Map
PDF
KALLISTI BLOCKCHAIN FORENSICS
TRC-20 (USDT primary asset) + native TRX · also: TVRa (1 events), AML (1 events), XCOM (6 events) ---
Target Wallet Address
TRSKhXD5qSekLUxfwYxR1zA5kwTLhke2Rx
Report Date: 2026-06-14  ·  Prepared by Kallisti Blockchain Forensics
…5kwTLhke2Rx · TRON · 2026-06-14

S0 — Executive Summary

Attributed Entity  ·  TRON
TRSKhXD5qSekLUxfwYxR1zA5kwTLhke2Rx
USDT In
$129.65M
21 inbound events
USDT Out
$19.76M
3 outbound events
Balance
$109.89M
Current USDT on-chain
Active Span
236
days · 0.65 years
Transactions
37
21 USDT in · 3 USDT out
Counterparties
10
distinct USDT counterparties
AML Risk Score
8CLEAR
Clear
Low
Medium
High
Critical
Intelligence Brief
Case Facts
Wallet AddressTRSKhXD5qSekLUxfwYxR1zA5kwTLhke2Rx
BlockchainTRON mainnet · TRC-20 USDT
First Seen2025-10-21 11:39:30 UTC
Last Active2026-06-09 22:19:33 UTC
Account Age236 days (0.65 years)
Primary TokenUSDT (…8otSzgjLj6t)
TRX Balance28.5146 TRX
Counterparty Exposure by Category
Private / Unattributed
$129.65M
Finding 01  · 
Supporting Detail
AML Scorecard
Sanctions (OFAC/EU/UN)
CLEAR
Fraud/Scam Exposure
CLEAR
Ransomware/Darknet
CLEAR
Mixer/CoinJoin
CLEAR
Exchange Source Verif.
CLEAR
Structuring/Layering
CLEAR
Third-Party Risk
CLEAR
Address Poisoning
CLEAR
Key Dates
YYYY-MM-DD
Attribution Hypotheses
H1
60%
H2
30%
H3
10%
Investigator Summary
Recommended Actions  · 
…5kwTLhke2Rx · TRON · 2026-06-14

S1 — TARGET PROFILE, FINANCIALS & ACTIVITY

Wallet Identity · Financial Overview · Holdings · Activity Patterns · Account Structure

DEPLOYMENT 15.2% Sent Out 84.8% Net Balance USDT IN$129.65MSent Out$19.76MNet Balance$109.89MCURRENT HOLDINGSUSDT100.00%$109.89M$109.82MTRX28.5146 TRX$9.07COUNTERPARTIESPrivate / Unattributed100.0%OTC / BrokerRegulated CEXDeFi / ProtocolMixer / ObfuscationGovernmentCriminal / FraudSanctioned Entity
EntityTRSKhXD5qSekLUxfwYxR1zA5kwTLhke2Rx
BlockchainTRON mainnet · TRC-20 USDT wallet
Account Age236 days (0.65 years) ‖ Active: 2025-10-21 11:39:30 UTC → 2026-06-09 22:19:33 UTC
TRX Balance28.5146 TRX
Transactions37 total · 24 USDT transfers (21 in · 3 out) · 10 counterparties
Total USDT In$129.65M
Total USDT Out$19.76M
Net Balance$109.89M

Activity Overview

BY YEAR Oct Nov Dec 2026 Feb Mar Apr May Jun Jul $200M $80M $50M $18M $10M $5M InflowOutflow BY HOUR (UTC) 2 4 6 8 10 12 00 06 12 18 23 BY DAY Mon 12 Tue 5 Wed 7 Thu 2 Fri 5 Sat 0 Sun 1

Behavioral Classification

Treasury accumulator — wallet retains $109.89M USDT (84.8% of all inbound value) after 236 days. High per-transaction value (~$6.2M average inbound), minimal throughput (37 events total), and a narrow counterparty base of 10 addresses — all unattributed — are consistent with a controlled holding wallet rather than a trading or pass-through account.

Transaction Size Profile

Inbound flows are large-denomination and near-exclusively round-figure: $79.65M, $50M, $10M, $8M, $7M, $5M. Outbound is likewise rounded: $18M, $9.76M, $5M ×2, $1M. Micro-transfers ($0.65 ×9, $5 ×3) are third-party dust probes — not operator-originated. Institutional-scale round figures and total counterparty non-attribution suggest OTC or private custody sourcing.

Operational Profile

Counterparty base is narrow: 10 distinct USDT addresses (5 funders, 2 destinations). All remain unattributed across OKLink, Tronscan, and Arkham. The single largest funder (…R6AtazzZ8LLQ, $79.65M / 61.4%) itself draws from three further unattributed wallets, extending the opacity chain. TRX float: 28.51 TRX — sufficient for bandwidth, no staking or energy delegation. All secondary token holdings (AML, TVRa, XCOM) are sub-$1 airdrop spam.

Temporal Activity Pattern

Monday 37.5% (dominant); Wednesday 21.9%; Tuesday/Friday 15.6% each; Saturday 0%, Sunday 3.1%. UTC peaks: 14:00 (12 events, 37.5%), 09:00 (5 events, 15.6%), 11:00 (3 events). Dead zone 01:00–08:00 UTC eliminates Americas and Western Europe. Peak 14:00 maps to 17:00 in UTC+3 (Gulf/Moscow) and evening in UTC+5–UTC+8. Probable timezone: UTC+3 to UTC+8 — Gulf states, Central Asia, or East Asia.

Automation Assessment

No scripted operation signatures. 37 events over 236 days yields 0.16 events/day with no regular intervals or batch cadence. Dust probes originate from external monitoring actors — this wallet never initiates micro-transfers. Outflow events are sparse (3 USDT out over 8 months), manually sized, and irregularly spaced. Pattern is consistent with supervised, human-directed custody under periodic instruction.

Sources
S1Tronscan — On-chain dataset · tronscan.org/#/address/TRSKhXD5qSekLUxfwYxR1zA5kwTLhke2Rx
S2OKLink — TRON Address Detail · www.oklink.com/tron/address/TRSKhXD5qSekLUxfwYxR1zA5kwTLhke2…
…5kwTLhke2Rx · TRON · 2026-06-14

S2 — TRANSACTION NETWORK & FUND FLOW

Counterparty Map · Inflow Architecture · Outflow Architecture

61.4% 50.6% IN 38.6% OUT 49.4% …azzZ8LLQ 61.4% …EPDXMECZ 0.0% …JADXMECZ 0.0% …gqSpQN4r 0.0% …jqDXMECZ 50.6% …qybCW7b2 49.4% …TLhke2Rx$109.89MTARGET NODE: Exchange Unattributed Illicit/SDN OTC/Clean Mixer node size ∝ volume · edge weight ∝ share

Inflow

Upstream · Top 5 Funders

IDAddressVolume inAttributionRisk
A1TDbvitQBkigAiMDdEmCB6MR6AtazzZ8LLQ$79.65MUnattributedMEDIUM
A2TQWWJFsxPSiSwHKHq9kCbtZtjQqybCW7b2$50.00MUnattributedMEDIUM
A3TVDUMsEM6mDCuqMqis1GEFtNUaEPDXMECZ$5.00UnattributedMEDIUM
A4TRfa2RUq1UEQfSiYN6kqNADUJNJADXMECZ$5.00UnattributedMEDIUM
A5TWJf98xnJYYM1um8ryox9NzALYgqSpQN4r$5.00UnattributedMEDIUM

Outflow

Downstream · Top 5 Destinations

IDAddressVolume outAttributionRisk
B1TVDUJs88qUARLgG9x866qPG7dkjqDXMECZ$10.00MUnattributedMEDIUM
B2TQWWJFsxPSiSwHKHq9kCbtZtjQqybCW7b2$9.76MUnattributedMEDIUM
…5kwTLhke2Rx · TRON · 2026-06-14

S3 — OPERATIONAL PROFILE & SECURITY ASSESSMENT

Account Structure · Protocol Interactions · Threat Exposure

Security
Rating
COMPROMISEDADEQUATEPROFICIENT
58

Account Structure

Address Type
Script Encoding
UTXO Count
Clustering
Service Label
VASP Exposure
Wallet Software

Protocol Interactions

CategoryStatus
Exchange Deposits / WithdrawalsNONE
DeFi / Smart Contract InteractionNONE
Lightning Network ChannelsNONE
Ordinals / InscriptionsNONE
Mixing / CoinJoin ServicesNONE
Cross-Chain BridgesNONE
Sanctions-Listed Address ContactNONE
Operational Summary
…5kwTLhke2Rx · TRON · 2026-06-14

S4 — AML / RISK ASSESSMENT

Sanctions Fraud/Scam Ransomware Mixer Exch.Source Structuring Third-Party Addr.Poison CRITERION EXPOSURE RATING Sanctions (OFAC/EU/UN) CLEAR Fraud/Scam Exposure CLEAR Ransomware/Darknet CLEAR Mixer/CoinJoin CLEAR Exchange Source Verif. CLEAR Structuring/Layering CLEAR Third-Party Risk CLEAR Address Poisoning CLEAR OVERALL AML RISK 8 CLEAR Scale: CLEAR=no exposure detected · MEDIUM=indirect signal · HIGH=direct confirmed exposure
CRITERIONFINDINGASSESSMENT
1. Sanctions (OFAC/EU/UN)
CLEAR
2. Fraud/Scam Exposure
CLEAR
3. Ransomware/Darknet
CLEAR
4. Mixer/CoinJoin
CLEAR
5. Exchange Source Verif.
CLEAR
6. Structuring/Layering
CLEAR
7. Third-Party Risk
CLEAR
8. Address Poisoning
CLEAR
Assessment
…5kwTLhke2Rx · TRON · 2026-06-14

S5 — NOTABLE EVENTS & ANOMALIES

Flagged Patterns & Significant Observations

2025-10 2026-06 2026 HIGH — critical finding HIGH — monitor LOW — contextual
IDDateEventSeveritySignificance
A-01YYYY-MM-DD. NOTABLE
Synthesis
…5kwTLhke2Rx · TRON · 2026-06-14

S6 — OWNERSHIP ATTRIBUTION MODEL

Hypothesis Assessment

60%

30%

10%

Probabilities sum to 100%. Attribution confidence: MEDIUM.

What This Means For You
…5kwTLhke2Rx · TRON · 2026-06-14

S7 — LINKS, DIGITAL FOOTPRINT & PUBLIC RECORD

Government Records · Press Coverage · Research & Analytics · Blockchain Intelligence

Blockchain Explorers
tronscan.io
2026-06-14
Account TRSKhXD5qSekLUxfwYxR1zA5kwTLhke2Rx | TRONSCAN — TRONSCAN is the first blockchain explorer for the TRON network. It supports multiple login methods and provides a comple
OSINT Summary
…5kwTLhke2Rx · TRON · 2026-06-14

S8 — RECOMMENDED FURTHER INVESTIGATION

Priority Actions & Engagement Opportunities

P1 ·
Investigator Assessment
…5kwTLhke2Rx · TRON · 2026-06-14

APPENDIX A — MASTER SOURCE LIST

REFSOURCE
S1On-chain dataset -- TRC-20 Transfers
https://tronscan.org/#/address/TRSKhXD5qSekLUxfwYxR1zA5kwTLh…
Full TRC-20 transfer history via Tronscan API. Retrieved 2026-06-14.
S2On-chain dataset -- Raw Transactions
https://tronscan.org/#/address/TRSKhXD5qSekLUxfwYxR1zA5kwTLh…
Full transaction log via Tronscan API. Retrieved 2026-06-14.
S3Arkham -- Address Profile
https://arkm.com/explorer/address/TRSKhXD5qSekLUxfwYxR1zA5kw…
Screenshot captured 2026-06-14. File: screenshot_arkham.png
S4Tronscan -- Address Profile
https://tronscan.org/#/address/TRSKhXD5qSekLUxfwYxR1zA5kwTLh…
Screenshot captured 2026-06-14. File: screenshot_tronscan.png
S5Oklink -- Address Profile
https://www.oklink.com/tron/address/TRSKhXD5qSekLUxfwYxR1zA5…
Screenshot captured 2026-06-14. File: screenshot_oklink.png
…5kwTLhke2Rx · TRON · 2026-06-14

APPENDIX B — GLOSSARY OF TERMS

TERMDEFINITION