chainscore.netHolistix

Holistic wallet report

0x098B716B8Aaf21512996dC57EB0615e2383E2f96

HX-355a30847db2 · screened 2026-09-12 17:10:47+00:00 · 6 chain(s) in one call · data source: live

Forensic report
10.0 of 10 CRITICAL

Not a reliable summary of this wallet

Block Block the transaction and escalate.

Holistix scores this wallet 10.0 of 10 (critical risk) from a single screen across 6 chain(s), with activity on Ethereum, Base, Optimism, BNB Smart Chain, Polygon, Arbitrum. The wallet is itself attributed to LAZARUS GROUP, which forces the maximum score regardless of flow analysis. $920,064,841 of traced value breaks down as $445,491,815 direct, $474,573,026 one hop away and $0 beyond 0 bridge crossing(s). The score is driven by sanctioned entity or designated address (96% of the score), proceeds of hacks and exploits (2% of the score), unattributed address (2% of the score).

Do not transact. Direct or heavy illicit exposure.

Level 5 of 5 · prohibited Balanced tolerance
Partial attribution · 51.6% of traced value

Only 52% of traced value resolves to an identified counterparty. The score is real but partial: it measures the identified minority of this wallet's activity. Inbound coverage is 89%; outbound is 52%. The headline quotes the weaker side, because pooling the two would hide an unidentified half behind a pass-through.

Inbound 89.3% of traced value · outbound 51.6%. The headline quotes the weaker side so a pass-through cannot pin at 50%.

51 of 300 counterparties (17.0%) resolve to an identified entity. This screen cannot auto-clear: attribution is below the sufficient floor (70% of traced value). Unattributed exposure is scored, lightly: the 'unknown' category has weight 2 of 10, so unidentified counterparties raise the score but cannot on their own push it past 2.0. Allow recommendations are withheld below the sufficient attribution floor.

Traced value
$920,064,841
Direct
$445,491,815
observed on chain
One hop away
$474,573,026
weighted 50%
Across bridges
$0
0 crossing(s)
Balance held
$257,669
Chains active
6 / 6
ethereum, base, optimism, bsc, polygon, arbitrum

What the score is made of

Each category contributes on the same 0–10 scale and the score is the quadratic mean of those contributions, so the share of the score each category owns is exact — the percentages below sum to 100%.

direct exposure one hop away across a bridge
Sanctioned entity or designated address weight 10 10.00 of 10 · 96% of score
Sanctioned entity or designated address contributes 10.00 of 10: $366,576,117 directly and $108,325,679 one hop away on Ethereum ($474,901,796). Weighted exposure is 61.622% of traced value, at the 0.050% saturation point for this category.
LAZARUS GROUP · ethereum · $84,960,113 LAZARUS GROUP · ethereum · $63,597,093 LAZARUS GROUP · ethereum · $59,550,776
Proceeds of hacks and exploits weight 8 1.56 of 10 · 2% of score
Proceeds of hacks and exploits contributes 1.56 of 10: $258,159 directly on Ethereum ($258,159). Weighted exposure is 0.038% of traced value, below the 1.000% saturation point for this category.
Euler Finance Exploiter · ethereum · $258,159
Unattributed address weight 2 1.39 of 10 · 2% of score
Unattributed address contributes 1.38 of 10: $78,657,538 directly and $366,247,318 one hop away on Ethereum ($444,904,845), BNB Smart Chain ($12), Polygon ($0). Weighted exposure is 38.341% of traced value, below the 80.000% saturation point for this category.
Unattributed address 0x002c...dd44 · ethereum · $22,073,360 Unattributed address 0x9e1e...03b1 · ethereum · $21,529,476 Unattributed address 0x99b6...a12d · ethereum · $17,740,861
Regulated exchange or VASP weight 1 0.00 of 10 · 0% of score
Regulated exchange or VASP contributes 0.00 of 10: $29 one hop away on Ethereum ($29), BNB Smart Chain ($0). Weighted exposure is 0.000% of traced value, below the 80.000% saturation point for this category.
Bybit Hot Wallet · ethereum · $25 Binance Hot Wallet 15 · ethereum · $2 Binance Hot Wallet 14 · ethereum · $1
Cross-chain bridge weight 3 0.00 of 10 · 0% of score
Cross-chain bridge carries no scoring weight in this model, so its $0 of flow does not affect the score.
HopBridgeToken · polygon · $0
Decentralised finance protocol weight 2 0.00 of 10 · 0% of score
Decentralised finance protocol carries no scoring weight in this model, so its $0 of flow does not affect the score.
UniswapV3Pool · polygon · $0
Regulated custodian weight 1 0.00 of 10 · 0% of score
Regulated custodian carries no scoring weight in this model, so its $0 of flow does not affect the score.
Ethereum Foundation · ethereum · $0
Merchant or payment processor weight 1 0.00 of 10 · 0% of score
Merchant or payment processor carries no scoring weight in this model, so its $0 of flow does not affect the score.
USDC Token Contract · ethereum · $0
Token contract weight 1 0.00 of 10 · 0% of score
Token contract carries no scoring weight in this model, so its $0 of flow does not affect the score.
USD Coin (USDC) · base · $0 Wrapped Ether (WETH) · bsc · $0 Tether USD (USDT) · polygon · $0

Flow of funds

Source and destination are kept apart on purpose. Illicit money arriving is a source-of-funds question the institution must report; clean money leaving towards a risky party is a destination question it may still be able to prevent.

Source of funds

Total
$258,200
412 transfer(s)
Largest single
$253,097
mean $627
Risk-relevant
98.024%
$253,097
Counterparties
147
1.976% unattributed
CategoryShareValue TransfersCustodyTop entities
Proceeds of hacks and exploits risk-relevant 98.024% $253,097 1 unhosted Euler Finance Exploiter
Cross-chain bridge 0.0% $0 1 protocol HopBridgeToken
Unattributed address 1.976% $5,103 397 unhosted Unattributed address 0xe129...0c64, Unattributed address 0x4e5b...972f, Unattributed address 0xc3c9...f47f, Unattributed address 0x5a1a...5160, Unattributed address 0x0050...9b79
Decentralised finance protocol 0.0% $0 1 protocol UniswapV3Pool
Regulated custodian 0.0% $0 2 hosted Ethereum Foundation
Merchant or payment processor 0.0% $0 1 hosted USDC Token Contract
Token contract 0.0% $0 8 unhosted USD Coin (USDC), Wrapped Ether (WETH), Tether USD (USDT), USDCoin, Wrapped Matic (WMATIC)
Regulated exchange or VASP 0.0% $0 1 hosted Binance 8

Destination of funds

Total
$445,233,614
150 transfer(s)
Largest single
$84,960,113
mean $2,968,224
Risk-relevant
82.335%
$366,581,179
Counterparties
47
17.665% unattributed
CategoryShareValue TransfersCustodyTop entities
Sanctioned entity or designated address risk-relevant 82.333% $366,576,117 8 unhosted LAZARUS GROUP
Proceeds of hacks and exploits risk-relevant 0.001% $5,062 1 unhosted Euler Finance Exploiter
Unattributed address 17.665% $78,652,435 141 unhosted Unattributed address 0x1bf5...18d6, Unattributed address 0xdf22...df2a, Unattributed address 0x7753...2828, Unattributed address 0xbcd7...3868, Unattributed address 0x1361...1f39

Funds arrived mainly from proceeds of hacks and exploits (98.024%) across 412 inbound transfer(s) totalling $258,200. Funds left mainly to sanctioned entity or designated address (82.333%) across 150 outbound transfer(s) totalling $445,233,614. 98.024% of inbound value came from categories that carry material risk weight, which is a source-of-funds question for the institution. 82.335% of outbound value went to categories that carry material risk weight, which is a destination-of-funds question and may be preventable.

Both sides are computed from observed transfers only, so the percentages describe funds this screen actually saw move. Modelled hops are excluded here deliberately: a source-of-funds statement should not rest on an inferred counterparty.

Typology indicators

Exposure says who the wallet touched; these say what it was doing. A clean counterparty set does not rule out structuring.

5 indicator(s) triggered, 3 not observable with the data available.

IndicatorFamilyStatusWhat was found
Mixing or anonymising service use privacy clear No traced value connects to a mixing service.
CoinJoin-shaped joint spend privacy clear No group of equal-value transfers large enough to indicate a collaborative mix.
Peel chain structuring medium Run of 3 successively smaller outbound transfers totalling $31,883,436, consistent with peeling a bulk balance into increments.
Deposit splitting below a reporting threshold structuring clear No counterparty received 3 or more transfers in the band beneath the reporting threshold.
Rapid pass-through structuring high 7 outbound transfer(s) left within an hour of funds arriving; median dwell is 10.05h across 150 sample(s).
Bridge and cross-chain swap routing cross chain clear No bridge crossing appears in this screen.
Swap and protocol routing concentration cross chain clear Protocol routing accounts for 0.0% of flow, within normal range.
Burst transaction scheduling network medium 46 transfers were broadcast inside a 5-minute window, which is automation rather than a person transacting.
Mempool and fee irregularities network unavailable Zero-confirmation transactions, fee spikes and confirmation depth are not exposed on the chains in this screen, so this indicator is reported as unavailable rather than inferred. Bitcoin mempool.space is the exception, and it was not read here.
Unhosted wallet interaction custody medium 100.0% of directly transacted value went to or from self-custodied addresses with no regulated operator behind them, so no counterparty holds identity information for that flow.
Deviation from stated customer profile profile unavailable No stated customer profile was supplied, so deviation from expected behaviour cannot be scored. The wallet's own history is still in the report.
Opening deposit inconsistent with stated identity identity unavailable No stated identity (account opening date, new-customer flag, or declared income) was supplied, so an opening deposit cannot be judged inconsistent and a new-user full withdrawal cannot be scored. PEP/RCA name screening and source-of-wealth documents are not in this product. The institution's own identity stack still has to sit beside this screen.
Many-to-one inbound wallet shape identity medium 11 distinct inbound wallets sent value inside a 24-hour window ($2). That is a many-to-one wallet shape, not a finding that they are several people or share an IP.

Indicators are computed from the observed transfer set and the composed exposure view. They describe transaction shape, not intent: a triggered indicator is a reason to look, not a finding of wrongdoing. Profile deviation is scored only when the institution supplies a stated customer profile; without one the indicator is not observable rather than clear. Opening-deposit is scored only when account age or declared income is supplied. Many-to-one names inbound wallets, not people or a shared IP.

Sanctions and watchlist screening

9 direct match(es), 6 indirect exposure(s) 9 direct match(es) against LAZARUS GROUP. Dealing with a designated party is prohibited irrespective of value, so this is a block decision rather than a risk judgement. 6 indirect exposure(s) totalling $108,325,679 sit one or more hops from a designated party. These are reportable findings, not prohibited dealings. Lists matched: OFAC, EU, UN, UK-HMT.
EntityMatchSeverityLists ValueShare
LAZARUS GROUP
0x35fb6f6db4fb05e6a4ce86f2c93691425626d4b1
 direct counterparty critical
OFAC SDN · DPRK3 · OFAC-SDN-27307
 $84,960,113 9.234%
LAZARUS GROUP
0xf7b31119c2682c88d88d455dbb9d5932c65cf1be
 direct counterparty critical
OFAC SDN · DPRK3 · OFAC-SDN-27307
 $63,597,093 6.912%
LAZARUS GROUP
0x3e37627deaa754090fbfbb8bd226c1ce66d255e9
 direct counterparty critical
OFAC SDN · DPRK3 · OFAC-SDN-27307
 $59,550,776 6.472%
LAZARUS GROUP
0x53b6936513e738f44fb50d2b9476730c0ab3bfc1
 direct counterparty critical
OFAC SDN · DPRK3 · OFAC-SDN-27307
 $54,743,653 5.95%
LAZARUS GROUP
0xa0e1c89ef1a489c9c7de96311ed5ce5d32c20e4b
 direct counterparty critical
OFAC SDN · DPRK3 · OFAC-SDN-27307
 $46,207,508 5.022%
LAZARUS GROUP
0x08723392ed15743cc38513c4925f5e6be5c17243
 direct counterparty critical
OFAC SDN · DPRK3 · OFAC-SDN-27307
 $31,878,374 3.465%
LAZARUS GROUP
0x3cffd56b47b7b41c56258d9c7731abadc360e073
 direct counterparty critical
OFAC SDN · DPRK3 · OFAC-SDN-27307
 $25,638,600 2.787%
LAZARUS GROUP
0x098B716B8Aaf21512996dC57EB0615e2383E2f96
 direct subject critical
OFAC SDN · DPRK3 · OFAC-SDN-27307
 $257,669 100.0%
LAZARUS GROUP
0x098b716b8aaf21512996dc57eb0615e2383e2f96
 direct counterparty critical
OFAC SDN · DPRK3 · OFAC-SDN-27307
 $0 0.0%
Tornado Cash Router
0xd90e2f925da726b50c4ed8d0fb90ad053324f31b
 indirect exposure high
OFAC SDN · CYBER2 · OFAC-2DE39D7B9C
EU CFSP consolidated · 2019/796 · EU-B14E4A3AB0
UN Consolidated · 1267/1989/2253 · UN-0CCF190BFF
UK-HMT UK Sanctions List · CYB · UK-HMT-5596380580
 $22,019,472 2.393%
Tornado Cash Router
0xd90e2f925da726b50c4ed8d0fb90ad053324f31b
 indirect exposure high
OFAC SDN · CYBER2 · OFAC-2DE39D7B9C
EU CFSP consolidated · 2019/796 · EU-B14E4A3AB0
UN Consolidated · 1267/1989/2253 · UN-0CCF190BFF
UK-HMT UK Sanctions List · CYB · UK-HMT-5596380580
 $21,513,277 2.338%
Tornado Cash Router
0xd90e2f925da726b50c4ed8d0fb90ad053324f31b
 indirect exposure high
OFAC SDN · CYBER2 · OFAC-2DE39D7B9C
EU CFSP consolidated · 2019/796 · EU-B14E4A3AB0
UN Consolidated · 1267/1989/2253 · UN-0CCF190BFF
UK-HMT UK Sanctions List · CYB · UK-HMT-5596380580
 $17,716,817 1.926%
Tornado Cash Router
0xd90e2f925da726b50c4ed8d0fb90ad053324f31b
 indirect exposure high
OFAC SDN · CYBER2 · OFAC-2DE39D7B9C
EU CFSP consolidated · 2019/796 · EU-B14E4A3AB0
UN Consolidated · 1267/1989/2253 · UN-0CCF190BFF
UK-HMT UK Sanctions List · CYB · UK-HMT-5596380580
 $16,704,427 1.816%
Tornado Cash Router
0xd90e2f925da726b50c4ed8d0fb90ad053324f31b
 indirect exposure high
OFAC SDN · CYBER2 · OFAC-2DE39D7B9C
EU CFSP consolidated · 2019/796 · EU-B14E4A3AB0
UN Consolidated · 1267/1989/2253 · UN-0CCF190BFF
UK-HMT UK Sanctions List · CYB · UK-HMT-5596380580
 $15,692,038 1.706%
Tornado Cash Router
0xd90e2f925da726b50c4ed8d0fb90ad053324f31b
 indirect exposure high
OFAC SDN · CYBER2 · OFAC-2DE39D7B9C
EU CFSP consolidated · 2019/796 · EU-B14E4A3AB0
UN Consolidated · 1267/1989/2253 · UN-0CCF190BFF
UK-HMT UK Sanctions List · CYB · UK-HMT-5596380580
 $14,679,648 1.596%

Addresses are matched against the seeded watchlist by cluster, so a designation applies to every address attributed to the same entity. Direct matches are observed on chain; indirect and bridged findings include modelled hops and must be confirmed before they are relied on.

Only the Tornado Cash and Lazarus clusters reflect real designations. Every other listing is fabricated for demonstration and must never be used as a sanctions determination.

Forensic tracing

8 path(s) traced, 8 of them fully observed on chain; deepest is 3 hop(s).

Source of funds Subject wallet Destination of funds Onward and cross-chain $5,062 $23 $5 $3 $2 $2 $84,960,113 $63,597,093 $59,550,776 $54,743,653 $46,207,508 $31,878,374 $22,073,360 $22,019,472 $21,529,476 $21,513,277 $17,740,861 $17,716,817 $84,960,113 $63,597,093 $59,550,776 $54,743,653 $46,207,508 $31,878,374 $22,073,360 $22,019,472 $21,529,476 $21,513,277 Unattributed address 0xe129...0c64 | Unattributed address | Ethereum | direct | $5,062 Unattributed address 0xe... Ethereum $5,062 Unattributed address 0x4e5b...972f | Unattributed address | Ethereum | direct | $23 Unattributed address 0x4... Ethereum $23 Unattributed address 0xc3c9...f47f | Unattributed address | Ethereum | direct | $5 Unattributed address 0xc... Ethereum $5 Unattributed address 0x5a1a...5160 | Unattributed address | Ethereum | direct | $3 Unattributed address 0x5... Ethereum $3 Unattributed address 0x0050...9b79 | Unattributed address | BNB Smart Chain | direct | $2 Unattributed address 0x0... BNB Smart Chain $2 Unattributed address 0x0b70...5b76 | Unattributed address | BNB Smart Chain | direct | $2 Unattributed address 0x0... BNB Smart Chain $2 LAZARUS GROUP | Sanctioned entity or designated address | Ethereum | direct | $84,960,113 LAZARUS GROUP Ethereum $84,960,113 LAZARUS GROUP | Sanctioned entity or designated address | Ethereum | direct | $63,597,093 LAZARUS GROUP Ethereum $63,597,093 LAZARUS GROUP | Sanctioned entity or designated address | Ethereum | direct | $59,550,776 LAZARUS GROUP Ethereum $59,550,776 LAZARUS GROUP | Sanctioned entity or designated address | Ethereum | direct | $54,743,653 LAZARUS GROUP Ethereum $54,743,653 LAZARUS GROUP | Sanctioned entity or designated address | Ethereum | direct | $46,207,508 LAZARUS GROUP Ethereum $46,207,508 LAZARUS GROUP | Sanctioned entity or designated address | Ethereum | direct | $31,878,374 LAZARUS GROUP Ethereum $31,878,374 Unattributed address 0x002c...dd44 | Unattributed address | Ethereum | indirect | $22,073,360 Unattributed address 0x0... Ethereum $22,073,360 Tornado Cash Router | Sanctioned entity or designated address | Ethereum | indirect | $22,019,472 Tornado Cash Router Ethereum $22,019,472 Unattributed address 0x9e1e...03b1 | Unattributed address | Ethereum | indirect | $21,529,476 Unattributed address 0x9... Ethereum $21,529,476 Tornado Cash Router | Sanctioned entity or designated address | Ethereum | indirect | $21,513,277 Tornado Cash Router Ethereum $21,513,277 Unattributed address 0x99b6...a12d | Unattributed address | Ethereum | indirect | $17,740,861 Unattributed address 0x9... Ethereum $17,740,861 Tornado Cash Router | Sanctioned entity or designated address | Ethereum | indirect | $17,716,817 Tornado Cash Router Ethereum $17,716,817 0x098B716B...
Counterparty category Sanctioned entity or designated address Unattributed address

Value flows left to right. Solid edges are observed transfers; dashed edges are modelled onward hops. Circle area is proportional to value, not to risk. Node colour is the counterparty category — see the key below the diagram. 282 lower-value node(s) omitted for legibility.

Multi-hop transfer diagram

Fund flow by hop and first transfer time. Orange arrows cross chains; dashed arrows are onward or bridged hops.

Source 3 Source 2 Hop 1 · sources Subject Hop 1 · destinations Hop 2 Hop 3+ $0 · hop 3 · Ethereum · 2023-10-25 02:46 $5,062 · hop 3 · Ethereum · 2024-02-20 05:58 $7 · hop 3 · Ethereum · 2026-09-12 16:42 $0 · hop 2 · Ethereum · 2021-04-02 15:51 $1 · hop 2 · BNB Smart Chain · 2021-07-09 05:14 $1 · hop 2 · BNB Smart Chain · 2021-07-11 15:12 $0 · hop 2 · BNB Smart Chain · 2021-09-04 13:50 $0 · hop 2 · BNB Smart Chain · 2021-10-12 13:55 $0 · hop 2 · BNB Smart Chain · 2021-10-12 13:55 $1 · hop 2 · BNB Smart Chain · 2021-10-12 14:31 $0 · hop 1 · Polygon · 2022-03-29 16:17 $0 · hop 1 · Polygon · 2022-03-29 19:15 $0 · hop 1 · Polygon · 2022-03-29 19:31 $0 · hop 1 · Polygon · 2022-03-29 23:02 $0 · hop 1 · BNB Smart Chain · 2022-03-30 13:24 $0 · hop 1 · BNB Smart Chain · 2022-03-30 13:25 $0 · hop 1 · BNB Smart Chain · 2022-03-30 13:30 $0 · hop 1 · Ethereum · 2022-03-31 11:06 $0 · hop 1 · Ethereum · 2022-03-31 11:06 $0 · hop 1 · Ethereum · 2022-03-31 11:09 $0 · hop 1 · Ethereum · 2022-03-31 11:10 $0 · hop 1 · Ethereum · 2022-03-31 11:17 $0 · hop 1 · Ethereum · 2022-03-31 11:18 $0 · hop 1 · Ethereum · 2022-03-31 11:19 $3,867,882 · hop 2 · Ethereum · 2022-04-22 10:53 $7,953,535 · hop 2 · Ethereum · 2022-04-23 11:25 $13,695,851 · hop 2 · Ethereum · 2022-04-24 12:50 $11,420,513 · hop 2 · Ethereum · 2022-04-27 01:40 $13,257,494 · hop 2 · Ethereum · 2022-04-28 03:10 $21,529,476 · hop 2 · Ethereum · 2022-04-29 13:40 $16,736,824 · hop 2 · Ethereum · 2022-05-02 02:08 $22,019,472 · hop 3 · Ethereum · 2022-04-29 13:44 $21,513,277 · hop 3 · Ethereum · 2022-04-29 13:44 $17,716,817 · hop 3 · Ethereum · 2022-04-29 13:44 $16,704,427 · hop 3 · Ethereum · 2022-04-29 13:44 $15,692,038 · hop 3 · Ethereum · 2022-04-29 13:44 $14,679,648 · hop 3 · Ethereum · 2022-04-29 13:44 $127 · hop 3 · Ethereum · 2023-03-25 08:53 $21,529,476 $22,019,472 $21,513,277 Unattributed address 0x4e5b...972f | Unattributed address | Ethereum | indirect | $0 | first 2023-10-25 02:46 Unattributed address 0... Ethereum · 10-25 02:46 $0 Unattributed address 0x8b58...6b4f | Unattributed address | Ethereum | indirect | $5,062 | first 2024-02-20 05:58 Unattributed address 0... Ethereum · 02-20 05:58 $5,062 Unattributed address 0xe7e7...12a3 | Unattributed address | Ethereum | indirect | $7 | first 2026-09-12 16:42 Unattributed address 0... Ethereum · 09-12 16:42 $7 Unattributed address 0xe0c8...834e | Unattributed address | Ethereum | indirect | $0 | first 2021-04-02 15:51 Unattributed address 0... Ethereum · 04-02 15:51 $0 Unattributed address 0xab88...f4ae | Unattributed address | BNB Smart Chain | indirect | $1 | first 2021-07-09 05:14 Unattributed address 0... BNB Smart Chain · 07-09 05:14 $1 Unattributed address 0xdccf...a75a | Unattributed address | BNB Smart Chain | indirect | $1 | first 2021-07-11 15:12 Unattributed address 0... BNB Smart Chain · 07-11 15:12 $1 Unattributed address 0xc845...97eb | Unattributed address | BNB Smart Chain | indirect | $0 | first 2021-09-04 13:50 Unattributed address 0... BNB Smart Chain · 09-04 13:50 $0 Unattributed address 0x3f80...2d62 | Unattributed address | BNB Smart Chain | indirect | $0 | first 2021-10-12 13:55 Unattributed address 0... BNB Smart Chain · 10-12 13:55 $0 Unattributed address 0x8840...c1ba | Unattributed address | BNB Smart Chain | indirect | $0 | first 2021-10-12 13:55 Unattributed address 0... BNB Smart Chain · 10-12 13:55 $0 Unattributed address 0xbcb5...23a5 | Unattributed address | BNB Smart Chain | indirect | $1 | first 2021-10-12 14:31 Unattributed address 0... BNB Smart Chain · 10-12 14:31 $1 Unattributed address 0x0cae...4875 | Unattributed address | Polygon | direct | $0 | first 2022-03-29 16:17 Unattributed address 0... Polygon · 03-29 16:17 $0 Unattributed address 0x0ca6...70fd | Unattributed address | Polygon | direct | $0 | first 2022-03-29 19:15 Unattributed address 0... Polygon · 03-29 19:15 $0 Unattributed address 0x5464...8888 | Unattributed address | Polygon | direct | $0 | first 2022-03-29 19:31 Unattributed address 0... Polygon · 03-29 19:31 $0 Unattributed address 0xdc10...685b | Unattributed address | Polygon | direct | $0 | first 2022-03-29 23:02 Unattributed address 0... Polygon · 03-29 23:02 $0 Unattributed address 0x44f6...4ec4 | Unattributed address | BNB Smart Chain | direct | $0 | first 2022-03-30 13:24 Unattributed address 0... BNB Smart Chain · 03-30 13:24 $0 Unattributed address 0x546c...9d09 | Unattributed address | BNB Smart Chain | direct | $0 | first 2022-03-30 13:25 Unattributed address 0... BNB Smart Chain · 03-30 13:25 $0 Unattributed address 0x505c...f2d6 | Unattributed address | BNB Smart Chain | direct | $0 | first 2022-03-30 13:30 Unattributed address 0... BNB Smart Chain · 03-30 13:30 $0 Unattributed address 0x5e7c...f5cd | Unattributed address | Ethereum | direct | $0 | first 2022-03-31 11:06 Unattributed address 0... Ethereum · 03-31 11:06 $0 Unattributed address 0x8ea2...5a99 | Unattributed address | Ethereum | direct | $0 | first 2022-03-31 11:06 Unattributed address 0... Ethereum · 03-31 11:06 $0 Unattributed address 0x6489...f828 | Unattributed address | Ethereum | direct | $0 | first 2022-03-31 11:09 Unattributed address 0... Ethereum · 03-31 11:09 $0 Unattributed address 0x12da...5c80 | Unattributed address | Ethereum | direct | $0 | first 2022-03-31 11:10 Unattributed address 0... Ethereum · 03-31 11:10 $0 Unattributed address 0x5110...fffb | Unattributed address | Ethereum | direct | $0 | first 2022-03-31 11:17 Unattributed address 0... Ethereum · 03-31 11:17 $0 Unattributed address 0x792c...d2fc | Unattributed address | Ethereum | direct | $0 | first 2022-03-31 11:18 Unattributed address 0... Ethereum · 03-31 11:18 $0 Unattributed address 0x102d...4c14 | Unattributed address | Ethereum | direct | $0 | first 2022-03-31 11:19 Unattributed address 0... Ethereum · 03-31 11:19 $0 Unattributed address 0x8fa7...42b6 | Unattributed address | Ethereum | indirect | $3,867,882 | first 2022-04-22 10:53 Unattributed address 0... Ethereum · 04-22 10:53 $3,867,882 Unattributed address 0x28f0...a70b | Unattributed address | Ethereum | indirect | $7,953,535 | first 2022-04-23 11:25 Unattributed address 0... Ethereum · 04-23 11:25 $7,953,535 Unattributed address 0xb365...d81d | Unattributed address | Ethereum | indirect | $13,695,851 | first 2022-04-24 12:50 Unattributed address 0... Ethereum · 04-24 12:50 $13,695,851 Unattributed address 0x5967...3c0a | Unattributed address | Ethereum | indirect | $11,420,513 | first 2022-04-27 01:40 Unattributed address 0... Ethereum · 04-27 01:40 $11,420,513 Unattributed address 0xdd64...6683 | Unattributed address | Ethereum | indirect | $13,257,494 | first 2022-04-28 03:10 Unattributed address 0... Ethereum · 04-28 03:10 $13,257,494 Unattributed address 0x9e1e...03b1 | Unattributed address | Ethereum | indirect | $21,529,476 | first 2022-04-29 13:40 Unattributed address 0... Ethereum · 04-29 13:40 $21,529,476 Unattributed address 0x6221...ca14 | Unattributed address | Ethereum | indirect | $16,736,824 | first 2022-05-02 02:08 Unattributed address 0... Ethereum · 05-02 02:08 $16,736,824 Tornado Cash Router | Sanctioned entity or designated address | Ethereum | indirect | $22,019,472 | first 2022-04-29 13:44 Tornado Cash Router Ethereum · 04-29 13:44 $22,019,472 Tornado Cash Router | Sanctioned entity or designated address | Ethereum | indirect | $21,513,277 | first 2022-04-29 13:44 Tornado Cash Router Ethereum · 04-29 13:44 $21,513,277 Tornado Cash Router | Sanctioned entity or designated address | Ethereum | indirect | $17,716,817 | first 2022-04-29 13:44 Tornado Cash Router Ethereum · 04-29 13:44 $17,716,817 Tornado Cash Router | Sanctioned entity or designated address | Ethereum | indirect | $16,704,427 | first 2022-04-29 13:44 Tornado Cash Router Ethereum · 04-29 13:44 $16,704,427 Tornado Cash Router | Sanctioned entity or designated address | Ethereum | indirect | $15,692,038 | first 2022-04-29 13:44 Tornado Cash Router Ethereum · 04-29 13:44 $15,692,038 Tornado Cash Router | Sanctioned entity or designated address | Ethereum | indirect | $14,679,648 | first 2022-04-29 13:44 Tornado Cash Router Ethereum · 04-29 13:44 $14,679,648 Unattributed address 0x479b...beae | Unattributed address | Ethereum | indirect | $127 | first 2023-03-25 08:53 Unattributed address 0... Ethereum · 03-25 08:53 $127 0x098B716B...
Counterparty category Sanctioned entity or designated address Unattributed address

Transfer diagram: Source 3 → Source 2 → Hop 1 sources feed the subject; Hop 1 destinations → Hop 2 → Hop 3+ leave to the right. Nodes in a column are ordered by first transfer time. Circle area tracks USD. Solid arrows are observed; dashed arrows are onward or bridged hops. Orange arrows cross chains. Node colour is the counterparty category — see the key below the diagram. 262 lower-value node(s) omitted for legibility. 38 arrow(s) · 24 multi-hop.

When the funds moved

98% of inbound USD arrived in a 4-hour window starting 17 Mar 2023 03:48 UTC ($253,097 of $258,200). The lower chart is activity on counterparties (hop 2+), not funds through this address.

Full history: every transfer this wallet has on the screened chains was read.

Hop 1 — this address (inbound above, outbound below) Inbound 0 $250.0M $500.0M $250.0M $500.0M Outbound 28 Mar · inbound · Unattributed address · $2 04 Apr · inbound · Unattributed address · $1 04 Apr · outbound · Unattributed address · $41.0M 11 Apr · inbound · Unattributed address · $5 11 Apr · outbound · Unattributed address · $37.6M 18 Apr · inbound · Unattributed address · $8 18 Apr · outbound · Sanctioned entity or designated address · $211.5M 25 Apr · inbound · Unattributed address · $0 25 Apr · outbound · Sanctioned entity or designated address · $63.6M 02 May · outbound · Sanctioned entity or designated address · $91.4M 16 May · inbound · Unattributed address · $0 30 May · inbound · Unattributed address · $0 13 Mar · inbound · Proceeds of hacks and exploits · $253.1k 13 Mar · inbound · Unattributed address · $0 20 Mar · outbound · Proceeds of hacks and exploits · $5.1k 07 Aug · inbound · Unattributed address · $0 16 Oct · inbound · Unattributed address · $0 23 Oct · inbound · Unattributed address · $23 19 Feb · inbound · Unattributed address · $5.1k 01 Apr · inbound · Unattributed address · $0 13 May · inbound · Unattributed address · $0 Hop 2+ — activity on counterparties, not through this address 0 $200.0M 18 Apr · hop 2+ peer activity · $21.6M 25 Apr · hop 2+ peer activity · $71.6M 02 May · hop 2+ peer activity · $199.7M 09 May · hop 2+ peer activity · $105.4M 16 May · hop 2+ peer activity · $76.2M 20 Mar · hop 2+ peer activity · $270 27 Mar · hop 2+ peer activity · $7 17 Apr · hop 2+ peer activity · $1.6k 07 Aug · hop 2+ peer activity · $1.4k 21 Aug · hop 2+ peer activity · $79 28 Aug · hop 2+ peer activity · $10.6k 04 Sep · hop 2+ peer activity · $68 11 Sep · hop 2+ peer activity · $3.4k 18 Sep · hop 2+ peer activity · $241 02 Oct · hop 2+ peer activity · $0 06 Nov · hop 2+ peer activity · $758 20 Nov · hop 2+ peer activity · $35.4k 27 Nov · hop 2+ peer activity · $8.3k 25 Dec · hop 2+ peer activity · $146 12 Feb · hop 2+ peer activity · $17.1k 19 Feb · hop 2+ peer activity · $26.7k 26 Feb · hop 2+ peer activity · $3.0k 28 Mar 11 Jul 24 Oct 06 Feb 22 May 04 Sep 18 Dec 01 Apr 08 Jul
Hop 1 category Sanctioned entity or designated address Proceeds of hacks and exploits Unattributed address

Traced paths

observed LAZARUS GROUP · Sanctioned entity or designated address $84,960,113
1. LAZARUS GROUP · Ethereum · observed
$84,960,113 traced across 1 hop(s): LAZARUS GROUP, ending at a sanctioned entity or designated address on Ethereum. The endpoint is not a hosted service, so there is no operator to ask for the beneficiary's identity.
observed LAZARUS GROUP · Sanctioned entity or designated address $63,597,093
1. LAZARUS GROUP · Ethereum · observed
$63,597,093 traced across 1 hop(s): LAZARUS GROUP, ending at a sanctioned entity or designated address on Ethereum. The endpoint is not a hosted service, so there is no operator to ask for the beneficiary's identity.
observed LAZARUS GROUP · Sanctioned entity or designated address $59,550,776
1. LAZARUS GROUP · Ethereum · observed
$59,550,776 traced across 1 hop(s): LAZARUS GROUP, ending at a sanctioned entity or designated address on Ethereum. The endpoint is not a hosted service, so there is no operator to ask for the beneficiary's identity.
observed LAZARUS GROUP · Sanctioned entity or designated address $54,743,653
1. LAZARUS GROUP · Ethereum · observed
$54,743,653 traced across 1 hop(s): LAZARUS GROUP, ending at a sanctioned entity or designated address on Ethereum. The endpoint is not a hosted service, so there is no operator to ask for the beneficiary's identity.
observed LAZARUS GROUP · Sanctioned entity or designated address $46,207,508
1. LAZARUS GROUP · Ethereum · observed
$46,207,508 traced across 1 hop(s): LAZARUS GROUP, ending at a sanctioned entity or designated address on Ethereum. The endpoint is not a hosted service, so there is no operator to ask for the beneficiary's identity.
observed LAZARUS GROUP · Sanctioned entity or designated address $31,878,374
1. LAZARUS GROUP · Ethereum · observed
$31,878,374 traced across 1 hop(s): LAZARUS GROUP, ending at a sanctioned entity or designated address on Ethereum. The endpoint is not a hosted service, so there is no operator to ask for the beneficiary's identity.
observed LAZARUS GROUP · Sanctioned entity or designated address $25,638,600
1. LAZARUS GROUP · Ethereum · observed
$25,638,600 traced across 1 hop(s): LAZARUS GROUP, ending at a sanctioned entity or designated address on Ethereum. The endpoint is not a hosted service, so there is no operator to ask for the beneficiary's identity.
observed Tornado Cash Router · Sanctioned entity or designated address $22,019,472
1. LAZARUS GROUP · Ethereum · observed → 2. Unattributed address 0x002c...dd44 · Ethereum · observed → 3. Tornado Cash Router · Ethereum · observed
$22,019,472 traced across 3 hop(s): LAZARUS GROUP to Unattributed address 0x002c...dd44 to Tornado Cash Router, ending at a sanctioned entity or designated address on Ethereum. The endpoint is not a hosted service, so there is no operator to ask for the beneficiary's identity.

8 path(s) from this wallet reach an identified endpoint, of which 8 are fully observed on chain. $84,960,113 traced across 1 hop(s): LAZARUS GROUP, ending at a sanctioned entity or designated address on Ethereum. The endpoint is not a hosted service, so there is no operator to ask for the beneficiary's identity.

Timeline

WhenChainDirection CounterpartyValue
2022-03-29 16:17 Polygon in 0x0caee49bdd3440735cea29f855afcc19c0214875 $0
2022-03-29 19:15 Polygon in 0x0ca69fff9cb56958ac5cc3082bba506fce5b70fd $0
2022-03-29 19:31 Polygon in 0x5464204ab93bf4e2d698875a59c8f4e988888888 $0
2022-03-29 23:02 Polygon in 0xdc1057e01a03d4583062f2f21371ffbfb335685b $0
2022-03-30 13:24 BNB Smart Chain in 0x44f6d7ac588c3e0943f0b41c755a62220fdc4ec4 $0
2022-03-30 13:25 BNB Smart Chain in 0x546c2fa1919d7a8e766e979e44cf7b64e1459d09 $0
2022-03-30 13:25 BNB Smart Chain in 0x44f6d7ac588c3e0943f0b41c755a62220fdc4ec4 $0
2022-03-30 13:25 BNB Smart Chain in 0x44f6d7ac588c3e0943f0b41c755a62220fdc4ec4 $0
2022-03-30 13:26 BNB Smart Chain in 0x44f6d7ac588c3e0943f0b41c755a62220fdc4ec4 $0
2022-03-30 13:27 BNB Smart Chain in 0x44f6d7ac588c3e0943f0b41c755a62220fdc4ec4 $0
2022-03-30 13:27 BNB Smart Chain in 0x44f6d7ac588c3e0943f0b41c755a62220fdc4ec4 $0
2022-03-30 13:28 BNB Smart Chain in 0x44f6d7ac588c3e0943f0b41c755a62220fdc4ec4 $0
2022-03-30 13:28 BNB Smart Chain in 0x44f6d7ac588c3e0943f0b41c755a62220fdc4ec4 $0
2022-03-30 13:29 BNB Smart Chain in 0x44f6d7ac588c3e0943f0b41c755a62220fdc4ec4 $0
2022-03-30 13:30 BNB Smart Chain in 0x44f6d7ac588c3e0943f0b41c755a62220fdc4ec4 $0
2022-03-30 13:30 BNB Smart Chain in 0x505c5d50ce7ffe89b69691138adaa29e4b25f2d6 $0
2022-03-30 13:30 BNB Smart Chain in 0x77af6f3404bc674b425cb68546b277d3fcfaa849 $0
2022-03-30 13:30 BNB Smart Chain in 0x44f6d7ac588c3e0943f0b41c755a62220fdc4ec4 $0
2022-03-30 13:31 BNB Smart Chain in 0x44f6d7ac588c3e0943f0b41c755a62220fdc4ec4 $0
2022-03-30 13:31 BNB Smart Chain in 0x44f6d7ac588c3e0943f0b41c755a62220fdc4ec4 $0

Exhibits

AddressEntityCluster AttributionBasis
0x35fb6f6db4fb05e6a4ce86f2c93691425626d4b1 LAZARUS GROUP
Sanctioned entity or designated address
 ofac-sdn-27307
0 address(es)
 ofac observed on chain
0xf7b31119c2682c88d88d455dbb9d5932c65cf1be LAZARUS GROUP
Sanctioned entity or designated address
 ofac-sdn-27307
0 address(es)
 ofac observed on chain
0x3e37627deaa754090fbfbb8bd226c1ce66d255e9 LAZARUS GROUP
Sanctioned entity or designated address
 ofac-sdn-27307
0 address(es)
 ofac observed on chain
0x53b6936513e738f44fb50d2b9476730c0ab3bfc1 LAZARUS GROUP
Sanctioned entity or designated address
 ofac-sdn-27307
0 address(es)
 ofac observed on chain
0xa0e1c89ef1a489c9c7de96311ed5ce5d32c20e4b LAZARUS GROUP
Sanctioned entity or designated address
 ofac-sdn-27307
0 address(es)
 ofac observed on chain
0x08723392ed15743cc38513c4925f5e6be5c17243 LAZARUS GROUP
Sanctioned entity or designated address
 ofac-sdn-27307
0 address(es)
 ofac observed on chain
0x3cffd56b47b7b41c56258d9c7731abadc360e073 LAZARUS GROUP
Sanctioned entity or designated address
 ofac-sdn-27307
0 address(es)
 ofac observed on chain
0x002c93452d54b6d64bfa9879fcab14a74f1bdd44 Unattributed address 0x002c...dd44
Unattributed address
 unlabelled-4f1bdd44
0 address(es)
 unlabelled observed on chain
0xd90e2f925da726b50c4ed8d0fb90ad053324f31b Tornado Cash Router
Sanctioned entity or designated address
 tornado-cash
3 address(es)
 public observed on chain

Paths are assembled from the composed exposure view, walking each endpoint back to the subject. Direct hops are observed on chain. Onward and bridged hops are observed from a live indexer walk, or modelled from the seed when SAFESCORE_OFFLINE=1, and are marked as such on every hop. The transfer map lays those hops on chain lanes ordered by fund size and transfer timestamp.

Counterparty services

The same exposure means different things through a licensed custodian and a no-KYC venue, so each service a wallet touched is scored on its own controls.

3 directory-listed service(s) appear in this screen; 0 of them are high risk or prohibited, carrying 0.0% of traced value.

ServiceJurisdictionLicenceKYC LayersValueEntity risk
Binance Holdings Ltd
Regulated exchange or VASP
 Malta licensed strict directindirect $4 2.1 low
Stiftung Ethereum
Regulated custodian
 Switzerland licensed strict direct $0 1.0 minimal
Circle Internet Financial
Merchant or payment processor
 United States registered standard direct $0 4.9 medium

Only counterparties with a directory entry are profiled here. Everything else is covered by category exposure.

Cross-chain picture

Ethereum ETH

Traced value$445,491,808
In / out$258,194 / $445,233,614
Transfers299
Balance$257,659
Sourcelive:alchemy

Base ETH

Traced value$0
In / out$0 / $0
Transfers30
Balance$0
Sourcelive:alchemy

Optimism ETH

Traced value$0
In / out$0 / $0
Transfers1
Balance$0
Sourcelive:alchemy

BNB Smart Chain BNB

Traced value$7
In / out$7 / $0
Transfers150
Balance$10
Sourcelive:alchemy

Polygon POL

Traced value$0
In / out$0 / $0
Transfers77
Balance$0
Sourcelive:alchemy

Arbitrum ETH

Traced value$0
In / out$0 / $0
Transfers5
Balance$0
Sourcelive:alchemy

Bridge crossings

Bridged value does not stop at the bridge contract, so Holistix follows it onto the chains the bridge connects and weights what it finds there at 70%.

No bridge crossings observed, so all exposure stays on the chains screened.

Counterparties

CounterpartyCategoryChainLayer JurisdictionVisibility ValueWeighted
LAZARUS GROUP
0x35fb6f6db4fb05e6a4ce86f2c93691425626d4b1
 Sanctioned entity or designated address
ofac (1.00)
Ethereum direct -- traced on $84,960,113 $84,960,113
LAZARUS GROUP
0xf7b31119c2682c88d88d455dbb9d5932c65cf1be
 Sanctioned entity or designated address
ofac (1.00)
Ethereum direct -- traced on $63,597,093 $63,597,093
LAZARUS GROUP
0x3e37627deaa754090fbfbb8bd226c1ce66d255e9
 Sanctioned entity or designated address
ofac (1.00)
Ethereum direct -- traced on $59,550,776 $59,550,776
LAZARUS GROUP
0x53b6936513e738f44fb50d2b9476730c0ab3bfc1
 Sanctioned entity or designated address
ofac (1.00)
Ethereum direct -- traced on $54,743,653 $54,743,653
LAZARUS GROUP
0xa0e1c89ef1a489c9c7de96311ed5ce5d32c20e4b
 Sanctioned entity or designated address
ofac (1.00)
Ethereum direct -- traced on $46,207,508 $46,207,508
LAZARUS GROUP
0x08723392ed15743cc38513c4925f5e6be5c17243
 Sanctioned entity or designated address
ofac (1.00)
Ethereum direct -- traced on $31,878,374 $31,878,374
LAZARUS GROUP
0x3cffd56b47b7b41c56258d9c7731abadc360e073
 Sanctioned entity or designated address
ofac (1.00)
Ethereum direct -- traced on $25,638,600 $25,638,600
Unattributed address 0x002c...dd44
0x002c93452d54b6d64bfa9879fcab14a74f1bdd44
 Unattributed address
unlabelled (0.00)
Ethereum indirect
via 0x53b6936513…
 -- traced on $22,073,360 $11,036,680
Tornado Cash Router
0xd90e2f925da726b50c4ed8d0fb90ad053324f31b
 Sanctioned entity or designated address
public (1.00)
Ethereum indirect
via 0x002c93452d…
 -- traced on $22,019,472 $11,009,736
Unattributed address 0x9e1e...03b1
0x9e1e41985048c07a68a67f632f82799baaf903b1
 Unattributed address
unlabelled (0.00)
Ethereum indirect
via 0xa0e1c89ef1…
 -- traced on $21,529,476 $10,764,738
Tornado Cash Router
0xd90e2f925da726b50c4ed8d0fb90ad053324f31b
 Sanctioned entity or designated address
public (1.00)
Ethereum indirect
via 0x9e1e419850…
 -- traced on $21,513,277 $10,756,639
Unattributed address 0x99b6...a12d
0x99b6843f8410ee696b7487a5535dd5b0ca32a12d
 Unattributed address
unlabelled (0.00)
Ethereum indirect
via 0x35fb6f6db4…
 -- traced on $17,740,861 $8,870,430
Tornado Cash Router
0xd90e2f925da726b50c4ed8d0fb90ad053324f31b
 Sanctioned entity or designated address
public (1.00)
Ethereum indirect
via 0x99b6843f84…
 -- traced on $17,716,817 $8,858,408
Unattributed address 0x6221...ca14
0x622163f3f21752d359216343df88e9108495ca14
 Unattributed address
unlabelled (0.00)
Ethereum indirect
via 0x53b6936513…
 -- traced on $16,736,824 $8,368,412
Unattributed address 0x1bf5...18d6
0x1bf53ce80ff2ed5711b8a2db8f7ea5b38da118d6
 Unattributed address
unlabelled (0.00)
Ethereum direct -- traced on $8,358,794 $8,358,794
Tornado Cash Router
0xd90e2f925da726b50c4ed8d0fb90ad053324f31b
 Sanctioned entity or designated address
public (1.00)
Ethereum indirect
via 0x622163f3f2…
 -- traced on $16,704,427 $8,352,214
Unattributed address 0xdf22...df2a
0xdf225c84a0eaeaaac20e6c1d369e94ee13b9df2a
 Unattributed address
unlabelled (0.00)
Ethereum direct -- traced on $8,290,573 $8,290,573
Unattributed address 0x7753...2828
0x77532dd2eb6e8eaf416f39c65f48cd2369782828
 Unattributed address
unlabelled (0.00)
Ethereum direct -- traced on $8,105,012 $8,105,012
Unattributed address 0xedb6...45a6
0xedb60566f3fd86c2cd9db744d59f019dae0e45a6
 Unattributed address
unlabelled (0.00)
Ethereum indirect
via 0x53b6936513…
 -- traced on $15,732,280 $7,866,140
Unattributed address 0xbcd7...3868
0xbcd78c2d608e7ceb3d25bea30fae8a9d57033868
 Unattributed address
unlabelled (0.00)
Ethereum direct -- traced on $7,852,654 $7,852,654
Tornado Cash Router
0xd90e2f925da726b50c4ed8d0fb90ad053324f31b
 Sanctioned entity or designated address
public (1.00)
Ethereum indirect
via 0xedb60566f3…
 -- traced on $15,692,038 $7,846,019
Unattributed address 0x1361...1f39
0x1361c1e18930483f4aaf91f3a263937e4fcc1f39
 Unattributed address
unlabelled (0.00)
Ethereum direct -- traced on $7,600,476 $7,600,476
Unattributed address 0xb236...56c7
0xb2369d20e7f0c46270b9f79ab26fc62fada356c7
 Unattributed address
unlabelled (0.00)
Ethereum direct -- traced on $7,444,252 $7,444,252
Unattributed address 0xbc56...6404
0xbc5639887283eaf1b8e966e0b2fa6998d2ec6404
 Unattributed address
unlabelled (0.00)
Ethereum direct -- traced on $7,378,396 $7,378,396
Unattributed address 0x1aff...2f49
0x1aff30f79a05d6505c7846c13dd669858eb52f49
 Unattributed address
unlabelled (0.00)
Ethereum indirect
via 0x35fb6f6db4…
 -- traced on $14,710,779 $7,355,390
Tornado Cash Router
0xd90e2f925da726b50c4ed8d0fb90ad053324f31b
 Sanctioned entity or designated address
public (1.00)
Ethereum indirect
via 0x1aff30f79a…
 -- traced on $14,679,648 $7,339,824
Unattributed address 0x5b04...d8bd
0x5b0431365ce1ab3693bea6f33ae67653dd30d8bd
 Unattributed address
unlabelled (0.00)
Ethereum direct -- traced on $7,094,968 $7,094,968
Unattributed address 0xde46...03e7
0xde4612757719829d1df069213a5f4317bb7503e7
 Unattributed address
unlabelled (0.00)
Ethereum indirect
via 0x3e37627dea…
 -- traced on $13,934,782 $6,967,391
Unattributed address 0xb365...d81d
0xb3656c5ed7ef97b4c9097d416df98e2e2a5dd81d
 Unattributed address
unlabelled (0.00)
Ethereum indirect
via 0x3cffd56b47…
 -- traced on $13,695,851 $6,847,925
Unattributed address 0xdd64...6683
0xdd6458eb5090832eb88bffc7adf39b0f3cdd6683
 Unattributed address
unlabelled (0.00)
Ethereum indirect
via 0xa0e1c89ef1…
 -- traced on $13,257,494 $6,628,747
Unattributed address 0xfce9...c8e2
0xfce9d04133701a77589615c23def7ba98289c8e2
 Unattributed address
unlabelled (0.00)
Ethereum direct -- traced on $6,354,731 $6,354,731
Unattributed address 0x5967...3c0a
0x5967524ce3bc2bc422e584e33bd50921a22e3c0a
 Unattributed address
unlabelled (0.00)
Ethereum indirect
via 0xa0e1c89ef1…
 -- traced on $11,420,513 $5,710,257
Unattributed address 0xa58b...9ec4
0xa58b6105e208cb23e7566d69120319e30a1a9ec4
 Unattributed address
unlabelled (0.00)
Ethereum indirect
via 0x35fb6f6db4…
 -- traced on $11,382,169 $5,691,084
Unattributed address 0x3f1b...f07a
0x3f1b0a5064cc517aa6a2f31f8f07a206f4d7f07a
 Unattributed address
unlabelled (0.00)
Ethereum indirect
via 0x35fb6f6db4…
 -- traced on $10,644,770 $5,322,385
Unattributed address 0x93df...f704
0x93df2c9c8786242b8fdca3f96b3914b8b4a9f704
 Unattributed address
unlabelled (0.00)
Ethereum indirect
via 0xf7b31119c2…
 -- traced on $10,379,827 $5,189,914
Unattributed address 0x429a...1a3e
0x429a66e7bd829f9453cee5239bfeaf5657a11a3e
 Unattributed address
unlabelled (0.00)
Ethereum direct -- traced on $5,108,101 $5,108,101
Unattributed address 0xbc25...29eb
0xbc25d57412a04956cdd95af07825c5c1f34d29eb
 Unattributed address
unlabelled (0.00)
Ethereum direct -- traced on $5,064,479 $5,064,479
Unattributed address 0xf945...279c
0xf945fa5b71cfaa2736b427b7213cff14cc83279c
 Unattributed address
unlabelled (0.00)
Ethereum indirect
via 0x08723392ed…
 -- traced on $9,066,201 $4,533,101
Unattributed address 0x28f0...a70b
0x28f080edf51145c3f511415b8c2afaebb605a70b
 Unattributed address
unlabelled (0.00)
Ethereum indirect
via 0x3cffd56b47…
 -- traced on $7,953,535 $3,976,767
Unattributed address 0xd98d...72c0
0xd98d925685908152f18c32697e0d3894a5c672c0
 Unattributed address
unlabelled (0.00)
Ethereum indirect
via 0x35fb6f6db4…
 -- traced on $7,647,084 $3,823,542

Transfer sample

WhenChainDirectionCounterparty AmountValue
2026-08-13 ethereum out 0x4d511e05a88ddb5f5e960c68b54885364b4af8ef 0.000005 $0
2026-08-09 ethereum in 0x2767ae7e0c205425a7b7f7583c512513c527f482 0.000090 $0
2026-07-27 ethereum in 0x087238209bac1d2985b12d7a4be5bd75daa17243 0.000011 $0
2026-07-01 ethereum in 0xef9bdf3ed535abeb41ec6dd005bf7d66defd77be 2004.610604 $0
2026-05-16 ethereum in 0x9a7c6194a5860e2dea06ebc42a3d9f3b4ea32025 0.000000 $0
2026-04-20 ethereum in 0xd15fe25ed0dba12fe05e7029c88b10c25e8880e3 77866.000000 $0
2026-04-20 ethereum in 0xd15fe25ed0dba12fe05e7029c88b10c25e8880e3 40000.000000 $0
2026-04-09 ethereum in 0x8c75ad518dce956b488ab65e36ab229d8664bf29 0.000046 $0
2026-03-29 ethereum in 0x10fd68ca747b648acd95d80aa9c195547988399f 0.000000 $0
2026-03-13 ethereum in 0xdcaaaff8e9cef3f7fd37d3fbfa854b06569bbfa8 3.333333 $0
2026-03-09 ethereum in 0xbb30fb9fa731eee64772251327b7c2c8de781304 0.000002 $0
2025-12-13 ethereum in 0x0934d7c6fa5eed7af6603ab3cb58f8d656abe5fe 2093071.861230 $0
2025-09-06 ethereum in 0x985409c0e4b1853a42800765bafcd9efc1c57d03 0.000000 $0
2025-09-06 ethereum in 0x2c3c4b7213ad8aaabefd8e4472719338a47f1610 2.700000 $0
2025-03-01 ethereum in 0xe546480138d50bb841b204691c39cc514858d101 0.000000 $0
2024-08-06 ethereum in 0xfc3ff9d9abd3abadda68821e443779beb1082f43 0.000500 $1
2024-05-13 ethereum in 0x09564ac9288ed66bd32e793e76ce4336c1a9ed00 0.000011 $0
2024-04-04 ethereum in 0xbc25d517cc9d7ea453622ded3213302de34d29eb 0.000001 $0
2024-04-04 ethereum in 0xdf225c04450504e9198569982c98de2e15b9df2a 0.000002 $0
2024-02-24 ethereum in 0xe129927cfc61ce2f0b2a0ca6d8f9482d4ee60c64 2.000000 $5,062
2026-08-13 base in 0x1b285ffd0b19805947e7f285a922d2ffe5c4fe4d 100000.000000 $0
2025-12-01 base in 0x0000000000c2d145a2526bd8c716263bfebe1a72 1241.000000 $0
2025-09-26 base in 0xc0eaa4efe5be2b447605d0db1f62547c79cc4543 1.000000 $0
2025-09-18 base in 0xd152f549545093347a162dce210e7293f1452150 223.800000 $0
2025-07-25 base in 0xc7be1c4af7a5ed3e904e802a72b20b5be925e1e1 10.000000 $0

Risk level (1–5)

1 minimal below 2.0
2 low 2.0 to 4.0
3 medium 4.0 to 6.0
4 high 6.0 to 8.0
5 prohibited 8.0 and above

Continuous score 10.00 falls in the level 5 band (8.0 and above) under the balanced tolerance.

Reject. Exposure is outside any acceptable tolerance. Level 5 is above this institution's 3 auto-accept limit, so a human has to sign this off.

Policy: Balanced, boundaries 2.0 / 4.0 / 6.0 / 8.0. Change the risk tolerance →

The 1-5 level is the institution's policy applied to the 0-10 score, not a second measurement. Re-grading under a different tolerance changes the level and never the score.

Rules triggered

5 of 19 enabled rules matched. Tune the rule set →

block Any sanctions exposure
$474,901,796 (51.616% of traced value, any layer) against a 0.00% threshold. Sanctions liability does not scale with the amount.
block Direct sanctions list match
9 direct sanctions match(es) against OFAC, EU, UN, UK-HMT. A direct match is a prohibited dealing, not a risk rating.
block Score of 8.0 or above
Score 10.00 reached the 8.0 floor.
review Score of 6.0 or above
Score 10.00 reached the 6.0 floor.
flag Score of 4.0 or above
Score 10.00 reached the 4.0 floor.

Subject attribution

NameLAZARUS GROUP
CategorySanctioned entity or designated address weight 10
JurisdictionUnattributed (--)
Sourceofac · confidence 1.00
Clusterofac-sdn-27307
A named group in the attribution source, not a co-spend cluster inferred from this wallet's transactions.

Score history

ScreenedScoreBand
2026-09-13 19:47 10.0 critical
2026-09-12 17:10 10.0 critical
2026-08-28 17:28 10.0 critical

Provenance

ethereumlive:alchemy
https://eth-mainnet.g.alchemy.com/v2/… | native=151 token=147 internal=1 | unpriced_tokens=144
baselive:alchemy
https://base-mainnet.g.alchemy.com/v2/… | native=1 token=29 internal=0 | unpriced_tokens=29
optimismlive:alchemy
https://opt-mainnet.g.alchemy.com/v2/… | native=0 token=1 internal=0 | internal transfers unavailable on this network; unpriced_tokens=1
bsclive:alchemy
https://bnb-mainnet.g.alchemy.com/v2/… | native=13 token=137 internal=0 | internal transfers unavailable on this network; unpriced_tokens=134
polygonlive:alchemy
https://polygon-mainnet.g.alchemy.com/v2/… | native=7 token=70 internal=0 | unpriced_tokens=68
arbitrumlive:alchemy
https://arb-mainnet.g.alchemy.com/v2/… | native=0 token=5 internal=0 | internal transfers unavailable on this network; unpriced_tokens=5
Label set 2463 entities, 20 categories, 85 clusters

Label sources

  • Sanctions: 943 designated addresses from the US Treasury OFAC SDN list, published 08/28/2026.
  • Token contracts: 927 identified from public token lists.
  • Cited public labels: 519 addresses from 34 source(s), each with a URL.
    • Aave address book: V3 Ethereum (98 addresses) — https://aave-dao.github.io/aave-address-book/api/v1/modules/AaveV3Ethereum.json
    • FBI/IC3 PSA: North Korea responsible for $1.5 billion Bybit hack (51 addresses) — https://www.ic3.gov/PSA/2025/PSA250226
    • Aave address book: AaveV3Polygon (45 addresses) — https://aave-dao.github.io/aave-address-book/api/v1/modules/AaveV3Polygon.json
    • Aave address book: V2 Ethereum (40 addresses) — https://aave-dao.github.io/aave-address-book/api/v1/modules/AaveV2Ethereum.json
    • Aave address book: AaveV3Arbitrum (39 addresses) — https://aave-dao.github.io/aave-address-book/api/v1/modules/AaveV3Arbitrum.json
    • Aave address book: AaveV3Optimism (31 addresses) — https://aave-dao.github.io/aave-address-book/api/v1/modules/AaveV3Optimism.json
    • Aave address book: AaveV3Base (25 addresses) — https://aave-dao.github.io/aave-address-book/api/v1/modules/AaveV3Base.json
    • Tornado Cash smart contracts (24 addresses) — https://docs.tornado.cash/general/tornado-cash-smart-contracts
    • Bybit: wallet addresses ownership explained (21 addresses) — https://www.bybit.com/en/help-center/article/Bybit-Wallet-Addresses-Ownership-Explained
    • Circle CCTP EVM contract addresses (20 addresses) — https://developers.circle.com/cctp/evm-smart-contracts
    • Aave address book: AaveV3BNB (18 addresses) — https://aave-dao.github.io/aave-address-book/api/v1/modules/AaveV3BNB.json
    • Bitfinex: published public wallets (16 addresses) — https://github.com/bitfinexcom/pub/blob/main/wallets.txt
    • Aave address book: AaveV2Polygon (16 addresses) — https://aave-dao.github.io/aave-address-book/api/v1/modules/AaveV2Polygon.json
    • Aave address book: AaveV3EthereumLido (12 addresses) — https://aave-dao.github.io/aave-address-book/api/v1/modules/AaveV3EthereumLido.json
    • Crypto.com: Transparency First cold-wallet list (10 addresses) — https://crypto.com/en/company-news/transparency-first
    • Uniswap v3 Arbitrum deployments (7 addresses) — https://docs.uniswap.org/contracts/v3/reference/deployments/arbitrum-deployments
    • Uniswap v3 Optimism deployments (7 addresses) — https://docs.uniswap.org/contracts/v3/reference/deployments/optimism-deployments
    • Uniswap v3 Polygon deployments (7 addresses) — https://docs.uniswap.org/contracts/v3/reference/deployments/polygon-deployments
    • Lido deployed contracts (6 addresses) — https://docs.lido.fi/deployed-contracts/
    • Uniswap v3 Base deployments (6 addresses) — https://docs.uniswap.org/contracts/v3/reference/deployments/base-deployments
    • Uniswap v3 Ethereum deployments (3 addresses) — https://docs.uniswap.org/contracts/v3/reference/deployments/ethereum-deployments
    • Chainalysis: Euler Finance flash loan attack (2 addresses) — https://www.chainalysis.com/blog/euler-finance-flash-loan-attack/
    • Morpho deployed contracts (2 addresses) — https://docs.morpho.org/get-started/resources/addresses
    • Compound III USDC Ethereum roots (2 addresses) — https://github.com/compound-finance/comet/blob/main/deployments/mainnet/usdc/roots.json
    • Aave address book: GhoEthereum (2 addresses) — https://aave-dao.github.io/aave-address-book/api/v1/modules/GhoEthereum.json
    • Railgun privacy system contracts (1 address) — https://docs.railgun.org/wiki/learn/helpful-links
    • Linea network contracts (1 address) — https://docs.linea.build/network/build/contracts
    • Starknet L1-L2 messaging (1 address) — https://docs.starknet.io/documentation/architecture_and_concepts/Network_Architecture/l1-l2-messaging/
    • Chainalysis: Wormhole hack February 2022 (1 address) — https://www.chainalysis.com/blog/wormhole-hack-february-2022/
    • Compound III USDS Ethereum roots (1 address) — https://github.com/compound-finance/comet/blob/main/deployments/mainnet/usds/roots.json
    • Compound III USDT Ethereum roots (1 address) — https://github.com/compound-finance/comet/blob/main/deployments/mainnet/usdt/roots.json
    • Compound III WBTC Ethereum roots (1 address) — https://github.com/compound-finance/comet/blob/main/deployments/mainnet/wbtc/roots.json
    • Compound III WETH Ethereum roots (1 address) — https://github.com/compound-finance/comet/blob/main/deployments/mainnet/weth/roots.json
    • Compound III WSTETH Ethereum roots (1 address) — https://github.com/compound-finance/comet/blob/main/deployments/mainnet/wsteth/roots.json
  • Demonstration data: excluded — 118 synthetic entities were not scored.

Proof-of-reserves feed

Screen window

  • Up to 500 transfers across 3 indexer page(s) · default 2 hops · hop-2 budget 16 · hop-3 budget 12.

Artefact integrity

  • sha256+hmac · SHA-256 6ecdc2a3c113917728ac8a307c108515a35a8aaa0e8de30ca2e85c8c1a1e0128 · sealed 2026-09-12T17:10:48+00:00 · HMAC present.

Informative

Notice / Disclaimer

Limits that apply to this artefact as a whole. Sources and hashes stay in provenance; this section is how to read them.

  • Holistix scores combine public blockchain data with a seeded label set. Direct counterparties are observed on every screened chain. Onward and bridge hops are observed from a live indexer walk; they are modelled from the seed only when SAFESCORE_OFFLINE=1. Unlabelled counterparties stay unknown. Synthetic seed entities are demonstration labels, not live attribution. IP/node geolocation is not inferred.
  • direct counterparties are observed from chain data on every screened chain. Hop-2 and hop-3 same-chain walks are observed from a live indexer when online (budgets split inbound/outbound so Source and Hop columns both receive inputs), and modelled from the label seed only when SAFESCORE_OFFLINE=1. The far side of a bridge is always modelled: the crossing into the bridge is observed, but no transfer links it to a specific address on the destination chain, so value is attributed across that bridge cluster's known addresses there. Modelled hops cannot carry sanctions or terrorism-financing categories. IP/node geolocation is not inferred from first-seen time.
  • Token-contract labels name contracts, not wallet owners.
  • Demonstration data was excluded — 118 synthetic entities were not scored.
  • 211812 reserve-list address(es) from 2 ingested file(s). A hit is a snapshot claim, not a verification and not a host. Pages without an extractable address list stay in the bibliography only.
  • OKX: Landing page. The address list is the reserves zip linked from the download table, not this page.
  • OKX: Index of reserve and liability zips. Hits come from the zip.
  • OKX: Bulk reserve list. Indexed locally; not a cited label.
  • Binance: Live Merkle / Download All Address page. No public address file was extractable from this URL (WAF / account flow).
  • Binance: Addresses printed in the appendix, claimed as of the 22 Nov 2022 reporting date. Snapshot, not a current named-wallet page.
  • Activity beyond the stated screen window is not in the score.
  • Recompute the sha256+hmac digest against the JSON export to confirm this copy matches what was stored.