KALLISTI BLOCKCHAIN FORENSICS
BTC (native Bitcoin)
---
Target Wallet Address
bc1q2778ztaa48crjdxx6wpa28l5gr0a24dlrvar9t
Report Date: 2026-06-02 · Prepared by Kallisti Blockchain Forensics
Wallet Identity · Financial Overview · Holdings · Activity Patterns · Account Structure
| Entity | bc1q2778ztaa48crjdxx6wpa28l5gr0a24dlrvar9t |
| Blockchain | Bitcoin mainnet · Bech32 SegWit |
| Account Age | 108 days (0.30 years) ‖ Active: 2026-02-12 04:01:39 UTC → 2026-05-31 22:24:14 UTC |
| Balance | ₿0.00000000 |
| Total Received | ₿1,699.0000 |
| Total Sent | ₿1,699.0000 |
| Net Balance | ₿0.00000000 |
| Transactions | 2 on-chain (1 in · 1 out) · 3 counterparties |
Temporary holding wallet. Received a single large inflow, held for 108 days, then fully swept in one outbound transaction to two destinations. This is a holding-position or staging wallet, not a treasury or pass-through. Address is now empty.
1,699 BTC inbound (near-round lot to integer BTC). Outbound: 1,549 BTC (91.2%) and 150 BTC (8.8%) — both near-round lots suggesting system-generated allocation rather than ad hoc amounts. The 150 BTC Kraken deposit is a notable round-lot suggesting a pre-planned exchange tranche.
P2WPKH single-signature address — lower security tier than the co-profiled Wallet ...csfx4mu6 multisig. 0 UTXOs as of scrape date. Address used once in and once out; no address reuse. Outflow split to 2 destinations with distinct risk profiles (unattributed vs confirmed VASP). No DeFi or protocol interaction.
Inbound: Thursday 2026-02-12 04:01 UTC. Outbound: Sunday 2026-05-31 22:24 UTC. 108-day hold consistent with a tax quarter or strategic hold period. The 22:24 UTC outbound timestamp matches Wallet ...csfx4mu6's inbound to the same minute — strong indicator of shared operator or platform. Inbound at 04:01 UTC maps to late evening US time (23:01 EST), consistent with automated overnight execution.
The 22:24 UTC outbound precisely matches a co-occurring inbound event on a related wallet — strongly suggests scripted or platform-orchestrated execution. The split-routing (two outputs, precision round-lot amounts) is consistent with an automated treasury or portfolio management system. Two-transaction lifecycle with no irregular timing events.
| S1 | Blockchain.com — Bitcoin Address Explorer · www.blockchain.com/explorer/addresses/btc/bc1q2778ztaa48crjd… |
| S2 | OKLink — BTC Address Detail & Counterparty Profiles · www.oklink.com/btc/address/bc1q2778ztaa48crjdxx6wpa28l5gr0a2… |
Counterparty Map · Inflow Architecture · Outflow Architecture
Upstream · Top 5 Funders
| ID | Address | Volume in | Attribution | Risk |
|---|---|---|---|---|
| A1 | bc1qxzmc40n2l9sarwvz8pzjayeqlc52kxdq7hw9k4 | ₿1,699.0000 | Unattributed | MEDIUM |
Downstream · Top 5 Destinations
| ID | Address | Volume out | Attribution | Risk |
|---|---|---|---|---|
| B1 | bc1q4zjuftmfwztjs9hu5t9zjz4738trw24jnskwqf | ₿1,549.0000 | Unattributed | MEDIUM |
| B2 | 3NyqB7db8qMwU6qmoxDayCVGLbdc4PxzJx | ₿150.0000 | Kraken (confirmed) | MEDIUM |
Account Structure · Protocol Interactions · Threat Exposure
| Address Type | Native SegWit P2WPKH (Pay-to-Witness-Public-Key-Hash) — Single Signature |
| Script Encoding | P2WPKH — Bech32 (bc1q prefix) |
| UTXO Count | 0 — fully swept 2026-05-31 |
| Clustering | Unattributed — Arkham entity label: 'BTC Whale' |
| Service Label | None on this address; outbound to confirmed Kraken deposit address |
| VASP Exposure | Confirmed: Kraken — 150 BTC deposited to 3NyqB7db8qMwU6qmoxDayCVGLbdc4PxzJx on 2026-05-31 |
| Wallet Software | Unknown — single-sig, likely hardware or software wallet |
| Category | Status |
|---|---|
| Exchange Deposits / Withdrawals | ACTIVE 1 confirmed Kraken deposit — 150 BTC to 3NyqB7db8qMwU6qmoxDayCVGLbdc4PxzJx (OKLink label: '# Kraken') on 2026-05-31 |
| DeFi / Smart Contract Interaction | NONE |
| Lightning Network Channels | NONE |
| Ordinals / Inscriptions | NONE |
| Mixing / CoinJoin Services | NONE |
| Cross-Chain Bridges | NONE |
| Sanctions-Listed Address Contact | NONE |
The confirmed Kraken deposit creates a regulatory anchor point. Kraken, as a registered US exchange, is required to maintain KYC records for deposit address 3NyqB7db8qMwU6qmoxDayCVGLbdc4PxzJx and any associated accounts. A lawful process request to Kraken referencing this deposit address and the specific transactions (150 BTC from this wallet on 2026-05-31 and 300 BTC from the funder on 2026-02-12) would be the highest-yield investigative step. No SAR obligation is indicated on the basis of this profile alone; the exchange interaction is voluntary and to a regulated entity.
| CRITERION | FINDING | ASSESSMENT | |
| 1. Sanctions (OFAC/EU/UN) | CLEAR | ||
| 2. Fraud/Scam Exposure | CLEAR | ||
| 3. Ransomware/Darknet | CLEAR | ||
| 4. Mixer/CoinJoin | CLEAR | ||
| 5. Exchange Source Verif. | CLEAR | ||
| 6. Structuring/Layering | LOW | ||
| 7. Third-Party Risk | CLEAR | ||
| 8. Address Poisoning | CLEAR |
All quantitative fields confirmed across three API sources. Note: Blockchain.com displays timestamps in local display time; Mempool.space UTC is authoritative — outbound transaction is 2026-05-31 22:24 UTC (Mempool), displayed as 2026-06-01 02:20:21 by Blockchain.com (UTC+4 offset). OKLink screenshots for all three counterparty addresses captured; Kraken label confirmed from screenshot_oklink_VGLbdc4PxzJx.png. OCR of all explorer screenshots completed at scrape time.
Flagged Patterns & Significant Observations
| ID | Date | Event | Severity | Significance |
| A-01 | 2026-05-31 | 22:24 UTC Timestamp Collision with Co-Profiled Wallet. Outbound sweep at 22:24 UTC matches inbound receipt time on co-profiled wallet (Wallet ...csfx4mu6) to the minute — same operator or shared automation platform. | NOTABLE | Minute-level timestamp coincidence across two large unattributed wallets is a strong indicator of shared infrastructure. |
| A-02 | 2026-02-12 | Funder Routes 300 BTC to Kraken Simultaneously. At point of funding this address, funder also sent 300 BTC to the same Kraken deposit address — establishes pre-existing operator Kraken relationship. | NOTABLE | Funder's parallel Kraken routing confirms the operator's exchange preference and provides a second transaction anchor for legal process. |
1,699 BTC received 2026-02-12 from unattributed relay (bc1qxzmc40n2l9sarwvz8pzjayeqlc52kxdq7hw9k4). Held 108 days. Swept 2026-05-31: 1,549 BTC to new cold storage (bc1q4zjuftmfwztjs9hu5t9zjz4738trw24jnskwqf), 150 BTC to confirmed Kraken deposit address (3NyqB7db8qMwU6qmoxDayCVGLbdc4PxzJx). Funder also sent 300 BTC to same Kraken address at funding time. Address now empty.
Hypothesis Assessment
Probabilities sum to 100%. Attribution confidence: 70.
OSINT sweep returned null for the subject address — no Google News hits, no BitcoinWhosWho appearances. The material intelligence finding for this case derives from on-chain counterparty profiling: the OKLink entity label '# Kraken' on the outbound destination confirms direct exposure to a regulated exchange. No open-source adverse findings.
Government Records · Press Coverage · Research & Analytics · Blockchain Intelligence
Priority Actions & Engagement Opportunities
| P1 | Legal Process — Kraken KYC Request — Subpoena or MLAT request to Kraken (Payward Inc.) for KYC identity of deposit address 3NyqB7db8qMwU6qmoxDayCVGLbdc4PxzJx — reference both the 150 BTC deposit from this address (2026-05-31) and the 300 BTC deposit from the funder (2026-02-12); total operator Kraken exposure 450 BTC · Legal |
| P2 | Trace and Monitor 1,549 BTC Recipient — Monitor bc1q4zjuftmfwztjs9hu5t9zjz4738trw24jnskwqf — currently holding 1,549 BTC with only 1 transaction; likely the operator's primary cold-storage address; alert on first movement · On-chain |
| P3 | Cross-Reference 22:24 UTC Timestamp Collision — Co-profiled wallet received 4,000 BTC at the same 22:24 UTC minute on 2026-04-20; confirm whether both wallets share an operator or automation platform by cross-referencing transaction structure and funder addresses · On-chain |
High priority. Confirmed Kraken deposit creates an accessible legal pathway to operator identity — Kraken KYC request is the immediate recommended action. Parallel on-chain monitoring of the 1,549 BTC cold-storage recipient provides the next likely intelligence event.
| REF | SOURCE |
|---|---|
| S-01 | Blockchain.com — Bitcoin Address Explorer https://www.blockchain.com/explorer/addresses/btc/bc1q2778zt… Full BTC transaction history via blockchain.com API. Primary quantitative data source. Retrieved 2026-06-02. |
| S-02 | OKLink — BTC Address Detail & Counterparty Profiles https://www.oklink.com/btc/address/bc1q2778ztaa48crjdxx6wpa2… Balance, UTXO count, inscription tokens, counterparty sub-profiles. Retrieved 2026-06-02. |
| S-03 | Arkham Intelligence — Entity & Portfolio Profile https://intel.arkm.com/explorer/address/bc1q2778ztaa48crjdxx… Entity label and portfolio value snapshot. Retrieved 2026-06-02. |
| S-04 | Mempool.space — Bitcoin Mempool Explorer https://mempool.space/address/bc1q2778ztaa48crjdxx6wpa28l5gr… Mempool status and last confirmed transaction. Retrieved 2026-06-02. |
| S-05 | WalletExplorer — Cluster Attribution https://www.walletexplorer.com/address/bc1q2778ztaa48crjdxx6… Cluster label from WalletExplorer API. Retrieved 2026-06-02. |
| S-06 | OFAC SDN List — Sanctions Screen https://sanctionssearch.ofac.treas.gov Sanctions screen against OFAC Specially Designated Nationals list. Retrieved 2026-06-02. |
| S3 | Arkham -- Address Profile https://intel.arkm.com/explorer/address/bc1q2778ztaa48crjdxx… Screenshot captured 2026-06-02. File: screenshot_arkham.png |
| S4 | Blockchain -- Address Profile https://www.blockchain.com/explorer/addresses/btc/bc1q2778zt… Screenshot captured 2026-06-02. File: screenshot_blockchain.png |
| S5 | Oklink -- Address Profile https://www.oklink.com/btc/address/bc1q2778ztaa48crjdxx6wpa2… Screenshot captured 2026-06-02. File: screenshot_oklink.png |
| S6 | Mempool -- Address Profile https://mempool.space/address/bc1q2778ztaa48crjdxx6wpa28l5gr… Screenshot captured 2026-06-02. File: screenshot_mempool.png |
| TERM | DEFINITION |
|---|---|
| P2WPKH | Pay-to-Witness-Public-Key-Hash — a native SegWit Bitcoin address type (bc1q prefix) requiring a single private key signature to spend. |
| Kraken | A US-regulated cryptocurrency exchange (Payward Inc.) licensed in multiple jurisdictions and subject to AML/KYC obligations — its deposit addresses are identifiable by on-chain analysis tools. |
| VASP | Virtual Asset Service Provider — the regulatory term for exchanges, custodians, and other entities handling cryptocurrency on behalf of users, subject to AML/CFT rules. |
| Hold Period | The interval between receipt and disbursement of funds — 108 days in this case, suggesting intentional position management rather than pass-through activity. |
| KYC | Know Your Customer — the identity verification process regulated entities must conduct when onboarding users; Kraken holds KYC records for its deposit address holders. |