The target wallet presents a coherent operational profile across all forensic dimensions: an institutionally configured P2WSH 3-of-N multisig address that received approximately $230M in BTC across a 22-day window, retained $93M on-chain, and disbursed $44M in a single perfectly round outflow. The complete absence of entity attribution across four intelligence platforms is the defining investigative constraint — without it, the H1 (institutional treasury) and H2 (layering relay) hypotheses cannot be formally distinguished. The midweek-only temporal concentration, business-hours UTC timing (08:00–14:00 UTC peak), and round-figure settlement amount are each individually consistent with legitimate institutional finance; collectively they form a pattern that warrants enhanced due diligence rather than immediate adverse action. The Whirlpool network proximity, while confirmed at dust-level exposure only, is a documented adverse flag that must be disclosed in any compliance filing referencing this address. The wallet's static balance since 2026-05-28 suggests either a cold storage holding posture or a pending second disbursement event; continued monitoring of the address and its counterparties is recommended.

The comprehensive AML scoring is presented in Section 4. Axis-by-axis findings are documented in the AML Rows table (S0). Key headline: Structuring/Layering (MEDIUM, 0.45) and Mixer/CoinJoin (MONITOR, 0.35) drive the LOW-MEDIUM composite; Sanctions, Ransomware/Darknet, and direct Fraud/Scam are CLEAR. The full axis breakdown with scoring rationale is in S4_BODY above. No new adverse findings are introduced at this stage — the S15 assessment confirms and consolidates the S4 findings without amendment.

The target wallet's event record spans 22 days (2026-05-06 to 2026-05-28) and contains six on-chain transactions across three distinct activity dates. The operational sequence follows a three-phase pattern: an activation-and-test phase (2026-05-06), a primary accumulation phase (2026-05-07), and a settlement phase (2026-05-28). The most forensically significant event is the same-day receive-and-forward on 2026-05-28 — the wallet received ₿1,456.84 and disbursed ₿690.00 within the same UTC date, indicating pre-coordinated fund movement rather than passive accumulation. The Whirlpool dust contact on 2026-05-07 is the only confirmed adverse-tagged network event and coincides precisely with the primary inflow date, a temporal alignment that may indicate deliberate address monitoring by a third party or incidental dust from the CoinJoin pool's output distribution. No anomalous fee behavior, double-spend attempts, or RBF (Replace-By-Fee) transactions have been identified.

Open-source intelligence returned no direct hits for the target address across BitcoinWhosWho and CoinCarp (the two OSINT sources with saved pages confirmed in the case file). Neither the address nor any variant appears in publicly accessible scam reports, forum threads, or media coverage. The Arkham Intelligence profile page loads but returns no entity label — the address is present in the Arkham index (the explorer resolves the address and displays balance data) but carries no attribution tag, which differs from an address not in the Arkham dataset at all. This suggests the address was provisioned recently enough that Arkham's entity clustering algorithms have not yet assigned it to a known cluster, or that the controlling entity deliberately uses address rotation to avoid cluster linking. The absence of any public footprint is itself a forensic data point: at ~$93M on-chain value and $230M total throughput, an institutional actor would ordinarily generate some indexable public record unless operating under deliberate operational security posture.

The investigation has established the factual on-chain record with high confidence and identified four material investigative gaps that cannot be resolved through open-source analysis alone. The highest-priority gap is entity attribution for the wallet controller — the P2WSH multisig at $93M scale almost certainly has a known institutional counterparty that has simply not yet been indexed or that is deliberately operating under new address infrastructure. The second-priority gap is the upstream origin of the ₿2,146.84 inflow: tracing …p7vHoAupCFcw's inbound transactions through hop-3 and hop-4 has a reasonable probability of reaching a VASP or exchange withdrawal event that would establish source-of-funds provenance. The ₿690.0000 outflow recipient …2ycdUioNu1zF, with its four-year address history and static $44M balance, is a priority target for cluster analysis — if it belongs to a known exchange or OTC desk cluster, it would simultaneously validate the institutional hypothesis and complete the flow-of-funds chain. Until these gaps are closed, the LOW-MEDIUM rating and dual-hypothesis attribution remain the most defensible analytical position.

PASS_2_COMPLETE: true