Holistic wallet report

0x098B716B8Aaf21512996dC57EB0615e2383E2f96

HX-e73bc25e4a6e · screened 2026-08-28 17:28:18+00:00 · 6 chain(s) in one call · data source: deterministic-fallback

Forensic report

Alert webhook (optional, https or localhost)

Block Block the transaction and escalate.

Holistix scores this wallet 10.0 of 10 (critical risk) from a single screen across 6 chain(s), with activity on Optimism, BNB Smart Chain. The wallet is itself attributed to Ronin Bridge Exploiter (OFAC designated), which forces the maximum score regardless of flow analysis. $241,708 of traced value breaks down as $170,432 direct, $38,743 one hop away and $32,533 beyond 3 bridge crossing(s). The score is driven by cross-chain bridge (81% of the score), decentralised finance protocol (15% of the score), regulated exchange or vasp (3% of the score).

Do not transact. Direct or heavy illicit exposure.

Level 5 of 5 · prohibited Balanced tolerance

Traced value

$241,708

Direct

$170,432

observed on chain

One hop away

$38,743

weighted 50%

Across bridges

$32,533

3 crossing(s)

Balance held

$103,950

Chains active

2 / 6

optimism, bsc

What the score is made of

Each category contributes on the same 0–10 scale and the score is the quadratic mean of those contributions, so the share of the score each category owns is exact — the percentages below sum to 100%.

direct exposure one hop away across a bridge

Cross-chain bridge weight 3 2.72 of 10 · 81% of score

Cross-chain bridge contributes 2.72 of 10: $87,373 directly on Optimism ($87,373). Weighted exposure is 41.102% of traced value, below the 50.000% saturation point for this category.

Helix Bridge (OPTIMISM) · optimism · $43,945 Wormlink Bridge (OPTIMISM) · optimism · $43,429

Decentralised finance protocol weight 2 1.17 of 10 · 15% of score

Decentralised finance protocol contributes 1.17 of 10: $39,202 directly and $38,743 one hop away on Optimism ($77,945). Weighted exposure is 27.554% of traced value, below the 80.000% saturation point for this category.

AaveLike Lending (OPTIMISM) · optimism · $26,811 AaveLike Lending (OPTIMISM) · optimism · $25,238 GMXLike Perps (OPTIMISM) · optimism · $12,391

Regulated exchange or VASP weight 1 0.54 of 10 · 3% of score

Regulated exchange or VASP contributes 0.54 of 10: $30,513 directly and $26,140 across a bridge on BNB Smart Chain ($30,513), Ethereum ($26,140). Weighted exposure is 22.962% of traced value, below the 80.000% saturation point for this category.

Binance Hot Wallet (BSC) · bsc · $17,029 Binance Hot Wallet · bsc · $13,483 Gate.io Hot Wallet · ethereum · $16,329

Merchant or payment processor weight 1 0.32 of 10 · 1% of score

Merchant or payment processor contributes 0.32 of 10: $13,344 directly and $6,393 across a bridge on BNB Smart Chain ($13,344), Base ($6,393). Weighted exposure is 8.382% of traced value, below the 80.000% saturation point for this category.

Tether USD (BEP-20) · bsc · $13,344 ShopChain Gateway (BASE) · base · $6,393

Flow of funds

Source and destination are kept apart on purpose. Illicit money arriving is a source-of-funds question the institution must report; clean money leaving towards a risky party is a destination question it may still be able to prevent.

Source of funds

Total

$134,928

29 transfer(s)

Largest single

$41,950

mean $4,653

Risk-relevant

0.0%

Counterparties

0.0% unattributed

Category	Share	Value	Transfers	Custody	Top entities
Cross-chain bridge	64.755%	$87,373	9	protocol	Helix Bridge (OPTIMISM), Wormlink Bridge (OPTIMISM)
Decentralised finance protocol	20.67%	$27,889	3	protocol	AaveLike Lending (OPTIMISM), GMXLike Perps (OPTIMISM)
Merchant or payment processor	7.911%	$10,674	7	hosted	Tether USD (BEP-20)
Regulated exchange or VASP	6.664%	$8,992	10	hosted	Binance Hot Wallet (BSC), Binance Hot Wallet

Destination of funds

Total

$35,503

16 transfer(s)

Largest single

$9,796

mean $2,219

Risk-relevant

0.0%

Counterparties

0.0% unattributed

Category	Share	Value	Transfers	Custody	Top entities
Decentralised finance protocol	31.864%	$11,313	3	protocol	GMXLike Perps (OPTIMISM), AaveLike Lending (OPTIMISM)
Regulated exchange or VASP	60.617%	$21,521	9	hosted	Binance Hot Wallet (BSC), Binance Hot Wallet
Merchant or payment processor	7.52%	$2,670	4	hosted	Tether USD (BEP-20)

Funds arrived mainly from cross-chain bridge (64.755%) across 29 inbound transfer(s) totalling $134,928. Funds left mainly to regulated exchange or vasp (60.617%) across 16 outbound transfer(s) totalling $35,503.

Round trips

Counterparty	Category	In	Out	Net
AaveLike Lending (OPTIMISM)	Decentralised finance protocol	$26,687	$125	$26,562
Binance Hot Wallet (BSC)	Regulated exchange or VASP	$5,437	$11,592	$-6,154
Binance Hot Wallet	Regulated exchange or VASP	$3,554	$9,929	$-6,375
Tether USD (BEP-20)	Merchant or payment processor	$10,674	$2,670	$8,004
GMXLike Perps (OPTIMISM)	Decentralised finance protocol	$1,202	$11,188	$-9,986

Both sides are computed from observed transfers only, so the percentages describe funds this screen actually saw move. Modelled hops are excluded here deliberately: a source-of-funds statement should not rest on an inferred counterparty.

Typology indicators

Exposure says who the wallet touched; these say what it was doing. A clean counterparty set does not rule out structuring.

3 indicator(s) triggered, 1 not observable with the data available.

Indicator	Family	Status	What was found
Mixing or anonymising service use	privacy	clear	No traced value connects to a mixing service.
CoinJoin-shaped joint spend	privacy	clear	No group of equal-value transfers large enough to indicate a collaborative mix.
Peel chain	structuring	medium	Run of 3 successively smaller outbound transfers totalling $1,315, consistent with peeling a bulk balance into increments.
Deposit splitting below a reporting threshold	structuring	clear	No counterparty received 3 or more transfers in the band beneath the reporting threshold.
Rapid pass-through	structuring	clear	Median dwell is 314.19h, which does not indicate pass-through layering.
Bridge and cross-chain swap routing	cross chain	medium	3 bridge crossing(s) carried $32,533 (13.5% of traced value) onto base, ethereum. Routing through a bridge breaks a single-chain trail, which is why the far side is followed here.
Swap and protocol routing concentration	cross chain	medium	$165,319 (68.4%) of flow moves through bridges and swap contracts, so most of this wallet's activity is asset conversion rather than payment.
Burst transaction scheduling	network	clear	Busiest 5-minute window holds 1 transfer(s), consistent with ordinary activity.
Mempool and fee irregularities	network	unavailable	Zero-confirmation transactions, fee spikes and confirmation depth are not exposed by the keyless public indexers this system reads, so this indicator is reported as unavailable rather than inferred from confirmed history.
Unhosted wallet interaction	custody	clear	Self-custodied counterparties account for 0.0% of directly transacted value; hosted services account for 25.7%.

Indicators are computed from the observed transfer set and the composed exposure view. They describe transaction shape, not intent: a triggered indicator is a reason to look, not a finding of wrongdoing.

Sanctions and watchlist screening

1 direct match(es), 0 indirect exposure(s) 1 direct match(es) against Ronin Bridge Exploiter (OFAC designated). Dealing with a designated party is prohibited irrespective of value, so this is a block decision rather than a risk judgement. Lists matched: OFAC, EU, UN, UK-HMT.

Entity	Match	Severity	Lists	Value	Share
Ronin Bridge Exploiter (OFAC designated) 0x098B716B8Aaf21512996dC57EB0615e2383E2f96	direct subject	critical	OFAC SDN · DPRK4 · OFAC-46F325A1B1 EU CFSP consolidated · 2017/1509 · EU-6B66B2FCDF UN Consolidated · 1718 Committee · UN-503525F5A8 UK-HMT UK Sanctions List · DPRK · UK-HMT-08C897499C	$103,950	100.0%

Addresses are matched against the seeded watchlist by cluster, so a designation applies to every address attributed to the same entity. Direct matches are observed on chain; indirect and bridged findings include modelled hops and must be confirmed before they are relied on.

Only the Tornado Cash and Lazarus clusters reflect real designations. Every other listing is fabricated for demonstration and must never be used as a sanctions determination.

Counterparty services

The same exposure means different things through a licensed custodian and a no-KYC venue, so each service a wallet touched is scored on its own controls.

4 directory-listed service(s) appear in this screen; 0 of them are high risk or prohibited, carrying 0.0% of traced value.

Service	Jurisdiction	Licence	KYC	Layers	Value	Entity risk
Helix Bridge Cross-chain bridge	Unattributed	out_of_scope	none	direct	$43,945	3.9 low
Wormlink Bridge Cross-chain bridge	Unattributed	out_of_scope	none	direct	$43,429	3.2 low
Binance Holdings Ltd Regulated exchange or VASP	Malta	licensed	strict	direct	$30,513	2.1 low
ShopChain Gateway Merchant or payment processor	Germany	registered	standard	bridge	$6,393	5.4 medium

Only counterparties with a directory entry are profiled here. Everything else is covered by category exposure.

Cross-chain picture

Transfer diagram

Multi-hop fund flow across screened chains. Columns are hops; nodes in a column are ordered by first transfer time; arrow thickness tracks USD.

Counterparty category Decentralised finance protocol Merchant or payment processor Regulated exchange or VASP Cross-chain bridge

Arrows Observed transfer Modelled or onward hop Crosses chains

Transfer diagram: Source 3 → Source 2 → Hop 1 sources feed the subject; Hop 1 destinations → Hop 2 → Hop 3+ leave to the right. Nodes in a column are ordered by first transfer time. Circle area tracks USD. Solid arrows are observed; dashed arrows are onward or bridged hops. Orange arrows cross chains. Node colour is the counterparty category — see the key below the diagram. 12 arrow(s) · 3 cross-chain · 5 multi-hop.

Ethereum ETH

Traced value$0

In / out$0 / $0

Transfers0

Balance$0

Sourcedeterministic-fallback

Base ETH

Traced value$0

In / out$0 / $0

Transfers0

Balance$0

Sourcedeterministic-fallback

Optimism ETH

Traced value$126,575

In / out$115,262 / $11,313

Transfers15

Balance$103,950

Sourcedeterministic-fallback

BNB Smart Chain BNB

Traced value$43,857

In / out$19,666 / $24,191

Transfers30

Balance$0

Sourcedeterministic-fallback

Polygon POL

Traced value$0

In / out$0 / $0

Transfers0

Balance$0

Sourcedeterministic-fallback

Arbitrum ETH

Traced value$0

In / out$0 / $0

Transfers0

Balance$0

Sourcedeterministic-fallback

Bridge crossings

Bridged value does not stop at the bridge contract, so Holistix follows it onto the chains the bridge connects and weights what it finds there at 70%.

Crossing	Bridge	Value bridged	Far-side counterparties
Optimism → Ethereum	Wormlink Bridge (OPTIMISM) 0x423d1596dcef91f583b492337b83634973b78617	$20,151	OKX Hot Wallet · $9,811
Optimism → Ethereum	Helix Bridge (OPTIMISM) 0x7f9648485a4a81ef8e4925305ab9980248a5a140	$29,859	Gate.io Hot Wallet · $16,329
Optimism → Base	Helix Bridge (OPTIMISM) 0x7f9648485a4a81ef8e4925305ab9980248a5a140	$29,706	ShopChain Gateway (BASE) · $6,393

Counterparties

Counterparty	Category	Chain	Layer	Jurisdiction	Visibility	Value	Weighted
Helix Bridge (OPTIMISM) 0x7f9648485a4a81ef8e4925305ab9980248a5a140	Cross-chain bridge synthetic (0.90)	Optimism	direct	--	traced on	$43,945	$43,945
Wormlink Bridge (OPTIMISM) 0x423d1596dcef91f583b492337b83634973b78617	Cross-chain bridge synthetic (0.90)	Optimism	direct	--	traced on	$43,429	$43,429
AaveLike Lending (OPTIMISM) 0x15bd07c796f316c60952f4c674d5e8e4848e8a25	Decentralised finance protocol synthetic (0.90)	Optimism	direct	--	traced on	$26,811	$26,811
Binance Hot Wallet (BSC) 0x8894E0a0c962CB723c1976a4421c95949bE2D4E3	Regulated exchange or VASP public (1.00)	BNB Smart Chain	direct	MT	traced on	$17,029	$17,029
Binance Hot Wallet 0xe2fc31F816A9b94326492132018C3aEcC4a93aE1	Regulated exchange or VASP public (1.00)	BNB Smart Chain	direct	MT	traced on	$13,483	$13,483
Tether USD (BEP-20) 0x55d398326f99059fF775485246999027B3197955	Merchant or payment processor public (1.00)	BNB Smart Chain	direct	US	traced on	$13,344	$13,344
AaveLike Lending (OPTIMISM) 0x15bd07c796f316c60952f4c674d5e8e4848e8a25	Decentralised finance protocol synthetic (0.90)	Optimism	indirect via 0x7f9648485a…	--	traced on	$25,238	$12,619
GMXLike Perps (OPTIMISM) 0xb58b40681fa31e33255b81840bb5faf2cbe6e767	Decentralised finance protocol synthetic (0.90)	Optimism	direct	--	traced on	$12,391	$12,391
Gate.io Hot Wallet 0x0D0707963952f2fBA59dD06f2b425ace40b492Fe	Regulated exchange or VASP public (1.00)	Ethereum	bridge via 0x7f9648485a…	KY	traced on	$16,329	$11,430
OKX Hot Wallet 0x6cc5f688a315f3dc28a7781717a9a798a59fda7b	Regulated exchange or VASP public (1.00)	Ethereum	bridge via 0x423d1596dc…	SC	traced on	$9,811	$6,868
AaveLike Lending (OPTIMISM) 0x15bd07c796f316c60952f4c674d5e8e4848e8a25	Decentralised finance protocol synthetic (0.90)	Optimism	indirect via 0x423d1596dc…	--	traced on	$13,505	$6,753
ShopChain Gateway (BASE) 0xaec101995c1175c592b98286756cf2d59f66148f	Merchant or payment processor synthetic (0.90)	Base	bridge via 0x7f9648485a…	DE	traced on	$6,393	$4,475

Transfer sample

When	Chain	Direction	Counterparty	Amount	Value
2026-08-26	optimism	in	0x15bd07c796f316c60952f4c674d5e8e4848e8a25	10.674623	$26,687
2026-08-23	optimism	in	0x423d1596dcef91f583b492337b83634973b78617	0.144808	$362
2026-08-08	optimism	in	0x423d1596dcef91f583b492337b83634973b78617	5.427596	$13,569
2026-07-16	optimism	in	0x7f9648485a4a81ef8e4925305ab9980248a5a140	0.728605	$1,822
2026-07-12	optimism	in	0x7f9648485a4a81ef8e4925305ab9980248a5a140	0.069178	$173
2026-07-07	optimism	in	0x423d1596dcef91f583b492337b83634973b78617	1.956907	$4,892
2026-07-06	optimism	in	0x423d1596dcef91f583b492337b83634973b78617	0.057432	$144
2026-07-03	optimism	in	0xb58b40681fa31e33255b81840bb5faf2cbe6e767	0.387786	$969
2026-06-09	optimism	out	0xb58b40681fa31e33255b81840bb5faf2cbe6e767	3.710593	$9,276
2026-05-28	optimism	in	0x423d1596dcef91f583b492337b83634973b78617	0.079389	$198
2026-05-26	optimism	in	0x423d1596dcef91f583b492337b83634973b78617	9.705419	$24,264
2026-05-19	optimism	out	0x15bd07c796f316c60952f4c674d5e8e4848e8a25	0.049809	$125
2026-05-13	optimism	in	0xb58b40681fa31e33255b81840bb5faf2cbe6e767	0.093214	$233
2026-05-07	optimism	out	0xb58b40681fa31e33255b81840bb5faf2cbe6e767	0.764649	$1,912
2026-04-22	optimism	in	0x7f9648485a4a81ef8e4925305ab9980248a5a140	16.780022	$41,950
2026-07-17	bsc	out	0x8894E0a0c962CB723c1976a4421c95949bE2D4E3	13.520107	$8,112
2026-06-16	bsc	in	0x55d398326f99059fF775485246999027B3197955	0.096551	$58
2026-06-04	bsc	out	0xe2fc31F816A9b94326492132018C3aEcC4a93aE1	0.018097	$11
2026-05-22	bsc	in	0x55d398326f99059fF775485246999027B3197955	0.004516	$3
2026-05-21	bsc	in	0x8894E0a0c962CB723c1976a4421c95949bE2D4E3	0.103832	$62
2026-04-23	bsc	out	0x8894E0a0c962CB723c1976a4421c95949bE2D4E3	0.048811	$29
2026-04-15	bsc	in	0x55d398326f99059fF775485246999027B3197955	0.067648	$41
2026-01-26	bsc	in	0x55d398326f99059fF775485246999027B3197955	16.264985	$9,759
2025-11-24	bsc	in	0x55d398326f99059fF775485246999027B3197955	0.010927	$7
2025-11-09	bsc	in	0xe2fc31F816A9b94326492132018C3aEcC4a93aE1	1.293449	$776

Risk level (1–5)

1 minimal below 2.0

2 low 2.0 to 4.0

3 medium 4.0 to 6.0

4 high 6.0 to 8.0

5 prohibited 8.0 and above

Continuous score 10.00 falls in the level 5 band (8.0 and above) under the balanced tolerance.

Reject. Exposure is outside any acceptable tolerance. Level 5 is above this institution's 3 auto-accept limit, so a human has to sign this off.

Policy: Balanced, boundaries 2.0 / 4.0 / 6.0 / 8.0. Change the risk tolerance →

The 1-5 level is the institution's policy applied to the 0-10 score, not a second measurement. Re-grading under a different tolerance changes the level and never the score.

Rules triggered

4 of 19 enabled rules matched. Tune the rule set →

block Direct sanctions list match

1 direct sanctions match(es) against OFAC, EU, UN, UK-HMT. A direct match is a prohibited dealing, not a risk rating.

block Score of 8.0 or above

Score 10.00 reached the 8.0 floor.

review Score of 6.0 or above

Score 10.00 reached the 6.0 floor.

flag Score of 4.0 or above

Score 10.00 reached the 4.0 floor.

Subject attribution

Name	Ronin Bridge Exploiter (OFAC designated)
Category	Sanctioned entity or designated address weight 10
Jurisdiction	North Korea (KP)
Source	public · confidence 1.00
Cluster	lazarus recorded on ETH A named group in the attribution source, not a co-spend cluster inferred from this wallet's transactions.

Alerts from this screen

Blocked On First Screen

First screen returned a block recommendation: Direct sanctions list match; Score of 8.0 or above

Score history

Screened	Score	Band
2026-09-13 19:47	10.0	critical
2026-09-12 17:10	10.0	critical
2026-08-28 17:28	10.0	critical

Provenance

ethereum	deterministic-fallback offline mode forced \| no activity on this chain
base	deterministic-fallback offline mode forced \| no activity on this chain
optimism	deterministic-fallback offline mode forced \| profile=moderate
bsc	deterministic-fallback offline mode forced \| profile=moderate
polygon	deterministic-fallback offline mode forced \| no activity on this chain
arbitrum	deterministic-fallback offline mode forced \| no activity on this chain
Label set	187 entities, 19 categories, 85 clusters

Informative

Notice / Disclaimer

Limits that apply to this artefact as a whole. Sources and hashes stay in provenance; this section is how to read them.

Holistix scores combine public blockchain data with a seeded label set. Direct counterparties are observed on every screened chain. Onward and bridge hops are observed from a live indexer walk; they are modelled from the seed only when SAFESCORE_OFFLINE=1. Unlabelled counterparties stay unknown. Synthetic seed entities are demonstration labels, not live attribution. IP/node geolocation is not inferred.
direct counterparties are observed from chain data on every screened chain. Hop-2 and hop-3 same-chain walks plus the far side of each bridge are observed from a live indexer when online (budgets split inbound/outbound so Source and Hop columns both receive inputs), and modelled from the label seed only when SAFESCORE_OFFLINE=1. IP/node geolocation is not inferred from first-seen time.