KALLISTI BLOCKCHAIN FORENSICS
BTC (native Bitcoin)
---
Target Wallet Address
bc1qf8kep70t232jtajg2x4r8dhtuvtd7kuea8ve9w02qy5k4wncyl7spmnfme
Report Date: 2026-05-28 · Prepared by Kallisti Blockchain Forensics
Wallet Identity · Financial Overview · Holdings · Activity Patterns · Account Structure
| Entity | OKX. Cold Wallet_87 |
| Blockchain | Bitcoin mainnet |
| Address Type | Bech32 SegWit |
| Active Window | 2025-09-25 20:52:15 UTC → 2026-05-28 10:38:02 UTC |
| Account Age | 244 days (0.67 years) |
| Balance | ₿1,695.8615 |
| Total Received | ₿30,770.3502 |
| Total Sent | ₿29,074.4886 |
| Transactions | 238 on-chain (237 in · 120 out) |
Wallet …spmnfme is confirmed as OKX. Cold Wallet_87 — a designated Bitcoin cold storage address within OKX's multi-tier treasury architecture. Over 244 days, ₿30,770.35 was received across 237 events and ₿29,074.49 disbursed across 120 events, with ₿1,695.86 retained at snapshot. High event volume, institutional counterparties, and batch schedule are entirely consistent with exchange cold-storage operations.
Inbound events average ₿129.8 per receipt; outbound events average ₿242.3 per disbursement — a 1.87× ratio reflecting the consolidation-then-bulk-disburse pattern of cold wallet operations. Individual events range from small test transfers (₿0.001) to large sweeps (₿1,572 observed in TX_EVENTS). No abnormal sizing patterns detected.
Bidirectional relationship with OKX. Hot Wallet_41442 is the defining operational characteristic — this cold wallet receives BTC from the hot wallet (refill sweeps) and from OKX user deposit addresses, then periodically returns BTC to the hot wallet (cold-to-hot liquidity top-ups). A one-time ₿5.795 transfer to sibling OKX. Cold Wallet_86 represents internal cold storage rebalancing.
Three batch windows drive 88.7% of activity: UTC 20-21 (43.3%), UTC 02-03 (25.2%), and UTC 10-11 (20.2%). These map to approximately 04:00, 10:00, and 18:00 UTC+8 — Hong Kong/Singapore business-adjacent times consistent with OKX's operational base. Tuesday-dominant DOW (16.8%), broadly uniform weekly distribution. No weekend suppression — continuous exchange operation.
Transaction scheduling is fully automated. Batch windows, uniform sizing, and 24/7 operation confirm programmatic exchange treasury management. No manual transaction signatures detectable from the behavioral pattern.
| S1 | Blockchain.com — Bitcoin Address Explorer · www.blockchain.com/explorer/addresses/btc/bc1qf8kep70t232jta… |
| S2 | Mempool.space — Bitcoin Mempool Explorer · mempool.space/address/bc1qf8kep70t232jtajg2x4r8dhtuvtd7kuea8… |
Counterparty Map · Inflow Architecture · Outflow Architecture
Upstream · Top 5 Funders
| ID | Address | Volume in | Attribution | Risk |
|---|---|---|---|---|
| A1 | bc1qn2cpj0hrl37wqh5q94kwrlhtj2lx8ahtw7ef5rg35tswxsqtvufqfmmrq2 | ₿14,434.3100 | OKX. Hot Wallet_41442 | LOW |
| A2 | bc1qlccksaaehjkdv4tgf032pvx8n76uhazqt4rgy70y4drmqwh5espqwx89f9 | ₿2,804.7096 | OKX. User | LOW |
| A3 | 3KbDzhb8B5pUU7Wk1y26J8D4cxYLmxJsca | ₿1,314.7263 | OKX. User | LOW |
| A4 | bc1qzy2hg9aup0vnt3cnetlpc8h7eytqveqxk36rjfsd8dy8kfyg29yqg29swh | ₿994.4458 | OKX. User | LOW |
| A5 | bc1q4tzyrsvzgd3fkpac53s92ka5y4q3fplcax3836xhmtru2ks5hd0qknt6ne | ₿453.4269 | OKX. User | LOW |
Downstream · Top 5 Destinations
| ID | Address | Volume out | Attribution | Risk |
|---|---|---|---|---|
| B1 | bc1qn2cpj0hrl37wqh5q94kwrlhtj2lx8ahtw7ef5rg35tswxsqtvufqfmmrq2 | ₿20,238.2063 | OKX. Hot Wallet_41442 | MEDIUM |
| B2 | bc1qe4wh2v669c6vrhxunjagwm5ar8tspkujk9ef6m0xsqz8tk8t68hs43uamj | ₿5.7950 | OKX. Cold Wallet_86 | LOW |
Account Structure · Protocol Interactions · Threat Exposure
| CRITERION | FINDING | ASSESSMENT | |
| 1. Sanctions (OFAC/EU/UN) | CLEAR | ||
| 2. Fraud/Scam Exposure | CLEAR | ||
| 3. Ransomware/Darknet | CLEAR | ||
| 4. Mixer/CoinJoin | CLEAR | ||
| 5. Exchange Source Verif. | CLEAR | ||
| 6. Structuring/Layering | CLEAR | ||
| 7. Third-Party Risk | CLEAR | ||
| 8. Address Poisoning | CLEAR |
Flagged Patterns & Significant Observations
Hypothesis Assessment
Probabilities sum to 100%. Attribution confidence: HIGH.
Government Records · Press Coverage · Research & Analytics · Blockchain Intelligence
₿30,770.35 throughput; 65% inflow attributed OKX; 69.6% outflow to OKX.Hot Wallet; 94.5% transit ratio consistent with active cold-warm cycle.
Priority Actions & Engagement Opportunities
| REF | SOURCE |
|---|---|
| S1 | On-chain dataset -- BTC Transactions https://www.blockchain.com/explorer/addresses/btc/bc1qf8kep7… Full BTC transaction history via blockchain.com API. Retrieved 2026-05-28. |
| S2 | WalletExplorer cluster attribution https://www.walletexplorer.com/address/bc1qf8kep70t232jtajg2… Cluster label from WalletExplorer API. Retrieved 2026-05-28. |
| S3 | Oklink -- Address Profile https://www.oklink.com/btc/address/bc1qf8kep70t232jtajg2x4r8… Screenshot captured 2026-05-28. File: screenshot_oklink.png |
| S4 | Mempool -- Address Profile https://mempool.space/address/bc1qf8kep70t232jtajg2x4r8dhtuv… Screenshot captured 2026-05-28. File: screenshot_mempool.png |
No glossary entries provided for this report.