Holistic wallet report
0x8589427373D6D84E98730D7795D8f6f8731FDA16
HX-5a46b1b3bdd7 · screened 2026-09-12 17:10:22+00:00 · 6 chain(s) in one call · data source: live
Not a reliable summary of this wallet
Holistix scores this wallet 10.0 of 10 (critical risk) from a single screen across 6 chain(s), with activity on Ethereum, Base, BNB Smart Chain, Polygon. The wallet is itself attributed to Tornado Cash Donation, which forces the maximum score regardless of flow analysis. $119,254 of traced value breaks down as $54,451 direct, $64,803 one hop away and $0 beyond 0 bridge crossing(s). The score is driven by sanctioned entity or designated address (59% of the score), mixing or anonymising service (38% of the score), unattributed address (2% of the score).
Do not transact. Direct or heavy illicit exposure.
What the score is made of
Each category contributes on the same 0–10 scale and the score is the quadratic mean of those contributions, so the share of the score each category owns is exact — the percentages below sum to 100%.
Flow of funds
Source and destination are kept apart on purpose. Illicit money arriving is a source-of-funds question the institution must report; clean money leaving towards a risky party is a destination question it may still be able to prevent.
Source of funds
| Category | Share | Value | Transfers | Custody | Top entities |
|---|---|---|---|---|---|
| Sanctioned entity or designated address risk-relevant | 0.0% | $0 | 1 | unhosted | Tornado Cash Router |
| Unattributed address | 100.0% | $7,308 | 162 | unhosted | Privacy, Unattributed address 0xbdd6...da0a, Unattributed address 0x1dff...6a37, Unattributed address 0x6ff8...cbdc, Unattributed address 0x0000...0000 |
| Token contract | 0.0% | $0 | 2 | unhosted | USD Coin (USDC), Tether USD (USDT) |
Destination of funds
| Category | Share | Value | Transfers | Custody | Top entities |
|---|---|---|---|---|---|
| Sanctioned entity or designated address risk-relevant | 6.809% | $3,210 | 2 | unhosted | SEMENOV, Roman, Tornado Cash Donation |
| Mixing or anonymising service risk-relevant | 5.369% | $2,531 | 1 | protocol | TornadoProxy |
| Unattributed address | 85.138% | $40,136 | 134 | unhosted | Unattributed address 0x9813...ac0f, Unattributed address 0x38d6...bdee, Unattributed address 0xd130...0dd6, pavlik.eth, Unattributed address 0x7759...4219 |
| Decentralised finance protocol | 2.684% | $1,265 | 3 | protocol | 1inch Aggregation Router V3 |
| Merchant or payment processor | 0.0% | $0 | 7 | hosted | Tether USD (USDT), USDC Token Contract |
| Token contract | 0.0% | $0 | 4 | unhosted | Ethereum Name Service (ENS), Dai Stablecoin (DAI) |
Funds arrived mainly from unattributed address (100.0%) across 165 inbound transfer(s) totalling $7,308. Funds left mainly to unattributed address (85.138%) across 151 outbound transfer(s) totalling $47,142. 12.178% of outbound value went to categories that carry material risk weight, which is a destination-of-funds question and may be preventable.
Both sides are computed from observed transfers only, so the percentages describe funds this screen actually saw move. Modelled hops are excluded here deliberately: a source-of-funds statement should not rest on an inferred counterparty.
Typology indicators
Exposure says who the wallet touched; these say what it was doing. A clean counterparty set does not rule out structuring.
4 indicator(s) triggered, 3 not observable with the data available.
| Indicator | Family | Status | What was found |
|---|---|---|---|
| Mixing or anonymising service use | privacy | critical | $2,664 (2.234% of traced value) is connected to an anonymising service, of which $2,531 is a direct transfer. |
| CoinJoin-shaped joint spend | privacy | high | 5 transfers of near-identical value inside a 6-hour window, the shape of a collaborative mix rather than ordinary payments. |
| Peel chain | structuring | clear | Longest shrinking run is 2 transfer(s), below the 3 needed to call a peel chain. |
| Deposit splitting below a reporting threshold | structuring | clear | No counterparty received 3 or more transfers in the band beneath the reporting threshold. |
| Rapid pass-through | structuring | clear | Median dwell is 400.12h, which does not indicate pass-through layering. |
| Bridge and cross-chain swap routing | cross chain | clear | No bridge crossing appears in this screen. |
| Swap and protocol routing concentration | cross chain | clear | Protocol routing accounts for 3.5% of flow, within normal range. |
| Burst transaction scheduling | network | medium | 13 transfers were broadcast inside a 5-minute window, which is automation rather than a person transacting. |
| Mempool and fee irregularities | network | unavailable | Zero-confirmation transactions, fee spikes and confirmation depth are not exposed on the chains in this screen, so this indicator is reported as unavailable rather than inferred. Bitcoin mempool.space is the exception, and it was not read here. |
| Unhosted wallet interaction | custody | medium | 93.0% of directly transacted value went to or from self-custodied addresses with no regulated operator behind them, so no counterparty holds identity information for that flow. |
| Deviation from stated customer profile | profile | unavailable | No stated customer profile was supplied, so deviation from expected behaviour cannot be scored. The wallet's own history is still in the report. |
| Opening deposit inconsistent with stated identity | identity | unavailable | No stated identity (account opening date, new-customer flag, or declared income) was supplied, so an opening deposit cannot be judged inconsistent and a new-user full withdrawal cannot be scored. PEP/RCA name screening and source-of-wealth documents are not in this product. The institution's own identity stack still has to sit beside this screen. |
| Many-to-one inbound wallet shape | identity | clear | Busiest 24-hour inbound window holds 3 distinct wallet(s), below the 8 needed to call a many-to-one shape. Shared IP remains unobservable. |
Indicators are computed from the observed transfer set and the composed exposure view. They describe transaction shape, not intent: a triggered indicator is a reason to look, not a finding of wrongdoing. Profile deviation is scored only when the institution supplies a stated customer profile; without one the indicator is not observable rather than clear. Opening-deposit is scored only when account age or declared income is supplied. Many-to-one names inbound wallets, not people or a shared IP.
Sanctions and watchlist screening
| Entity | Match | Severity | Lists | Value | Share |
|---|---|---|---|---|---|
| SEMENOV, Roman
0xdcbeffbecce100cce9e4b153c4e15cb885643193 |
direct counterparty | critical |
OFAC SDN
· DPRK3 · OFAC-SDN-44718
|
$3,210 | 2.692% |
| Tornado Cash Donation
0x8589427373D6D84E98730D7795D8f6f8731FDA16 |
direct subject | critical |
OFAC SDN
· CYBER2 · OFAC-2DE39D7B9C
EU CFSP consolidated
· 2019/796 · EU-B14E4A3AB0
UN Consolidated
· 1267/1989/2253 · UN-0CCF190BFF
UK-HMT UK Sanctions List
· CYB · UK-HMT-5596380580
|
$31 | 100.0% |
| Tornado Cash Router
0xd90e2f925da726b50c4ed8d0fb90ad053324f31b |
direct counterparty | critical |
OFAC SDN
· CYBER2 · OFAC-2DE39D7B9C
EU CFSP consolidated
· 2019/796 · EU-B14E4A3AB0
UN Consolidated
· 1267/1989/2253 · UN-0CCF190BFF
UK-HMT UK Sanctions List
· CYB · UK-HMT-5596380580
|
$0 | 0.0% |
| Tornado Cash Donation
0x8589427373d6d84e98730d7795d8f6f8731fda16 |
direct counterparty | critical |
OFAC SDN
· CYBER2 · OFAC-2DE39D7B9C
EU CFSP consolidated
· 2019/796 · EU-B14E4A3AB0
UN Consolidated
· 1267/1989/2253 · UN-0CCF190BFF
UK-HMT UK Sanctions List
· CYB · UK-HMT-5596380580
|
$0 | 0.0% |
| SEMENOV, Roman
0xdcbeffbecce100cce9e4b153c4e15cb885643193 |
indirect exposure | high |
OFAC SDN
· DPRK3 · OFAC-SDN-44718
|
$7,593 | 6.367% |
Addresses are matched against the seeded watchlist by cluster, so a designation applies to every address attributed to the same entity. Direct matches are observed on chain; indirect and bridged findings include modelled hops and must be confirmed before they are relied on.
Only the Tornado Cash and Lazarus clusters reflect real designations. Every other listing is fabricated for demonstration and must never be used as a sanctions determination.
Forensic tracing
8 path(s) traced, 8 of them fully observed on chain; deepest is 2 hop(s).
Value flows left to right. Solid edges are observed transfers; dashed edges are modelled onward hops. Circle area is proportional to value, not to risk. Node colour is the counterparty category — see the key below the diagram. 236 lower-value node(s) omitted for legibility.
Multi-hop transfer diagram
Fund flow by hop and first transfer time. Orange arrows cross chains; dashed arrows are onward or bridged hops.
Transfer diagram: Source 3 → Source 2 → Hop 1 sources feed the subject; Hop 1 destinations → Hop 2 → Hop 3+ leave to the right. Nodes in a column are ordered by first transfer time. Circle area tracks USD. Solid arrows are observed; dashed arrows are onward or bridged hops. Orange arrows cross chains. Node colour is the counterparty category — see the key below the diagram. 212 lower-value node(s) omitted for legibility. 42 arrow(s) · 28 multi-hop.
When the funds moved
51% of inbound USD arrived in a 4-hour window starting 07 Oct 2022 08:31 UTC ($3,731 of $7,308). The lower chart is activity on counterparties (hop 2+), not funds through this address.
Full history: every transfer this wallet has on the screened chains was read.
Traced paths
8 path(s) from this wallet reach an identified endpoint, of which 8 are fully observed on chain. $7,593 traced across 2 hop(s): Unattributed address 0xd130...0dd6 to SEMENOV, Roman, ending at a sanctioned entity or designated address on Ethereum. The endpoint is not a hosted service, so there is no operator to ask for the beneficiary's identity. 2 path(s) terminate at a hosted service, which is where an investigation can realistically recover identity information or freeze funds.
Timeline
| When | Chain | Direction | Counterparty | Value |
|---|---|---|---|---|
| 2021-03-31 02:28 | Ethereum | out | 0x527653ea119f3e6a1f5bd18fbf4714081d7b31ce | $0 |
| 2021-03-31 02:30 | Ethereum | out | 0x527653ea119f3e6a1f5bd18fbf4714081d7b31ce | $0 |
| 2021-03-31 02:33 | Ethereum | out | 0x527653ea119f3e6a1f5bd18fbf4714081d7b31ce | $0 |
| 2021-03-31 02:35 | Ethereum | out | 0x527653ea119f3e6a1f5bd18fbf4714081d7b31ce | $0 |
| 2021-03-31 02:37 | Ethereum | out | 0x527653ea119f3e6a1f5bd18fbf4714081d7b31ce | $0 |
| 2021-03-31 02:39 | Ethereum | out | 0x527653ea119f3e6a1f5bd18fbf4714081d7b31ce | $0 |
| 2021-03-31 02:41 | Ethereum | out | 0x527653ea119f3e6a1f5bd18fbf4714081d7b31ce | $0 |
| 2021-03-31 02:43 | Ethereum | out | 0x527653ea119f3e6a1f5bd18fbf4714081d7b31ce | $0 |
| 2021-03-31 02:45 | Ethereum | out | 0x527653ea119f3e6a1f5bd18fbf4714081d7b31ce | $0 |
| 2021-03-31 02:46 | Ethereum | out | 0x527653ea119f3e6a1f5bd18fbf4714081d7b31ce | $0 |
| 2021-03-31 02:48 | Ethereum | out | 0x527653ea119f3e6a1f5bd18fbf4714081d7b31ce | $0 |
| 2021-03-31 02:51 | Ethereum | out | 0x527653ea119f3e6a1f5bd18fbf4714081d7b31ce | $0 |
| 2021-03-31 03:10 | Ethereum | out | 0x39aa39c021dfbae8fac545936693ac917d5e7563 | $0 |
| 2021-03-31 03:12 | Ethereum | out | 0x11111112542d85b3ef69ae05771c2dccff4faa26 | $0 |
| 2021-03-31 03:12 | Ethereum | out | 0xdb38ae75c5f44276803345f7f02e95a0aeef5944 | $0 |
| 2021-03-31 03:18 | Ethereum | out | 0x527653ea119f3e6a1f5bd18fbf4714081d7b31ce | $0 |
| 2021-03-31 03:38 | Ethereum | out | 0x527653ea119f3e6a1f5bd18fbf4714081d7b31ce | $0 |
| 2021-03-31 03:40 | Ethereum | out | 0x527653ea119f3e6a1f5bd18fbf4714081d7b31ce | $0 |
| 2021-03-31 04:07 | Ethereum | out | 0x527653ea119f3e6a1f5bd18fbf4714081d7b31ce | $0 |
| 2021-03-31 04:15 | Ethereum | out | 0x527653ea119f3e6a1f5bd18fbf4714081d7b31ce | $0 |
Exhibits
| Address | Entity | Cluster | Attribution | Basis |
|---|---|---|---|---|
| 0xd1300054ea25892e0b12ddcbad22038102f50dd6 | Unattributed address 0xd130...0dd6 Unattributed address |
unlabelled-02f50dd6
0 address(es) |
unlabelled | observed on chain |
| 0xdcbeffbecce100cce9e4b153c4e15cb885643193 | SEMENOV, Roman Sanctioned entity or designated address |
ofac-sdn-44718
0 address(es) |
ofac | observed on chain |
| 0x7759e9093463c049aac1400d5b556e6c7fa24219 | Unattributed address 0x7759...4219 Unattributed address |
unlabelled-7fa24219
0 address(es) |
unlabelled | observed on chain |
| 0x722122df12d4e14e13ac3b6895a86e84145b6967 | TornadoProxy Mixing or anonymising service |
tornadoproxy
0 address(es) |
blockscout | observed on chain |
| 0xd90e2f925da726b50c4ed8d0fb90ad053324f31b | Tornado Cash Router Sanctioned entity or designated address |
tornado-cash
3 address(es) |
public | observed on chain |
| 0x8589427373d6d84e98730d7795d8f6f8731fda16 | Tornado Cash Donation Sanctioned entity or designated address |
tornado-cash
3 address(es) |
public | observed on chain |
| 0xdac17f958d2ee523a2206206994597c13d831ec7 | Tether USD (USDT) Merchant or payment processor |
tether
0 address(es) |
public | observed on chain |
| 0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48 | USDC Token Contract Merchant or payment processor |
circle
1 address(es) |
public | observed on chain |
Paths are assembled from the composed exposure view, walking each endpoint back to the subject. Direct hops are observed on chain. Onward and bridged hops are observed from a live indexer walk, or modelled from the seed when SAFESCORE_OFFLINE=1, and are marked as such on every hop. The transfer map lays those hops on chain lanes ordered by fund size and transfer timestamp.
Counterparty services
The same exposure means different things through a licensed custodian and a no-KYC venue, so each service a wallet touched is scored on its own controls.
2 directory-listed service(s) appear in this screen; 0 of them are high risk or prohibited, carrying 0.0% of traced value.
| Service | Jurisdiction | Licence | KYC | Layers | Value | Entity risk |
|---|---|---|---|---|---|---|
| Binance Holdings Ltd
Regulated exchange or VASP |
Malta | licensed | strict | indirect | $4,715 | 2.1 low |
| Circle Internet Financial
Merchant or payment processor |
United States | registered | standard | direct | $0 | 4.9 medium |
Only counterparties with a directory entry are profiled here. Everything else is covered by category exposure.
Cross-chain picture
Ethereum ETH
Base ETH
Optimism ETH
BNB Smart Chain BNB
Polygon POL
Arbitrum ETH
Bridge crossings
Bridged value does not stop at the bridge contract, so Holistix follows it onto the chains the bridge connects and weights what it finds there at 70%.
No bridge crossings observed, so all exposure stays on the chains screened.
Counterparties
| Counterparty | Category | Chain | Layer | Jurisdiction | Visibility | Value | Weighted |
|---|---|---|---|---|---|---|---|
| Unattributed address 0x9813...ac0f
0x98138788220cd08e17e364685d8af4edcea6ac0f |
Unattributed address
unlabelled
(0.00)
|
Ethereum | direct | -- | traced on | $10,000 | $10,000 |
| Unattributed address 0x38d6...bdee
0x38d6e3e06c5d3c018acbbf2482d63dc376bebdee |
Unattributed address
unlabelled
(0.00)
|
Ethereum | direct | -- | traced on | $7,774 | $7,774 |
| Unattributed address 0xd130...0dd6
0xd1300054ea25892e0b12ddcbad22038102f50dd6 |
Unattributed address
unlabelled
(0.00)
|
Ethereum | direct | -- | traced on | $7,593 | $7,593 |
| pavlik.eth
ENS pavlik.eth
0x27e82ba6afebf3eee3a8e1613c2af5987929a546 |
Unattributed address
ens
(0.75)
|
Ethereum | direct | -- | traced on | $7,293 | $7,293 |
| Privacy
0xc479c31aca1ba077899ca5dec4f3a8e8ece1f57e |
Unattributed address
blockscout
(0.70)
|
Ethereum | direct | -- | traced on | $7,280 | $7,280 |
| Unattributed address 0xbf2f...9775
0xbf2fc60ba9c0d247edbaff760392797a2d969775 |
Unattributed address
unlabelled
(0.00)
|
Ethereum | indirect
via 0x38d6e3e06c… |
-- | traced on | $7,742 | $3,871 |
| SEMENOV, Roman
0xdcbeffbecce100cce9e4b153c4e15cb885643193 |
Sanctioned entity or designated address
ofac
(1.00)
|
Ethereum | indirect
via 0xd1300054ea… |
-- | traced on | $7,593 | $3,796 |
| Unattributed address 0x7759...4219
0x7759e9093463c049aac1400d5b556e6c7fa24219 |
Unattributed address
unlabelled
(0.00)
|
Ethereum | direct | -- | traced on | $3,687 | $3,687 |
| Unattributed address 0x89e5...7c40
0x89e51fa8ca5d66cd220baed62ed01e8951aa7c40 |
Unattributed address
unlabelled
(0.00)
|
Ethereum | indirect
via 0xbf2fc60ba9… |
-- | traced on | $6,504 | $3,252 |
| SEMENOV, Roman
0xdcbeffbecce100cce9e4b153c4e15cb885643193 |
Sanctioned entity or designated address
ofac
(1.00)
|
Ethereum | direct | -- | traced on | $3,210 | $3,210 |
| Unattributed address 0x67a7...2fef
0x67a7229e68ea48614fa6ae774ecbd0a8580d2fef |
Unattributed address
unlabelled
(0.00)
|
Ethereum | indirect
via 0x27e82ba6af… |
-- | traced on | $5,356 | $2,678 |
| TornadoProxy
0x722122df12d4e14e13ac3b6895a86e84145b6967 |
Mixing or anonymising service
blockscout
(0.85)
|
Ethereum | direct | -- | out of sight — mixer internals | $2,531 | $2,531 |
| Unattributed address 0x17f9...7d91
0x17f90828535d5aa2198ca4734827ed6a559c7d91 |
Unattributed address
unlabelled
(0.00)
|
Ethereum | indirect
via 0x9813878822… |
-- | traced on | $3,452 | $1,726 |
| Bybit Hot Wallet
0xf89d7b9c864f589bbf53a82105107622b35eaa40 |
Regulated exchange or VASP
public
(1.00)
|
Ethereum | indirect
via 0x67a7229e68… |
-- | out of sight — exchange-internal | $3,307 | $1,653 |
| Unattributed address 0x744a...2811
0x744accf0a127c54f7dcee4fff87f9d7881ce2811 |
Unattributed address
unlabelled
(0.00)
|
Ethereum | direct | -- | traced on | $1,500 | $1,500 |
| Unattributed address 0xfeee...81e2
0xfeeeb7e293187bdc2d8d31880c6706d3b8f781e2 |
Unattributed address
unlabelled
(0.00)
|
Ethereum | indirect
via 0x9813878822… |
-- | traced on | $2,594 | $1,297 |
| Binance Hot Wallet 14
PoR Binance historical
w=0.00
0x28c6c06298d514db089934071355e5743bf21d60 |
Regulated exchange or VASP
public
(1.00)
|
Ethereum | indirect
via 0xfeeeb7e293… |
MT | out of sight — exchange-internal | $2,543 | $1,271 |
| 1inch Aggregation Router V3
0x11111112542d85b3ef69ae05771c2dccff4faa26 |
Decentralised finance protocol
public
(1.00)
|
Ethereum | direct | -- | traced on | $1,265 | $1,265 |
| Unattributed address 0xcf14...0ee6
0xcf148146a24a2ddc7c6fcc01f1b465a3c7660ee6 |
Unattributed address
unlabelled
(0.00)
|
Ethereum | direct | -- | traced on | $1,139 | $1,139 |
| Unattributed address 0x975a...83da
0x975af4f2006be99d14042cdc56dfc36e74f883da |
Unattributed address
unlabelled
(0.00)
|
Ethereum | indirect
via 0x9813878822… |
-- | traced on | $2,160 | $1,080 |
| Unattributed address 0x7903...41a9
0x7903bdfb222672ba488605945887c3fd822141a9 |
Unattributed address
unlabelled
(0.00)
|
Ethereum | direct | -- | traced on | $886 | $886 |
| Binance Hot Wallet 14
PoR Binance historical
w=0.00
0x28c6c06298d514db089934071355e5743bf21d60 |
Regulated exchange or VASP
public
(1.00)
|
Ethereum | indirect
via 0x975af4f200… |
MT | out of sight — exchange-internal | $1,475 | $738 |
| Unattributed address 0x15fe...4240
0x15feecbfd8688d43462eeaa1ccdd386de6724240 |
Unattributed address
unlabelled
(0.00)
|
Ethereum | indirect
via 0x17f9082853… |
-- | traced on | $1,273 | $637 |
| Unattributed address 0x5171...4283
0x517104583428b06de592896411a300e995094283 |
Unattributed address
unlabelled
(0.00)
|
Ethereum | indirect
via 0x27e82ba6af… |
-- | traced on | $1,264 | $632 |
| Unattributed address 0x18e2...82f6
0x18e296053cbdf986196903e889b7dca7a73882f6 |
Unattributed address
unlabelled
(0.00)
|
Ethereum | indirect
via 0x5171045834… |
-- | traced on | $1,264 | $632 |
| ERC20Locker
0x23ddd3e3692d1861ed57ede224608875809e127f |
Unattributed address
blockscout
(0.70)
|
Ethereum | indirect
via 0xdcbeffbecc… |
-- | traced on | $1,224 | $612 |
| Unattributed address 0x18e2...82f6
0x18e296053cbdf986196903e889b7dca7a73882f6 |
Unattributed address
unlabelled
(0.00)
|
Ethereum | indirect
via 0x67a7229e68… |
-- | traced on | $1,024 | $512 |
| Unattributed address 0x0c23...98d5
0x0c23ff22648580c59e1e68f6ca8ae37551b198d5 |
Unattributed address
unlabelled
(0.00)
|
Ethereum | indirect
via 0xcf148146a2… |
-- | traced on | $1,018 | $509 |
| 1inch Aggregation Router V4
0x1111111254fb6c44bac0bed2854e76f90643097d |
Decentralised finance protocol
public
(1.00)
|
Ethereum | indirect
via 0x7759e90934… |
-- | traced on | $1,012 | $506 |
| Unattributed address 0x260b...4cea
0x260b364fe0d3d37e6fd3cda0fa50926a06c54cea |
Unattributed address
unlabelled
(0.00)
|
Ethereum | indirect
via 0x67a7229e68… |
-- | traced on | $1,001 | $501 |
| Unattributed address 0x868b...4e4e
0x868bc50f77a9edad42a4e0f5ba338cbf508c4e4e |
Unattributed address
unlabelled
(0.00)
|
Ethereum | indirect
via 0x17f9082853… |
-- | traced on | $921 | $461 |
| Unattributed address 0x1d7e...485c
0x1d7e9e9d107cfefa4db33e27447708bc2122485c |
Unattributed address
unlabelled
(0.00)
|
Ethereum | indirect
via 0x744accf0a1… |
-- | traced on | $914 | $457 |
| Unattributed address 0xf816...8ad0
0xf816b8ea458f3114c9829681ac96102544998ad0 |
Unattributed address
unlabelled
(0.00)
|
Ethereum | indirect
via 0x17f9082853… |
-- | traced on | $879 | $440 |
| Unattributed address 0xdad1...d930
0xdad1c12c5ef30c25d908ddaf4d435fbd0fcad930 |
Unattributed address
unlabelled
(0.00)
|
Ethereum | indirect
via 0x9813878822… |
-- | traced on | $844 | $422 |
| 1inch V5 Router
0x1111111254eeb25477b68fb85ed929f73a960582 |
Decentralised finance protocol
public
(1.00)
|
Ethereum | indirect
via 0x7759e90934… |
-- | traced on | $806 | $403 |
| Unattributed address 0xe9aa...70b4
0xe9aa46f0e94ec2d61354befd8669f60979d970b4 |
Unattributed address
unlabelled
(0.00)
|
Ethereum | indirect
via 0xdcbeffbecc… |
-- | traced on | $765 | $382 |
| Binance 1
0x3f5ce5fbfe3e9af3971dd833d26ba9b5c936f0be |
Regulated exchange or VASP
public
(1.00)
|
Ethereum | indirect
via 0x975af4f200… |
MT | out of sight — exchange-internal | $685 | $342 |
| Unattributed address 0x8531...5807
0x8531f6d1a8d38dbe5903516c7e313662816c5807 |
Unattributed address
unlabelled
(0.00)
|
Ethereum | indirect
via 0x27e82ba6af… |
-- | traced on | $586 | $293 |
| Unattributed address 0xa082...2a77
0xa082b783d16395800977726627ea43234bf02a77 |
Unattributed address
unlabelled
(0.00)
|
Ethereum | indirect
via 0x7759e90934… |
-- | traced on | $538 | $269 |
| Unattributed address 0xb02f...77b5
0xb02f39e382c90160eb816de5e0e428ac771d77b5 |
Unattributed address
unlabelled
(0.00)
|
Ethereum | indirect
via 0x9813878822… |
-- | traced on | $507 | $253 |
Transfer sample
| When | Chain | Direction | Counterparty | Amount | Value |
|---|---|---|---|---|---|
| 2026-08-31 | ethereum | in | 0x0000000000000000000000000000000000000000 | 10000.000000 | $0 |
| 2026-04-13 | ethereum | in | 0xd86f4f7dbd63f350c884b23c0e5c3df70082524c | 0.000000 | $0 |
| 2026-04-13 | ethereum | in | 0xd86f4f7dbd63f350c884b23c0e5c3df70082524c | 0.000000 | $0 |
| 2026-04-13 | ethereum | in | 0xd86f4f7dbd63f350c884b23c0e5c3df70082524c | 0.000000 | $0 |
| 2026-02-01 | ethereum | in | 0xc479c31aca1ba077899ca5dec4f3a8e8ece1f57e | 0.000113 | $0 |
| 2026-02-01 | ethereum | in | 0xc479c31aca1ba077899ca5dec4f3a8e8ece1f57e | 0.000218 | $1 |
| 2025-12-24 | ethereum | in | 0x4d723a2d19bff1e08b3d60347a9cd48970e9dbab | 0.000000 | $0 |
| 2025-11-28 | ethereum | in | 0xbdd68ccc0a295d95845eea0e9eea15b5e8cdda0a | 0.006524 | $20 |
| 2025-09-17 | ethereum | in | 0xc479c31aca1ba077899ca5dec4f3a8e8ece1f57e | 0.000230 | $1 |
| 2025-08-27 | ethereum | in | 0x6a56aebe538c8a6b502bcf20e8b63ae418452833 | 0.000000 | $0 |
| 2025-08-01 | ethereum | in | 0x6ff8d3e416ec0a7e6611674b9c4344641bedcbdc | 0.900000 | $1 |
| 2025-06-10 | ethereum | in | 0x6627c488e5cd393e20b1c43d267e5a91236d7db2 | 0.000001 | $0 |
| 2025-05-25 | ethereum | in | 0x9adc3f7e8b7e4e0d31bf7443c9815c1dcbf3c168 | 0.168888 | $0 |
| 2024-10-18 | ethereum | in | 0x20f8320addd70439b67df27389bbebd7a998e5bb | 202104.000000 | $0 |
| 2024-10-05 | ethereum | in | 0x2072c65d8a599cdc48325bfd81c9725382828f2c | 20878.230000 | $0 |
| 2024-07-07 | ethereum | in | 0x1dff7cd0e7ff958c3517da1747e7c556e1ae6a37 | 0.000399 | $1 |
| 2024-06-13 | ethereum | in | 0x0000000000000000000000000000000000000000 | 250000.000000 | $0 |
| 2024-06-13 | ethereum | in | 0x0000000000000000000000000000000000000000 | 2500.000000 | $0 |
| 2023-02-17 | ethereum | out | 0x38d6e3e06c5d3c018acbbf2482d63dc376bebdee | 3.059895 | $7,745 |
| 2023-02-17 | ethereum | out | 0xdac17f958d2ee523a2206206994597c13d831ec7 | 0.000000 | $0 |
| 2025-08-01 | base | in | 0x833589fcd6edb6e08f4c7c32d4f71b54bda02913 | 1250.000000 | $0 |
| 2025-01-22 | base | in | 0xb063fbe607d03c787b2842f2af926ea632a61d85 | 1.000000 | $0 |
| 2025-11-28 | bsc | in | 0xbdd68ccc0a295d95845eea0e9eea15b5e8cdda0a | 0.011145 | $7 |
| 2024-05-09 | bsc | in | 0x220a8074809598e5eda6d69235994b1563954854 | 50001.000000 | $0 |
| 2025-12-08 | polygon | in | 0x25c608acc7075abc30199224135b0c3f1181cb45 | 1.000000 | $0 |
Risk level (1–5)
Continuous score 10.00 falls in the level 5 band (8.0 and above) under the balanced tolerance.
Reject. Exposure is outside any acceptable tolerance. Level 5 is above this institution's 3 auto-accept limit, so a human has to sign this off.
Policy: Balanced, boundaries 2.0 / 4.0 / 6.0 / 8.0. Change the risk tolerance →
The 1-5 level is the institution's policy applied to the 0-10 score, not a second measurement. Re-grading under a different tolerance changes the level and never the score.
Rules triggered
7 of 19 enabled rules matched. Tune the rule set →
Subject attribution
| Name | Tornado Cash Donation |
|---|---|
| Category | Sanctioned entity or designated address weight 10 |
| Jurisdiction | Unattributed (--) |
| Source | public · confidence 1.00 |
| Cluster | tornado-cash
recorded on ETH
A named group in the attribution source, not a
co-spend cluster inferred from this wallet's transactions. |
Score history
| Screened | Score | Band |
|---|---|---|
| 2026-09-13 19:46 | 10.0 | critical |
| 2026-09-12 17:10 | 10.0 | critical |
| 2026-08-28 17:28 | 10.0 | critical |
| 2026-08-25 17:12 | 10.0 | critical |
| 2026-08-25 15:10 | 10.0 | critical |
Provenance
| ethereum | live:alchemy
https://eth-mainnet.g.alchemy.com/v2/… | native=142 token=26 internal=132 | unpriced_tokens=16 |
|---|---|
| base | live:alchemy
https://base-mainnet.g.alchemy.com/v2/… | native=0 token=2 internal=0 | unpriced_tokens=2 |
| optimism | live:alchemy
https://opt-mainnet.g.alchemy.com/v2/… | native=0 token=0 internal=0 | internal transfers unavailable on this network |
| bsc | live:alchemy
https://bnb-mainnet.g.alchemy.com/v2/… | native=1 token=1 internal=0 | internal transfers unavailable on this network; unpriced_tokens=1 |
| polygon | live:alchemy
https://polygon-mainnet.g.alchemy.com/v2/… | native=1 token=11 internal=0 | unpriced_tokens=10 |
| arbitrum | live:alchemy
https://arb-mainnet.g.alchemy.com/v2/… | native=0 token=0 internal=0 | internal transfers unavailable on this network |
| Label set | 2463 entities, 20 categories, 85 clusters |
Label sources
- Sanctions: 943 designated addresses from the US Treasury OFAC SDN list, published 08/28/2026.
- Token contracts: 927 identified from public token lists.
-
Cited public labels:
519 addresses from
34 source(s), each with a URL.
- Aave address book: V3 Ethereum (98 addresses) — https://aave-dao.github.io/aave-address-book/api/v1/modules/AaveV3Ethereum.json
- FBI/IC3 PSA: North Korea responsible for $1.5 billion Bybit hack (51 addresses) — https://www.ic3.gov/PSA/2025/PSA250226
- Aave address book: AaveV3Polygon (45 addresses) — https://aave-dao.github.io/aave-address-book/api/v1/modules/AaveV3Polygon.json
- Aave address book: V2 Ethereum (40 addresses) — https://aave-dao.github.io/aave-address-book/api/v1/modules/AaveV2Ethereum.json
- Aave address book: AaveV3Arbitrum (39 addresses) — https://aave-dao.github.io/aave-address-book/api/v1/modules/AaveV3Arbitrum.json
- Aave address book: AaveV3Optimism (31 addresses) — https://aave-dao.github.io/aave-address-book/api/v1/modules/AaveV3Optimism.json
- Aave address book: AaveV3Base (25 addresses) — https://aave-dao.github.io/aave-address-book/api/v1/modules/AaveV3Base.json
- Tornado Cash smart contracts (24 addresses) — https://docs.tornado.cash/general/tornado-cash-smart-contracts
- Bybit: wallet addresses ownership explained (21 addresses) — https://www.bybit.com/en/help-center/article/Bybit-Wallet-Addresses-Ownership-Explained
- Circle CCTP EVM contract addresses (20 addresses) — https://developers.circle.com/cctp/evm-smart-contracts
- Aave address book: AaveV3BNB (18 addresses) — https://aave-dao.github.io/aave-address-book/api/v1/modules/AaveV3BNB.json
- Bitfinex: published public wallets (16 addresses) — https://github.com/bitfinexcom/pub/blob/main/wallets.txt
- Aave address book: AaveV2Polygon (16 addresses) — https://aave-dao.github.io/aave-address-book/api/v1/modules/AaveV2Polygon.json
- Aave address book: AaveV3EthereumLido (12 addresses) — https://aave-dao.github.io/aave-address-book/api/v1/modules/AaveV3EthereumLido.json
- Crypto.com: Transparency First cold-wallet list (10 addresses) — https://crypto.com/en/company-news/transparency-first
- Uniswap v3 Arbitrum deployments (7 addresses) — https://docs.uniswap.org/contracts/v3/reference/deployments/arbitrum-deployments
- Uniswap v3 Optimism deployments (7 addresses) — https://docs.uniswap.org/contracts/v3/reference/deployments/optimism-deployments
- Uniswap v3 Polygon deployments (7 addresses) — https://docs.uniswap.org/contracts/v3/reference/deployments/polygon-deployments
- Lido deployed contracts (6 addresses) — https://docs.lido.fi/deployed-contracts/
- Uniswap v3 Base deployments (6 addresses) — https://docs.uniswap.org/contracts/v3/reference/deployments/base-deployments
- Uniswap v3 Ethereum deployments (3 addresses) — https://docs.uniswap.org/contracts/v3/reference/deployments/ethereum-deployments
- Chainalysis: Euler Finance flash loan attack (2 addresses) — https://www.chainalysis.com/blog/euler-finance-flash-loan-attack/
- Morpho deployed contracts (2 addresses) — https://docs.morpho.org/get-started/resources/addresses
- Compound III USDC Ethereum roots (2 addresses) — https://github.com/compound-finance/comet/blob/main/deployments/mainnet/usdc/roots.json
- Aave address book: GhoEthereum (2 addresses) — https://aave-dao.github.io/aave-address-book/api/v1/modules/GhoEthereum.json
- Railgun privacy system contracts (1 address) — https://docs.railgun.org/wiki/learn/helpful-links
- Linea network contracts (1 address) — https://docs.linea.build/network/build/contracts
- Starknet L1-L2 messaging (1 address) — https://docs.starknet.io/documentation/architecture_and_concepts/Network_Architecture/l1-l2-messaging/
- Chainalysis: Wormhole hack February 2022 (1 address) — https://www.chainalysis.com/blog/wormhole-hack-february-2022/
- Compound III USDS Ethereum roots (1 address) — https://github.com/compound-finance/comet/blob/main/deployments/mainnet/usds/roots.json
- Compound III USDT Ethereum roots (1 address) — https://github.com/compound-finance/comet/blob/main/deployments/mainnet/usdt/roots.json
- Compound III WBTC Ethereum roots (1 address) — https://github.com/compound-finance/comet/blob/main/deployments/mainnet/wbtc/roots.json
- Compound III WETH Ethereum roots (1 address) — https://github.com/compound-finance/comet/blob/main/deployments/mainnet/weth/roots.json
- Compound III WSTETH Ethereum roots (1 address) — https://github.com/compound-finance/comet/blob/main/deployments/mainnet/wsteth/roots.json
- Demonstration data: excluded — 118 synthetic entities were not scored.
Proof-of-reserves feed
- OKX: OKX Proof of Reserves · bibliography only
- OKX: OKX Proof of Reserves downloads · bibliography only
- OKX: OKX reserves zip — 11 Aug 2026 · snapshot 2026-08-11 · 211,793 addresses indexed
- Binance: Binance Proof of Reserves · bibliography only
- Binance: Binance Mazars PoR report — 7 Dec 2022 · snapshot 2022-11-22 · 19 addresses indexed
Screen window
- Up to 500 transfers across 3 indexer page(s) · default 2 hops · hop-2 budget 16 · hop-3 budget 12.
Artefact integrity
-
sha256+hmac · SHA-256
0546d3e72312626bef1cfd1c09df0a8dd18fa6878b04f6dfda25e36255876a1e· sealed 2026-09-12T17:10:23+00:00 · HMAC present.
Informative
Notice / Disclaimer
Limits that apply to this artefact as a whole. Sources and hashes stay in provenance; this section is how to read them.
- Holistix scores combine public blockchain data with a seeded label set. Direct counterparties are observed on every screened chain. Onward and bridge hops are observed from a live indexer walk; they are modelled from the seed only when SAFESCORE_OFFLINE=1. Unlabelled counterparties stay unknown. Synthetic seed entities are demonstration labels, not live attribution. IP/node geolocation is not inferred.
- direct counterparties are observed from chain data on every screened chain. Hop-2 and hop-3 same-chain walks are observed from a live indexer when online (budgets split inbound/outbound so Source and Hop columns both receive inputs), and modelled from the label seed only when SAFESCORE_OFFLINE=1. The far side of a bridge is always modelled: the crossing into the bridge is observed, but no transfer links it to a specific address on the destination chain, so value is attributed across that bridge cluster's known addresses there. Modelled hops cannot carry sanctions or terrorism-financing categories. IP/node geolocation is not inferred from first-seen time.
- Token-contract labels name contracts, not wallet owners.
- Demonstration data was excluded — 118 synthetic entities were not scored.
- 211812 reserve-list address(es) from 2 ingested file(s). A hit is a snapshot claim, not a verification and not a host. Pages without an extractable address list stay in the bibliography only.
- OKX: Landing page. The address list is the reserves zip linked from the download table, not this page.
- OKX: Index of reserve and liability zips. Hits come from the zip.
- OKX: Bulk reserve list. Indexed locally; not a cited label.
- Binance: Live Merkle / Download All Address page. No public address file was extractable from this URL (WAF / account flow).
- Binance: Addresses printed in the appendix, claimed as of the 22 Nov 2022 reporting date. Snapshot, not a current named-wallet page.
- Activity beyond the stated screen window is not in the score.
- Recompute the sha256+hmac digest against the JSON export to confirm this copy matches what was stored.