KALLISTI BLOCKCHAIN FORENSICS
TRC-20 (USDT primary asset) + native TRX
---
Target Wallet Address
TPTkSyuoX7awZLYCCjjywWG9Hz7VQLaaki
Report Date: 2026-05-29 · Prepared by Kallisti Blockchain Forensics
Wallet Identity · Financial Overview · Holdings · Activity Patterns · Account Structure
| Entity | TPTkSyuoX7awZLYCCjjywWG9Hz7VQLaaki |
| Blockchain | TRON mainnet |
| Address Type | TRC-20 USDT wallet |
| Active Window | 2025-05-27 15:52:27 UTC → 2026-05-28 11:16:03 UTC |
| Account Age | 365 days (1.00 years) |
| USDT Balance | $2.24M |
| Total USDT In | $46.07M |
| Total USDT Out | $43.83M |
| TRX Balance | 5529.8260 TRX |
| Transactions | 1066 on-chain (244 in · 140 out) |
Wallet …VQLaaki is a high-throughput USDT accumulation-and-disbursement node — receiving fragmented inflows from multiple sources and consolidating outbound flow toward Kraken. Over 365 days, $46.07M was received across 244 events and $43.83M disbursed across 140 events, producing a 1.74:1 in/out event ratio consistent with an aggregator function. $2.24M retained balance (4.9% of inflow) represents operational float.
Inflows average $188,800 per event; outflow events average $312,357 — a 1.65× differential indicating batch consolidation before onward transfer. Top five inflow counterparties account for 72.4% of total volume; the three largest are unattributed ($14.5M, $7.5M, $3.56M). Kraken alone absorbs 45.9% of outflow ($20.10M). Ticket sizes are consistent with institutional scale.
Wallet operates continuously across all 7 days of the week with no material weekend suppression. Binance.Withdraw_18 and OKX.Hot Wallet_3 are the only attributed inflow sources; Kraken.User and OKX.User are the only attributed outflow destinations — confirming institutional exchange engagement on both sides. Four spam token receipts carry no operational significance.
Tuesday-dominant at 18.2% (70/384 events); Wednesday-trough at 9.1% (35) — anomalous mid-week dip. UTC hourly peaks: 04:00 (47 events, 12.3%), 09:00 (45, 11.8%), 07:00 (42, 11.0%) — together 35.1% of all activity. Near-zero UTC 19:00–23:00 (6 events, 1.6%). Mapping UTC 04:00: UTC+3 → 07:00, UTC+4 → 08:00, UTC+5 → 09:00. Most probable operator timezone UTC+3 to UTC+5.
Transaction cadence and volume distribution do not exhibit the sub-second or mechanically-regular spacing characteristic of fully automated bot activity. Activity spans all hours with clear daily peaks rather than uniform 24/7 throughput, and the 192-counterparty set indicates human-directed routing rather than programmatic sweep logic. Manual or semi-automated operation is the more probable model.
| S1 | Tronscan — On-chain dataset · tronscan.org/#/address/TPTkSyuoX7awZLYCCjjywWG9Hz7VQLaaki |
| S2 | OKLink — TRON Address Detail · www.oklink.com/tron/address/TPTkSyuoX7awZLYCCjjywWG9Hz7VQLaa… |
Counterparty Map · Inflow Architecture · Outflow Architecture
Upstream · Top 5 Funders
| ID | Address | Volume in | Attribution | Risk |
|---|---|---|---|---|
| A1 | TPMEY7mgwC8NV5AHFdVcFpq6pVi8CFRS8b | $14.50M | Unattributed | MEDIUM |
| A2 | TPz3xabXjorvX5dBZd11CqroiXJcW3f7zn | $7.50M | Unattributed | MEDIUM |
| A3 | TAzsQ9Gx8eqFNFSKbeXrbi45CuVPHzA8wr | $4.29M | Binance. Withdraw_18 | LOW |
| A4 | TN4NuTB5r7MXSXtwafbQvu7WiQwuP9sFUK | $3.56M | Unattributed | MEDIUM |
| A5 | TB73ShfgSqVyakXyoMjNXN6Y7y6SBKWzWx | $3.50M | OKX. Hot Wallet_3 | LOW |
Downstream · Top 5 Destinations
| ID | Address | Volume out | Attribution | Risk |
|---|---|---|---|---|
| B1 | TGp2gDQEyA7db1ypxwwHiio1xaFTyB33H8 | $20.10M | Kraken. User | MEDIUM |
| B2 | TBqygGjRHT2sSeFMMHaju67APNp3CfNtf3 | $4.77M | Unattributed | MEDIUM |
| B3 | TWmQgH22juL6V9CgmXYEBss7J1TszzADF1 | $4.33M | Unattributed | MEDIUM |
| B4 | TP5UzNzk4tL2Jo6twHavUM9s9NjUPSgrvN | $3.12M | Unattributed | MEDIUM |
| B5 | TDwr6k4j57KEeZnk3pvyay3Q2Cp9VyJf23 | $2.00M | OKX. User | LOW |
Account Structure · Protocol Interactions · Threat Exposure
| CRITERION | FINDING | ASSESSMENT | |
| 1. Sanctions (OFAC/EU/UN) | CLEAR | ||
| 2. Fraud/Scam Exposure | CLEAR | ||
| 3. Ransomware/Darknet | CLEAR | ||
| 4. Mixer/CoinJoin | CLEAR | ||
| 5. Exchange Source Verif. | MONITOR | ||
| 6. Structuring/Layering | MONITOR | ||
| 7. Third-Party Risk | MONITOR | ||
| 8. Address Poisoning | CLEAR |
Flagged Patterns & Significant Observations
Hypothesis Assessment
Probabilities sum to 100%. Attribution confidence: LOW.
Government Records · Press Coverage · Research & Analytics · Blockchain Intelligence
$46.07M total throughput; 16.9% attributed inflow (Binance + OKX); 47.5% unattributed inflow; 45.9% outflow to confirmed Kraken; 95.1% transit ratio.
Priority Actions & Engagement Opportunities
| REF | SOURCE |
|---|---|
| S1 | On-chain dataset -- TRC-20 Transfers https://tronscan.org/#/address/TPTkSyuoX7awZLYCCjjywWG9Hz7VQ… Full TRC-20 transfer history via Tronscan API. Retrieved 2026-05-29. |
| S2 | On-chain dataset -- Raw Transactions https://tronscan.org/#/address/TPTkSyuoX7awZLYCCjjywWG9Hz7VQ… Full transaction log via Tronscan API. Retrieved 2026-05-29. |
| S3 | Arkham -- Address Profile https://intel.arkm.com/explorer/address/TPTkSyuoX7awZLYCCjjy… Screenshot captured 2026-05-29. File: screenshot_arkham.png |
| S4 | Tronscan -- Address Profile https://tronscan.org/#/address/TPTkSyuoX7awZLYCCjjywWG9Hz7VQ… Screenshot captured 2026-05-29. File: screenshot_tronscan.png |
| S5 | Oklink -- Address Profile https://www.oklink.com/tron/address/TPTkSyuoX7awZLYCCjjywWG9… Screenshot captured 2026-05-29. File: screenshot_oklink.png |
No glossary entries provided for this report.