iran-linked USDT sanctions evasion network. Named as a key upstream funder in the 344 million USDT TRON freeze event; Hop2 analysis confirms $272M routed through a one-hop hub to OKLink-confirmed Sanction endpoints. Wallet decommissioned consistent with the enforcement period; activated on the same date co-network wallet TZ3xL5jeBXyo8jPDvh2veBtJZCJozHq81t was retired — 7-minute relay handoff.

TRON relay node active August 2021 to February 2022 with confirmed direct Hop1 bidirectional contact with two OKLink-confirmed Sanction addresses collectively holding $344M USDT. Named co-upstream funder contributing ~$16.5M in the 344 million USDT TRON freeze event linked to OFAC Iran sanctions. Final transaction occurred 6 minutes 51 seconds before co-network wallet TD2BiYkihphjrK35YQy1QGxGotSo86vVnk activated on the same date, confirming a deliberate relay handoff within a coordinated evasion network.

P2WSH 3-of-5 multisig received ₿4,000 (~$284.9M) in a single precision transfer 2026-04-20, sourced from a relay that simultaneously disbursed ₿6,500 across four outputs at the same block. Both this address and its direct funder confirmed 3-of-5 multisig — institutional custody standard. Five upstream hops fully unattributed at institutional scale throughout; no exchange or entity tag at any layer. OSINT null. 43-day dormancy at time of report consistent with cold storage or escrow hold. No sanctions, mixer, or darknet exposure. AML LOW. Primary hypothesis: institutional cold-storage distribution (65%).

Unattributed P2WPKH single-signature address received ₿1,699 (~$120.9M) 2026-02-12 and held for 108 days before a full sweep 2026-05-31: ₿1,549 (91.2%) routed to a new cold-storage address; ₿150 (8.8%) to confirmed Kraken deposit 3NyqB7db...PxzJx. Funder concurrently sent ₿300 to the same Kraken address (total 450 BTC Kraken exposure). Outbound timestamp 22:24 UTC matches a co-profiled wallet inbound to the minute — shared operator or automation platform indicator. No sanctions, mixing, or darknet exposure. AML LOW. Primary hypothesis: institutional investor with partial Kraken liquidation (70%).

TRON energy delegate attributed to HitBTC by on-chain analysis. $511.74M USDT received across 132 inbound events; $509.69M disbursed via 126 outflows over 785 days — 99.6% pass-through ratio consistent with exchange clearing infrastructure. Single unattributed relay (TYtRsvRY...) supplies 77.1% of inflows and receives 7.5% of outflows, forming a circular relay topology. WhiteBIT confirmed as 18.4% inflow source ($94.2M). Feb 2026 batch drawdown of ~$421M via exact $5M lots raises structuring-pattern indicator (MEDIUM); no confirmed contamination, no sanctions or fraud exposure. AML risk LOW overall.

Pure accumulation terminal: ₿3,299.9993 (~$243M) received across 11 exact round-integer deposits (₿10–₿1,910) via single-use relay wallets. ₿2,809.9993 (~$207M) retained; ₿490 partially exited 2026-04-24 in two transactions. All 16 counterparties unattributed. Thursday-dominant cadence (54%; 7/13 txs). WalletExplorer cluster 5bf1322de7. No sanctions hits, no confirmed mixer or ransomware exposure. AML risk LOW on confirmed contamination; qualitative risk elevated by complete source opacity, relay wallet architecture, and structured deposit pattern consistent with deliberate layering. Source of funds unverified; ownership identity unknown.

State-affiliated treasury reserve attributed to the Central Bank of Iran (CBI) — OFAC SDN designated 2026-04-24 as part of Operation Economic Fury. $141.2M USDT received from three unattributed addresses (96.8% of inflow). $131.3M frozen by Tether 2026-04-23 — largest single-wallet stablecoin sanctions action on record. Single confirmed on-chain link to sister CBI address TNiq9AXBp9 ($8.6M transfer 2022-01-07). Active 1,750 days; no mixer exposure; terminal accumulator pattern consistent with sovereign reserve custody.

Active accumulation wallet: ₿2,150.003 (~$152.7M) across four exact round-lot deposits — 1,300 / 250 / 100 / 500 BTC — over 145 days (2025-11-06 → 2026-04-01). All nine transactions fall Mon–Fri; zero weekend activity. Peak UTC hours 14–16 map to North American or European business hours. Two consistent source wallets fund 76.7% and 23.3% of balance; 5-hop origination trace is fully unattributed at institutional scale throughout (Hop 2 holds 5,049 BTC). No sanctions, no mixer, no darknet exposure. AML LOW-MEDIUM: round-lot weekday-only pattern is a structuring indicator requiring attribution of the two dominant funder wallets to resolve. Primary hypothesis: OTC desk or institutional accumulation (55%).

One of the largest known single-address Bitcoin holdings globally: ₿53,880.067 (~$3.83B) received in a single genesis transfer on 2014-05-27 with zero outflows in 4,378 days (~0.257% of total BTC supply). Fully unattributed across all blockchain intelligence sources — no entity label, no exchange attribution. 259 of 260 total transactions are a confirmed automated address poisoning campaign from 259 distinct counterparties spanning 2014–2026; near-uniform day-of-week distribution confirms scripted multi-operator probing. Wallet controller has not initiated any on-chain action in 12 years. No sanctions, mixer, or darknet exposure. AML LOW. Identity and key-access status indeterminate; most probable scenario: deep cold storage or lost keys (60%).

U.S. Government civil forfeiture custody — Operation Prince. ₿8,611.057 (~$611.7M) consolidated in a single seizure deposit on 2024-07-05; zero outflows in 567 days. Primary source address independently confirmed as a “Hack address” by on-chain intelligence; “U.S. Government: Chen Zhi Seized Funds” (Government entity tier). Part of the largest cryptocurrency forfeiture in U.S. history — 127,271 BTC total (~$15B) — arising from Chen Zhi’s Prince Group TCO operating forced-labour pig-butchering scam compounds in Cambodia (DOJ indictment Oct 14 2025). Funds traced to LuBian mining pool theft (2020). Static hold consistent with active civil forfeiture proceedings; first outbound transaction will signal case resolution.

Central Bank of Iran — OFAC SDN designated state treasury wallet. $228.65M received across 166 inbound events; $212.92M USDT remains unfrozen and fully liquid despite active SDN status. Funds routed through relay node TCXfhTDMuS (72.8% of inflows, including a single $111M transfer). Weekend-dominant scheduling and dual UTC operating windows confirm automated treasury software; operator timezone IRST (UTC+3:30). Any interaction constitutes a strict-liability OFAC violation.

USDD MultiSig Signer — TRON DAO Reserve collateral wallet holding 1.964B TRX ($687.2M). Zero outbound transfers across 1,445 days. Capitalised via 11 batch deposits on 2025-03-02 ($130.8M tracked); remaining balance entered via smart-contract collateral mechanism (TriggerSmartContract type-31). AML risk LOW. Attribution HIGH (dual-source corroboration).

$146M USDT treasury accumulating from four structurally identical feeder wallets (99.6% of $221M inflows unattributed). Day-of-week and hourly pattern point to a Gulf-region operator (Islamic business calendar, UTC+3/+4). Two outflow events ($60M + $15M) route through a pass-through relay with $716M lifetime throughput to an unidentified TDXb-prefixed cluster. 222-day dormancy following first outflow. Address poisoning targeting confirmed. AML risk LOW.

Confirmed Bybit TRON USDT reserve address used for Proof of Reserves attestations. $275M received across 21 inbound events; $243.5M disbursed in 6 outbound sweeps; $31.5M current balance. 410-day active span, exclusively institutional counterparties, round-sum batches. AML CLEAR — 100% attributed exchange infrastructure. Merkle-tree PoR attestation confirmed via Bybit quarterly publication.

Unattributed USDT treasury with $148.9M on-chain. $168.9M received across 60 inbound transfers over 528 days from five relay-only counterparties — zero VASP contact at two verified hops. Single $20M outflow on 2026-04-21 routed through a 10-transaction pass-through wallet with immediate full-balance forward — layering flag. Tuesday-concentrated scheduling (47% of transfers) and UTC+7/+8 batch-window pattern indicate automated institutional operation.

Tether-blacklisted USDT treasury with $83.77M balance frozen. $137.08M accumulated across 43 inbound events from 37 fully unattributed counterparties over 914 days. Eleven round-figure disbursements totalling $53.30M. Blocked status confirmed on target and primary outflow destination (...Jd6wuZkG2ZiN, 48.8% of outflows). Seven of eight AML criteria score HIGH or CRITICAL — mandatory reporting trigger under US, EU, and UK frameworks.

Institutional cold-storage treasury. ₿6,320.61 held (~$465.97M); ₿52,038.69 received across 114 inbound events over 8.38 years. Primary source (2013-era Legacy address) transferred ₿17,523.23 in January 2018. All outflows in round-figure amounts to four unattributed destinations. Confirmed Bitstamp attribution via Merkle proof-of-reserves attestation (Nov 2023).

Active OTC desk / cross-exchange routing hub. $46.07M in / $43.83M out across 192 counterparties over 365 days; $2.24M retained. Defining feature: 64+ confirmed trigger-signal pairs — micro-USDT deposits (0.01–10 USDT) trigger large outflows (up to $10M) within seconds. Inflow sourced from Binance and OKX hot wallets; 45.9% of outflow ($20.10M) delivered to a single Kraken User address. Enterprise energy management: 92 Delegate/Undelegate cycles. 55.5% of inflow from two unattributed addresses — provenance unresolved.

OKX. Cold Wallet_87 — confirmed OKX exchange cold storage. 244 days active, ₿30,770 throughput (~$2.26B). Primary counterparty bc1qn2cpj0 confirmed OKX. Hot Wallet_41442 (46.9% in / 69.6% out); all remaining counterparties OKX. User addresses. Automated 24/7 operation with dominant UTC evening peak (20–21 UTC, 43% of transactions). No sanctions, no mixer exposure. AML: Clear (licensed exchange cold storage, all counterparties attributed).

Long-dormant BTC whale storage. Active since September 2017, holding 2,328 BTC (~$218M) with ~$1.9B lifetime throughput across 87 transactions. Genesis 4,884 BTC deposit followed by six years of dormancy (2018–2023), then a controlled partial exit in 2024 distributing ~2,500 BTC to unidentified counterparties. Consistent with private HNW or early-adopter holder; no exchange, mixer, or sanctioned-entity exposure. AML score: Clear.

Unattributed TRON TRC-20 address with confirmed Tether Limited blacklist — independently corroborated by multiple intelligence sources. $1,791,526.83 USDT received 2024-06-20 via a two-hop relay chain and permanently frozen; zero outflows across 710 days. The balance is irrecoverable absent a formal Tether reversal. AML HIGH (Fraud/Scam 0.85). Primary hypothesis: fraud-proceeds deposit with Tether intervention (75%).

Confirmed CoinEx exchange DepositAndWithdraw_6 hot wallet — independently confirmed by multiple blockchain intelligence sources. 4,050,365 lifetime transactions; 977,066 TRX operational float (~$324.7K). 12-hour scrape window captured 1,996 USDT transfer events. All fund flows within the CoinEx ecosystem. AML CLEAR — no adverse findings at any counterparty layer. Standard VASP counterparty classification applies.

Confirmed OKX exchange Hot Wallet_116, created 2026-05-28 (5 days old at scrape). $52.15M in / $80.86M out across 96,386 transactions in 5 days. CRITICAL FINDING: TMj17yryskb2aP7H9BMgb2qhXKNNaN89Gs (confirmed phishing address) received $22.76M — 28.2% of all outflows. Inflows 100% OKX institutional; phishing exposure is Third-Party Risk to OKX customers, not the wallet itself. AML LOW overall; Third-Party Risk ELEVATED (0.25).

Confirmed Bitget exchange Cold Wallet_5 — confirmed by multiple blockchain intelligence sources. 675-day active lifecycle cycling $2,688.60M inbound / $2,674.51M outbound; $14.10M residual balance. Exclusive hub counterparty: TJ7hhY (Bitget DepositAndWithdraw_4). Round-number outflows ($10M–$100M); 2025-01-17 peak: 4× $100M = $400M single day. UTC+8 timezone confirmed (Singapore dead zone 17:00–21:00 UTC). Dormant since 2026-05-25. AML CLEAR.

Unattributed Bitcoin P2PKH legacy cold storage holding ₿6,061.836 (~$403.7M). Single inbound transaction 2022-11-16 — exactly 5 days after the FTX bankruptcy filing (2022-11-11). Zero outflows in 1,188 days. Funded exclusively by 1LVBnipcnkwqHKaXcHeV9gcbPMvByaJkqk (active since 2017-07-31). Subsequent activity limited to 6 probe / inscription dust inputs. No exchange, darknet, mixer, or sanctions exposure. AML LOW. Primary hypothesis: FTX-era asset preservation cold storage (60%).

Principal TRX cold storage reserve tentatively attributed to Justin Sun (TRON founder). 940.17M TRX (~$313.5M) received exclusively from Binance institutional addresses (Binance DepositAndWithdraw + Binance Withdraw_18); zero TRX outflows across 1,161 days. CoinCarp TRON rich list #39. JustLend USDT activity (85.53M USDT, Apr 2024) confirms active treasury management. AML CLEAR — no adverse findings. Attribution MODERATE (community corroboration via Binance Square).

Bybit Cold Wallet_2 — $100M USDT institutional reserve, capitalized in four equal $25M tranches on 2025-12-22 from Bybit DepositAndWithdraw_6 and dormant since. Dual-source attribution: multiple intelligence sources at HIGH confidence. Single-counterparty architecture; UTC+8 (Singapore) operator timezone. AML CLEAR — 100% attributed institutional flows. 95/100 PROFICIENT.

P2WSH 3-of-N multisig that received ₿3,603.69 (~$230M) across a 22-day window (2026-05-06 to 2026-05-28), retaining ₿1,456.84 (~$93M). All five counterparties unattributed across Arkham, OKLink, and WalletExplorer. Counterparty network includes a confirmed Whirlpool-tagged address (dust contact, OKLink #Whirlpool) and a ₿690.0000 round-figure outflow to an address active since 2022 — consistent with a pre-negotiated OTC block trade settlement. Same-day receive-and-forward on 2026-05-28 indicates pre-coordinated fund movement. No sanctions, ransomware, or fraud hits. AML LOW-MEDIUM (Mixer/CoinJoin MONITOR, Structuring MEDIUM). Primary hypothesis: institutional OTC cold storage or treasury relay (H1, 55%); layering pass-through (H2, 30%) not excluded.