KALLISTI BLOCKCHAIN FORENSICS
Bitcoin Legacy Address
BTC (native Bitcoin)
---
Target Wallet Address
1gtmmzwhqUzhb8XoShHwgyrzbJwdZ47ok
Report Date: 2026-05-28 · Prepared by Kallisti Blockchain Forensics
Wallet Identity · Financial Overview · Holdings · Activity Patterns · Account Structure
| Address | 1gtmmzwhqUzhb8XoShHwgyrzbJwdZ47ok |
| Blockchain | Bitcoin mainnet — native BTC (P2PKH) |
| Address Type | P2PKH legacy (1xxx) — single-key control, no multisig observed |
| Sanctions Status | None identified — no OFAC, EU, or UN listing as of 2026-05-27 |
| Entity Attribution | Unattributed — no public record, no analytics-platform label identified |
| Activity Window | 2017-09-22 → 2026-01-15 — 3,037 days (8.32 years) |
| BTC Received (lifetime) | ₿11,072.4155 (~$1.037B at current rates) across 67 inbound events |
| BTC Sent (lifetime) | ₿8,743.9705 (~$818.7M) across 20 outbound events (79.0% of inflow) |
| Net Balance (on-chain computed) | ₿2,328.4450 (~$218M) |
| Distinct Counterparties | 164 (all unattributed) |
| Total Transactions | 87 (67 BTC in · 20 BTC out) |
Cold-storage accumulator with long-term hold and controlled partial exit. Receives BTC from few large sources, holds for years, then periodically disburses in round-number tranches. Classic institutional cold-storage pattern.
The genesis deposit (₿4,884.49) dwarfs all subsequent transactions. Post-2018 inflows are smaller (₿100–600 BTC range). Outflows post-2024 are disciplined round numbers: ₿251, ₿300, ₿499.99, ₿525, ₿613 BTC. Average post-dormancy outflow: ₿437.8 BTC (~$40.9M). Consistent with large-block OTC settlement or fund distribution rather than retail activity.
Receive-heavy by count (67 in vs. 20 out), but outflow-dominant by recent volume. The 2024–2026 phase is exclusively outbound. No indication of active management during 2019–2023. Pattern is consistent with a long-term store-of-value position undergoing partial liquidation or migration.
Recovered from 67 confirmed transactions. Tuesday is the dominant day (25/67 = 37%), with Sunday accounting for only 2 transactions (3%) — an 18:1 weekday/weekend ratio that is atypical for automated systems. Hour 10 UTC is the single most active hour (16/67 = 24%), pointing to a European morning operator window (11:00 CET / 12:00 EET). The 2024 outflows cluster in April and November–December, consistent with periodic rebalancing or fund distribution events rather than continuous programmatic settlement.
Manual. 87 transactions across 3,037 days — roughly one event per 35 days average, with multi-year gaps. No scripted pattern is consistent with this profile. All indications point to infrequent, deliberate, manually-initiated transfers.
| S1 | blockchain.com Explorer — BTC address history · www.blockchain.com/explorer/addresses/btc/1gtmmzwhqUzhb8XoSh… |
| S2 | WalletExplorer — cluster attribution · www.walletexplorer.com/address/1gtmmzwhqUzhb8XoShHwgyrzbJwdZ… |
| S3 | OKLink — BTC address profile · www.oklink.com/btc/address/1gtmmzwhqUzhb8XoShHwgyrzbJwdZ47ok |
Counterparty Map · Inflow Architecture · Outflow Architecture
Upstream · Top 5 Funders
| ID | Address | Volume in | Pass 2 attribution | Risk |
|---|---|---|---|---|
| A1 | 15YZJMzxcZXFrfyDhAn7Ku3AKS6UJoc6vj | $457.3M | Unattributed — genesis source; 23 tx total; likely operator's prior cold-storage address or OTC counterparty (₿4,884.49) | HIGH |
| A2 | 1FQdUTJySTawZE2SozDxYB9yUCkqKVYDox | $56.2M | Unattributed — secondary funder (₿599.997) | HIGH |
| A3 | 1CfJvwkrUiPyD4ayg8hQ8qsiwPxSjVYULT | $37.4M | Unattributed (₿399.998) | HIGH |
| A4 | 1MgneqPtpNT6rs562veDDUag7KBFyShYaF | $37.4M | Unattributed (₿399.998) | HIGH |
| A5 | 1H56xooL6N5Vix16A2PepowfgdPaLbXiZT | $21.8M | Unattributed (₿233.332) | HIGH |
Downstream · Top 5 Destinations
| ID | Address | Volume out | Pass 2 attribution | Risk |
|---|---|---|---|---|
| B1 | 1H2TBw61grssQ65CxGNnRKeudPJZ6qtcAV | $457.3M | Unattributed — 2018 internal sweep; likely operator's own secondary cold-storage address (₿4,884.48) | MEDIUM |
| B2 | 1F2DkuJZK1xTpnMf5WKjVoNWGixVwiae9E | $57.4M | Unattributed — 2026 outflow recipient; also received BTC in 2019 (₿613.00) | MEDIUM |
| B3 | 1CbKkD24V21RwYutJCu2ZnUXfQCZiCUkvW | $49.2M | Unattributed — 2024 outflow recipient; single tranche (₿525.00) | MEDIUM |
| B4 | 1Fh3uu6UjtWWrPMEph2kMK1FQ6zor3ovQZ | $46.8M | Unattributed — 2024 outflow recipient; single tranche (₿499.99) | MEDIUM |
| B5 | 1Eyg5NRf5dTPeFGZ5CPJ5o6v1a3dYpeZsi | $28.1M | Unattributed — 2024 outflow recipient; single tranche (₿300.00) | LOW |
| S1 | blockchain.com Explorer — counterparty transaction records · www.blockchain.com/explorer/addresses/btc/1gtmmzwhqUzhb8XoSh… |
| S2 | WalletExplorer API — Hop 1 cluster attribution · www.walletexplorer.com/api/1/address-lookup |
Account Structure · Protocol Interactions · Threat Exposure
| Key Control | Single-key P2PKH custody — no multisig configuration observed |
| Address Rotation | None — single legacy P2PKH address in use since 2017-09-22 |
| Fee Management | Standard miner fees per transaction — no fee optimisation or batching observed |
| Privacy Protocols | None — no CoinJoin, no Wasabi, no Taproot migration |
| Dust / Poison | No dust attacks or address poisoning engagement observed |
| Enforcement Status | Not sanctioned — BTC freely transferable as of 2026-05-27 |
| Category | Status |
|---|---|
| CoinJoin / Mixing | NONE |
| Lightning Network | NONE |
| Cross-Chain Bridge | NONE |
| DeFi / Wrapped BTC | NONE |
| Ordinals / BRC-20 | NONE |
| Taproot / SegWit upgrade | NONE — LEGACY P2PKH ONLY |
| 3rd-Party Custodian | UNCONFIRMED |
| Date | Category | Source | Nominal | Outcome |
|---|---|---|---|---|
| 2024–2026 | Dormancy Reactivation | Six-year dormancy followed by systematic outflows | 5 withdrawal events 2024–2026 | MONITOR |
| Ongoing | Key Age / Concentration Risk | P2PKH keys from 2017 on legacy address holding ~$218M | ₿2,328.44 residual balance | MONITOR |
Not applicable — single-asset address (native BTC only). No token inventory present.
| S1 | blockchain.com Explorer — transaction type analysis · www.blockchain.com/explorer/addresses/btc/1gtmmzwhqUzhb8XoSh… |
| S2 | blockchain.com Explorer — address and UTXO data · www.blockchain.com/explorer/addresses/btc/1gtmmzwhqUzhb8XoSh… |
| CRITERION | FINDING | ASSESSMENT | |
| 1. Sanctions list exposure (OFAC, EU, UN) | CLEAR | ||
| 2. Scam / fraud report exposure | UNVERIFIED — NO REPORTS | ||
| 3. Ransomware / darknet association | CLEAR | ||
| 4. Mixer / CoinJoin / tumbler exposure | CLEAR | ||
| 5. Exchange / custodian source verification | UNRESOLVED — 0% ATTRIBUTED | ||
| 6. Dormancy reactivation / behavioural anomaly | LOW — MONITOR | ||
| 7. Third-party risk score | CLEAR | ||
| 8. Address poisoning / targeted attacks | CLEAR |
This wallet scores CLEAR on the contamination-based AML scale — no confirmed adverse source has been identified. That said, 100% of material inflow originates from unattributed addresses at ~$1.037B lifetime throughput. Under standard AML/CFT frameworks, institutions should treat any counterparty exposure as requiring enhanced due diligence focused on entity resolution for 15YZJMzxcZXFrfyDhAn7Ku3AKS6UJoc6vj and the 2024–2026 outflow recipients. The wallet passes a contamination check; it has not passed a source-of-funds check.
| S1 | blockchain.com Explorer — full dataset · www.blockchain.com/explorer/addresses/btc/1gtmmzwhqUzhb8XoSh… |
| S2 | WalletExplorer — risk check · www.walletexplorer.com/address/1gtmmzwhqUzhb8XoShHwgyrzbJwdZ… |
| S3 | OKLink — BTC address risk check · www.oklink.com/btc/address/1gtmmzwhqUzhb8XoShHwgyrzbJwdZ47ok |
Flagged Patterns & Significant Observations
| ID | Date | Event | Severity | Significance |
| A1 | 2017-09-22 | Genesis Deposit — Single Source, Institutional Scale. ₿4,884.49 received in a single transaction from an unattributed address on wallet creation day. This represents 44.1% of all lifetime inflows and is among the largest single-event seedings of the 2017 era. The source address (15YZJMzxcZXFrfyDhAn7Ku3AKS6UJoc6vj) has 23 total transactions — consistent with a personal or institutional cold-store predecessor rather than a high-frequency intermediary. | MEDIUM | Single-source genesis at institutional scale — source address unattributed |
| A2 | 2018-02-05 | Full-Balance Internal Sweep. ₿4,884.48 (near-total balance at time) moved to 1H2TBw61grssQ65CxGNnRKeudPJZ6qtcAV in a single transaction the day after re-seeding. Classic key rotation or cold-storage rebalance pattern. 1H2TBw61 has no public attribution but low tx count — consistent with another personal cold-storage address under same-operator control. | LOW | Internal balance sweep consistent with key rotation — likely same-operator |
| A3 | 2018–2023 | Six-Year Dormancy Window. After February 2018 re-seeding activity, the address shows no material outbound transactions for approximately six years. This is the wallet's most distinctive behavioural feature and strongly argues against active criminal use during that period. Dormancy of this length is consistent with disciplined cold-storage custody. | LOW | Six-year dormancy — professional cold-storage discipline; reduces criminal-use probability |
| A4 | 2024–2026 | Systematic Round-Tranche Partial Exit. Five outbound events from April 2024 to January 2026 in round-number increments: ₿525, ₿251, ₿499.99, ₿300, ₿613 BTC. Each goes to a distinct unattributed address. Average tranche: ₿437.8 (~$40.9M). Sizing and spacing consistent with OTC block-trade settlement or controlled fund distribution. No structuring pattern (below-threshold splitting) detected. | MEDIUM | Systematic round-tranche outflows post-dormancy — OTC or managed distribution pattern |
| S1 | blockchain.com Explorer — full transfer and transaction history · www.blockchain.com/explorer/addresses/btc/1gtmmzwhqUzhb8XoSh… |
Hypothesis Assessment
The genesis deposit structure (single large seed, 2017 vintage, unattributed source address with low tx count), the six-year dormancy, and the round-tranche 2024 outflows are all hallmarks of disciplined cold-storage custody. This is the null hypothesis in the absence of confirmed red flags and has the strongest evidentiary support from the on-chain record. The operator demonstrates professional discipline across 8+ years with no mistakes.
The 2024–2026 outflows, all in round-number tranches to distinct new addresses, are consistent with a deliberate migration from the legacy P2PKH address to modern P2WPKH or Taproot addresses, possibly combined with OTC liquidation. This hypothesis is not mutually exclusive with H1 — the exit phase may represent simultaneous liquidation and address-standard migration by the same institutional actor.
The wallet received BTC from multiple upstream addresses in structured tranches before performing large single outflows. Could indicate a custodial aggregation address receiving funds on behalf of clients. However, the six-year dormancy period makes active custodial use implausible for that window, and the transaction count (87 over 8+ years) is far too low for an active custodian.
Probabilities sum to 100%. Attribution confidence: LOW-MEDIUM overall. H1 (institutional cold storage) has the strongest on-chain evidentiary support — the dormancy and round-tranche exits are characteristic. H2 (key migration) is not mutually exclusive and may be simultaneously true. H3 (custodial relay) is retained as a low-confidence alternative given the dormancy pattern effectively rules out active custodial use for the 2018–2023 period. Attribution confidence is LOW — no public source has identified this wallet or its primary counterparties..
For compliance and counterparty teams: the attribution picture is open, not resolved. This wallet has not been flagged by any known authority, but it also has no verified clean provenance. Any institution counterparty-screening this address should treat it as unresolved-enhanced-due-diligence. The appropriate standard is: do not proceed with material exposure until the genesis source (15YZJMzx) has been identified and the 2024–2026 exit recipients have been screened. The absence of a negative flag is not a positive clearance at this volume.
| S1 | blockchain.com Explorer — counterparty behavioural data · www.blockchain.com/explorer/addresses/btc/1gtmmzwhqUzhb8XoSh… |
Government Records · Press Coverage · Research & Analytics · Blockchain Intelligence
Priority Actions & Engagement Opportunities
Open questions and verification paths:
| P1 — OPEN (CRITICAL) | Entity resolution on the genesis funder: 15YZJMzxcZXFrfyDhAn7Ku3AKS6UJoc6vj (₿4,884.49, 44.1% of all inflows). This is the single most material unknown — identifying the genesis source would fundamentally change the attribution model. Verification path: paid-tier Chainalysis Reactor, Elliptic Navigator, TRM Labs, or Crystal Intelligence graph queries tracing 15YZJMzx's own history. Materiality: CRITICAL. |
| P2 — OPEN | Verification that 1H2TBw61grssQ65CxGNnRKeudPJZ6qtcAV (the 2018 internal sweep destination, ₿4,884.48) is same-operator controlled. If confirmed as internal, this simplifies the attribution model. If confirmed as third-party, it represents an additional large counterparty requiring investigation. Verification path: on-chain graph analysis of 1H2TBw61's subsequent transaction history. Materiality: MEDIUM. |
| P3 — OPEN | Identity of 2024–2026 outflow recipients: 1CbKkD24 (₿525), 1Eyg5NRf (₿300), 1KdoAdDc (₿251), 1Fh3uu6U (₿499.99), 1F2DkuJZ (₿613). These five addresses collectively received ₿2,188.99 at current values of ~$204.9M. Verification path: paid-tier analytics on each recipient; check for exchange deposit patterns. Materiality: HIGH. |
| P4 — OPEN | Ongoing monitoring: last activity 2026-01-15. ₿2,328.44 residual suggests further outflows are likely. Any new outflow to an identifiable address would materially inform the attribution model. Verification path: blockchain monitoring alert on address. Materiality: MEDIUM (ongoing). |
| S1 | WalletExplorer API — Hop 1 counterparty cluster data · www.walletexplorer.com/api/1/address-lookup |
| REF | SOURCE |
|---|---|
| S1 | On-chain dataset -- BTC Transactions https://www.blockchain.com/explorer/addresses/btc/1gtmmzwhqU… Full BTC transaction history via blockchain.com API. Retrieved 2026-05-28. |
| S2 | WalletExplorer cluster attribution https://www.walletexplorer.com/address/1gtmmzwhqUzhb8XoShHwg… Cluster label from WalletExplorer API. Retrieved 2026-05-28. |
| S3 | Oklink -- Address Profile https://www.oklink.com/btc/address/1gtmmzwhqUzhb8XoShHwgyrzb… Screenshot captured 2026-05-28. File: screenshot_oklink.png |
| S4 | Mempool -- Address Profile https://mempool.space/address/1gtmmzwhqUzhb8XoShHwgyrzbJwdZ4… Screenshot captured 2026-05-28. File: screenshot_mempool.png |
| TERM | DEFINITION |
|---|---|
| AML | Anti-Money Laundering — regulatory and procedural framework designed to detect, prevent, and report financial crime. |
| Counterparty | Any address that has sent BTC to or received BTC from the target wallet. |
| Cold Storage | A method of holding cryptocurrency in an offline or minimally-connected wallet to reduce exposure to hacking or theft. |
| Enhanced Due Diligence (EDD) | A more rigorous level of customer/counterparty review applied when standard checks reveal elevated risk factors. |
| Hop 1 | Direct counterparties of the target wallet — addresses with a single transaction step between them and the subject. |
| OFAC | Office of Foreign Assets Control — U.S. Treasury agency that administers and enforces economic and trade sanctions. |
| OTC | Over-the-Counter — direct, bilaterally negotiated cryptocurrency trades conducted outside public exchange order books. |
| P-item | Pending investigative item — an open question identified during analysis that requires further verification to resolve. |
| TERM | DEFINITION |
|---|---|
| P2PKH | Pay-to-Public-Key-Hash — the original Bitcoin address format (1xxx), used since 2009. Addresses from 2017 are typically P2PKH. |
| P2WPKH | Pay-to-Witness-Public-Key-Hash — SegWit native address format (bc1q...), offering lower fees than P2PKH. |
| SAR | Suspicious Activity Report — a filing made by financial institutions to regulators when suspicious transactions are identified. |
| SDN | Specially Designated Nationals — OFAC's list of individuals and entities whose assets are blocked under U.S. sanctions law. |
| Taproot | Bitcoin's most recent address upgrade (P2TR, bc1p...), improving privacy and smart-contract capabilities. Activated November 2021. |
| Unattributed | An address with no confirmed public identity — no exchange label, no analytics-platform attribution, no regulatory naming. |
| UTXO | Unspent Transaction Output — the Bitcoin accounting model; each UTXO is a discrete chunk of BTC that must be spent in full. |
| WalletExplorer | A Bitcoin blockchain analytics service that clusters addresses into wallets based on heuristic co-spend analysis. |