KALLISTI BLOCKCHAIN FORENSICS
TRC-20 (USDT primary asset) + native TRX
---
Target Wallet Address
TKhXDEshLkYEYfaPzvKfEj8zCztSqDNUw2
Report Date: 2026-06-03 · Prepared by Kallisti Blockchain Forensics
Wallet Identity · Financial Overview · Holdings · Activity Patterns · Account Structure
| Entity | Bybit. Cold Wallet_2 |
| Blockchain | TRON mainnet · TRC-20 USDT wallet |
| Account Age | 87 days (0.24 years) ‖ Active: 2025-12-04 11:42:12 UTC → 2026-03-02 09:55:00 UTC |
| TRX Balance | 193.5715 TRX |
| Transactions | 3 total · 7 USDT transfers (6 in · 1 out) · 1 counterparties |
| Total USDT In | $100.00M |
| Total USDT Out | $5.38 |
| Net Balance | $100.00M |
Bybit Cold Wallet_2 exhibits pure-accumulation treasury behavior: $100,000,015 USDT inflow against $5.38 in outflows, yielding a $100M static balance held uninterrupted since 2025-12-22. The activation-probe-then-deploy sequence (10 USDT test send → return → $100M batch load) is a standard institutional cold wallet commissioning protocol. Arkham’s ‘Proof of Reserves’ designation further classifies this as a segregated attestation reserve rather than an active operational node.
All substantive inflows comprise four equal $25,000,000 USDT tranches dispatched on 2025-12-22 — a structured round-lot batch pattern signalling automated script execution rather than manual transfers. The $10 activation probe and $5.38 return constitute the commissioning bookends; the $5 liveness top-up (2026-03-02) confirms ongoing watchdog automation. No sub-institutional or retail-scale transactions are present; the size profile is consistent with enterprise treasury management at the $25M allocation unit.
Single-counterparty architecture: TU4vEruvZwLLkSfV9bNw12EJTPvNr7Pvaa (Bybit DepositAndWithdraw_6) is both sole source and sole destination, accounting for 100% of all value flows. TRX float of 193.5715 TRX (~$64.73) maintained for bandwidth and fee coverage with no staking or resource delegation; bandwidth limit 600 confirmed via Tronscan OCR. Two spam airdrops received (AML token, XCOM) are uninstructed dust of sub-$1 value and carry no operational relevance. The wallet functions as a fully closed bilateral node within Bybit’s internal treasury infrastructure.
Seven events span UTC 03 (4 events, 57%), UTC 09 (1), UTC 10 (1), and UTC 11 (1); dead window covers UTC 04–08 and UTC 12–23 (zero events, 20 of 24 hours). UTC 03 maps to 11:00 AM SGT (UTC+8) — primary business hours at Bybit’s Singapore HQ; UTC 09–11 maps to 17:00–19:00 SGT. DOW: Monday 71.4%, Thursday 14.3%, Friday 14.3% — Monday dominance reflects the Dec 22 capitalization batch and Mar 2 top-up, suggesting institutional treasury operations are scheduled at the start of the working week. Probable operator timezone: UTC+8 (Singapore/Hong Kong).
Strongly automated. The four $25M tranches on 2025-12-22 were dispatched in sequential round lots within a narrow UTC 03 window, characteristic of a programmatic treasury allocation routine. The $5 maintenance probe on 2026-03-02 follows a 70-day interval from the Dec 22 capitalization, consistent with a scheduled watchdog check. No manual timing irregularities detected; the wallet exhibits no spontaneous outflows or variable-lot activity across its 87-day lifespan.
| S1 | Tronscan — On-chain dataset · tronscan.org/#/address/TKhXDEshLkYEYfaPzvKfEj8zCztSqDNUw2 |
| S2 | OKLink — TRON Address Detail · www.oklink.com/tron/address/TKhXDEshLkYEYfaPzvKfEj8zCztSqDNU… |
Counterparty Map · Inflow Architecture · Outflow Architecture
Upstream · Top 5 Funders
| ID | Address | Volume in | Attribution | Risk |
|---|---|---|---|---|
| A1 | TU4vEruvZwLLkSfV9bNw12EJTPvNr7Pvaa | $100.00M | Bybit. DepositAndWithdraw_6 | LOW |
Downstream · Top 5 Destinations
| ID | Address | Volume out | Attribution | Risk |
|---|---|---|---|---|
| B1 | TU4vEruvZwLLkSfV9bNw12EJTPvNr7Pvaa | $5.38 | Bybit. DepositAndWithdraw_6 | MEDIUM |
Account Structure · Protocol Interactions · Threat Exposure
| Address Type | TRON Base58 EOA (Externally Owned Account) |
| Script Encoding | TRC-20 USDT — smart contract token transfer (TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t) |
| UTXO Count | N/A — TRON account-based model |
| Clustering | Bybit cluster: ‘Cold Wallet_2’ (OKLink) / ‘Bybit Proof of Reserves Centralized Exchange’ (Arkham) |
| Service Label | Bybit — Centralised Exchange (Singapore); dual-source confirmed |
| VASP Exposure | 100% Bybit institutional — Bybit DepositAndWithdraw_6 (72.9M-tx hub, $161M balance); no external VASP contact |
| Wallet Software | Institutional custody system — automated treasury management; specific software unknown |
| Category | Status |
|---|---|
| Exchange Deposits / Withdrawals | ACTIVE Bybit DepositAndWithdraw_6 — 100% of all flows; no external exchange interaction |
| DeFi / Smart Contract Interaction | NONE No DeFi, DEX, or protocol interaction detected |
| Lightning Network Channels | N/A TRON network — not applicable |
| Ordinals / Inscriptions | N/A TRON network — not applicable |
| Mixing / CoinJoin Services | NONE No mixing or privacy protocol contact |
| Cross-Chain Bridges | NONE No cross-chain bridge activity detected |
| Sanctions-Listed Address Contact | NONE All counterparties confirmed Bybit institutional infrastructure |
No OFAC, EU, or UN sanctioned address contact detected. Bybit operates as a regulated VASP in applicable jurisdictions. The sole counterparty (Bybit DepositAndWithdraw_6) is a confirmed Bybit institutional address with no sanctions nexus. Sanctions risk: NONE.
| CRITERION | FINDING | ASSESSMENT | |
| 1. Sanctions (OFAC/EU/UN) | CLEAR | ||
| 2. Fraud/Scam Exposure | CLEAR | ||
| 3. Ransomware/Darknet | CLEAR | ||
| 4. Mixer/CoinJoin | CLEAR | ||
| 5. Exchange Source Verif. | CLEAR | ||
| 6. Structuring/Layering | CLEAR | ||
| 7. Third-Party Risk | CLEAR | ||
| 8. Address Poisoning | CLEAR |
The primary notable event is the four-tranche $100M capitalization on 2025-12-22 — institutionally significant in scale and structurally consistent with a Proof of Reserves reserve positioning event preceding a Bybit PoR attestation cycle. No adverse anomalies detected. The $10 test probe (2025-12-04), $5.38 return (2025-12-12), and $5 maintenance top-up (2026-03-02) are standard institutional commissioning and watchdog behaviors with no investigative concern.
Flagged Patterns & Significant Observations
| ID | Date | Event | Severity | Significance |
| A-01 | 2025-12-22 | Quadruple Round-Lot Capitalization — $100M. Four sequential $25,000,000 USDT tranches dispatched from Bybit DepositAndWithdraw_6 on a single calendar day, completing the wallet’s full reserve position in one automated batch. | NOTABLE | Consistent with automated treasury allocation or Proof of Reserves pre-attestation positioning; no adverse implication. |
Bybit Cold Wallet_2 — $100M USDT institutional cold reserve confirmed at HIGH attribution confidence (OKLink + Arkham dual-source); AML CLEAR across all eight dimensions; operational profile consistent with Bybit Proof of Reserves programme.
Hypothesis Assessment
Probabilities sum to 100%. Attribution confidence: HIGH.
This wallet is Bybit Cold Wallet_2 — a $100M USDT institutional reserve address attributed at HIGH confidence to the Bybit centralised exchange (Singapore). The wallet was capitalized in four equal $25M tranches on 2025-12-22 from Bybit DepositAndWithdraw_6 and has remained dormant since, consistent with Bybit’s published Proof of Reserves programme. AML profile is fully clear; no investigative concern is indicated. Cross-reference Bybit’s Merkle tree snapshots to confirm attestation inclusion.
Government Records · Press Coverage · Research & Analytics · Blockchain Intelligence
No open-source OSINT hits were returned for this address (NULL_RESULT). Institutional attribution confirmed exclusively via on-chain analytics platforms (OKLink, Arkham). Bybit’s official Proof of Reserves publication is cited per PoR wallet conventions as the relevant institutional reference.
Priority Actions & Engagement Opportunities
| P1 | Verify PoR Merkle Inclusion — Cross-reference this address against Bybit’s published Proof of Reserves Merkle tree snapshots to confirm attestation inclusion and verify that the 2025-12-22 capitalization date aligns with a published PoR attestation cycle. · On-chain |
| P2 | Passive Outflow Monitoring — Flag any outflow event exceeding $1M USDT for review — a material departure from a designated cold reserve would constitute a significant treasury movement warranting notification. · On-chain |
No immediate investigative action required. Cross-reference Bybit PoR Merkle snapshots to confirm attestation inclusion; maintain passive monitoring for material outflow events.
| REF | SOURCE |
|---|---|
| S1 | On-chain dataset -- TRC-20 Transfers https://tronscan.org/#/address/TKhXDEshLkYEYfaPzvKfEj8zCztSq… Full TRC-20 transfer history via Tronscan API. Retrieved 2026-06-03. |
| S2 | On-chain dataset -- Raw Transactions https://tronscan.org/#/address/TKhXDEshLkYEYfaPzvKfEj8zCztSq… Full transaction log via Tronscan API. Retrieved 2026-06-03. |
| S3 | Arkham -- Address Profile https://intel.arkm.com/explorer/address/TKhXDEshLkYEYfaPzvKf… Screenshot captured 2026-06-03. File: screenshot_arkham.png |
| S4 | Tronscan -- Address Profile https://tronscan.org/#/address/TKhXDEshLkYEYfaPzvKfEj8zCztSq… Screenshot captured 2026-06-03. File: screenshot_tronscan.png |
| S5 | Oklink -- Address Profile https://www.oklink.com/tron/address/TKhXDEshLkYEYfaPzvKfEj8z… Screenshot captured 2026-06-03. File: screenshot_oklink.png |
| TERM | DEFINITION |
|---|---|
| Proof of Reserves (PoR) | An exchange’s on-chain demonstration that it holds sufficient assets to back all customer deposits, typically verified via cryptographic Merkle tree attestation audited by a third party. |
| Cold Wallet | A cryptocurrency address whose private keys are stored offline (air-gapped), used to hold large balances securely away from exchange hot wallet infrastructure. |
| Round-Lot Transfer | A transfer in a precise, even amount (e.g. $25,000,000 USDT) characteristic of institutional or automated treasury operations, as opposed to organic retail transactions. |
| Liveness Probe | A small-value test transaction used to verify that a wallet address is functional and the operator retains signing capability, typically preceding or following a large capital movement. |
| VASP | Virtual Asset Service Provider — a regulated entity that exchanges, transfers, or custodies virtual assets on behalf of customers, subject to AML/KYC obligations under FATF standards. |