KALLISTI BLOCKCHAIN FORENSICS
BTC (native Bitcoin)
---
Target Wallet Address
1Cr7EjvS8C7gfarREHCvFhd9gT3r46pfLb
Report Date: 2026-05-29 · Prepared by Kallisti Blockchain Forensics
Wallet Identity · Financial Overview · Holdings · Activity Patterns · Account Structure
| Entity · Blockchain | Unattributed — Possible Bitstamp Cold Wallet · Bitcoin mainnet · P2PKH legacy (1xxx) |
| Account Age · Active Window | 3,057 days (8.38 years) ‖ Active: 2018-01-07 → 2026-05-23 |
| Balance | ₿6,320.6139 · ~$465.75M |
| Transactions | 115 total · 114 BTC in · 7 BTC out · Across 213 counterparties |
This wallet operates exclusively as a cold-storage accumulation and periodic disbursement address. It received ₿52,038.69 across 114 inbound events and disbursed ₿45,718.08 across only 7 outbound transactions — an outbound-to-inbound ratio of 1:16. This extreme asymmetry is characteristic of custodial treasury infrastructure rather than active trading or retail use. The wallet has never been observed initiating high-frequency activity, interacting with DeFi protocols, or operating as a fee-payer address.
Inbound transactions range from sub-₿1 dust events to a single ₿17,523.23 transfer — a 17,000× size spread spanning 8 years. Outbound transactions are consistently large: the seven recorded outputs average ₿6,531.15 each, with the smallest being ₿1,994.18. This two-tier size structure — many small inflows aggregated into a few very large outflows — is the operational signature of an exchange hot-wallet-to-cold-wallet sweep cycle or institutional custody batch processing.
The wallet holds 100 UTXOs and has never consolidated them, indicating no urgency to optimize fee surface — consistent with a cold wallet operated by an entity with low fee sensitivity. Inbound counterparties span all three Bitcoin address generations (Legacy P2PKH, Nested SegWit, Native SegWit), suggesting the operator receives deposits from a broad, multi-generational user base. Four distinct unattributed outflow destinations received aggregate disbursements, none linkable to known exchanges or sanctioned entities through available OSINT sources.
Transaction activity is non-uniform across the 8.38-year window. The 2018–2019 period accounted for the largest single inflow event and two major outflows; 2021 brought three identical ₿235.00 inbound transfers followed by the largest single disbursement (₿6,601). Activity was minimal 2022–2023. A cluster of outbound activity resumed in 2024–2025, with three sequential payments to ...DqeRUTR. The most recent transaction recorded is 2026-05-23. This episodic cadence — long dormant periods punctuated by deliberate large-value movements — is consistent with institutional treasury rebalancing rather than continuous operational use.
No evidence of automated or scripted transaction patterns was observed. Transaction timing does not cluster at regular intervals; outflow amounts are not algorithmically derived. The wallet shows no interaction with contract addresses, relayer services, or batching protocols. All seven outbound transactions appear to be manually initiated discrete movements, consistent with human-authorized treasury disbursements subject to internal approval workflows.
| S1 | Blockchain.com — Bitcoin Address Explorer · www.blockchain.com/explorer/addresses/btc/1Cr7EjvS8C7gfarREH… |
| S2 | Mempool.space — Bitcoin Mempool Explorer · mempool.space/address/1Cr7EjvS8C7gfarREHCvFhd9gT3r46pfLb |
Counterparty Map · Inflow Architecture · Outflow Architecture
Upstream · Top 5 Funders
| ID | Address | Volume in | Attribution | Risk |
|---|---|---|---|---|
| A1 | 19vWUsLH7G6yQH484r3n1GodLEoLivWHJg | ₿17,523.2321 | Unattributed · Legacy (est. 2013) | MEDIUM |
| A2 | 32njR8f9z8pSNhPjGkqCQ82e84XyrVnCWM | ₿381.8000 | Unattributed · Nested SegWit | MEDIUM |
| A3 | bc1q9ns4vakspwv93ndqnlkm7x2amwsfth8sp3nphc6p5tehn8ufxy2sfwegdq | ₿235.0000 | Unattributed · Native SegWit | MEDIUM |
| A4 | bc1qsfpp6u5wq4kyfdw8u38kq0d3t443jtkx0fgkqnvj7v97wcrj65jqz6sha5 | ₿235.0000 | Unattributed · Native SegWit | MEDIUM |
| A5 | bc1qp58kn030k4flm5c3mdgaavmzap8tjdggs87phvtrttukjxm6hz0q86ltfa | ₿235.0000 | Unattributed · Native SegWit | MEDIUM |
Downstream · Top 5 Destinations
| ID | Address | Volume out | Attribution | Risk |
|---|---|---|---|---|
| B1 | 33YHzTHafvBQNzkiPkixGDDLVHof9b644m | ₿6,600.9997 | Unattributed | MEDIUM |
| B2 | 3K5wjhE27ww1nrcdhAb8ct3eehmAesiYx5 | ₿4,500.0000 | Unattributed | MEDIUM |
| B3 | 1KBzcn6CAY2oDsQEZcUrhHDQv3vDqeRUTR | ₿3,500.0010 | Unattributed | MEDIUM |
| B4 | 366k4bqibNrbUyby4xtkDT1demdcHS8fVA | ₿1,994.1844 | Unattributed | LOW |
The wallet received ₿52,038 across 114 inbound events over 8.38 years, with two transactions (January 2018 and October 2019) accounting for 59% of total lifetime inflows. The largest single source — a legacy address active since February 2013 — transferred ₿17,523 in what appears to be a cold-wallet migration event. Three native SegWit addresses each contributed exactly ₿235 in late 2021, consistent with coordinated batch processing. Seven outbound disbursements distributed ₿16,595 to four unattributed recipients in structured round-figure amounts consistent with institutional treasury operations. The remaining balance of ₿6,320 (~$465M) sits across 100 UTXOs with the most recent movement recorded on 2026-05-23.
Account Structure · Protocol Interactions · Threat Exposure
| Key Control | Single-key P2PKH — no multisig or script-based custody configuration |
| Address Rotation | None — single address in continuous operation since 2018-01-07 (8.38 years) |
| UTXO Holdings | 100 unspent outputs — gradual accumulation over 8+ years without consolidation |
| Inscription Tokens | 36 Ordinals tokens received — externally minted, no active operator participation |
| Attribution Status | Unconfirmed — Arkham: 'Bitstamp?' · BTC Whale · no corroborating label found |
| Enforcement Status | Not blacklisted — BTC freely transferable as of 2026-05-23 |
| Category | Status |
|---|---|
| Lightning Network | NONE none — no channel opens or closes detected |
| Ordinals / Inscriptions | LIMITED 36 tokens received · externally initiated · no operator inscription activity |
| Cross-Chain Bridge | NONE |
| CoinJoin / Mixing | NONE none — all transactions are direct P2PKH transfers |
| DeFi / Smart Contracts | N/A N/A — Bitcoin mainnet has no smart contract layer for this address type |
| Date | Category | Source | Nominal | Outcome |
|---|---|---|---|---|
| 2018–2026 | Micro-dust address sweep campaign | 90+ distinct unattributed addresses | Continuous 5–10 satoshi deposits from 2018 through 2026 — consistent with third-party address monitoring or dust-attack campaigns targeting high-value wallets | NOT ENGAGED |
| 2023–2026 | Ordinals inscription targeting | Multiple external inscription senders | 22 inscription transactions placing Ordinals tokens on this address without operator action — a common technique targeting prominent Bitcoin addresses | NOT ENGAGED |
This wallet demonstrates a textbook cold-storage accumulation pattern: 114 inbound events against 7 outbound disbursements over 8.38 years. No active trading, yield-seeking, or protocol interaction has been detected. The wallet receives BTC from unattributed sources in structured tranches and disburses to four unattributed destinations in round-figure amounts. This operational model is consistent with an institutional cold wallet receiving aggregated deposits from hot-wallet systems and periodically disbursing to other cold storage addresses or exchange settlement destinations.
The 100-UTXO count reflects 8+ years of accumulated unspent inputs without periodic consolidation. This fragmentation is typical of a wallet receiving from many counterparties, consistent with exchange cold wallet operation where consolidation is minimised to reduce on-chain operational footprint. No same-day round-trip flows, no structuring patterns, and no rapid cycling have been identified.
| CRITERION | FINDING | ASSESSMENT | |
| 1. Sanctions list exposure (OFAC, EU, UN) | CLEAR | ||
| 2. Scam / fraud report exposure | CLEAR | ||
| 3. Ransomware / darknet association | CLEAR | ||
| 4. Mixer / CoinJoin / tumbler exposure | CLEAR | ||
| 5. Exchange / custodian source verification | UNVERIFIED — NO CONFIRMED LABELS | ||
| 6. Counterparty attribution depth | MONITOR — COMPLETE OPACITY | ||
| 7. Third-party risk score | UNVERIFIED — BITSTAMP HYPOTHESIS ONLY | ||
| 8. Address poisoning / targeted attacks | CLEAR |
AML rating is CLEAR. No sanctions designation, no fraud or scam reports, no mixer exposure, and no third-party risk flags have been identified against this address or any counterparty. The controlling entity is unconfirmed — Arkham's "Bitstamp?" hypothesis is an unverified attribution — and 100% of the 213 counterparties are unattributed across all available intelligence sources.
This represents a significant investigation gap: the absence of confirmed adverse indicators does not constitute a clearance; it reflects incomplete attribution rather than a positive finding of legitimacy. If the Bitstamp attribution is confirmed, the risk profile reduces substantially, as Bitstamp is an FCA/CSSF-authorised regulated exchange with established AML/KYC frameworks. Under the unknown-entity scenario, the wallet's ₿6,320 balance and $7.2B lifetime volume warrant enhanced due diligence focused on entity resolution before any transactional relationship is established.
This wallet scores CLEAR on AML risk criteria. No adverse indicators — sanctions, darknet associations, mixer exposure, or fraud reports — have been identified. The sole remaining risk vector is attribution opacity: the beneficial owner of ₿6,320 (~$465M) is unconfirmed, and the source of 64.2% of lifetime inflows (₿33,428) cannot be traced beyond hop-1. Arkham's tentative "Bitstamp?" attribution is consistent with the operational profile but has not been independently verified. The appropriate compliance treatment is enhanced due diligence focused on entity confirmation, with particular attention to the primary inflow source (...LivWHJg, 33.7% of volume, 2013-era legacy address). The wallet passes a contamination-based AML check; it does not yet pass a complete source-of-funds check.
Flagged Patterns & Significant Observations
| ID | Date | Event | Severity | Significance |
| A-01 | 2018-01-07 | Dominant single-source inflow. ₿17,523.23 (33.7% of lifetime inflows) received in a single transfer from a Legacy P2PKH address first seen on-chain in February 2013 — more than five years before this transfer. Single-event concentration at this scale is consistent with a cold-wallet migration from early institutional infrastructure. | NOTABLE | High counterparty concentration in one unattributed source; primary attribution candidate for exchange legacy cold-wallet migration |
| A-02 | 2021 | Coordinated identical-amount batch inflow. Three distinct native SegWit (bc1q) addresses each contributed exactly ₿235.00 in a short temporal window. Identical amounts across separate counterparties indicate a common originating entity executing batch-processed institutional disbursements. | NOTABLE | Coordination signature across three independent addresses; supports institutional treasury or exchange batch-processing hypothesis |
| A-03 | 2018–2026 | Persistent dust sweep address monitoring. Over 90 unattributed addresses deposited 5–10 satoshi in a continuous stream spanning the full operational lifetime of the wallet. Consistent with automated UTXO tracking campaigns targeting high-value Bitcoin addresses. | NOT ENGAGED | Wallet operator has not responded to or interacted with any dust-sending address; no coercion, phishing, or compromise response detected |
| A-04 | 2023–2026 | Ordinals inscription targeting. 22 inscription transactions placed 36 Ordinals tokens at this address without any operator action. Externally initiated inscriptions are a common technique targeting prominent, high-balance Bitcoin addresses for visibility or market positioning. | NOT ENGAGED | All 36 tokens externally minted; no operator NFT market participation, no inscription contract calls, no engagement with Ordinals platforms |
| A-05 | 2018–2026 | Multi-generation inbound address diversity. Inbound counterparties span all three major Bitcoin address generations: Legacy P2PKH (1xxx), Nested SegWit (3xxx), and Native SegWit (bc1q). This cross-format spread across an 8-year window reflects a receiving address accepting deposits from an evolving user or client base across the full arc of Bitcoin address format adoption. | NOTABLE | Address format diversity across counterparties is consistent with an exchange cold wallet receiving customer deposits over multiple protocol eras |
Hypothesis Assessment
Probabilities sum to 100%. Attribution confidence: MEDIUM-HIGH. H1 (Exchange Cold Wallet) is the leading hypothesis at 65%, supported by Arkham's unconfirmed Bitstamp attribution, the 114:7 inbound-to-outbound ratio, 100-UTXO holding profile, and a 2013-era primary inflow source consistent with early institutional cold storage infrastructure. H2 (Institutional Custodian or OTC Desk) at 25% remains viable and is not mutually exclusive with H1 — an OTC desk or custodian could operate with an identical profile. H3 (High-Net-Worth Individual) accounts for the remaining 10%; wallet scale and multi-counterparty structure are atypical for individual self-custody. Attribution confidence is MEDIUM-HIGH on operational classification as institutional cold storage; it is LOW on specific entity identity pending independent corroboration of the Bitstamp attribution..
The investigation reaches MEDIUM-HIGH confidence that this wallet is operated by an institutional entity — most likely a regulated exchange or custodian — on the basis of the operational profile, Arkham's unconfirmed Bitstamp attribution, and the 2013-era primary counterparty consistent with early exchange cold-storage infrastructure. Specific entity identity remains unconfirmed. Counterparties or institutions considering transactional relationships with this wallet should treat it as a probable institutional cold wallet with a positive regulatory background (if Bitstamp confirmed), while obtaining independent entity verification before proceeding with significant transactions. The absence of any adverse indicator across all checked sources is a meaningful positive signal; the absence of a confirmed entity identity is a meaningful remaining gap.
Government Records · Press Coverage · Research & Analytics · Blockchain Intelligence
Priority Actions & Engagement Opportunities
| P1 | Entity Resolution — Confirm or Deny Bitstamp Attribution — Arkham's 'Bitstamp?' label is the only available attribution signal. Verification path: paid-tier Arkham graph query, Chainalysis Reactor entity lookup, or TRM Labs cluster analysis. Without confirmed identity, the source-of-funds picture for the controlling entity of ₿6,320 is entirely unresolved. · Intelligence |
| P2 | Trace Primary Inflow Source ...LivWHJg — 2013-era legacy address (19vWUsLH7G6yQH484r3n1GodLEoLivWHJg) sent ₿17,523.23 on 2018-01-07 — 33.7% of lifetime inflows; 55 on-chain transactions. Verification path: hop-2 cluster analysis via Chainalysis or Crystal Intelligence; check whether this address belongs to a known exchange cluster. · On-chain |
| P3 | Characterise Four Outflow Destinations — None of ...Hof9b644m (₿6,601), ...AesiYx5 (₿4,500), ...DqeRUTR (₿3,500), or ...cHS8fVA (₿1,994) carry any entity label. Hop-2 analysis on each destination; check for eventual exchange deposits. If any destination confirmed as exchange-controlled, the operational profile solidifies further. · On-chain |
| P4 | Ongoing Monitoring — Wallet last transacted 2026-05-23 and remains active. Verification path: mempool.space alert or Arkham notification setup for next movement event. · On-chain |
Open questions and verification paths: Entity resolution is the critical outstanding item — Arkham's 'Bitstamp?' label is unverified and all counterparties remain unattributed. The wallet's $465M+ balance and $7.2B lifetime volume warrant active monitoring pending entity confirmation. No adverse indicators reduce urgency, but no confirmed clearance has been achieved.
| REF | SOURCE |
|---|---|
| S-01 | Blockchain.com — Bitcoin Address Explorer https://www.blockchain.com/explorer/addresses/btc/1Cr7EjvS8C… Primary quantitative data source. Balance ₿6,320.61387528. Total received ₿52,038.64490328. Total sent ₿45,718.08102800. 115 transactions. Total volume $7,201,573,541. Captured 2026-05-29. |
| S-02 | OKLink — BTC Address Detail & Counterparty Profiles https://www.oklink.com/btc/address/1Cr7EjvS8C7gfarREHCvFhd9g… Balance ₿6,320.61387528 ($465.75M). 115 transactions. 100 UTXOs. 36 inscription tokens ($731). First received 01/07/2018. No entity label assigned. Counterparty sub-profiles captured for all 9 hop-1 addresses. No labels found on any counterparty. Captured 2026-05-29. |
| S-03 | Arkham Intelligence — Entity & Portfolio Profile https://intel.arkm.com/explorer/address/1Cr7EjvS8C7gfarREHCv… Label: 'Bitstamp?' (unconfirmed). BTC Whale marker. Portfolio value at capture: $465,974,616.73. Holdings: 6.321K BTC at $73,723. Balance history: accumulation from 2018, peak ~$1.2B in 2021 bull market, current ~$466M. Captured 2026-05-29. |
| S-04 | Mempool.space — Bitcoin Mempool Explorer https://mempool.space/address/1Cr7EjvS8C7gfarREHCvFhd9gT3r46… No pending transactions at time of capture. Last confirmed transaction: 2026-05-23 00:12:48 UTC. Address active and unblacklisted. Captured 2026-05-29. |
| S-05 | WalletExplorer — Cluster Attribution https://www.walletexplorer.com/address/1Cr7EjvS8C7gfarREHCvF… No cluster label returned. Address not assigned to any known exchange or entity wallet cluster. All 9 queried hop-1 counterparty addresses also returned no label. Captured 2026-05-29. |
| S-06 | Bitstamp Ltd — Regulatory Status & Public Record https://www.bitstamp.net Bitstamp incorporated in Luxembourg; regulated under CSSF VASP licence and EU MiCA framework. FCA-registered in the UK. FinCEN MSB-licensed in the US. Operating continuously since 2011. Attribution hypothesis source: Arkham Intelligence (unconfirmed). No direct confirmation from exchange. |
| S-07 | OFAC Sanctions Database — SDN List Check https://sanctionssearch.ofac.treas.gov No match for wallet address 1Cr7EjvS8C7gfarREHCvFhd9gT3r46pfLb or any identified counterparty. BTC freely transferable as of 2026-05-23. Checked 2026-05-29. |
| S-08 | Blockchain.com — Counterparty Address Profiles (Hop-1) https://www.blockchain.com/explorer/addresses/btc/ Sub-profiles captured for 9 primary inflow counterparties. No entity labels on any counterparty. Primary source (19vWUsLH7G6yQH484r3n1GodLEoLivWHJg) first active February 2013. Three bc1q addresses each contributed exactly ₿235.00 in 2021. Captured 2026-05-29. |
| TERM | DEFINITION |
|---|---|
| AML | Anti-Money Laundering — the regulatory and procedural framework designed to detect, prevent, and report financial crime including proceeds of illicit activity. |
| UTXO | Unspent Transaction Output — the fundamental unit of Bitcoin balance. Each UTXO must be fully consumed when spent; any remainder is returned as a new UTXO (change output). This wallet holds 100 UTXOs. |
| P2PKH | Pay-to-Public-Key-Hash — the original Bitcoin address format, producing addresses beginning with '1'. Derived by hashing a public key. The address type used by this wallet. |
| P2SH | Pay-to-Script-Hash — a Bitcoin address format producing addresses beginning with '3'. Enables multisig and other script conditions. Used by several counterparties observed in this case. |
| SegWit | Segregated Witness — a 2017 Bitcoin protocol upgrade that moved signature data outside the transaction body, reducing transaction size and fees. Produces addresses beginning with 'bc1q' (native SegWit / P2WPKH). |
| Taproot | A 2021 Bitcoin protocol upgrade enabling more complex spending conditions with improved privacy. Produces addresses beginning with 'bc1p'. Not used by this wallet. |
| Cold Wallet | A cryptocurrency wallet held offline or in long-term storage, disconnected from active trading systems. Characterised by infrequent outbound transactions and large accumulated balances. |
| Hot Wallet | An exchange or custodian's online operational wallet used for daily deposit and withdrawal processing. Transfers from hot wallet to cold wallet are a routine treasury management function. |
| Counterparty | Any address that has sent BTC to or received BTC from the target wallet directly (hop-1). This wallet has 213 distinct counterparties. |
| Hop-1 / Hop-2 | Hop-1 refers to addresses that transacted directly with the target. Hop-2 refers to addresses that transacted with those hop-1 addresses. Investigative depth diminishes at each hop. |
| Dust / Dust Attack | Micro-amounts of BTC (5–10 satoshis) sent to addresses by third parties to monitor UTXO movements and link wallet activity. Below economical spending thresholds. This wallet has received dust continuously since 2018. |
| TERM | DEFINITION |
|---|---|
| Ordinals / Inscriptions | A Bitcoin protocol (launched 2023) allowing arbitrary data to be inscribed onto individual satoshis using the witness field. Can be sent to any address without the recipient's consent. This wallet received 36 externally initiated Ordinals tokens. |
| OFAC | Office of Foreign Assets Control — the US Treasury agency administering economic sanctions. Maintains the Specially Designated Nationals (SDN) list. No SDN match for this wallet or its counterparties. |
| CSSF | Commission de Surveillance du Secteur Financier — Luxembourg's financial sector regulator. Bitstamp holds a Luxembourg VASP licence under CSSF oversight. |
| FCA | Financial Conduct Authority — the UK's financial services regulator. Relevant if Bitstamp attribution is confirmed; Bitstamp holds FCA registration for UK operations. |
| MiCA | Markets in Crypto-Assets Regulation — the EU regulatory framework for crypto asset service providers, effective 2024. Bitstamp operates under MiCA as a licenced CASP. |
| VASP | Virtual Asset Service Provider — the regulatory classification for entities providing crypto exchange, custody, or transfer services. Subject to AML and KYC obligations under FATF standards. |
| Attribution | The process of linking a blockchain address to a real-world entity (exchange, individual, organisation). The Bitstamp hypothesis is an unconfirmed attribution — the wallet is classified as unattributed for this report's purposes. |
| CoinJoin | A Bitcoin transaction protocol where multiple users combine inputs and outputs into a single transaction to obscure fund flows. No CoinJoin transactions are present in this wallet's history. |
| UTXO Consolidation | The practice of combining multiple small UTXOs into fewer larger ones to reduce future transaction size and fees. This wallet has not consolidated its 100 UTXOs — a deliberate or operationally accepted fragmentation. |
| Wallet Cluster | A group of Bitcoin addresses controlled by the same entity, identified through common-input-ownership heuristics or service attribution. No cluster label was returned for this wallet by WalletExplorer. |
| Heuristic (CIOH) | Common Input Ownership Heuristic — the analytical assumption that all inputs in a single Bitcoin transaction are controlled by the same entity. Used to cluster wallet addresses. Not applicable here as no multi-input spending pattern was identified. |