KALLISTI BLOCKCHAIN FORENSICS
BTC (native Bitcoin)
---
Target Wallet Address
bc1qw344rmvdss4yx3qytpr9lwdlcn0cvl4kuycj7a
Report Date: 2026-06-01 · Prepared by Kallisti Blockchain Forensics
Wallet Identity · Financial Overview · Holdings · Activity Patterns · Account Structure
| Entity | bc1qw344rmvdss4yx3qytpr9lwdlcn0cvl4kuycj7a |
| Blockchain | Bitcoin mainnet · Bech32 SegWit |
| Account Age | 145 days (0.40 years) ‖ Active: 2025-11-06 17:02:58 UTC → 2026-04-01 15:00:54 UTC |
| Balance | ₿2,150.0028 |
| Total Received | ₿2,150.0028 |
| Total Sent | ₿0.00007100 |
| Net Balance | ₿2,150.0028 |
| Transactions | 9 on-chain (8 in · 1 out) · 6 counterparties |
Institutional accumulation wallet — actively receiving large round-lot BTC deposits from a small set of consistent source wallets. The setup sequence (dust receive → test send → 53-day hold → first block deposit) and the ongoing weekday-only operation distinguish this from retail or opportunistic wallets. The address is in an active accumulation phase with no signs of planned distribution; it has not recycled any of the accumulated BTC.
All four substantive inflows are exact round figures: 1,299.999 / 250.000 / 100.000 / 499.999 BTC. The −0.001 BTC undersize on the two largest deposits is consistent with fee deduction from an exact-lot OTC instruction — a standard settlement artifact. Retail investors do not transact in ₿100, ₿250, or ₿500 exact lots.
Six active UTXOs: one test-receive UTXO (0.000071 BTC), and five deposit UTXOs from the four deposit events (the 2025-12-29 deposit arrived as two inputs). Modern SegWit P2WPKH encoding reduces transaction size and fees. No address reuse detected. Counterparty diversity is minimal — two funders, one test destination — consistent with a controlled institutional deployment rather than an open-receive retail wallet.
All 9 transactions fall Mon–Fri (Mon 33%, Wed 22%, Fri 22%, Tue/Thu 11% each); zero weekend activity across 145 days — near-impossible by coincidence across nine events and the strongest institutional signal available. Peak UTC hours at 14–16 UTC map to 10am–12pm Eastern or 2pm–4pm London/CET, placing the operator in a North American or European business-hours context.
Deposit cadence (2025-12-29, 2026-02-03, 2026-02-06, 2026-04-01) shows no fixed interval — event-driven rather than time-scheduled. This argues against automated DCA scripting and toward human-initiated OTC settlement decisions. Test transaction, round-lot sizing, and consistent funder usage indicate semi-automated institutional infrastructure under human direction.
| S1 | Blockchain.com — Bitcoin Address Explorer · www.blockchain.com/explorer/addresses/btc/bc1qw344rmvdss4yx3… |
| S2 | Mempool.space — Bitcoin Mempool Explorer · mempool.space/address/bc1qw344rmvdss4yx3qytpr9lwdlcn0cvl4kuy… |
Counterparty Map · Inflow Architecture · Outflow Architecture
Upstream · Top 5 Funders
| ID | Address | Volume in | Attribution | Risk |
|---|---|---|---|---|
| A1 | bc1qkdfcsghv5dvh63z0dmk857338afxypcm0u53az | ₿1,650.0000 | Unattributed | MEDIUM |
| A2 | bc1q8zpww6mafnnjzpeg8lykh8cxjkrjleman07qtx | ₿500.0000 | Unattributed | MEDIUM |
| A3 | bc1qmakv42j4lawznxpat6dnp20m9fh330sega3hqdzc77dw22unsrgqm0kd58 | ₿0.00137500 | Unattributed | MEDIUM |
| A4 | bc1qjsk5tn89cmykljdy0gwpa8amwanp6qargc5hcp8aavgem8wzqq8qcpp795 | ₿0.00137500 | Unattributed | MEDIUM |
| A5 | bc1qfnpwlzv4vl6dtv2ukqtau78jkwzdyufv808scuhprj2kkxngf69swm6kf0 | ₿0.00007100 | Unattributed | MEDIUM |
Downstream · Top 5 Destinations
| ID | Address | Volume out | Attribution | Risk |
|---|---|---|---|---|
| B1 | bc1qqqqs2pje79fhd6aum8zssshek0c9zktcnkswct | ₿0.00005473 | Unattributed | MEDIUM |
Two dominant funders account for the entire substantive balance: bc1q...u53az (76.7%, ₿1,650 across 3 deposit events, 11 prior txs) and bc1q...07qtx (23.3%, ₿500 in 1 deposit event, 17 prior txs). Both funders are fully unattributed — no VASP, exchange, or entity label on either. The 5-hop origination trace from the primary funder reveals institutional-scale BTC holdings at every hop (1,193 → 2,060 → 3,551 → 1,817 BTC); the Hop 2 address holds 5,049 BTC and is the primary extended investigation target. All five traced addresses are native SegWit (bc1q format), consistent with post-2018 infrastructure. Zero outflows except a single 0.000071 BTC pre-deployment test transaction. No exchange, VASP, or entity label appears within the 5-hop window.
Account Structure · Protocol Interactions · Threat Exposure
| Address Type | Native SegWit — P2WPKH (bc1q format, Bech32 encoding) |
| Script Encoding | P2WPKH — Pay-to-Witness-Public-Key-Hash; single-key SegWit standard |
| UTXO Count | 6 active UTXOs (1 test-receive dust + 5 deposit UTXOs across 4 block events) |
| Clustering | Arkham — 'BTC Whale' (generic size label, not entity attribution) |
| Service Label | None — fully unattributed across all intelligence sources |
| VASP Exposure | None confirmed — no exchange, OTC, or custodian interaction detected in on-chain data |
| Wallet Software | Unknown — SegWit P2WPKH consistent with modern hardware wallet or institutional custody system |
| Category | Status |
|---|---|
| Exchange Deposits / Withdrawals | NONE none confirmed |
| DeFi / Smart Contract Interaction | NONE |
| Lightning Network Channels | NONE |
| Ordinals / Inscriptions | NONE |
| Mixing / CoinJoin Services | NONE |
| Cross-Chain Bridges | NONE |
| Sanctions-Listed Address Contact | NONE |
This SegWit address holds ₿2,150.003 (~$152.7M) accumulated across four exact round-lot deposits over 145 days. Arkham assigns only the generic "BTC Whale" label; the wallet is fully unattributed across all sources. The transaction pattern — setup test, 53-day delay, then four block deposits (1,300 / 250 / 100 / 500 BTC) — with strict weekday-only timing and 14–16 UTC peak hours is consistent with OTC desk settlement or institutional accumulation. The AML rating is LOW-MEDIUM driven by the structuring pattern indicator; no confirmed contamination or adverse counterparty identified.
| CRITERION | FINDING | ASSESSMENT | |
| 1. Sanctions (OFAC/EU/UN) | CLEAR | ||
| 2. Fraud/Scam Exposure | CLEAR | ||
| 3. Ransomware/Darknet | CLEAR | ||
| 4. Mixer/CoinJoin | CLEAR | ||
| 5. Exchange Source Verif. | LOW | ||
| 6. Structuring/Layering | MONITOR | ||
| 7. Third-Party Risk | CLEAR | ||
| 8. Address Poisoning | CLEAR |
The investigation identifies this wallet as a high-probability institutional accumulation address with an unresolved structuring indicator requiring follow-up investigation. The most likely operational scenario is OTC block-trade settlement (55%) or scheduled institutional acquisition (30%). The 145-day observation window and ₿2,150 accumulated value place this in the significant monitoring tier. Recommended next step is counterparty attribution on both dominant funders, which would either confirm a legitimate exchange/OTC source and reduce the AML risk rating, or identify an unattributed chain warranting deeper tracing.
Flagged Patterns & Significant Observations
| ID | Date | Event | Severity | Significance |
| A-01 | 2025-12-29 | Round-Lot Deposit Series Begins. First of four exact round-lot BTC deposits (₿1,299.999) received from primary funder; initiates a pattern of 1,300 / 250 / 100 / 500 BTC block transfers across 94 days. | NOTABLE | Statistically improbable coincidence across four deposits; consistent with OTC block-trade settlement or deliberate structuring — requires attribution investigation to resolve. |
| A-02 | LIFETIME | Zero Weekend Activity. All 9 transactions occur Monday–Friday across the 145-day observation window; zero Saturday or Sunday activity. | NOTABLE | Near-impossible by coincidence across nine events; confirms institutionally operated infrastructure with business-hours mandate. |
| A-03 | 2025-11-07 | Test Transaction — Pre-Deployment Verification. 0.000055 BTC sent to bc1qqqqs2...kswct one day after address activation, before any substantial deposits were received. | LOW | Confirms deliberate institutional deployment protocol: address control verified before committing ₿2,150 in subsequent deposits. |
Unattributed SegWit accumulation wallet. ₿2,150 (~$152.7M) in four exact round-lot deposits, weekday-only, 14–16 UTC. Structuring indicator elevated for investigation. Primary hypothesis: OTC desk / institutional acquisition.
Hypothesis Assessment
The combination of exact round-lot deposit sizes (1,300 / 250 / 100 / 500 BTC), strict Monday–Friday operation, 14–16 UTC peak hours, and two consistent upstream funders is most consistent with an OTC block-trade settlement wallet or a programmatic institutional accumulation vehicle. OTC desks typically settle in round lots, operate during business hours, and use a small set of source wallets. The 145-day observation window and ₿2,150 accumulated at ~$152.7M supports an active acquisition program.
The round-lot pattern and weekday-only timing could also reflect a disciplined high-net-worth individual executing a dollar-cost averaging or scheduled purchase strategy, with deposits timed to business-day liquidity. The SegWit encoding and test transaction before the main deposits suggest technical competence. The two-funder structure (76.7% / 23.3%) could represent two separate exchange or OTC accounts consolidating into a single cold address.
The wallet may be a sub-wallet within a larger exchange or custodian infrastructure, receiving customer deposits or internal treasury movements in round lots. The strict weekday operation and absence of any outflows (except a single test transaction) is consistent with a receiving-only deposit address used by an institutional custodian. The absence of a VASP label on either funder weakens this hypothesis.
Probabilities sum to 100%. Attribution confidence: 55.
Government Records · Press Coverage · Research & Analytics · Blockchain Intelligence
Comprehensive open-source search across indexed press, blockchain analytics publications, regulatory databases, forum archives, and social media returned zero references to this address. For a wallet holding $152.7M, the complete absence of any public footprint is itself a significant finding — the operator maintains strict operational security with no traceable public profile in any open-source channel. This is consistent with the institutional or high-HNWI custody hypothesis and distinguishes this address from retail or semi-public holders of comparable scale.
Priority Actions & Engagement Opportunities
| P1 | Attribute Primary Funder Wallets — Run extended attribution on bc1qkdfcsghv5dvh63z0dmk857338afxypcm0u53az and bc1q8zpww6mafnnjzpeg8lykh8cxjkrjleman07qtx using Chainalysis/Elliptic or expanded Arkham graph analysis; confirmed VASP attribution would substantially reduce the structuring risk rating. · OSINT |
| P2 | Trace Hop 2 Address — Expand origination trace on the 5,049 BTC Hop 2 address; institutional-scale holder at this depth may have exchange or OTC desk attribution not visible in the 5-hop window. · On-chain |
| P3 | Document Structuring Indicator — Formally document the round-lot deposit pattern (1,300 / 250 / 100 / 500 BTC, weekday-only, 145 days) in your AML case management system; this constitutes a pattern that may require SAR filing depending on jurisdiction and the outcome of funder attribution. · Regulatory |
| P4 | Monitor for Outflow Activity — Set alert for any outbound transaction from this wallet; the first outflow will reveal the downstream use of the accumulated ₿2,150 and provide critical information for determining whether the accumulation was legitimate or structuring-motivated. · On-chain |
Elevated due diligence is warranted. Document the structuring indicator formally. Prioritize attribution of the two dominant funder wallets — a confirmed VASP label would close the investigation; continued unattribution should escalate to SAR consideration depending on your jurisdiction's thresholds. Set an outbound movement alert; the first disbursement from this ₿2,150 position will be the decisive investigative event.
| REF | SOURCE |
|---|---|
| S-01 | Blockchain.com — Bitcoin Address Explorer https://www.blockchain.com/explorer/addresses/btc/bc1qw344rm… Full BTC transaction history via blockchain.com API. Primary quantitative data source. Retrieved 2026-06-01. |
| S-02 | OKLink — BTC Address Detail & Counterparty Profiles https://www.oklink.com/btc/address/bc1qw344rmvdss4yx3qytpr9l… Balance, UTXO count, inscription tokens, counterparty sub-profiles. Retrieved 2026-06-01. |
| S-03 | Arkham Intelligence — Entity & Portfolio Profile https://intel.arkm.com/explorer/address/bc1qw344rmvdss4yx3qy… Entity label and portfolio value snapshot. Retrieved 2026-06-01. |
| S-04 | Mempool.space — Bitcoin Mempool Explorer https://mempool.space/address/bc1qw344rmvdss4yx3qytpr9lwdlcn… Mempool status and last confirmed transaction. Retrieved 2026-06-01. |
| S-05 | WalletExplorer — Cluster Attribution https://www.walletexplorer.com/address/bc1qw344rmvdss4yx3qyt… Cluster label from WalletExplorer API. Retrieved 2026-06-01. |
| S-06 | OFAC SDN List — Sanctions Screen https://sanctionssearch.ofac.treas.gov Sanctions screen against OFAC Specially Designated Nationals list. Retrieved 2026-06-01. |
| S3 | Arkham -- Address Profile https://intel.arkm.com/explorer/address/bc1qw344rmvdss4yx3qy… Screenshot captured 2026-06-01. File: screenshot_arkham.png |
| S4 | Blockchain -- Address Profile https://www.blockchain.com/explorer/addresses/btc/bc1qw344rm… Screenshot captured 2026-06-01. File: screenshot_blockchain.png |
| S5 | Oklink -- Address Profile https://www.oklink.com/btc/address/bc1qw344rmvdss4yx3qytpr9l… Screenshot captured 2026-06-01. File: screenshot_oklink.png |
| S6 | Mempool -- Address Profile https://mempool.space/address/bc1qw344rmvdss4yx3qytpr9lwdlcn… Screenshot captured 2026-06-01. File: screenshot_mempool.png |
| TERM | DEFINITION |
|---|---|
| P2WPKH (Pay-to-Witness-Public-Key-Hash) | Bitcoin's native SegWit address format (bc1q prefix) introduced in 2017, offering lower transaction fees and improved security over legacy P2PKH addresses. |
| Round-Lot Deposit | A transfer in an exact round figure (e.g., 100, 250, 500 BTC) as opposed to an organic fractional amount; commonly associated with OTC block-trade settlement or programmatic institutional purchasing. |
| OTC (Over-the-Counter) Trade | A bilateral Bitcoin transaction negotiated directly between parties outside of an exchange order book, typically used for large blocks where exchange liquidity would cause adverse price movement. |
| Structuring | The practice of breaking large transactions into smaller amounts to avoid currency reporting thresholds; a financial crime under most AML frameworks when done with intent to evade reporting. |