KALLISTI BLOCKCHAIN FORENSICS
TRX-native (primary holding is TRX; zero USDT activity)
---
Target Wallet Address
TJ45EBCYKxRuxXhWUnWvpTYKfudbPDtunS
Report Date: 2026-06-05 · Prepared by Kallisti Blockchain Forensics
Wallet Identity · Financial Overview · Holdings · Activity Patterns · Account Structure
| Entity | TJ45EBCYKxRuxXhWUnWvpTYKfudbPDtunS |
| Blockchain | TRON mainnet · TRX-native wallet |
| Account Age | 21 days (0.06 years) ‖ Active: 2021-03-13 03:12:21 UTC → 2021-04-03 14:01:45 UTC |
| TRX Balance | 4.2384 TRX |
| Transactions | 516 total · 30 TRX transfers (23 in · 7 out) · 27 counterparties |
| Total TRX In | 663.0000 TRX |
| Total TRX Out | 396.0000 TRX |
| Net Balance | 267.0000 TRX |
Short-lived intermediary relay — single deployment. TJ45 receives TRX from one dominant source (75.4% of inflow), redistributes to five separate unattributed destinations via near-round disbursements, then ceases all operation with a near-zero residual balance. The pattern — single dominant funder, fan-out redistribution, abrupt abandonment — is consistent with a purpose-built relay or pass-through address deployed for a bounded operational window and decommissioned after task completion.
Inflows are micro-scale: 23 events averaging ~28.8 TRX (~$9 at March 2021 prices); range from 3 TRX (minimum) to ~161 TRX (single large receipt 2021-03-17). Outflows consolidate into 7 events averaging ~56.6 TRX (~$18): the five destinations receive 150, 100, 77, 43, and 26 TRX — near-round figures with no fee-adjustment basis. This rounding pattern across multiple small disbursements is a structuring-adjacent indicator, though the absolute amounts ($8–$48 per outflow at 2021 prices) are too small to independently constitute a layering scheme.
Standard TRON EOA (P2PKH-equivalent, base58check T-prefix). No DeFi, smart contract, staking, or energy delegation interaction detected. Address reuse is minimal — 27 distinct counterparties across 30 TRX transfers. The bidirectional counterparty TNmmt2L7rexaf9hJrFYfAzAavuUbMKAi5h (20 TRX in, 77 TRX out) suggests circular or network-internal routing. TRX float maintained at 4.24 TRX current; no bandwidth or energy delegation observed. Eight spam/airdrop token receipts (all < $1 USD) are consistent with passive TRON ecosystem airdrop exposure and carry no investigative significance.
DOW breakdown: Tuesday and Saturday dominate at 20.0% each; Thursday and Sunday near-dormant (6.7% and 3.3%). Hourly peak at 08 UTC (20.0%), secondary cluster at 11 UTC (13.3%) and 05–06 / 09 UTC (10.0% each). The 05–11 UTC active window maps to 08:00–14:00 local under UTC+3 (Iran/East Africa Standard Time) or 09:00–15:00 under UTC+4 (Gulf Standard Time) — both consistent with morning business hours. Hours 12–04 UTC are near-zero, further constraining probable operator timezone to UTC+3–5. The small sample (30 transfers, 21-day window) limits this inference to a working hypothesis rather than a determination.
No evidence of automation. Transfer intervals are irregular: the largest inter-event gap is 10 days (2021-03-20 to 2021-03-30), and most transfers cluster within the first 8 days of operation. Inbound event count (23) and outbound (7) are inconsistent with scripted batch processing. The 21-day lifecycle and low transaction count preclude automation pattern recognition.
| S1 | Tronscan — On-chain dataset · tronscan.org/#/address/TJ45EBCYKxRuxXhWUnWvpTYKfudbPDtunS |
| S2 | OKLink — TRON Address Detail · www.oklink.com/tron/address/TJ45EBCYKxRuxXhWUnWvpTYKfudbPDtu… |
Counterparty Map · Inflow Architecture · Outflow Architecture
Upstream · Top 5 Funders
| ID | Address | Volume in | Attribution | Risk |
|---|---|---|---|---|
| A1 | TVBqzmBcs1tgNBPpfLxucDYz9EqpAtaZbu | 500.0000 TRX | Unattributed | MEDIUM |
| A2 | TLeLLoqPqbdE11abx5VFCMNYaGyRtJnieW | 100.0000 TRX | Unattributed | MEDIUM |
| A3 | TStMXq5vktmKBHY3LorZFgdNbejPN1cQKF | 28.0000 TRX | Unattributed | MEDIUM |
| A4 | TNmmt2L7rexaf9hJrFYfAzAavuUbMKAi5h | 20.0000 TRX | Unattributed | MEDIUM |
| A5 | TF5UF5gh9gKoxpTu38LJtMvHWyJkTKJF6g | 15.0000 TRX | Unattributed | MEDIUM |
Downstream · Top 5 Destinations
| ID | Address | Volume out | Attribution | Risk |
|---|---|---|---|---|
| B1 | TNmg1Z5gYymasUfH7exF9DpMTyM9TWU99v | 150.0000 TRX | Unattributed | MEDIUM |
| B2 | TGXU3qPixzCpoB2RogFsqxDzhVoNv9X2NJ | 100.0000 TRX | Unattributed | MEDIUM |
| B3 | TNmmt2L7rexaf9hJrFYfAzAavuUbMKAi5h | 77.0000 TRX | Unattributed | MEDIUM |
| B4 | TNVc2xZwr5StBsgQrgCvwQd1MSu5jiQExt | 43.0000 TRX | Unattributed | MEDIUM |
| B5 | TNMXdUjwfWxsBRE9dobwxax4nwF7nP18N2 | 26.0000 TRX | Unattributed | MEDIUM |
Account Structure · Protocol Interactions · Threat Exposure
| Address Type | EOA — TRON standard account (P2PKH-equivalent) |
| Script Encoding | TRON base58check (T-prefix) |
| UTXO Count | N/A — TRON account model |
| Clustering | Unattributed — no Arkham entity cluster assigned |
| Service Label | None — no exchange or custodian label across Tronscan, OKLink, or Arkham |
| VASP Exposure | None confirmed |
| Wallet Software | Unknown |
| Category | Status |
|---|---|
| Exchange Deposits / Withdrawals | NONE |
| DeFi / Smart Contract Interaction | NONE |
| Lightning Network Channels | NONE |
| Ordinals / Inscriptions | NONE |
| Mixing / CoinJoin Services | NONE |
| Cross-Chain Bridges | NONE |
| Sanctions-Listed Address Contact | NONE |
TJ45EBCYKxRuxXhWUnWvpTYKfudbPDtunS presents a LOW-MEDIUM AML risk profile — attributable to universal counterparty anonymity and structuring-adjacent outflow patterns rather than any confirmed adverse finding. The sanctions screen is clear; OSINT is null; no fraud, darknet, or mixing exposure detected. The wallet's defining characteristics — ephemeral 21-day lifecycle, single-dominant-source funding structure, near-round disbursements, and abrupt abandonment — are consistent with a purpose-built intermediary used for a bounded operational task. The principal unresolved investigative gaps are the identity of the dominant inbound funder (TVBqzmBcs...AtaZbu, 75.4%, $2.46M sampled flow) and the Hop2 USD discrepancy requiring TRC-20 verification. Absent resolution of these gaps, no escalated action is indicated.
| CRITERION | FINDING | ASSESSMENT | |
| 1. Sanctions (OFAC/EU/UN) | CLEAR | ||
| 2. Fraud/Scam Exposure | CLEAR | ||
| 3. Ransomware/Darknet | CLEAR | ||
| 4. Mixer/CoinJoin | CLEAR | ||
| 5. Exchange Source Verif. | ANOMALOUS | ||
| 6. Structuring/Layering | ANOMALOUS | ||
| 7. Third-Party Risk | ANOMALOUS | ||
| 8. Address Poisoning | CLEAR |
Priority actions: (1) Obtain OKLink TRC-20 transfer detail for TJ45 and destination TNmg1Z5gYymasUfH7exF9DpMTyM9TWU99v to resolve the Hop2 USD anomaly ($94,923 attributed vs. ~$128 TRX-layer capacity). (2) Conduct independent investigation of dominant funder TVBqzmBcs1tgNBPpfLxucDYz9EqpAtaZbu — entity, transaction pattern, and network context. No SAR or regulatory escalation indicated absent adverse finding on counterparty investigation.
Flagged Patterns & Significant Observations
| ID | Date | Event | Severity | Significance |
| A-01 | 2021-04-03 | Wallet Abandonment — Ephemeral 21-Day Deployment. Wallet ceases all activity 21 days after activation with a 4.24 TRX residual (~$1.37 current). Residual is below usable outbound threshold without external TRX injection — consistent with deliberate decommissioning. | NOTABLE | Ephemeral single-deployment lifecycle warrants counterparty investigation to establish network context and operator identity. |
| A-02 | 2026-06-05 | Hop2 USD Data Anomaly — $94,923 vs ~$128 TRX Capacity. Hop2 sampling attributes $94,923 USD to TJ45 as a funder of top destination TNmg1Z5gYymasUfH7exF9DpMTyM9TWU99v — three orders of magnitude above the wallet's 396 TRX (~$128 at 2021 prices) total outflow capacity. | DATA GAP | Likely a TRC-20 token sampling artefact or smart-contract attribution error. Requires OKLink TRC-20 endpoint verification before treating as confirmed throughput. |
TJ45 receives 663 TRX from 5 counterparties (dominant: TVBqzmBcs...AtaZbu at 75.4% / 500 TRX; $2.46M sampled TRC-20 flow volume at that counterparty), redistributes 396 TRX to 5 destinations (dominant: TNmg1Z5...TWU99v at 37.9% / 150 TRX), and retains 4.24 TRX current on-chain balance. All counterparties unattributed. Hop2 profiling reveals the dominant funder processes $2.46M in TRC-20 flows — disproportionate to this wallet's micro-TRX profile. A Hop2 USD data anomaly ($94,923 attributed to TJ45) requires TRC-20 endpoint verification before treatment as confirmed throughput.
Hypothesis Assessment
Probabilities sum to 100%. Attribution confidence: LOW.
TJ45EBCYKxRuxXhWUnWvpTYKfudbPDtunS is a low-profile, ephemeral TRX relay deployed for 21 days in March–April 2021 and subsequently abandoned. Its defining characteristics — single-dominant-source funding (75.4%), near-round outflow disbursements across five unattributed destinations, and abrupt cessation — are consistent with a bounded intermediary function, most plausibly a semi-professional relay or OTC settlement address. The absence of OSINT, sanctions exposure, and confirmed adverse counterparties supports a LOW-MEDIUM risk classification. Two investigative gaps remain unresolved: the identity of the dominant inbound funder and a Hop2 USD data anomaly attributing $94,923 to this wallet — three orders of magnitude above its TRX-layer outflow capacity — which requires TRC-20 transfer verification before any throughput conclusion can be drawn.
Government Records · Press Coverage · Research & Analytics · Blockchain Intelligence
Null OSINT result across all open-source queries. No adverse finding; no public mention of this address in any indexed source. Sources limited to on-chain block explorers (Tronscan, OKLink).
Priority Actions & Engagement Opportunities
| P1 | Counterparty Attribution — Dominant Funder — Investigate TVBqzmBcs1tgNBPpfLxucDYz9EqpAtaZbu: entity identity, transaction pattern, TRC-20 token flows, and network affiliations. Scale ($2.46M sampled) inconsistent with subject wallet profile; may be a hub address in a wider unidentified cluster. · OSINT |
| P2 | TRC-20 Transfer Verification — Hop2 USD Anomaly — Query OKLink TRC-20 transfer endpoint for TJ45EBCYKxRuxXhWUnWvpTYKfudbPDtunS and TNmg1Z5gYymasUfH7exF9DpMTyM9TWU99v. Resolve whether $94,923 USD figure reflects an actual token transfer or a data aggregation artefact. Do not treat as confirmed throughput prior to verification. · On-chain |
| P3 | Dormancy Status — No Further Monitoring Required — Wallet inactive since 2021-04-03 (1,524+ days as of report date). Residual 4.24 TRX consistent with permanent abandonment. No active monitoring action recommended absent new transaction activity. · On-chain |
Priority action is counterparty attribution for TVBqzmBcs1tgNBPpfLxucDYz9EqpAtaZbu (dominant funder, 3,185 tx, $2.46M sampled TRC-20 volume). Secondary: resolve Hop2 USD anomaly via OKLink TRC-20 query for both TJ45 and top destination. No SAR, regulatory escalation, or law enforcement referral indicated absent adverse finding on counterparty investigation. Wallet is dormant — passive monitoring only.
| REF | SOURCE |
|---|---|
| S1 | On-chain dataset -- TRC-20 Transfers https://tronscan.org/#/address/TJ45EBCYKxRuxXhWUnWvpTYKfudbP… Full TRC-20 transfer history via Tronscan API. Retrieved 2026-06-05. |
| S2 | On-chain dataset -- Raw Transactions https://tronscan.org/#/address/TJ45EBCYKxRuxXhWUnWvpTYKfudbP… Full transaction log via Tronscan API. Retrieved 2026-06-05. |
| S3 | Arkham -- Address Profile https://intel.arkm.com/explorer/address/TJ45EBCYKxRuxXhWUnWv… Screenshot captured 2026-06-05. File: screenshot_arkham.png |
| S4 | Tronscan -- Address Profile https://tronscan.org/#/address/TJ45EBCYKxRuxXhWUnWvpTYKfudbP… Screenshot captured 2026-06-05. File: screenshot_tronscan.png |
| S5 | Oklink -- Address Profile https://www.oklink.com/tron/address/TJ45EBCYKxRuxXhWUnWvpTYK… Screenshot captured 2026-06-05. File: screenshot_oklink.png |
| TERM | DEFINITION |
|---|---|
| EOA | Externally Owned Account — a TRON wallet controlled by a private key, as distinct from a smart contract address. |
| Hop2 Analysis | Tracing transaction counterparties two steps removed from the subject wallet to identify upstream funders and downstream destinations at the network level. |
| Relay Wallet | A short-lived intermediary address that receives funds from one or more sources and redistributes them to multiple destinations, typically without accumulating a long-term balance. |
| TRX-native | A TRON wallet whose primary documented activity is in the network's native token TRX, as distinct from TRC-20 token (e.g., USDT) activity. |
| Structuring | Breaking up transactions into smaller amounts to avoid detection thresholds — a pattern indicator rather than a confirmed violation when amounts are micro-scale. |