KALLISTI BLOCKCHAIN FORENSICS
ETH native (Ethereum mainnet)
---
Target Wallet Address
0x126fFb737f37e0d57e3C00d8F227F1a7706bCaF9
Report Date: 2026-06-10 · Prepared by Kallisti Blockchain Forensics
Wallet Identity · Financial Overview · Holdings · Activity Patterns · Account Structure
| Entity | 0x126fFb737f37e0d57e3C00d8F227F1a7706bCaF9 |
| Blockchain | Ethereum mainnet · ETH native |
| Account Age | 249 days since creation ‖ Active: 2025-10-03 19:16:47 UTC → 2025-10-03 19:25:23 UTC (9-min window) |
| ETH Balance | Ξ0.00003255 |
| Total Received | Ξ0.00009013 |
| Total Sent | Ξ0.00000000 |
| Transactions | 3 on-chain (1 in · 0 out) · 1 counterparties |
This address is classified as a single-use USDT deposit relay — an EOA created to receive ETH gas funding and immediately transfer ERC-20 USDT to an exchange (OKX), after which it was permanently abandoned. This pattern is characteristic of privacy-conscious individual depositors or automated exchange deposit address management systems; it is not indicative of mixing, layering, or structuring.
The native ETH inflow (Ξ0.00009013, ~$0.15) is gas-only — negligible in value. The primary economic activity is the ~$207,083 USDT transfer, attributed by Arkham to OKX. This is a retail-to-institutional-scale single event; no size distribution can be assessed from a one-transaction dataset.
Gas consumed: approximately Ξ0.0000576 (~$0.10) — consistent with a single ERC-20 transfer operation. Residual balance Ξ0.00003255 represents unused gas float. No DeFi, bridge, or multi-contract interactions detected.
Single-counterparty, single-session account. No address reuse. The gas funder (0x58a1…e765) is a separate unattributed address — consistent with a privacy-preserving practice of funding deposit addresses from a dedicated gas wallet rather than directly from a personal account.
All activity is contained within a single 9-minute window on 2025-10-03 at UTC hour 19 — the only non-zero bin in both the hourly (index 19, count 2) and DOW (Friday, index 4, count 2) distributions. UTC 19 maps to 14:00–15:00 ET or 20:00–21:00 CET; no meaningful timezone inference is possible from a single event.
The sequencing — separate address funds gas, target receives USDT, USDT swept within minutes, address abandoned — is consistent with programmatic execution. Manual deposit workflows typically include delays between steps; the 9-minute total duration and the use of a dedicated gas funder point toward automation, though a single event cannot confirm this conclusively.
| S1 | Etherscan — Ethereum Address Explorer · etherscan.io/address/0x126fFb737f37e0d57e3C00d8F227F1a7706bC… |
| S2 | OKLink — ETH Address Detail · www.oklink.com/eth/address/0x126fFb737f37e0d57e3C00d8F227F1a… |
Counterparty Map · Inflow Architecture · Outflow Architecture
Upstream · Top 5 Funders
| ID | Address | Volume in | Attribution | Risk |
|---|---|---|---|---|
| A1 | 0x58a1eeea77b3509f8f9a0b8f4a7c21439935e765 | Ξ0.00009013 | Unattributed | MEDIUM |
Downstream · Top 5 Destinations
| ID | Address | Volume out | Attribution | Risk |
|---|---|---|---|---|
| B1 | OKX.HotWallet.ETH | ~$207,083 USDT | OKX Hot Wallet (Arkham) | MEDIUM |
Account Structure · Protocol Interactions · Threat Exposure
| Address Type | Externally Owned Account (EOA) — standard Ethereum address |
| Script Encoding | EIP-55 checksummed hex (0x prefix) |
| UTXO Count | N/A — Ethereum account model |
| Clustering | No Arkham entity cluster assigned to target address |
| Service Label | Unattributed — Etherscan, OKLink, Arkham return no entity label |
| VASP Exposure | OKX (outflow destination, Arkham-attributed) |
| Wallet Software | Unknown — consistent with programmatic key generation |
| Category | Status |
|---|---|
| Exchange Deposits / Withdrawals | REVIEW OKX — ~$207,083 USDT deposit (Arkham, 2025-10-03; pending ERC-20 tab verification) |
| DeFi / Smart Contract Interaction | LIMITED ERC-20 transfer only (USDT contract 0xdac17f…); no DeFi protocol interaction detected |
| Lightning Network Channels | N/A N/A — Ethereum mainnet |
| Ordinals / Inscriptions | N/A N/A — Ethereum mainnet |
| Mixing / CoinJoin Services | NONE |
| Cross-Chain Bridges | NONE None detected |
| Sanctions-Listed Address Contact | NONE |
This address is a minimal-footprint Ethereum EOA whose sole economic activity was an Arkham-attributed ~$207,083 USDT deposit to OKX, executed within a 9-minute window on 2025-10-03. The address has been dormant for approximately 249 days. AML exposure is low — OKX is a regulated VASP and the destination is institutional-grade infrastructure — but the upstream provenance of the $207K USDT remains unresolved and warrants verification.
| CRITERION | FINDING | ASSESSMENT | |
| 1. Sanctions (OFAC/EU/UN) | CLEAR | ||
| 2. Fraud/Scam Exposure | CLEAR | ||
| 3. Ransomware/Darknet | CLEAR | ||
| 4. Mixer/CoinJoin | CLEAR | ||
| 5. Exchange Source Verif. | MONITOR | ||
| 6. Structuring/Layering | CLEAR | ||
| 7. Third-Party Risk | MONITOR | ||
| 8. Address Poisoning | CLEAR |
AML exposure is assessed as LOW. No sanctions designation, fraud record, ransomware attribution, or mixer interaction exists for this address or its counterparties. The outflow destination (OKX) is a regulated exchange. Two criteria are elevated modestly above baseline: Exchange Source Verif. (0.25) reflects the unresolved upstream USDT origin — the source of funds prior to this address has not been traced and cannot be cleared from available data; Third-Party Risk (0.12) reflects the unattributed gas funder. No structuring, layering, or poisoning patterns are present.
Flagged Patterns & Significant Observations
| ID | Date | Event | Severity | Significance |
| A-01 | 2025-10-03 | 9-Minute Active Window. Address received ETH gas at 19:16 UTC and completed all operations by 19:25 UTC; dormant for 249+ days since. | NOTABLE | Consistent with scripted or purpose-built single-use address; indicative of automated exchange deposit workflow. |
No notable adverse events. The address’s complete operational history is a single 9-minute session on 2025-10-03: ETH gas receipt, USDT sweep to OKX, then 249 days of dormancy.
Hypothesis Assessment
Probabilities sum to 100%. Attribution confidence: LOW.
This address is fully unattributed. The Arkham-attributed OKX deposit provides a probable endpoint for the $207K USDT — suggesting the operator is an OKX account holder — but does not identify the individual or entity. Confirming the USDT transfer via Etherscan’s ERC-20 tab and tracing the upstream source of the USDT are the minimum steps required to advance attribution.
Government Records · Press Coverage · Research & Analytics · Blockchain Intelligence
Single inflow node (gas funder); single inferred outflow (OKX USDT deposit); no multi-hop ETH tracing possible.
Priority Actions & Engagement Opportunities
| P1 | Verify USDT Transfer via Etherscan ERC-20 Tab — Retrieve ERC-20 token transfer records for 0x126fFb737f37e0d57e3C00d8F227F1a7706bCaF9 to confirm the $207,083 USDT figure, exact destination address, and transaction hash · On-chain |
| P2 | Trace Upstream USDT Source — Identify the address that transferred $207K USDT to this wallet prior to the OKX deposit — this is the provenance gap that determines AML clearance · On-chain |
| P3 | Investigate Gas Funder 0x58a1…e765 — Trace 0x58a1eeea77b3509f8f9a0b8f4a7c21439935e765 (Ξ0.452, 10 txs) to determine whether it is a personal gas wallet, automated dispenser, or exchange-linked account · On-chain |
This address presents a low but incompletely resolved risk profile. The OKX destination — a regulated, globally licensed exchange — provides a legitimate endpoint for the $207K USDT transit. The primary unresolved question is the upstream source: funds entered this address from an unknown origin before being swept to OKX, and no provenance evidence is available from the data collected. Recommended priority is ERC-20 transfer verification (P1) followed by upstream tracing (P2). Absent adverse findings in those steps, this case is consistent with a privacy-conscious individual depositing personal funds to OKX via a fresh address.
| REF | SOURCE |
|---|---|
| S-01 | Etherscan — Ethereum Address Explorer https://etherscan.io/address/0x126fFb737f37e0d57e3C00d8F227F… Full ETH transaction history and ERC-20 token transfers via Etherscan API. Retrieved 2026-06-10. |
| S-02 | OKLink — ETH Address Detail & Counterparty Profiles https://www.oklink.com/eth/address/0x126fFb737f37e0d57e3C00d… Balance, token holdings, and counterparty sub-profiles via OKLink. Retrieved 2026-06-10. |
| S-03 | Arkham Intelligence — Entity & Portfolio Profile https://intel.arkm.com/explorer/address/0x126fFb737f37e0d57e… Entity label and portfolio value snapshot. Retrieved 2026-06-10. |
| S-04 | OFAC SDN List — Sanctions Screen https://sanctionssearch.ofac.treas.gov Sanctions screen against OFAC Specially Designated Nationals list. Retrieved 2026-06-10. |
| S3 | Arkham -- Address Profile https://intel.arkm.com/explorer/address/0x126fFb737f37e0d57e… Screenshot captured 2026-06-10. File: screenshot_arkham.png |
| S4 | Etherscan -- Address Profile https://etherscan.io/address/0x126fFb737f37e0d57e3C00d8F227F… Screenshot captured 2026-06-10. File: screenshot_etherscan.png |
| S5 | Oklink -- Address Profile https://www.oklink.com/eth/address/0x126fFb737f37e0d57e3C00d… Screenshot captured 2026-06-10. File: screenshot_oklink.png |
| TERM | DEFINITION |
|---|---|
| EOA | Externally Owned Account — a standard Ethereum address controlled by a private key, as distinct from a smart contract address. |
| ERC-20 | Ethereum token standard governing fungible assets such as USDT; transfers appear in a separate token transfer log from native ETH transactions. |
| Gas | Computational fee paid in ETH to execute Ethereum transactions, including ERC-20 token transfers; consumed regardless of the value transferred. |
| VASP | Virtual Asset Service Provider — a regulated exchange, custodian, or broker subject to AML/KYC obligations under FATF guidelines. |