KALLISTI BLOCKCHAIN FORENSICS
TRC-20 (USDT primary asset) + native TRX
---
Target Wallet Address
TXNYeYdao7JL7wBtmzbk7mAie7UZsdgVjx
Report Date: 2026-05-29 · Prepared by Kallisti Blockchain Forensics
Wallet Identity · Financial Overview · Holdings · Activity Patterns · Account Structure
| Entity | Blocked |
| Blockchain | TRON mainnet · TRC-20 USDT wallet |
| Account Age | 914 days (2.50 years) ‖ Active: 2023-10-09 11:07:18 UTC → 2026-04-10 18:22:03 UTC |
| TRX Balance | 3270.2374 TRX |
| Transactions | 218 total · 54 USDT transfers (43 in · 11 out) · 37 counterparties |
| Total USDT In | $137.08M |
| Total USDT Out | $53.30M |
| Net Balance | $83.77M |
Two-phase USDT treasury: accumulate 2023–2024, disburse 2025; flagged Blocked (OKLink), Banned by USDT (Arkham).
All 11 outflows are exact round integers ($3M–$21M), no fractional amounts; $90M single-day inflow (2024-11-24, 65.7% of receipts) and $21M disbursement (2025-10-12, 39.4% of outflows) are dominant single-event concentrations.
37 counterparties all unattributed; primary outflow destination (48.8%, $26M) independently OKLink-Blocked; TRX float 3,270 TRX for fees only — no staking, DeFi, or energy delegation; 10 spam-token types received across 12 micro-events.
Thursday peak (33% of events), 10am UTC dominant hour; 14-month pre-disbursement dormancy; nine identical 0.65 USDT probes on 2025-12-25 indicate automated external scanning; no material outflow since Dec 2025.
| S1 | Tronscan — On-chain dataset · tronscan.org/#/address/TXNYeYdao7JL7wBtmzbk7mAie7UZsdgVjx |
| S2 | OKLink — TRON Address Detail · www.oklink.com/tron/address/TXNYeYdao7JL7wBtmzbk7mAie7UZsdgV… |
Counterparty Map · Inflow Architecture · Outflow Architecture
Upstream · Top 5 Funders
| ID | Address | Volume in | Attribution | Risk |
|---|---|---|---|---|
| A1 | THqaCGcYASRcYCPSLqEU95z6BnzEtGxfWP | $53.70M | Unattributed | MEDIUM |
| A2 | TLji56QV5rrVVtmZG5poqGvp7rU1pjfmA5 | $46.00M | Unattributed | MEDIUM |
| A3 | TYdt7MHoR1CenyYUdeCZ477oTfLHoLqWkC | $32.01M | Unattributed | MEDIUM |
| A4 | TTnFePHUrFWW3xVB2Z9iaCsAB3k5TWMcju | $5.37M | Unattributed | MEDIUM |
| A5 | TNjeHbRLdjB3XRe1QjqA6WHmRGJLnyUKc8 | $200.00 | Unattributed | MEDIUM |
Downstream · Top 5 Destinations
| ID | Address | Volume out | Attribution | Risk |
|---|---|---|---|---|
| B1 | TFcLDs8SWxc4WoaJvk5pXuJd6wuZkG2ZiN | $26.00M | Blocked | MEDIUM |
| B2 | TCdLhRdHPBtZyNTva76eZLGCENJ5nSUPPp | $18.00M | Unattributed | MEDIUM |
| B3 | TJeCqcTc8yvVWaeL6iZ6texy6J2Lg99i6x | $5.00M | Unattributed | MEDIUM |
| B4 | TVbAAh7sjudfxWqJVbcPfyApGQjBKjwZaE | $3.00M | Unattributed | MEDIUM |
| B5 | TGmibxq5P4J4zWn1sm2xkGGdiw283GgBcx | $1.30M | Unattributed | LOW |
Account Structure · Protocol Interactions · Threat Exposure
| Account Type | TRON externally owned account (EOA) — not a smart contract; controlled by a single private key |
| Primary Asset | USDT TRC-20 (contract TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t) — $83.77M held |
| TRX Balance | 3,270.24 TRX (~$1.12K) — operational fee float only; no staking or delegation |
| Address Reuse | Single-address operation — all inflows and outflows via one TRC-20 address over 914 days |
| Blacklist Status | Tether (USDT) blacklisted — confirmed by Arkham Intelligence labeling |
| Category | Status |
|---|---|
| USDT TRC-20 | ACTIVE |
| TRX Native | ACTIVE |
| Non-USDT Tokens | ACTIVE |
| Date | Category | Source | Nominal | Outcome |
|---|---|---|---|---|
| Ongoing | Regulatory Action | Tether (USDT issuer) | $83.77M USDT balance subject to TRC-20 blacklist. Address cannot transfer or receive USDT under current blacklist status. Compliance action by issuer — likely triggered by fraud, sanctions, or criminal nexus determination. | ESCALATED |
| 2023–2026 | Compliance Designation | OKLink | OKLink 'Blocked' designation on target address. Independent adverse compliance attribution consistent with a sanctions or criminal association flag. | ONGOING |
| 2023–2026 | Compliance Designation | OKLink | OKLink 'Blocked' on primary outflow destination TFcLDs8SWxc4WoaJvk5pXuJd6wuZkG2ZiN — $26M (48.8% of disbursements) routed to a second blocked address. Two-hop contamination. | ONGOING |
| 2025–2026 | Address Probing | Multiple automated scanners | 10 distinct non-USDT phishing and tracking token contracts sent micro-amounts across 12 events. Wallet is actively monitored by address-scanning infrastructure. No operator engagement detected. | NOT ENGAGED |
| 2025-12-25 | Dust Attack | External scanner | Nine identical 0.65 USDT transfers received in rapid succession on Christmas Day — automated address-probing pattern targeting this high-balance wallet. | NOT ENGAGED |
| CRITERION | FINDING | ASSESSMENT | |
| 1. Source of Funds | CRITICAL — ALL SOURCES UNATTRIBUTED | ||
| 2. Counterparty Risk | CRITICAL — BLOCKED COUNTERPARTIES | ||
| 3. Transaction Structure | HIGH — ALL-ROUND DISBURSEMENTS | ||
| 4. Volume & Concentration | HIGH — $90M SINGLE-DAY INFLOW | ||
| 5. Temporal Patterns | MEDIUM — STRUCTURED CADENCE | ||
| 6. Network Exposure | CRITICAL — FIVE ADVERSE LABELS | ||
| 7. Regulatory Standing | CRITICAL — TETHER BLACKLISTED | ||
| 8. Counterparty Attribution Depth | HIGH — ZERO ATTRIBUTION |
Seven of eight AML criteria score HIGH or CRITICAL. The Tether blacklist entry (Banned by USDT) and OKLink Blocked designation are independent confirmed adverse indicators — the highest-severity signal set available for a TRON USDT address in open-source intelligence. The wallet qualifies as a mandatory reporting trigger under US, EU, and UK AML frameworks for any regulated institution with exposure.
Flagged Patterns & Significant Observations
| ID | Date | Event | Severity | Significance |
| A-01 | 2024-11-24 | $90M Single-Day Inflow. Two unattributed transfers of $46M and $44M arrived from separate TRON sources within a single calendar day, representing 65.7% of lifetime USDT inflows in one event. | CRITICAL | Extreme capital concentration in a single day. No legitimate commercial context identified for a $90M USDT injection into an unattributed wallet. Strongly indicative of aggregated illicit proceeds, a large OTC placement, or a structured capital injection. |
| A-02 | LIFETIME | Primary Outflow Destination OKLink-Blocked. 48.8% of all disbursements ($26M of $53.3M) were directed to TFcLDs8SWxc4WoaJvk5pXuJd6wuZkG2ZiN, which is independently designated 'Blocked' by OKLink. | CRITICAL | Adverse attribution confirmed at two independent hops — target wallet and primary recipient are both blocked. Deliberate routing through compliance-flagged infrastructure indicates operational coordination between adverse entities. |
| A-03 | LIFETIME | Banned by USDT — Tether Blacklist Action. Arkham Intelligence confirms 'Banned by USDT' label, indicating Tether has entered this address in the TRC-20 USDT contract blacklist. The $83.77M USDT balance is effectively frozen. | CRITICAL | Tether blacklisting is a direct compliance action by the USDT issuer, historically applied to addresses linked to fraud, sanctions violations, or other serious financial crime. This is the highest-severity attribution signal in the dataset and the primary enforcement nexus. |
| A-04 | 2025-10-12 | $21M Lump-Sum Disbursement. Largest single outflow of exactly $21,000,000 to unattributed destination TJeCqcTc8yvVWaeL6iZ6texy6J2Lg99i6x, representing 39.4% of total outflows in one event. | NOTABLE | Single-event disbursement concentration at an exact round figure. No commercial context. Destination unattributed. Consistent with a large OTC settlement, inter-treasury transfer, or controlled allocation within illicit infrastructure. |
| A-05 | 2025-12-25 | Christmas Day Operations. Active on 25 December 2025: $6.304M in outflows across two tranches ($1.304M + $5M) plus nine identical 0.65 USDT dust-probe inputs received from external scanners. | NOTABLE | Operational activity on major public holidays is inconsistent with standard business-hours operation and suggests non-Western jurisdiction, automated components, or deliberate holiday-timed execution designed to exploit reduced monitoring windows. |
Five anomalies flagged: three CRITICAL (Tether blacklist, $90M single-day inflow, blocked outflow destination) and two NOTABLE (Christmas operations, $21M lump disbursement). The CRITICAL anomalies are mutually reinforcing — the blacklist, the capital concentration event, and the blocked routing suggest deliberate operation within compliance-flagged infrastructure rather than coincidental adverse attribution.
Hypothesis Assessment
The combination of OKLink 'Blocked', Arkham 'Banned by USDT' and 'Suspicious' labels, a blocked primary outflow destination, all-unattributed counterparties, and exclusive round-figure disbursements collectively indicate a treasury wallet operating in connection with a sanctioned, criminally associated, or compliance-blacklisted entity. Tether's blacklist action — reserved for addresses identified in serious compliance violations — is the single strongest indicator. The two-phase lifecycle (14-month accumulation 2023–2024, then structured disbursement 2025) is consistent with a treasury deploying pre-accumulated USDT to downstream recipients under controlled conditions.
Large-scale USDT aggregation from multiple unattributed sources followed by structured round-figure disbursements is characteristic of an unlicensed over-the-counter broker or virtual asset service provider paying out customers. The Thursday scheduling peak, 10am UTC operational window, and consistent disbursement tranche sizes are consistent with a service-provider cadence. The adverse labels may reflect a compliance action against an unlicensed rather than directly sanctioned operator, though Tether blacklisting applies the same practical consequence regardless of the underlying classification.
The structured accumulation of $137M USDT with no identified legitimate source, Tether blacklisting, and OKLink blocking are also consistent with a wallet aggregating proceeds from fraud, scam activity, or other financial crime. The $90M single-day inflow event and 14-month pre-disbursement dormancy could reflect proceeds consolidation and a cooling-off period following a large-scale criminal event. This hypothesis differs from H1 primarily in the principal entity framing rather than the observable on-chain facts.
Probabilities sum to 100%. Attribution confidence: MEDIUM-HIGH. H1 (Illicit or Sanctioned USDT Treasury) leads at 65% on the strength of independent OKLink 'Blocked' and Arkham 'Banned by USDT' and 'Suspicious' designations, a blocked primary outflow destination, exclusive round-figure disbursements, and complete counterparty opacity across all 37 counterparties. H2 (Unlicensed OTC/VASP) at 25% is consistent with the operational cadence data but does not adequately account for the severity of Tether's blacklisting action. H3 (Criminal Proceeds Aggregation) at 10% is an alternative framing of essentially identical facts under a different principal hypothesis. Entity identity is unknown; confidence on specific identity is LOW. Confidence on adverse risk classification is HIGH. .
This wallet presents the most severe adverse signal profile available in open-source blockchain intelligence for a TRON USDT address: the issuer has blacklisted it, two independent compliance platforms have assigned adverse designations, and its primary outflow destination is also blocked. The $83.77M frozen balance is a significant enforcement target. Any regulated institution with direct or indirect exposure to this address should assess SAR/STR filing obligations immediately and engage specialist counsel on potential sanctions implications.
Government Records · Press Coverage · Research & Analytics · Blockchain Intelligence
Priority Actions & Engagement Opportunities
| P1 | Tether Blacklist Enquiry — Contact Tether Limited (legal@tether.to) to determine basis for blacklist action. Tether confirms blacklist context to law enforcement and compliance institutions upon formal request. The $83.77M frozen balance creates a direct asset-recovery nexus. · Issuer |
| P2 | Hop-2 Tracing — Extend analysis to hop-2 from the primary inflow source (...z6BnzEtGxfWP, $53.7M, 39.2%) and blocked outflow destination (...Jd6wuZkG2ZiN, $26M, 48.8%). Both carry adverse labels and may connect to exchange-linked addresses with KYC data. · On-chain |
| P3 | OFAC / FIU Cross-Reference — Submit formal queries against the target and all hop-1 counterparties to OFAC and relevant national FIUs. Tether blacklisting often precedes or accompanies OFAC designation activity — a formal enquiry may surface a pending or undisclosed SDN listing. · Regulatory |
| P4 | Exchange SAR Co-ordination — If any hop-1 or hop-2 address has transacted with a regulated exchange, submit an information request to that exchange's compliance team for potential co-SAR co-ordination under applicable mutual assistance frameworks. · SAR |
| P5 | TRX Float Provenance — Trace the source of the operational TRX float (3,270 TRX). TRX funding USDT treasury fee wallets is sometimes sourced from exchange accounts carrying KYC data — potentially the first attribution link. · On-chain |
The Tether blacklist action, OKLink Blocked designation, and completely opaque counterparty network collectively place this wallet in the highest-risk category for TRON USDT addresses. The $83.77M frozen balance is accessible only through a formal compliance or legal process with Tether. Any institution that has processed TRON USDT transactions through this address — or through its immediate counterparties — is advised to file a SAR, retain transaction records, and seek legal guidance before any further interaction with the wallet or its known network.
| REF | SOURCE |
|---|---|
| S1 | On-chain dataset -- TRC-20 Transfers https://tronscan.org/#/address/TXNYeYdao7JL7wBtmzbk7mAie7UZs… Full TRC-20 transfer history via Tronscan API. 66 transfers retrieved. Retrieved 2026-05-29. |
| S2 | On-chain dataset -- Raw Transactions https://tronscan.org/#/address/TXNYeYdao7JL7wBtmzbk7mAie7UZs… Full transaction log via Tronscan API. 218 transactions retrieved. Retrieved 2026-05-29. |
| S3 | Tronscan -- Address Profile https://tronscan.org/#/address/TXNYeYdao7JL7wBtmzbk7mAie7UZs… Blockchain explorer screenshot. Captured 2026-05-29. File: screenshot_tronscan.png |
| S4 | OKLink -- Address Profile (Entity: Blocked) https://www.oklink.com/tron/address/TXNYeYdao7JL7wBtmzbk7mAi… Entity label: Blocked. Screenshot captured 2026-05-29. File: screenshot_oklink.png |
| S5 | Arkham Intelligence -- Entity Profile https://intel.arkm.com/explorer/address/TXNYeYdao7JL7wBtmzbk… Entity labels: Suspicious, Banned by USDT, +3 further adverse tags. Balance: $83.77M USDT confirmed. Screenshot captured 2026-05-29. File: screenshot_arkham.png |
| S6 | OFAC SDN List -- Sanctions Search https://sanctionssearch.ofac.treas.gov/ Searched target address and hop-1 counterparties. No direct SDN match found as of 2026-05-29. Sanctions context relevant given Tether blacklist action. |
| S7 | Tether Transparency -- Blacklist Mechanism https://tether.to/en/transparency/ Background on Tether TRC-20 blacklist contract. Addresses on the blacklist cannot transfer or receive USDT; balance is effectively frozen pending reversal. |
| TERM | DEFINITION |
|---|---|
| AML | Anti-Money Laundering — the regulatory and procedural framework designed to detect, prevent, and report financial crime and the conversion of criminal proceeds. |
| TRC-20 | A token standard on the TRON blockchain network. USDT TRC-20 is Tether's implementation of USDT on TRON and is one of the most actively used stablecoins globally. |
| USDT | Tether USD — a US dollar-pegged stablecoin issued by Tether Limited. The TRC-20 version on the TRON network is widely used in both legitimate and illicit finance. |
| TRON | A public blockchain network (mainnet launched 2018) commonly associated with high-volume USDT stablecoin transfers due to low transaction fees. |
| Blacklist | A function in the USDT TRC-20 smart contract allowing Tether to prevent a specific address from sending or receiving USDT. Applied for compliance, law enforcement, and sanctions reasons. |
| Blocked | An adverse entity label applied by OKLink and similar analytics platforms, indicating a compliance-level adverse designation consistent with sanctions association, fraud nexus, or criminal activity. |
| Suspicious | An adverse entity label used by Arkham Intelligence to flag addresses that exhibit anomalous or potentially illicit behavioral patterns. |
| OKLink | A blockchain analytics and explorer platform operated by OKX. OKLink maintains entity labels and adverse designations for addresses on multiple chains including TRON. |
| Arkham Intelligence | A blockchain intelligence platform that provides entity attribution, fund flow tracing, and behavioral labeling for on-chain addresses. |
| Tronscan | The primary block explorer for the TRON network. Provides transaction history, token balances, and contract interaction data. |
| Treasury Wallet | A wallet used to hold and deploy funds on behalf of an entity or operation, typically with structured inflow accumulation and controlled outbound disbursements. |
| TERM | DEFINITION |
|---|---|
| Round-Figure Disbursement | A payment in an exact integer amount (e.g., $5,000,000.00) with no fractional component. A consistent pattern of round-figure outflows is an AML red flag indicating deliberate rather than commercial transaction sizing. |
| Dust Attack | A technique in which tiny amounts of cryptocurrency are sent to an address to track it, link it to other addresses, or probe it for phishing purposes. |
| Hop | In blockchain analytics, a 'hop' represents one step in the transfer chain. Hop-1 refers to addresses that transacted directly with the subject wallet. |
| OFAC | Office of Foreign Assets Control — the US Treasury agency responsible for administering sanctions programs. OFAC maintains the SDN (Specially Designated Nationals) list. |
| SDN | Specially Designated National — an individual, entity, or address designated by OFAC under a sanctions program. Transactions with SDNs are prohibited for US persons. |
| SAR | Suspicious Activity Report — a regulatory filing required from financial institutions and VASPs when a transaction or pattern meets the threshold for suspected money laundering or financial crime. |
| FATF | Financial Action Task Force — an intergovernmental body that sets international standards for AML and counter-terrorist financing. FATF guidance on virtual assets is widely adopted by regulators. |
| VASP | Virtual Asset Service Provider — any business engaged in virtual asset exchange, transfer, custody, or related services. VASPs are subject to FATF and local AML regulations. |
| Travel Rule | A FATF requirement (Recommendation 16) mandating that VASPs share originator and beneficiary information when transferring virtual assets above threshold — analogous to wire transfer rules in traditional banking. |
| EOA | Externally Owned Account — in the TRON and Ethereum account model, an address controlled by a private key (as opposed to a smart contract address). EOAs can initiate transactions directly. |