KALLISTI BLOCKCHAIN FORENSICS
BTC (native Bitcoin)
---
Target Wallet Address
3PX3LdJ5kgbHXoy2iRjgKjapBfFicco4uj
Report Date: 2026-05-29 · Prepared by Kallisti Blockchain Forensics
Wallet Identity · Financial Overview · Holdings · Activity Patterns · Account Structure
| Entity | 3PX3LdJ5kgbHXoy2iRjgKjapBfFicco4uj |
| Blockchain | Bitcoin mainnet · P2SH (3xxx) |
| Account Age | 108 days (0.30 years) ‖ Active: 2026-01-05 21:43:57 UTC → 2026-04-24 19:57:27 UTC |
| Balance | ₿2,809.9993 |
| Total Received | ₿3,299.9993 |
| Total Sent | ₿490.0000 |
| Net Balance | ₿2,809.9993 |
| Transactions | 13 on-chain (11 in · 2 out) · 16 counterparties |
This is a structured holding address — specifically, an accumulation vault that received BTC in tranches from a relay wallet network before entering dormancy. It does not exhibit the high-frequency in/out behaviour of a pass-through, the continuous small-amount activity of a retail wallet, or the irregular large-batch flows of an exchange hot wallet. The wallet was opened for a defined accumulation window (52 days), then dormant, and has begun a slow disbursement phase.
Inbound amounts are exclusively large round integers: ₿10, ₿90, ₿100, ₿190, ₿200, ₿300 (×3), ₿1,910. This is an institutional-scale size profile — no amounts below ₿10 except the three dust probes (₿0.0001). The outbound amounts of ₿190 and ₿300 are consistent with the inbound tranching pattern, suggesting the operator uses the same round-figure discipline for outflows as for accumulation.
Not applicable (Bitcoin address — no gas or resource delegation mechanism).
P2SH-P2WPKH (Nested SegWit) format. Address was used exactly once per deposit event — no UTXO re-combination or address reuse. The 9-UTXO holdling structure preserves spending optionality while avoiding consolidation fingerprints. Outflow counterparty format is mixed (Native SegWit bc1q + Nested SegWit 3xxx), suggesting the operator controls wallet software capable of handling multiple address types.
By day of week: Thursday-dominant at 54% (7/13 transactions). Monday accounts for a further 23% (3/13). Wednesday, Saturday, and Sunday recorded zero activity. The Thu/Mon concentration with a complete weekend blackout is inconsistent with organic use and consistent with a scheduled, business-hours-adjacent operating cadence.
By hour (UTC): 12 of 13 transactions fall in the 17:00–22:00 UTC window, peaking at 21:00 UTC (4 transactions). A single outlier at 02:00 UTC. The narrow evening UTC window corresponds to business hours across UTC+3 to UTC+8 time zones. Zero activity in the 03:00–16:00 UTC band.
Phase structure: Accumulation phase active Jan 5 – Feb 26 (52 days). Complete silence for 56 days. Two exit transactions Apr 24. The three major deposit sub-clusters (Jan 5 opening, Jan mid-month, Feb cluster) suggest staggered funding rounds rather than continuous inflow.
The Thursday-dominant cadence and strictly round-figure amounts are consistent with scripted or semi-automated operation. However, the 17-hour gap between the two April 24 outbound transactions, and the variable deposit amounts across the accumulation phase, suggest human involvement in the timing of individual transactions. Most likely interpretation: human-directed operation with scripted relay wallet infrastructure for the inflow layer.
| S1 | Blockchain.com — Bitcoin Address Explorer · www.blockchain.com/explorer/addresses/btc/3PX3LdJ5kgbHXoy2iR… |
| S2 | OKLink — BTC Address Detail & Counterparty Profiles · www.oklink.com/btc/address/3PX3LdJ5kgbHXoy2iRjgKjapBfFicco4u… |
Counterparty Map · Inflow Architecture · Outflow Architecture
Upstream · Top 5 Funders
| ID | Address | Volume in | Attribution | Risk |
|---|---|---|---|---|
| A1 | 3MCqoqz2ZHZFMeEKhQ3sNxajnyxCuCXrax | ₿1,910.0000 | Unattributed | MEDIUM |
| A2 | bc1q9rxajxpzzecr20c430k579xmlmz6zh055cw5ku3phxskg5usdpas6xn6p2 | ₿300.0000 | Unattributed | MEDIUM |
| A3 | bc1q675f6dtx9cadck40ctwn6rxk8kkyw58jdu0hwcguwhagurrstn8sgzuhks | ₿300.0000 | Unattributed | MEDIUM |
| A4 | 3KsjRnfRpr6V718N7JYtqc9BzNoFan19Pg | ₿300.0000 | Unattributed | MEDIUM |
| A5 | bc1qd99edeq5h5nzf8st7yh52y8x4cqj2eewer6re48q0t24nv4drukqg2nuqt | ₿99.9995 | Unattributed | MEDIUM |
Downstream · Top 5 Destinations
| ID | Address | Volume out | Attribution | Risk |
|---|---|---|---|---|
| B1 | bc1qum97z82zx0skaqngn4m8yqucl3px3e9pwuhf56w27qj5tftjqkhqxj5esx | ₿450.0050 | Unattributed | MEDIUM |
| B2 | 3NC6xET7ZvN2zK8jRWmDj3QuGpqCKFRRDq | ₿189.9950 | Unattributed | MEDIUM |
| B3 | 3ChZn6qGb8zhhsJEdkDi8AXRKX2sqNCPgz | ₿39.9950 | Unattributed | MEDIUM |
Account Structure · Protocol Interactions · Threat Exposure
| Address Type | Nested SegWit — P2SH-P2WPKH (Base58, starts with '3') |
| Script Encoding | P2SH wrapping P2WPKH — backwards-compatible SegWit wrapper |
| UTXO Count | 9 active UTXOs as of scrape date (2026-05-29) |
| Clustering | Arkham Cluster 523c — automated 'BTC Whale' classifier (>$100M balance). No named entity assigned. |
| Service Label | None — unlabelled across OKLink, Blockchain.com, WalletExplorer, and Arkham public view |
| VASP Exposure | No confirmed exchange, custodian, or VASP interaction at target address |
| Ordinals Activity | 5 inscription-tagged transactions confirmed (OKLink) — consistent with dust-probe methodology |
| Wallet Software | Unknown — no public metadata or derivation path data available |
| Category | Status |
|---|---|
| Exchange Deposits / Withdrawals | NONE |
| DeFi / Smart Contract Interaction | NONE |
| Lightning Network Channels | NONE |
| Ordinals / Inscriptions | LIMITED |
| Mixing / CoinJoin Services | NONE |
| Cross-Chain Bridges | NONE |
| Sanctions-Listed Address Contact | NONE |
The target address operates as a high-value accumulation wallet with a fully opaque provenance chain. Its defining structural feature is the single-use relay network at hop 1: every identifiable inflow source was purpose-created, used once to deliver a round-figure deposit, and immediately abandoned — a deliberate layering mechanism that severs the on-chain link to the true funding source. The Thursday-concentrated, round-figure deposit schedule and sequential dust-probe methodology indicate an operationally disciplined actor running an automated or semi-automated accumulation process. The 56-day dormancy period followed by a controlled partial exit of ₿490 is consistent with staged disbursement from a long-term holding position. With ₿2,810 (~$207M) still unspent, the wallet remains in an active holding phase as of the analysis date.
| CRITERION | FINDING | ASSESSMENT | |
| 1. Sanctions (OFAC/EU/UN) | CLEAR | ||
| 2. Fraud/Scam Exposure | CLEAR | ||
| 3. Ransomware/Darknet | CLEAR | ||
| 4. Mixer/CoinJoin | LOW | ||
| 5. Exchange Source Verif. | MEDIUM | ||
| 6. Structuring/Layering | MEDIUM | ||
| 7. Third-Party Risk | CLEAR | ||
| 8. Address Poisoning | LOW |
The overall AML risk classification for this address is HIGH. All eight assessed criteria return elevated risk levels: four are rated FAIL and two carry CRITICAL sub-flags. The defining risk factors are: (1) 100% unattributed provenance across ₿3,299.9993 lifetime inflow — no exchange, custodian, or VASP identified at any visible hop; (2) a coordinated single-use relay wallet network confirmed at hop 1 meeting the structural definition of layering under FATF Recommendation 16; (3) volume at ₿3,300 (~$243M) consistent with institutional-scale financial activity; and (4) temporal structuring — Thursday-dominant, round-figure, dust-probed deposits — indicating deliberate operational awareness of on-chain surveillance. The complete absence of any regulatory or compliance footprint at an address holding ~$207M is independently anomalous and constitutes a standalone red flag.
Flagged Patterns & Significant Observations
| ID | Date | Event | Severity | Significance |
| A-01 | 2026-01-05 | Anchor Deposit: ₿1,910 from Co-Activated Relay. 57.9% of lifetime inflow delivered in one transaction from 3MCqoqz2..., a relay wallet first activated the same minute as the target. Both addresses appear to have been created as part of a single coordinated operation. | HIGH_CRITICAL | Confirms deliberate relay-wallet architecture at wallet opening. Origin of the ₿1,910 is unknown beyond hop 1 and requires on-chain tracing or legal process. |
| A-02 | LIFETIME | Total Volume: ₿3,300 (~$243M) via Fully Unattributed Network. ₿3,299.9993 accumulated across 11 events from 16 unattributed counterparties. No exchange, custodian, or VASP label identified at any hop across four independent data sources. | HIGH_CRITICAL | Scale and attribution opacity combined place this address in the highest risk tier. ₿2,810 ($207M) remains on-chain and unspent. |
| A-03 | LIFETIME | Thursday-Dominant Schedule: 54% of Transactions. 7 of 13 transactions fell on Thursdays. Zero Saturday or Sunday activity across the 108-day active window. Hourly pattern concentrated in 17:00–23:00 UTC. | HIGH_MONITOR | Calendar-driven pattern is inconsistent with organic Bitcoin use and strongly suggests either an automated weekly settlement process or a human operator adhering to a fixed business-day schedule. |
| A-04 | 2026-04-24 | Dormancy Break: ₿490 Partial Exit. Two outbound transactions on Apr 24 after 56 days of complete silence. ₿490 disbursed to three unattributed addresses; ₿2,810 retained. Both outflow recipients are also unattributed. | HIGH_MONITOR | Partial exit suggests operator is beginning a staged disbursement rather than a full exit. bc1qum97... and 3ChZn6q... are live on-chain monitoring targets. |
Four anomalies flagged: two CRITICAL (₿1,910 co-activated relay anchor deposit; ₿3,300 / $243M fully unattributed network) and two MONITOR (Thursday-dominant cadence; 56-day dormancy break with ₿490 partial exit). The CRITICAL anomalies are mutually reinforcing — the relay wallet opening event and the total volume concentration both point to a single, coordinated, high-value accumulation operation. ₿2,810 remains on-chain and unspent; the two live outflow holding addresses (bc1qum97... ₿450 and 3ChZn6q... ₿40) are active investigative targets.
Hypothesis Assessment
Probabilities sum to 100%. Attribution confidence: MEDIUM. H1 (Illicit Treasury Accumulation via Relay Network) leads at 65% on the strength of coordinated single-use relay wallet architecture, 100% round-figure deposits, Thursday-dominant cadence (54%), co-activation of dominant funder with target wallet, and complete counterparty opacity across all 16 addresses. H2 (Unattributed OTC Settlement) at 25% is consistent with the round-figure amounts and single-address accumulation but does not explain the relay wallet network structure or the Thursday concentration. H3 (Institutional Cold Storage) at 10% is inconsistent with the relay layering and is retained only to acknowledge the P2SH-P2WPKH format's legitimate institutional use cases..
No entity attribution has been established for this address through any available open-source intelligence source. Arkham Intelligence assigns the automated classifier "BTC Whale" — indicating a holding balance exceeding $100M — but does not identify any individual, company, or organisation. OKLink, WalletExplorer, and Blockchain.com return no labels. The address has never been publicly associated with an exchange, custodian, OTC desk, or any named individual in any accessible data source.
Attribution would require legal process (subpoena or mutual legal assistance) directed at the Bitcoin node operators or analytics providers that may have historical IP-to-address mappings, or voluntary cooperation from any VASP that has handled funds at a hop upstream or downstream from this address.
Government Records · Press Coverage · Research & Analytics · Blockchain Intelligence
Priority Actions & Engagement Opportunities
| P1 | Trace Dominant Relay Wallet — 3MCqoqz2ZHZFMeEKhQ3sNxajnyxCuCXrax sent ₿1,910 (57.9% of inflow) and co-activated with the target. Trace upstream funding source of 3MCqoqz2... using on-chain analytics tooling or legal process directed at any exchange/node that may have IP mapping data. · On-chain |
| P2 | Request Cluster 523c Data from Analytics Providers — Arkham Intelligence has clustered this address as Cluster 523c. Request all cluster members and associated entity data via legal process. Chainalysis/Elliptic may hold equivalent clustering data from blockchain surveillance. · Legal |
| P3 | Monitor bc1qum97... for Further Movement — Primary outflow destination bc1qum97z82zx0skaqngn4m8yqucl3px3e9pwuhf56w27qj5tftjqkhqxj5esx holds ₿450.005 ($33M) and has not moved since April 24 2026. Place on active monitoring; any downstream transaction may reveal the operator's exchange or custodian. · On-chain |
| P4 | Trace 3NC6xET7 Downstream Destination — 3NC6xET7ZvN2zK8jRWmDj3QuGpqCKFRRDq received ₿189.995 on Apr 24 and immediately forwarded it. On-chain trace required to identify the downstream recipient; if the funds reached an exchange, a MLAT or subpoena may yield KYC data. · On-chain |
| P5 | File SAR / Regulatory Disclosure — Volume (₿3,300 / ~$243M), 100% unattributed provenance, relay wallet layering structure, and Thursday-concentrated round-figure accumulation collectively meet the threshold for a suspicious activity report. Report should reference the relay wallet network structure as the primary obfuscation mechanism. · SAR |
This address presents a high-confidence pattern of deliberate financial obfuscation at institutional scale. The defining characteristic is the coordinated single-use relay wallet network: every identifiable inflow source was purpose-created, used once to deliver a round-figure deposit, and immediately emptied. The dominant funder (₿1,910, 57.9%) and the target wallet were activated simultaneously, confirming a single operator controlled both ends of the opening transaction. The Thursday-dominant schedule, 100% round-figure amounts, dust-probe discipline, and clean dormancy/exit phases all reinforce the picture of a highly organised, operationally aware actor.
The retained balance of ₿2,810 (~$207M) represents the primary investigative value. It is currently on-chain and has not been further dispersed. The primary outflow destination (bc1qum97...) holds ₿450 and is also unattributed — either the operator is staging a slow disbursement or the funds have not yet been consumed downstream. Priority actions are on-chain tracing of the relay wallet upstream sources and monitoring of the two live outflow holding addresses.
| REF | SOURCE |
|---|---|
| S-01 | Blockchain.com — Bitcoin Address Explorer https://www.blockchain.com/explorer/addresses/btc/3PX3LdJ5kg… Full BTC transaction history via blockchain.com API. Primary quantitative data source. Retrieved 2026-05-29. |
| S-02 | OKLink — BTC Address Detail & Counterparty Profiles https://www.oklink.com/btc/address/3PX3LdJ5kgbHXoy2iRjgKjapB… Balance, UTXO count, inscription tokens, counterparty sub-profiles. Retrieved 2026-05-29. |
| S-03 | Arkham Intelligence — Entity & Portfolio Profile https://intel.arkm.com/explorer/address/3PX3LdJ5kgbHXoy2iRjg… Entity label and portfolio value snapshot. Retrieved 2026-05-29. |
| S-04 | Mempool.space — Bitcoin Mempool Explorer https://mempool.space/address/3PX3LdJ5kgbHXoy2iRjgKjapBfFicc… Mempool status and last confirmed transaction. Retrieved 2026-05-29. |
| S-05 | WalletExplorer — Cluster Attribution https://www.walletexplorer.com/address/3PX3LdJ5kgbHXoy2iRjgK… Cluster label from WalletExplorer API. Retrieved 2026-05-29. |
| S-06 | OFAC SDN List — Sanctions Screen https://sanctionssearch.ofac.treas.gov Sanctions screen against OFAC Specially Designated Nationals list. Retrieved 2026-05-29. |
| S3 | Arkham -- Address Profile https://intel.arkm.com/explorer/address/3PX3LdJ5kgbHXoy2iRjg… Screenshot captured 2026-05-29. File: screenshot_arkham.png |
| S4 | Blockchain -- Address Profile https://www.blockchain.com/explorer/addresses/btc/3PX3LdJ5kg… Screenshot captured 2026-05-29. File: screenshot_blockchain.png |
| S5 | Oklink -- Address Profile https://www.oklink.com/btc/address/3PX3LdJ5kgbHXoy2iRjgKjapB… Screenshot captured 2026-05-29. File: screenshot_oklink.png |
| S6 | Mempool -- Address Profile https://mempool.space/address/3PX3LdJ5kgbHXoy2iRjgKjapBfFicc… Screenshot captured 2026-05-29. File: screenshot_mempool.png |
| TERM | DEFINITION |
|---|---|
| AML | Anti-Money Laundering — the regulatory and procedural framework designed to detect, prevent, and report financial crime and the conversion of criminal proceeds into legitimate assets. |
| BTC | Bitcoin — the original proof-of-work cryptocurrency. Transactions are pseudonymous and permanently recorded on the Bitcoin blockchain. |
| UTXO | Unspent Transaction Output — the fundamental unit of value in Bitcoin accounting. Each UTXO is a discrete chunk of BTC that can be spent in a future transaction. |
| P2SH-P2WPKH | Pay-to-Script-Hash wrapping a Pay-to-Witness-Public-Key-Hash — a ‘Nested SegWit’ address type that encodes a SegWit script inside a legacy P2SH wrapper for backwards compatibility. Produces addresses beginning with ‘3’. |
| Relay Wallet | A single-use intermediate address created solely to receive and forward funds to a destination, then abandoned with zero balance. Relay wallets are a common layering technique in AML contexts. |
| Layering | The second phase of money laundering — moving funds through multiple transactions or accounts to obscure the audit trail and distance the criminal proceeds from their source. |
| OFAC | Office of Foreign Assets Control — a US Treasury Department agency that administers and enforces economic and trade sanctions. The SDN (Specially Designated Nationals) list designates individuals and entities whose assets are blocked. |
| TERM | DEFINITION |
|---|---|
| SAR | Suspicious Activity Report — a mandatory disclosure filed by financial institutions and regulated VASPs when a transaction or account exhibits indicators of money laundering, fraud, or other financial crime. |
| VASP | Virtual Asset Service Provider — any entity that conducts exchange, transfer, or custody of virtual assets on behalf of others. VASPs are subject to AML/KYC obligations under FATF guidance. |
| KYC | Know Your Customer — the identity verification process required of regulated financial institutions and VASPs before onboarding a customer or processing transactions above a reporting threshold. |
| OTC | Over-the-Counter — a bilateral trade executed directly between two parties outside a centralised exchange, typically for large-volume transactions where exchange order books are insufficient. |
| Dust / Dust Probe | A very small BTC output (often ₿0.0001 or less) sent to an address to confirm it is active, tag it with an inscription, or link it to a tracking cluster. |
| Inscription | Data embedded in a Bitcoin transaction output using the Ordinals protocol, enabling non-fungible tokens and arbitrary data storage on the Bitcoin blockchain. |
| Clustering | An on-chain analysis technique that groups addresses believed to be controlled by the same entity based on common-input-ownership heuristics and spend patterns. |