⚡ AML Investigation Report

CASE-2026-000065
Network: TRON|Generated: 2026-06-29T12:00:00.000Z
0/10
UNKNOWN

Insufficient attribution — obtain provider data (BitOK/AMLBot/Crystal/TRM) before clearing.

⚡ AML Investigation Completed
REVIEW REQUIRED
1.5/10
LOW
🌐 Network
tron
🔵 Case
CASE-2026-000065
👛 Main Wallet
TDEMOsourc…111111
📊 Overall Risk
1.5/10 — LOW
📌 Verdict
REVIEW REQUIRED
🏷 Case Quality
DEMO
🔌 Data Integrity
PASSED
💡 Recommendation
Potential risk indicators found. Analyst review required before processing.
📊 Coverage
9 transactions · 1 counterparties · depth 2 · LOW
🧾 Data Status
Verified 0 / Inferred 5 / Unknown 5 / Requires Validation 1

X2B Assessment

REVIEW REQUIRED · Score 1.5/10 (LOW)

Recommendation: Potential risk indicators found. Analyst review required before processing.

Top Risk Drivers

Source of Funds

Top inbound: 0 · Top outbound: 1 · Risky paths: 0 · Unknown paths: 3

Coverage: 9 transactions · 1 counterparties · depth 2 · LOW

External attribution not connected. X2B assessment completed under available coverage.

Case Overview

Main Wallet

Main Wallet
TDEMOsourc…111111
Network
TRON
Case Type
Address investigation
Investigation Date
2026-06-29T12:00:00.000Z

Transaction Summary

9
Transactions
0
Inflow
73k
Outflow
25k USDT
Largest Transfer
1
Counterparties
Complete
Coverage

Risk Drivers

  • Unknown/Unscreened5

Pattern Summary

  • ✓ Layering
  • ✓ Structuring
  • — Fan-In
  • — Fan-Out
  • — Hot Wallet
  • — Exchange-Like
  • ✓ OTC-Like
  • — Liquidity Hub

Investigation Quality

  • ✓ Graph Loaded
  • ✓ Transactions Loaded
  • ✓ Timeline Loaded
  • ✓ Counterparties Loaded
  • — Attribution Loaded needs provider
  • Coverage Complete

Top Counterparties

AddressVolumeRiskTransactions
TDEMOhot22…222222146k—12
TDEMOdest3…33333323.6k—2
TDEMOhot22…2222227k—2
TDEMOhot22…2222226k—2

Executive Summary

No direct OFAC/sanctions match found in local data. Layering indicators detected. Structuring indicators detected. Attribution is incomplete; provider enrichment required for a definitive determination.

Key Findings

(none)

Transaction Graph

SourceCounterpartiesHot WalletsDestinationTDEMOsou…111111 → TDEMOhot…222222 · tx=12 · vol=146000 · out146kTDEMOhot…222222 → TDEMOdes…333333 · tx=2 · vol=23600 · out23.6kTDEMOfan…555555 → TDEMOhot…222222 · tx=2 · vol=7000 · out7kTDEMOfan…444444 → TDEMOhot…222222 · tx=2 · vol=6000 · out6kTDEMOsource1111111111111111111111 · depth=0 · in=0 · out=146000 · tx=12TDEMOsou…111111146kTDEMOfanB5555555555555555555555555 · depth=2 · in=0 · out=7000 · tx=2TDEMOfan…555555TDEMOfanA4444444444444444444444444 · depth=2 · in=0 · out=6000 · tx=2TDEMOfan…444444TDEMOhot2222222222222222222222222 · depth=1 · in=159000 · out=23600 · tx=18TDEMOhot…222222182.6kTDEMOdest3333333333333333333333333 · depth=2 · in=23600 · out=0 · tx=2TDEMOdes…33333323.6kLegendREDYELLOWGREENUNKNOWNHot wallet (dashed ring)Seed (thick ring)Node size = total volume · Edge width = tx count · Edge label = transfer amount · Dashed edge = bidirectional

Incoming Exposure

Critical 🔴

(none)

Suspicious 🟠

(none)

Low Risk 🟢

(none)

Outgoing Exposure

Critical 🔴

(none)

Suspicious 🟠

(none)

Low Risk 🟢

(none)

Risk Categories

CategoryCount
Unknown/Unscreened5

Pattern Findings

KindAddressConfidenceSummary
otc-likeTDEMOhot22…222222mediumTDEMOhot2222222222222222222222222 looks OTC-like: only 4 counterparties with large/round transfers.
structuringTDEMOhot22…222222lowTDEMOhot2222222222222222222222222 has 4 transfers of 9000 (just below a round threshold) — possible structuring.
structuringTDEMOsourc…111111lowTDEMOsource1111111111111111111111 has 4 transfers of 9000 (just below a round threshold) — possible structuring.
layeringTDEMOhot22…222222lowTDEMOhot2222222222222222222222222 is a pass-through hop (in≈out volume) at depth 1 — a possible layering relay.
repeated-transfersTDEMOsourc…111111lowTDEMOsource1111111111111111111111 sent 4 identical transfers of 9000 to TDEMOhot2222222222222222222222222.

Wallet Overview

AddressSeed?First SeenLast SeenTxInflowOutflowCounterpartiesVerdict
TDEMOsourc…111111seed2026-06-22T01:00:00.000Z2026-06-29T08:00:00.000Z1201460001UNKNOWN
TDEMOhot22…222222—2026-06-22T01:00:00.000Z2026-06-29T08:00:00.000Z18159000236004UNKNOWN
TDEMOdest3…333333—2026-06-23T02:00:00.000Z2026-06-23T02:00:00.000Z22360001UNKNOWN
TDEMOfanA4…444444—2026-06-24T03:00:00.000Z2026-06-24T03:00:00.000Z2060001UNKNOWN
TDEMOfanB5…555555—2026-06-25T04:00:00.000Z2026-06-25T04:00:00.000Z2070001UNKNOWN

Counterparty Analysis

CounterpartyRelationshipTransactionsVolumeRiskCategory
TDEMOhot22…222222out12146000UNKNOWNOther
TDEMOdest3…333333out223600UNKNOWNOther
TDEMOhot22…222222out27000UNKNOWNOther
TDEMOhot22…222222out26000UNKNOWNOther

Top Flows

TDEMOsourc…111111→TDEMOhot22…222222→TDEMOdest3…333333(vol=169600, min=23600, tx=2, highest-volume)
TDEMOfanB5…555555→TDEMOhot22…222222→TDEMOdest3…333333(vol=30600, min=7000, tx=2, highest-volume)
TDEMOfanA4…444444→TDEMOhot22…222222→TDEMOdest3…333333(vol=29600, min=6000, tx=2, highest-volume)

Path Analysis

TDEMOfanA4…444444→TDEMOhot22…222222→TDEMOdest3…333333(vol=29600, min=6000, tx=2, shortest)
TDEMOfanB5…555555→TDEMOhot22…222222→TDEMOdest3…333333(vol=30600, min=7000, tx=2, shortest)
TDEMOsourc…111111→TDEMOhot22…222222→TDEMOdest3…333333(vol=169600, min=23600, tx=2, shortest)

Large Transfers

TxidFromToAmountAssetTime
demo-tx-0009TDEMOsourc…111111TDEMOhot22…22222225000USDT2026-06-29T08:00:00.000Z
demo-tx-0001TDEMOsourc…111111TDEMOhot22…22222212000USDT2026-06-22T01:00:00.000Z
demo-tx-0002TDEMOhot22…222222TDEMOdest3…33333311800USDT2026-06-23T02:00:00.000Z
demo-tx-0005TDEMOsourc…111111TDEMOhot22…2222229000USDT2026-06-26T05:00:00.000Z
demo-tx-0006TDEMOsourc…111111TDEMOhot22…2222229000USDT2026-06-27T06:00:00.000Z
demo-tx-0007TDEMOsourc…111111TDEMOhot22…2222229000USDT2026-06-28T07:00:00.000Z
demo-tx-0008TDEMOsourc…111111TDEMOhot22…2222229000USDT2026-06-29T08:00:00.000Z
demo-tx-0004TDEMOfanB5…555555TDEMOhot22…2222223500USDT2026-06-25T04:00:00.000Z
demo-tx-0003TDEMOfanA4…444444TDEMOhot22…2222223000USDT2026-06-24T03:00:00.000Z

Repeated Transfers

FromToAmountCountFirstLast
TDEMOsourc…111111TDEMOhot22…222222900042026-06-26T05:00:00.000Z2026-06-29T08:00:00.000Z

Timeline

TimeTxidFromToAmount
2026-06-22T01:00:00.000Zdemo-tx-0001TDEMOsourc…111111TDEMOhot22…22222212000
2026-06-23T02:00:00.000Zdemo-tx-0002TDEMOhot22…222222TDEMOdest3…33333311800
2026-06-24T03:00:00.000Zdemo-tx-0003TDEMOfanA4…444444TDEMOhot22…2222223000
2026-06-25T04:00:00.000Zdemo-tx-0004TDEMOfanB5…555555TDEMOhot22…2222223500
2026-06-26T05:00:00.000Zdemo-tx-0005TDEMOsourc…111111TDEMOhot22…2222229000
2026-06-27T06:00:00.000Zdemo-tx-0006TDEMOsourc…111111TDEMOhot22…2222229000
2026-06-28T07:00:00.000Zdemo-tx-0007TDEMOsourc…111111TDEMOhot22…2222229000
2026-06-29T08:00:00.000Zdemo-tx-0008TDEMOsourc…111111TDEMOhot22…2222229000
2026-06-29T08:00:00.000Zdemo-tx-0009TDEMOsourc…111111TDEMOhot22…22222225000

Evidence

Limitations

Intelligence Transparency

✅ Verified

(none)

🔍 Inferred

  • otc-like at TDEMOhot22…222222
  • structuring at TDEMOhot22…222222
  • structuring at TDEMOsourc…111111
  • layering at TDEMOhot22…222222
  • repeated-transfers at TDEMOsourc…111111

❓ Unknown

  • TDEMOdest3…333333: No risk signal found in local data
  • TDEMOfanA4…444444: No risk signal found in local data
  • TDEMOfanB5…555555: No risk signal found in local data
  • TDEMOhot22…222222: No risk signal found in local data
  • TDEMOsourc…111111: No risk signal found in local data

🔌 Requires Provider Validation

  • No external attribution provider configured — counterparties unscreened (offline run).

Findings appear under Verified only when backed by a VERIFIED/HIGH-confidence non-seed source. Seed/UNVERIFIED drivers land under Requires Provider Validation, never Verified.

Attribution Gap

✅ Known locally

(none)

🔌 Requires provider

  • BitOK
  • AMLBot
  • Crystal
  • TRM Labs
  • Chainalysis
  • Elliptic
  • Attribution incomplete — provider data required before clearing.

Low-signal or no-hit results without external provider data are reported as UNKNOWN, not GREEN — absence of evidence is not evidence of absence.