Verify a decision

{"actor":"system:backfill","investigation_id":"0ab4a937-de5a-4e31-b57a-29b1ee03248a","kind":"publish","page_slug":"bc1qtkv6qcgq3qhqcdsk88wey50je0wk07s6erjrr9","published_at":"2026-06-06T12:04:34.136Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"bc1qtkv6qcgq3qhqcdsk88wey50je0wk07s6erjrr9","sections":[{"content":"The address bc1qtkv6qcgq3qhqcdsk88wey50je0wk07s6erjrr9 is a native SegWit (Bech32, P2WPKH) Bitcoin address, identifiable by its 'bc1q' prefix. This address format was introduced to improve transaction efficiency and reduce fees. On-chain data retrieved from the Blockstream Esplora API confirms exactly two confirmed transactions and a current balance of zero satoshis. The address received a total of 5,793,506 satoshis (approximately 0.0579 BTC) and subsequently spent the entire balance, leaving no residual funds. No mempool (unconfirmed) activity was present at the time of query.","heading":"Address Overview","severity":"low","sources":[{"credibility":2,"name":"Blockstream Esplora API — address stats for bc1qtkv6qcgq3qhqcdsk88wey50je0wk07s6erjrr9","type":"on_chain","url":"https://blockstream.info/api/address/bc1qtkv6qcgq3qhqcdsk88wey50je0wk07s6erjrr9"}]},{"content":"Two transactions involving this address were confirmed on the Bitcoin mainnet in late May 2026.\n\n**Inbound transaction (block 951483, 2026-05-28 23:19 UTC):** TXID 0db77e30cbff08727485376b00a898bb3a706ae60333088438654f810a54abc1. The sending address bc1qtrdnv22l3cht4znvrzmkpmkmu4g5l2maq523hh contributed two UTXOs (208,271 sat and 5,596,531 sat) totaling 5,804,802 satoshis. After a fee of 465 satoshis, the target address received 5,793,506 satoshis. The sender address retained a change output of 10,831 satoshis.\n\n**Outbound transaction (block 951701, 2026-05-30 11:50 UTC):** TXID a3dc1168ee073bd420d1d61062b912a9b69dfcbb9177139ce47abe83913452c7. This transaction spent all 5,793,506 satoshis held by the target address alongside a co-input from bc1qt8eg5p69xzfguvartkf263evc20j36j7n0hqyh (135,900 sat). After a fee of 3,744 satoshis, funds were distributed to two addresses: bc1q3euy7y00m4vdfem6p0pmh2m58209gah9k40sfa (479,605 sat) and bc1q5akqq8mmj0g8j64ncvpyjmcz9gpxelepmz8e5l (5,446,057 sat). The larger output recipient (bc1q5akqq8mmj0g8j64ncvpyjmcz9gpxelepmz8e5l) received approximately 93.9% of the forwarded value.\n\nThe elapsed time between receipt and full disbursement was approximately 36 hours and 30 minutes. This rapid, full-balance forwarding behaviour is consistent with a pass-through or intermediary wallet pattern, which may indicate exchange deposit routing, mixing, automated payment processing, or custody transfer. It is also a pattern observed in fraud-adjacent fund movement, though no fraud-specific evidence was identified in this case.","heading":"Transaction History","severity":"medium","sources":[{"credibility":2,"name":"Blockstream Esplora API — transaction list for bc1qtkv6qcgq3qhqcdsk88wey50je0wk07s6erjrr9","type":"on_chain","url":"https://blockstream.info/api/address/bc1qtkv6qcgq3qhqcdsk88wey50je0wk07s6erjrr9/txs"},{"credibility":2,"name":"Blockstream Explorer — inbound transaction","type":"on_chain","url":"https://blockstream.info/tx/0db77e30cbff08727485376b00a898bb3a706ae60333088438654f810a54abc1"},{"credibility":2,"name":"Blockstream Explorer — outbound transaction","type":"on_chain","url":"https://blockstream.info/tx/a3dc1168ee073bd420d1d61062b912a9b69dfcbb9177139ce47abe83913452c7"}]},{"content":"The funding source for this address is bc1qtrdnv22l3cht4znvrzmkpmkmu4g5l2maq523hh, which itself shows six confirmed transactions and a remaining balance of approximately 10,831 satoshis. Of particular note, the upstream address received funds (transaction e56e473ebe9b2230e53170c2b57c49b3a9f74666268bc24079c10e2ebd185aeb, block 951478) from bc1q8j3lvc5d8tk74fkwavu0xghuys89cw5w38ly2q, which dispersed 85,104,474 satoshis across 20 output addresses simultaneously. Large fan-out transactions of this type are commonly associated with exchange hot wallet payouts, payroll-style batch disbursements, or — in adversarial contexts — the splitting of funds after theft or fraud. No definitive attribution was identified for the originating fan-out transaction or the intermediate address at the time of investigation.","heading":"Upstream Address Analysis","severity":"medium","sources":[{"credibility":2,"name":"Blockstream Esplora API — address stats for bc1qtrdnv22l3cht4znvrzmkpmkmu4g5l2maq523hh","type":"on_chain","url":"https://blockstream.info/api/address/bc1qtrdnv22l3cht4znvrzmkpmkmu4g5l2maq523hh"},{"credibility":2,"name":"Blockstream Esplora API — transaction list for bc1qtrdnv22l3cht4znvrzmkpmkmu4g5l2maq523hh","type":"on_chain","url":"https://blockstream.info/api/address/bc1qtrdnv22l3cht4znvrzmkpmkmu4g5l2maq523hh/txs"}]},{"content":"The address was queried against BitcoinWhosWho, a community-driven scam reporting database. The platform returned a 'Scam Alert: None' result, indicating no filed reports as of the investigation date. The address was also queried against Chainabuse (operated by TRM Labs), a widely used crypto fraud reporting platform; no indexed reports for this address were returned by the platform's public interface. No mentions of this address were found in general web searches, social media, Reddit, or the BitcoinTalk forum. No law enforcement press releases, SEC enforcement actions, CFTC orders, DOJ indictments, or OFAC sanctions listings referencing this address were identified.","heading":"Scam and Fraud Database Checks","severity":"low","sources":[{"credibility":3,"name":"BitcoinWhosWho address lookup","type":"community_report","url":"https://www.bitcoinwhoswho.com/address/bc1qtkv6qcgq3qhqcdsk88wey50je0wk07s6erjrr9"},{"credibility":2,"name":"Chainabuse address page","type":"community_report","url":"https://chainabuse.com/address/bc1qtkv6qcgq3qhqcdsk88wey50je0wk07s6erjrr9"}]},{"content":"Several behavioural characteristics of this address warrant notation, even in the absence of confirmed fraud reports.\n\n1. **Pass-through pattern:** The address received a lump sum and forwarded its entire balance within approximately 36 hours. Zero residual balance is consistent with disposable or single-use addresses, a common technique in fraud, mixing, and automated custodial operations alike.\n\n2. **Upstream fan-out:** The funding chain includes a large multi-output transaction (85 BTC dispersed across 20 addresses), which may indicate batch processing by an exchange, OTC desk, or automated payment system — or alternatively the splitting of proceeds.\n\n3. **No entity attribution:** Neither the target address nor its immediate parent address carries any exchange, custodian, or service label in publicly available blockchain intelligence databases. The absence of a known-entity label is a neutral finding but reduces confidence that funds passed through a regulated intermediary.\n\n4. **Absence of reporting:** The complete absence of community scam reports and regulatory actions is a positive signal, though it does not preclude private fraud or unreported illicit use.\n\nOverall, the on-chain footprint is minimal and the address appears to have been used for a single value-transfer relay. Without additional context about who controlled this address or the circumstances surrounding its use, a definitive risk assessment cannot be issued.","heading":"Risk Indicators and Behavioural Patterns","severity":"medium","sources":[{"credibility":2,"name":"Blockstream Esplora API — full transaction set","type":"on_chain","url":"https://blockstream.info/api/address/bc1qtkv6qcgq3qhqcdsk88wey50je0wk07s6erjrr9/txs"}]},{"content":"This investigation relied on publicly available on-chain data and open community reporting databases. The following limitations apply:\n\n- Blockchain clustering and advanced heuristics (e.g., common-input-ownership heuristics) were not applied; a professional blockchain analytics tool such as Chainalysis Reactor or TRM Labs may yield additional attribution.\n- Dynamic page content on Chainabuse and BitcoinWhosWho could not be fully rendered through automated fetch; reports filed after indexing cutoffs may not appear.\n- The upstream large fan-out transaction was not exhaustively traced to an originating entity or exchange hot wallet.\n- The address is very recent (activity confined to late May 2026) and may accumulate additional reports or law enforcement attention over time.","heading":"Investigative Limitations","severity":"low","sources":[]}],"sources_used":[{"credibility":2,"name":"Blockstream Esplora API — address stats","type":"on_chain","url":"https://blockstream.info/api/address/bc1qtkv6qcgq3qhqcdsk88wey50je0wk07s6erjrr9"},{"credibility":2,"name":"Blockstream Esplora API — transaction list","type":"on_chain","url":"https://blockstream.info/api/address/bc1qtkv6qcgq3qhqcdsk88wey50je0wk07s6erjrr9/txs"},{"credibility":2,"name":"Blockstream Esplora — inbound TXID 0db77e30","type":"on_chain","url":"https://blockstream.info/tx/0db77e30cbff08727485376b00a898bb3a706ae60333088438654f810a54abc1"},{"credibility":2,"name":"Blockstream Esplora — outbound TXID a3dc1168","type":"on_chain","url":"https://blockstream.info/tx/a3dc1168ee073bd420d1d61062b912a9b69dfcbb9177139ce47abe83913452c7"},{"credibility":2,"name":"Blockstream Esplora API — upstream address bc1qtrdnv22l3cht4znvrzmkpmkmu4g5l2maq523hh stats","type":"on_chain","url":"https://blockstream.info/api/address/bc1qtrdnv22l3cht4znvrzmkpmkmu4g5l2maq523hh"},{"credibility":2,"name":"Blockstream Esplora API — upstream address transaction list","type":"on_chain","url":"https://blockstream.info/api/address/bc1qtrdnv22l3cht4znvrzmkpmkmu4g5l2maq523hh/txs"},{"credibility":3,"name":"BitcoinWhosWho — scam lookup","type":"community_report","url":"https://www.bitcoinwhoswho.com/address/bc1qtkv6qcgq3qhqcdsk88wey50je0wk07s6erjrr9"},{"credibility":2,"name":"Chainabuse — fraud report lookup","type":"community_report","url":"https://chainabuse.com/address/bc1qtkv6qcgq3qhqcdsk88wey50je0wk07s6erjrr9"}],"summary":"bc1qtkv6qcgq3qhqcdsk88wey50je0wk07s6erjrr9 is a native SegWit (Bech32) Bitcoin address with a small and fully spent transaction history confined to a two-day window in late May 2026. The address received approximately 0.0579 BTC (~5,793,506 satoshis) in a single inbound transaction and forwarded the entire balance outward within roughly 36 hours, exhibiting a classic pass-through or forwarding pattern. No scam reports, law enforcement actions, or regulatory designations were identified for this address at the time of investigation.","timeline":[{"date":"2026-05-28","event":"Address received 5,793,506 satoshis (~0.0579 BTC) from bc1qtrdnv22l3cht4znvrzmkpmkmu4g5l2maq523hh in block 951483 (TXID: 0db77e30cbff08727485376b00a898bb3a706ae60333088438654f810a54abc1).","source":"Blockstream Esplora API","source_url":"https://blockstream.info/tx/0db77e30cbff08727485376b00a898bb3a706ae60333088438654f810a54abc1"},{"date":"2026-05-30","event":"Address fully disbursed its entire balance of 5,793,506 satoshis in block 951701 (TXID: a3dc1168ee073bd420d1d61062b912a9b69dfcbb9177139ce47abe83913452c7), sending the majority (5,446,057 sat) to bc1q5akqq8mmj0g8j64ncvpyjmcz9gpxelepmz8e5l. Balance reduced to zero.","source":"Blockstream Esplora API","source_url":"https://blockstream.info/tx/a3dc1168ee073bd420d1d61062b912a9b69dfcbb9177139ce47abe83913452c7"}]},"v":1}