KALLISTI BLOCKCHAIN FORENSICS
TRC-20 (USDT primary asset) + native TRX
---
Target Wallet Address
TG9n9mHxbYfwVjizac1WaEoQ8ELfExPBCp
Report Date: 2026-05-30 · Prepared by Kallisti Blockchain Forensics
Wallet Identity · Financial Overview · Holdings · Activity Patterns · Account Structure
| Entity | Bybit |
| Blockchain | TRON mainnet · TRC-20 USDT wallet |
| Account Age | 410 days (1.12 years) ‖ Active: 2025-02-28 15:06:45 UTC → 2026-04-15 12:07:57 UTC |
| TRX Balance | 145.2150 TRX |
| Transactions | 29 total · 27 USDT transfers (21 in · 6 out) · 10 counterparties |
| Total USDT In | $275.00M |
| Total USDT Out | $243.50M |
| Net Balance | $31.50M |
Bybit internal reserve address — operates as a unidirectional accumulation pool with periodic large sweeps back to the parent infrastructure address. Receives tranches from Bybit's main deposit/withdrawal hub and sweeps balances in bulk; no retail or external counterparty interaction. Arkham labels it "Bybit Proof of Reserves," consistent with its low-frequency, high-value cycling behaviour.
All material transfers are institutional round figures: $25M (×6), $30M, $20M inbound; $49M (×1), $46M (×1), $49.5M (×3) outbound. Median inflow: $25M. Outflow sweeps are consistently larger ($46–49.5M), indicating the wallet aggregates before each sweep rather than maintaining a fixed ceiling. No retail-scale or sub-$1M transfers in either direction.
Single TRON EOA; no multisig. TRX balance of 145.22 TRX is a minimal pre-funded gas reserve (energy staked: 0; bandwidth: free tier only) — never replenished, consistent with a set-and-forget automated address. At 29 transactions over 410 days (~0.07/day), activity frequency is extremely low for an address of this balance size, reinforcing reserve rather than hot-wallet classification.
Monday accounts for 37% of all transfer events (10/27), with Tuesday (19%) and Wednesday (15%) following — strong front-of-week weighting and zero Sunday activity. Hourly peaks cluster at UTC 08–09 (12 events combined) and UTC 12–15 (9 events); near-zero outside UTC 05–16. UTC+4 (Dubai) maps these peaks to 12:00–20:00 local — core Gulf business hours; UTC+8 (Singapore) yields 16:00–00:00, plausible for evening batch processing. The Monday-dominant cadence and Gulf hours alignment are consistent with Bybit's UAE operational base.
Six outflow sweeps of near-identical size ($46–49.5M) and six consecutive $25M inflows on a single day (2025-05-05) confirm scripted batch execution. Transaction intervals are irregular in calendar spacing but volume-regular — consistent with threshold-triggered automation rather than manual scheduling. Not a user-operated wallet.
| S1 | Tronscan — On-chain dataset · tronscan.org/#/address/TG9n9mHxbYfwVjizac1WaEoQ8ELfExPBCp |
| S2 | OKLink — TRON Address Detail · www.oklink.com/tron/address/TG9n9mHxbYfwVjizac1WaEoQ8ELfExPB… |
Counterparty Map · Inflow Architecture · Outflow Architecture
Upstream · Top 5 Funders
| ID | Address | Volume in | Attribution | Risk |
|---|---|---|---|---|
| A1 | TU4vEruvZwLLkSfV9bNw12EJTPvNr7Pvaa | $275.00M | Bybit. DepositAndWithdraw_6 | LOW |
| A2 | TMjcixF3oJjxsuGycRAG7gTMV93EokbFGD | $291.00 | Unattributed | MEDIUM |
| A3 | TJqwA7SoZnERE4zW5uDEiPkbz4B66h9TFj | $100.80 | Binance. Withdraw_22 | LOW |
| A4 | TQm6EUvDcKKVSHjaYJ97QxeBBazKnNoX1K | $19.00 | Unattributed | MEDIUM |
| A5 | TAzsQ9Gx8eqFNFSKbeXrbi45CuVPHzA8wr | $13.69 | Binance. Withdraw_18 | LOW |
Downstream · Top 5 Destinations
| ID | Address | Volume out | Attribution | Risk |
|---|---|---|---|---|
| B1 | TU4vEruvZwLLkSfV9bNw12EJTPvNr7Pvaa | $243.50M | Bybit. DepositAndWithdraw_6 | MEDIUM |
Account Structure · Protocol Interactions · Threat Exposure
| Address Type | TRON EOA — standard account model |
| Script Encoding | TRC-20 USDT contract (TR7NHqjeKQxGTCi8q8ZY4pL8otSxgjPvFm) |
| UTXO Count | N/A — TRON account model |
| Clustering | Bybit entity cluster (Arkham Intelligence) — Proof of Reserves sub-address |
| Service Label | Bybit (Arkham · OKLink) |
| VASP Exposure | Bybit — 100% of material volume; Binance — dust probes (<$115 total) |
| Wallet Software | Exchange infrastructure — automated |
| Category | Status |
|---|---|
| Exchange Deposits / Withdrawals | ACTIVE 100% — all flow to/from Bybit. DepositAndWithdraw_6 (...EJTPvNr7Pvaa) |
| DeFi / Smart Contract Interaction | NONE |
| Lightning Network Channels | N/A N/A — TRON network |
| Ordinals / Inscriptions | N/A N/A — TRON network |
| Mixing / CoinJoin Services | NONE |
| Cross-Chain Bridges | NONE |
| Sanctions-Listed Address Contact | NONE |
TG9n9mHxbYfwVjizac1WaEoQ8ELfExPBCp is a confirmed Bybit exchange address on TRON, classified by Arkham Intelligence as a Proof of Reserves wallet. All $275M in throughput is attributable to Bybit's internal infrastructure; counterparty concentration to a single Bybit address is expected for this wallet type. AML screening returns no adverse findings across all eight criteria. The address presents no risk to counterparties and requires no regulatory escalation.
| CRITERION | FINDING | ASSESSMENT | |
| 1. Sanctions (OFAC/EU/UN) | CLEAR | ||
| 2. Fraud/Scam Exposure | CLEAR | ||
| 3. Ransomware/Darknet | CLEAR | ||
| 4. Mixer/CoinJoin | CLEAR | ||
| 5. Exchange Source Verif. | CLEAR | ||
| 6. Structuring/Layering | CLEAR | ||
| 7. Third-Party Risk | CLEAR | ||
| 8. Address Poisoning | CLEAR |
This report covers TG9n9mHxbYfwVjizac1WaEoQ8ELfExPBCp, a TRON TRC-20 USDT address confirmed as part of Bybit's Proof of Reserves infrastructure. The wallet processed $275M in and $243.5M out over 410 days (February 2025 – April 2026), with all material volume cycling exclusively between Bybit internal addresses. AML risk is CLEAR across all eight screening criteria. Attribution confidence is high across all three independent intelligence sources consulted.
Flagged Patterns & Significant Observations
| ID | Date | Event | Severity | Significance |
| A-01 | 2025-05-05 | Six Consecutive $25M Inflows — $150M Single-Day Load. Six identical $25M tranches received from Bybit. DepositAndWithdraw_6 within a single day, totalling $150M. | NOTABLE | Confirms scripted batch reserve loading; no AML concern within Bybit infrastructure. |
| A-02 | 2025-12-15 | Q4 Sweep Cycle — Three $49.5M Outflows. Three outflow sweeps of $49.5M each across 14 days (Dec 15, 17, 29), totalling $148.5M — coincides with Bybit Q4 2025 PoR reporting window. | NOTABLE | Timing aligns with quarterly reserve attestation cycle; operationally expected. |
Confirmed Bybit Proof of Reserves address. AML: CLEAR. No adverse findings. Attribution: HIGH confidence.
Hypothesis Assessment
Probabilities sum to 100%. Attribution confidence: HIGH.
This is a confirmed Bybit exchange reserve address. All volume is internally attributed and AML risk is CLEAR. No investigation recommended beyond periodic balance verification against Bybit's published Proof of Reserves reports.
Government Records · Press Coverage · Research & Analytics · Blockchain Intelligence
Fund flow timeline reflects three operational phases: initial loading (Feb–May 2025), active cycling with sweeps (Aug–Dec 2025), and near-dormancy (Jan–Apr 2026).
Priority Actions & Engagement Opportunities
| P1 | PoR Balance Verification — Cross-reference current wallet balance ($31.5M) against the most recent Bybit Proof of Reserves publication to confirm continued inclusion in active reserve attestation. · OSINT |
| P2 | Activity Resumption Monitoring — Monitor for resumption of transfer activity — 45-day dormancy since 2026-04-15 may indicate address rotation. Flag if new large transfers appear. · On-chain |
No urgent action required. Two low-priority monitoring items: verify balance against next PoR publication; monitor for activity resumption or address rotation.
| REF | SOURCE |
|---|---|
| S1 | On-chain dataset -- TRC-20 Transfers https://tronscan.org/#/address/TG9n9mHxbYfwVjizac1WaEoQ8ELfE… Full TRC-20 transfer history via Tronscan API. Retrieved 2026-05-30. |
| S2 | On-chain dataset -- Raw Transactions https://tronscan.org/#/address/TG9n9mHxbYfwVjizac1WaEoQ8ELfE… Full transaction log via Tronscan API. Retrieved 2026-05-30. |
| S3 | Arkham -- Address Profile https://intel.arkm.com/explorer/address/TG9n9mHxbYfwVjizac1W… Screenshot captured 2026-05-30. File: screenshot_arkham.png |
| TERM | DEFINITION |
|---|---|
| Proof of Reserves (PoR) | A cryptographic attestation by an exchange that it holds sufficient assets to cover all customer balances, typically published quarterly using Merkle tree verification. |
| TRC-20 | The TRON blockchain standard for fungible tokens, analogous to Ethereum's ERC-20. USDT on TRON operates as a TRC-20 token. |
| DepositAndWithdraw | Bybit's internal address labelling convention for addresses that handle both customer deposit receipt and withdrawal disbursement operations. |
| Dust / Probe Transaction | A micro-transfer (often <$1) sent to a wallet to test address validity or monitor for activity — commonly used by exchanges for counterparty surveillance. |