KALLISTI BLOCKCHAIN FORENSICS
BTC (native Bitcoin)
---
Target Wallet Address
36X44rmLtk218sXACZ3gFpNMFENi6dQ2n3
Report Date: 2026-06-15 · Prepared by Kallisti Blockchain Forensics
Wallet Identity · Financial Overview · Holdings · Activity Patterns · Account Structure
| Entity | 36X44rmLtk218sXACZ3gFpNMFENi6dQ2n3 |
| Blockchain | Bitcoin mainnet · P2SH (3xxx) |
| Account Age | 77 days (0.21 years) ‖ Active: 2026-03-30 15:24:27 UTC → 2026-06-15 09:50:11 UTC |
| Balance | ₿13,556.2054 |
| Total Received | ₿20,968.7619 |
| Total Sent | ₿7,412.5564 |
| Transactions | 72 on-chain (70 in · 2 out) · 139 counterparties |
Ultra-high-value treasury accumulator — Bitcoin's 58th-largest address by balance as of 2026-06-15. The wallet absorbed ₿20,968.76 across 70 inbound events over 77 days, retaining ₿13,556.21 (64.6% net). Two outbound sweeps (₿7,412.56 total) executed within 24 hours of activation; no further outflows across 11.5 subsequent weeks. The settle-then-hold pattern — combined with institutional-scale round-number inflows, full counterparty opacity, and $200M+ media coverage — is consistent with an OTC settlement vault activated for a single large block trade before transitioning to passive cold storage.
Inbound events cluster in two tiers: (1) a single high-mass settlement day (2026-03-31) with 18 events in predominantly large round figures — ₿5,000, ₿3,000, ₿2,400, ₿2,000 ×2, ₿1,823, ₿172, ₿150, ₿99; (2) sustained accretion from 2026-04-01 at ₿3.56–₿110.71 per event (median ~₿14). Outbound comprised two P2SH sweeps — ₿7,401.00 (99.85% of a round-figure net transfer) and ₿11.56 — both on 2026-03-31. The dual-tier structure separates an OTC settlement layer from an ongoing accumulation layer conducted through the same address.
P2SH address (3xxx prefix), compatible with multisig or SegWit-wrapped scripts. 139 distinct counterparties across 72 transactions — high diversity for the volume, suggesting multiple OTC counterparties or relay wallets feeding the position. All nine resolved addresses are unattributed across Blockchain.com, Mempool.space, OKLink, WalletExplorer, and Arkham. Two primary destinations (3AZPFNzU..., 74.2%; 3BJqXAoQ..., 25.6%) have minimal on-chain histories (3 and 2 txs respectively), consistent with cold storage or single-use receive addresses. Five-hop upstream tracing from the primary funder yields no attribution breakpoint; chain opacity is maintained throughout.
Tuesday dominates at 45.8% (33/72 events); Monday 15.3%, Wednesday 16.7%, Thursday 13.9%, Friday 8.3%; zero weekend activity. UTC peaks: 08:00 (20 events, 27.8%), 07:00 (10, 13.9%), 16:00 (10, 13.9%). Active window UTC 06–16; dead zone UTC 17–05. UTC 08:00 → 10:00 UTC+2 (Eastern Europe/Israel), 11:00 UTC+3 (Moscow/Gulf). Dead zone eliminates Americas; UTC 17 end-of-window = close of business UTC+2 to UTC+5. Secondary peak UTC 15–16 = end-of-day settlement in UTC+2 to UTC+3. Probable operator timezone: UTC+2 to UTC+4.
No automation signatures. 70 inbound events arrive on 42 distinct dates at highly irregular intervals (0–20 day gaps between events). Inbound amounts are non-uniform and non-formulaic. The March 31 burst (18 transactions) could appear automated but the amounts are non-repetitive large round figures — consistent with manual OTC settlement instruction rather than scripted batch. Post-settlement accretion averages ~1.4 inbound events per day with irregular cadence. No repeating amounts, sub-minute tx intervals, or batch-pattern signatures. Human-directed operation is the working assessment.
| S1 | Blockchain.com — Bitcoin Address Explorer · www.blockchain.com/explorer/addresses/btc/36X44rmLtk218sXACZ… |
| S2 | Mempool.space — Bitcoin Mempool Explorer · mempool.space/address/36X44rmLtk218sXACZ3gFpNMFENi6dQ2n3 |
Counterparty Map · Inflow Architecture · Outflow Architecture
Upstream · Top 5 Funders
| ID | Address | Volume in | Attribution | Risk |
|---|---|---|---|---|
| A1 | 3Be7rzkqVMygrtKKiNCZPhTNBQUydtwQPy | ₿4,998.9990 | Unattributed | MEDIUM |
| A2 | bc1quv866t7ke929gxttpgc2u30ffnczpgfrjugwxv | ₿3,151.0005 | Unattributed | MEDIUM |
| A3 | bc1q8zahckk73g4qlxmp75e8axm3r22wj25a4pufa4 | ₿2,918.3646 | Unattributed | MEDIUM |
| A4 | bc1qepl89w9st507tgpgeqk83qpx2ra0uw8krdf3ds | ₿750.0000 | Unattributed | MEDIUM |
| A5 | bc1q0va6krf4ve5jv37jj2nh4gu2tgk5mdzrtgutqm | ₿750.0000 | Unattributed | MEDIUM |
Downstream · Top 5 Destinations
| ID | Address | Volume out | Attribution | Risk |
|---|---|---|---|---|
| B1 | 3AZPFNzUWW9CLRy6PESSZGmnsSUTPonET4 | ₿5,499.9995 | Unattributed | MEDIUM |
| B2 | 3BJqXAoQMWBKMxKxwCQWSXvKnP1Fm8ovRD | ₿1,901.0010 | Unattributed | MEDIUM |
| B3 | 3EVgMUJfuyvWkw12utRve9tF3Xi76cX8uV | ₿11.5556 | Unattributed | LOW |
| B4 | 1Nkc4yHAMKhL6xxcPEqst6YfwvoAfVSCVG | ₿0.00029685 | Unattributed | LOW |
Account Structure · Protocol Interactions · Threat Exposure
| Address Type | P2SH (3xxx prefix) — Nested SegWit or multisig script |
| Script Encoding | P2SH — spending script unknown; compatible with P2WPKH wrap, 2-of-3 multisig, or custom script |
| UTXO Count | Not resolved — Mempool.space and Blockchain.com did not return explicit UTXO count at scrape time |
| Clustering | No entity cluster — Arkham: unattributed; WalletExplorer: no label returned (15 API calls) |
| Service Label | None — no exchange, custodian, or VASP label across all five intelligence sources |
| VASP Exposure | None confirmed — zero identified exchange or VASP counterparty interactions across all 139 addresses |
| Wallet Software | Unknown — P2SH format compatible with BitGo, Electrum, Trezor, or custom multisig infrastructure |
| Category | Status |
|---|---|
| Exchange Deposits / Withdrawals | NONE none confirmed |
| DeFi / Smart Contract Interaction | NONE |
| Lightning Network Channels | NONE |
| Ordinals / Inscriptions | NONE |
| Mixing / CoinJoin Services | NONE |
| Cross-Chain Bridges | NONE |
| Sanctions-Listed Address Contact | NONE |
Inbound: 139 distinct counterparties across 72 transactions. Top 5 funders — all unattributed — contribute 59.9% of inbound value: 3Be7rzkqVMygrtKKiNCZPhTNBQUydtwQPy (23.8%, ₿4,999.00 · 2 txs), bc1quv866t... (15.0%, ₿3,151.00 · 19 txs), bc1q8zahckk... (13.9%, ₿2,918.36 · 193 txs), two bc1q... addresses (3.6% each, ₿750.00 · 2 txs each). Top funder appears single-use (2 txs, zero balance); bc1q8zahckk... (193 txs) is a high-frequency relay.
Outbound: Two destinations — 3AZPFNzUWW9CLRy6PESSZGmnsSUTPonET4 (74.2%, 3 txs) and 3BJqXAoQMWBKMxKxwCQWSXvKnP1Fm8ovRD (25.6%, 2 txs) — both unattributed P2SH with minimal on-chain history, consistent with cold storage or single-use receive addresses.
Hop-2 trace: 5 hops upstream from top funder yield no attribution breakpoint. Volume decreases across chain (₿5,000 → ₿5,000 → ₿3,017.65 → ₿388.77 → ₿388.77) — partial consolidation and splitting consistent with deliberate chain obfuscation.
| CRITERION | FINDING | ASSESSMENT | |
| 1. Sanctions (OFAC/EU/UN) | CLEAR | ||
| 2. Fraud/Scam Exposure | CLEAR | ||
| 3. Ransomware/Darknet | CLEAR | ||
| 4. Mixer/CoinJoin | CLEAR | ||
| 5. Exchange Source Verif. | MONITOR | ||
| 6. Structuring/Layering | MONITOR | ||
| 7. Third-Party Risk | CLEAR | ||
| 8. Address Poisoning | CLEAR |
P2SH encoding (3xxx prefix) is consistent with institutional custody standards — this format natively supports 2-of-3 or higher multisig configurations used by BitGo, Anchorage, and similar institutional custodians, as well as nested SegWit (P2SH-P2WPKH). Inbound counterparties include both legacy P2SH (3xxx) and native SegWit bech32 (bc1q...) addresses — typical of a mixed ecosystem of OTC counterparties using different wallet generations. No Ordinals, Lightning Network channels, cross-chain bridge interactions, or inscription activity detected. No RBF (replace-by-fee) or CPFP (child-pays-for-parent) fee-bumping patterns observed. UTXO count is unresolved from available sources; the sustained accumulation without consolidation sweeps since April suggests either very large-denomination UTXOs being held intact or active UTXO management out of view of the current analysis window.
Flagged Patterns & Significant Observations
| ID | Date | Event | Severity | Significance |
| A-01 | 2026-03-31 | Single-Day Settlement Burst + Immediate Sweep. 18 inbound transactions totalling ~₿10,550 in round-number tranches received within a single UTC calendar day, followed immediately by two sweeps (₿7,401.00 and ₿11.56) to unattributed P2SH destinations — all within the same date. | NOTABLE | The settlement-then-sweep structure on activation day, with total counterparty opacity at every level, indicates coordinated OTC block-trade activity; beneficial owner identity remains unresolved. |
| A-02 | 2026-03-30 | Address Probe Transactions. Two micro-transactions (₿0.00029685 and ₿0.001) received the day before the main settlement burst — consistent with pre-transfer address verification probes. | NOTABLE | Professional address-probing practice conducted ahead of large OTC settlement; indicates deliberate operational preparation and awareness of transaction risk. |
Scale: Bitcoin rich-list rank #58. Current balance ₿13,556.21 — estimated ~$874M at ~$64,500/BTC (OSINT-derived: $200M / 3,099 BTC, April 2026 media reports).
Operational signature: Two-phase structure — single-day settlement burst on 2026-03-31 absorbed ~₿10,550 in round-number tranches, immediately swept ₿7,412.56 to two unattributed P2SH addresses; 76 subsequent days show pure accumulation with zero outflows.
Attribution: Complete counterparty opacity — all 139 addresses unattributed across five intelligence sources. 5-hop upstream tracing yields no attribution breakpoint.
AML: LOW — no confirmed contamination on any axis. Exchange source unresolved; day-1 round-number inflow pattern noted under Structuring/Layering but consistent with OTC settlement.
Operator profile: UTC+2 to UTC+4 (Eastern Europe, Israel, Turkey, Gulf); Tuesday-dominant weekday-only cadence; no automation signatures. Consistent with a professional institutional operation.
Hypothesis Assessment
Probabilities sum to 100%. Attribution confidence: MEDIUM.
This wallet represents one of the largest anonymous Bitcoin positions on-chain globally. The scale (~$874M retained balance) and operational sophistication place this entity beyond any retail or individual retail investor profile. For any client receiving funds from this address: the complete absence of exchange source verification means standard KYC source-of-funds requirements cannot be satisfied from open-source on-chain data alone — counterparty declarations supported by documentation are required before institutional clearance. For investigative or regulatory clients: this address warrants Tier-1 watchlist designation given its balance scale, full counterparty opacity, and international media profile. The next outbound transaction from this address is the primary intelligence opportunity — destination identification will reveal the custodian, exchange, or entity to which this position is ultimately directed.
Government Records · Press Coverage · Research & Analytics · Blockchain Intelligence
8 open-source intelligence items collected across 3 block explorer sources, 4 media/news publications (Phemex, BingX, KuCoin, ChainCatcher), and 1 rich-list reference (CoinCarp). No sanctioned entity references, fraud database matches, or darknet service links found. Media coverage from four independent financial news platforms independently confirms this address was publicly identified as a destination in a $200M+ anonymous BTC movement in early 2026 — corroborating the March 31 on-chain settlement event. CoinCarp rich-list ranking (#58) independently confirms the significance of the retained balance.
Priority Actions & Engagement Opportunities
| P1 | Commercial Cluster Attribution — Submit all 9 resolved counterparty addresses to Chainalysis KYT, Elliptic Lens, or TRM Labs for heuristic common-input-ownership analysis — WalletExplorer returned no match but commercial HEURISTIC tools operate on significantly larger proprietary datasets. · OSINT |
| P2 | Real-Time On-Chain Monitoring — Register 36X44rmLtk218sXACZ3gFpNMFENi6dQ2n3 for real-time whale alert monitoring (Whale Alert API or Chainalysis webhook). Next outbound event is the primary intelligence opportunity — destination address will identify custodian, exchange, or entity. · On-chain |
| P3 | Source-of-Funds Documentation Request — If funds are received from this address by any regulated entity, initiate formal source-of-wealth documentation request — open-source on-chain data alone cannot satisfy KYC source-of-funds obligations due to complete counterparty opacity. · Regulatory |
| P4 | Arkham Intelligence Deep Pull — Media sources (BingX, KuCoin) cite Arkham Intelligence as the original data source for the $200M whale alert. Request full Arkham entity cluster data for this address via commercial API access — public Arkham returned no label but the proprietary cluster may contain additional attribution. · OSINT |
Immediate priority is passive monitoring — this wallet has been outflow-static since 2026-03-31 (76 days). No urgent regulatory action is warranted in the absence of confirmed contamination. However, the combination of $800M+ anonymous balance, complete source opacity, and public whale-alert media profile makes this address unsuitable as an unverified counterparty for any regulated institution. Any subsequent outbound event should trigger immediate escalation and destination analysis.
| REF | SOURCE |
|---|---|
| S-01 | Blockchain.com — Bitcoin Address Explorer https://www.blockchain.com/explorer/addresses/btc/36X44rmLtk… Full BTC transaction history via blockchain.com API. Primary quantitative data source. Retrieved 2026-06-15. |
| S-02 | OKLink — BTC Address Detail & Counterparty Profiles https://www.oklink.com/btc/address/36X44rmLtk218sXACZ3gFpNMF… Balance, UTXO count, inscription tokens, counterparty sub-profiles. Retrieved 2026-06-15. |
| S-03 | Arkham Intelligence — Entity & Portfolio Profile https://arkm.com/explorer/address/36X44rmLtk218sXACZ3gFpNMFE… Entity label and portfolio value snapshot. Retrieved 2026-06-15. |
| S-04 | Mempool.space — Bitcoin Mempool Explorer https://mempool.space/address/36X44rmLtk218sXACZ3gFpNMFENi6d… Mempool status and last confirmed transaction. Retrieved 2026-06-15. |
| S-05 | WalletExplorer — Cluster Attribution https://www.walletexplorer.com/address/36X44rmLtk218sXACZ3gF… Cluster label from WalletExplorer API. Retrieved 2026-06-15. |
| S-06 | OFAC SDN List — Sanctions Screen https://sanctionssearch.ofac.treas.gov Sanctions screen against OFAC Specially Designated Nationals list. Retrieved 2026-06-15. |
| S3 | Arkham -- Address Profile https://arkm.com/explorer/address/36X44rmLtk218sXACZ3gFpNMFE… Screenshot captured 2026-06-15. File: screenshot_arkham.png |
| S4 | Blockchain -- Address Profile https://www.blockchain.com/explorer/addresses/btc/36X44rmLtk… Screenshot captured 2026-06-15. File: screenshot_blockchain.png |
| S5 | Oklink -- Address Profile https://www.oklink.com/btc/address/36X44rmLtk218sXACZ3gFpNMF… Screenshot captured 2026-06-15. File: screenshot_oklink.png |
| S6 | Mempool -- Address Profile https://mempool.space/address/36X44rmLtk218sXACZ3gFpNMFENi6d… Screenshot captured 2026-06-15. File: screenshot_mempool.png |
| TERM | DEFINITION |
|---|---|
| P2SH | Pay-to-Script-Hash — a Bitcoin address format (3xxx prefix) that encodes spending conditions as a hash, supporting multisig, SegWit wrapping, and custom scripts without revealing those conditions until spent. |
| OTC Settlement | Over-the-counter block trade — a large BTC transaction executed directly between two parties off-exchange, typically producing large round-number on-chain transfers as funds move to the buyer's designated address. |
| UTXO | Unspent Transaction Output — the fundamental unit of Bitcoin ownership; each received amount creates a discrete UTXO that must be fully consumed when spent, potentially generating change. |
| Address Probe | A small test transaction sent to a new address to verify it is live and correctly controlled before committing large value — a common institutional practice ahead of OTC settlement. |
| Rich List | A public ranking of Bitcoin addresses by balance, maintained by sites such as CoinCarp and BitInfoCharts, used to contextualise the scale of a wallet's holdings relative to the global BTC distribution. |
| Whale Alert | An automated on-chain monitoring service that detects and broadcasts large cryptocurrency transfers in real time, commonly used by exchanges, analysts, and media as a market signal. |