wurrly

Treasury companyProven

Avalanche Treasury Corp (AVAT)

26 registry addresses

Observed portfolio value

Reading balances

No successful balance read yet.

The treasury that borrowed. Its two Anchorage-custodied wallets held 10,802,161 AVAX at 30 June 2026 against the 10,802,156 AVAX the Q2 10-Q puts with Anchorage Digital Bank that date. Twelve transfers of 100,000 AVAX went from the staging wallet to six Coinbase deposit addresses between 26 August and 15 September 2026. Five keys were validating on the P-Chain at the 16 September 2026 read, 6,522,949 AVAX between them, and a sixth holds 2,004,595 AVAX that has sat unlocked since its validation ended on 13 September 2026. The BitGo wallets that held its stAVAX closed in June 2026. The full account is on the research pages.

Holdings

AVAX and the listed tokens, across the addresses in scopeThe price read has not finished. The quantities below are measured; USD values follow.24 h value change unavailable. No read returns a second valued endpoint 24 hours earlier.

Reading balances

Requested: Registered AVAX and liquid-staking balances. Returned coverage unavailable. Chains requested: C, P. 26 eligible addresses; none read yet.

Source: Avalanche C-Chain RPC, Wurrly Intel registry. No successful read yet.

Read method

Every figure is summed in exact decimal over one asset key at a time. A chain figure adds the priced holdings measured on that chain; an asset the price read could not answer for is left out of the sum, and the cell says how many were left out. A share is that chain figure over the summed priced holdings in the selected scope, divided at 60 decimal places and shown at two.

The P-Chain balance is one measurement for the whole owner group, so an address row on that chain shows the group note instead of a figure of its own. C-Chain AVAX and P-Chain AVAX are separate asset keys and are never added into one line.

No route this card reads returns a valued endpoint twenty-four hours back over the same addresses and assets, so the 24 h change is unavailable in every row. The price route’s own daily move is the AVAX market, which is a different measurement.

Balance history

History range
Display unit
Requested dates follow the read's own successful timestamp.Daily balance, rebuilt from returned transactions and anchored to the live balance

Reading balance history

Requested: C-Chain AVAX only, daily. Returned coverage unavailable. Chains requested: C. 26 eligible addresses; none read yet.

Source: Routescan, Wurrly Intel registry. No successful read yet.

Transaction count unavailable. Anchor time unavailable.

Current positions. Read time unavailable. Staking positions unavailable for this read.

Reading current staking positions

Read method

The series is rebuilt from the transactions the feeds return and then shifted so its last figure equals the live balance the node reported. The shift is the anchor adjustment, and the reach of the feeds behind it is stated above. Nothing is drawn before that shift is proved.

A day's figure is that UTC day's close: the balance after every movement dated that day.

Historical USD is each slot day's own final recorded close for AVAX, from Coinbase Exchange, joined on the UTC day. A day that has not finished has no close, and no other day's price stands in for it. The C-Chain and P-Chain AVAX are the same asset in that market, so both join the one AVAX close. Price join revision 2026-09-14.

Quantity coverage start unavailable.

Flows

Transfers summed by counterparty over the selected window
Flow window

Reading transfer history

Requested: External AVAX transfers of at least 1 AVAX, summed by counterparty. Returned coverage unavailable. Minimum transfer: 1 AVAX. Chains requested: C, P. 26 eligible addresses; none read yet.

Source: Routescan, Wurrly Intel registry. No successful read yet.

Read method

A trailing window is the interval from the read’s own time minus 30 periods of 24 hours up to that time. The start instant is excluded and the end instant is included, so two adjacent windows never both count the moment they share. Every figure in a trailing window is summed from the dated transfer rows the read returned, one row at a time, in exact decimal.

The returned history is the source’s own aggregate, summed over every row it read rather than over the rows it sent. It is never filtered by its first and last date to make a trailing total: a window that the returned rows cannot reach is reported as unavailable instead.

Inflow is AVAX this subject received and outflow is AVAX it sent. A movement with this subject on both sides is internal and is counted but never summed into an external total; a row with this subject on neither side is unmatched and is counted the same way. A row the feeds dated unreadably belongs to no trailing window, and the count of those is stated above.

Every amount on this card arrived from the source as a JavaScript number, so the sums are exact over the figures received and the received figures are not exact to the last digit of the chain. Each row’s Details says so beside the figure it applies to.

Transfers

Returned transfers, newest firstMinimum transfer: 1 AVAX

Reading transfer history

Requested: Returned AVAX transfers of at least 1 AVAX, newest first, including movements between the subject's own addresses. Returned coverage unavailable. Minimum transfer: 1 AVAX. Chains requested: C, P. 26 eligible addresses; none read yet.

Source: Routescan, Wurrly Intel registry. No successful read yet.

Read method

These are the transfers the flow read returned, newest first. The same request answers the card above: one read of the source, two measurements of it. Every row is at least 1 AVAX, because the source drops everything below that before it answers, and there are no token rows in it, so no token quantity is ever compared against the numeric 1 of another asset’s unit. A different threshold would need a source that reads to a different depth, which is not a setting on this page.

TRANSFERS shows every returned row, including movements between this subject’s own addresses, each marked Internal. A subject’s own P-Chain key counts as its own in both spellings, so a wallet moving value between its C-Chain and P-Chain sides is Internal rather than a pair of external flows to itself. INFLOW and OUTFLOW are external directions relative to this subject and exclude those rows, and they exclude rows with this subject on neither side and rows whose other endpoint is a chain rather than an address, which have no direction to sort into. CROSS-CHAIN holds the movements between two Avalanche chains: two endpoint chains that differ, or the atomic feed, which returns nothing else.

No pair identifier reaches this page, so a cross-chain export and its matching import are two rows with two amounts and two links. Nothing on this card adds them into one movement, and no figure here counts a pair once.

A historical USD value is that row’s own UTC day’s final closing price multiplied by its exact quantity. A day that has not finished has no close and says so; a day the price read did not return says so separately. Today’s price is never substituted for either.

Pages are windows on the frozen read named in the footer. A newer read landing while you are reading does not replace these rows; it offers itself at the top of the card, and adopting it returns to page 1.

Visualizer

Registry addresses as boxes, and the transfers the read observed between themRegistry addresses are grouped by role. Arrows show transfers returned by the selected read.A counterparty is the address or organisation on the other side of a transfer.

Avalanche Treasury Corp (AVAT). Reading transfers

Visualizer view

Avalanche Treasury Corp (AVAT): registry addresses by role, and the transfers this read observed between them20 boxes and no arrows. Transfer coverage is being read.Custody4 addressestreasury, vaults, signersWorking8 addresses shown of 12 addressesstaging, pass-throughs, forwardersStaking8 addresses shown of 10 addressesvalidator owners, P-Chain keys, protoco…AVAT treasury wallettreasury · C-Chain · Proven0x98a9…e9e6AVAT BitGo multisig Acustody · C-Chain · Proven0xa5ae…cf07AVAT BitGo multisig Bcustody · C-Chain · Proven0x9862…6802AVAT third BitGo wallet…custody · C-Chain · Candida…0x0288…70eaAVAT counterparty, the …counterparty · C-Chain · Pr…0xefe6…56c9AVAT collateral walletcollateral · C-Chain · Prov…0x88c3…87c0AVAT staging walletstaging · C-Chain · Proven0xb33c…2d20Coinbase deposit #2deposit-address · C-Chain ·…0x411e…ce1bCoinbase deposit #3deposit-address · C-Chain ·…0x20a5…9c59Coinbase deposit #4deposit-address · C-Chain ·…0x03c5…77a2Coinbase deposit #5deposit-address · C-Chain ·…0xe07f…6551Coinbase deposit #6deposit-address · C-Chain ·…0xfec6…d877AVAT validator 1 ownervalidator-owner · P-Chain ·…P-avax16rq0…p2tct0AVAT validator 2 ownervalidator-owner · P-Chain ·…P-avax1pgjt…uynl9nAVAT staking wallet at …validator-owner · P-Chain ·…P-avax1r2jc…y997qpAVAT staking wallet at …validator-owner · P-Chain ·…P-avax1yk6l…q82v0cSingle-use P-Chain keycustody · P-Chain · ProvenP-avax12wg2…hnw6zdTreasury validator key …validator-owner · P-Chain ·…P-avax1rpkr…avk4z8Collateral validator ke…validator-owner · P-Chain ·…P-avax1q462…sgqhy6Collateral validator ke…validator-owner · P-Chain ·…P-avax1xvqu…9e86kv

Select an address to read its identity and observed transfers.

Registry addresses in scope, with each one's role. 26 of 26 addresses read.

Wurrly Intel registry: compiled with this page.

Reading transfers. Transfer coverage is being read.

No transfer read has answered for this scope.

Read method

The boxes are the registry’s own rows, placed by the role the research gave each one: custody first, the working wallets next, the staking and protocol keys, then the exits. Whoever was on the other side of a returned transfer joins an outer column, on the right when this subject paid them and on the left when they only paid in. Grouping is not attribution: a box is named only where the registry names it.

Arrows are the transfers this read returned, summed by pair, asset, chain and kind. Two assets between one pair of boxes are two arrows, never one; a token quantity is never added to an AVAX total and never takes the AVAX reporting threshold. Reverse directions stay apart. A sum is labelled At least only where the source states the depth it reports to and says its coverage was partial; otherwise it is labelled Observed, which is still scoped to this request.

An endpoint the feed left as a chain rather than an address is not a counterparty, so no arrow is drawn to it and the count of transfers that were excluded for that reason is stated in the scope line above.

A column of more than 8 addresses folds its tail behind one control. Folding changes the drawing and nothing else: Connections still lists every canonical relationship, and any movement whose two ends fold into one box is kept as that group’s own internal subtotal, so the arrows plus the subtotals still add up to the same per-asset totals.

Proven: a filed quantity matched to the unit, or a transaction identified by its hash. Inferred: behaviour or timing, with the base rate stated in the source. Candidate: a lead, one tier below inferred, with a written test for promoting it and a written test for killing it. Explorer tag: an explorer's attribution label. Standing describes the cited claim. A transfer alone does not establish ownership.

Minimum transfer: 1 AVAX.

Evidence

Registry claims, address by address, with each claim's standing26 registry addresses. 1 registry identifier shown as well: no address page answers for it.

Proven: a filed quantity matched to the unit, or a transaction identified by its hash. Inferred: behaviour or timing, with the base rate stated in the source. Candidate: a lead, one tier below inferred, with a written test for promoting it and a written test for killing it. Explorer tag: an explorer's attribution label. Unattributed: no ownership attribution is established in the registry. Standing describes the cited claim. A transfer alone does not establish ownership.

Evidence class: A flow tie, B co-signature or shared infrastructure, C filed-quantity match, D node or provider continuity, E adjacency.

Registry method states a review on 4 September 2026. No record states a review date of its own.

  1. AVAT treasury wallet

    ProvenC-Chaintreasury

    0x98a90680f275ee23ba7b4b5f5f3917448550e9e6

    Attribution
    Filed under Avalanche Treasury Corp (AVAT) as treasury. Open entity
    Claim supported
    7,809,589.2770 AVAX at block 89,166,730, the last C-Chain block at or before 2026-06-30 23:59:59 UTC, which with the counterparty sums to 10,802,160.5733 AVAX against the approximately 10,802,156 AVAX the Q2 10-Q puts with Anchorage Digital Bank on that date, a difference of 4.57 AVAX or 0.00004 percent
    Evidence
    eth_getBalance against the archive node https://avalanche.drpc.org at block 89,166,730, and 0 at block 74,824,633 (31 Dec 2025 23:59:56 UTC), which matches a filing that put nothing at Anchorage at year end; Q2 10-Q filed 19 Aug 2026, custodian table. Re-run: POST https://avalanche.drpc.org, method eth_getBalance, params 0x98a90680f275ee23ba7b4b5f5f3917448550e9e6 and block 0x550938a. publicnode and 1rpc are pruned and answer missing trie node
    Source

    How this row was graded

    Evidence class
    C, filed-quantity match

    Open addressOpen in Snowscan (opens in a new tab)

  2. AVAT counterparty, the second Anchorage wallet

    ProvenC-Chaincounterparty

    0xefe6e5574c0c8b4199264a42deede219a5d256c9

    Attribution
    Filed under Avalanche Treasury Corp (AVAT) as counterparty. Open entity
    Claim supported
    the site named it a counterparty before the block-height read; it is the company's own second Anchorage-custodied wallet. 2,992,571.2963 AVAX at block 89,166,730, the other half of the filed 10,802,156 AVAX. It held 2,354,568.2142 sAVAX from 20 Apr to 9 Jun 2026, sent 2,990,005 AVAX to the collateral wallet on 10 Jul 2026, and funded four validator keys on 28 Aug and 9 Sep 2026
    Evidence
    eth_getBalance against https://avalanche.drpc.org at block 89,166,730 returns 2,992,571.2963 AVAX; the sAVAX mint is 0xd5a891e2b880... and the redemption 0x75dd52e8d71a...; the 10-Q says liquid-staking receipt tokens are custodied with BitGo or Anchorage, and the stAVAX sat in the BitGo wallets, so the sAVAX position was on the Anchorage side. Re-run: the same eth_getBalance and the Routescan v2 rows on 0xefe6e5574c0c8b4199264a42deede219a5d256c9
    Source

    How this row was graded

    Evidence class
    C, filed-quantity match

    Open addressOpen in Snowscan (opens in a new tab)

  3. AVAT collateral wallet

    ProvenC-Chaincollateral

    0x88c358c345dc7ca89dbb8301cdaef674cd6987c0

    Attribution
    Filed under Avalanche Treasury Corp (AVAT) as collateral. Open entity
    Claim supported
    its only funder is the counterparty, 2,990,000 AVAX plus a 5 AVAX rehearsal on 10 Jul 2026; it exported 2,242,503 AVAX, 75 percent, to two keys it alone owns and kept 747,502 AVAX, which is the 75 percent staking cap in the Galaxy terms
    Evidence
    Class A: the Routescan v2 txlist on this wallet shows one funder. The 8-K of 16 Jul 2026 says the Galaxy collateral is held in a segregated custody account with Anchorage Digital Bank N.A. pursuant to an Account Control Agreement; the two owner keys are already proven (scratch/hunt/blue/pchain-stakes.md item 5), so the registry had proven children of an inferred parent. Re-run: GET https://api.routescan.io/v2/network/mainnet/evm/43114/etherscan/api?module=account&action=txlist&address=0x88C358C345Dc7CA89dBB8301cdaEF674Cd6987C0&sort=asc
    Source

    How this row was graded

    Evidence class
    A, flow tie

    Open addressOpen in Snowscan (opens in a new tab)

  4. AVAT staging wallet

    ProvenC-Chainstaging

    0xb33c0018fe14aa604a3f7d8c1593f508f5302d20

    Attribution
    Filed under Avalanche Treasury Corp (AVAT) as staging. Open entity
    Claim supported
    twelve transfers of exactly 100,000 AVAX to six Coinbase deposit addresses between 26 Aug and 15 Sep 2026 (26 and 31 Aug; 1, 2, 3, 4, 7, 8, 9, 10, 11 and 15 Sep), 1,200,000 AVAX in all, each swept on within 14 to 242 seconds; balance 349,668 AVAX at 16 Sep 2026
    Evidence
    Figure 07 | chain read, 16 Sep 2026: nine sweeps went to the Coinbase AVAX hot wallet 0x4a4e8595, one each to 0xb6242194 on 4 Sep, 0xe1a0ddeb on 8 Sep and 0x333d17d3 on 15 Sep. Same-day closes value the twelve at $9,000,200, which measures value moved and not proceeds, and no filing discloses any of it. Re-run: GET https://api.routescan.io/v2/network/mainnet/evm/43114/etherscan/api?module=account&action=txlist&address=0xb33c0018FE14aA604a3f7d8c1593F508f5302d20&sort=desc&offset=100
    Source

    How this row was graded

    Evidence class
    A, flow tie

    Open addressOpen in Snowscan (opens in a new tab)

  5. AVAT BitGo multisig A

    ProvenC-Chaincustody

    0xa5ae8253f1315ac627cbec4edbd9c82db4c3cf07

    Attribution
    Filed under Avalanche Treasury Corp (AVAT) as custody. Open entity
    Claim supported
    filed 575,123 stAVAX (42%); BitGo wallet contract; created and operated by 0x1705500d (a different signer from the AVX vaults)
    Evidence
    S-4 match; code hash = BitGo template | Snowscan: method Send Multi Sig; creator 0x1705500d
    Source

    Open addressOpen in Snowscan (opens in a new tab)

  6. AVAT BitGo multisig B

    ProvenC-Chaincustody

    0x9862a32092c7bf61df1d36cbeaa2243c3c4a6802

    Attribution
    Filed under Avalanche Treasury Corp (AVAT) as custody. Open entity
    Claim supported
    605,380 stAVAX out via the counterparty; created and operated by 0x1705500d (a different signer from the AVX vaults)
    Evidence
    424B3 custody schedule; code hash = BitGo template | Snowscan: method Send Multi Sig; creator 0x1705500d
    Source

    Open addressOpen in Snowscan (opens in a new tab)

  7. Coinbase deposit #2

    ProvenC-Chaindeposit-address

    0x411ea19e496f3dded7b4d2e827ba06135036ce1b

    Attribution
    Filed under Avalanche Treasury Corp (AVAT) as deposit-address. Open entity
    Claim supported
    account holder not established. The shared P-Chain custody desk exported 250,000 AVAX into it at 16:44 UTC on 12 Aug 2026 with a 0.05 AVAX prepaid import fee, and AVAT's staging wallet sent 100,000 AVAX on 31 Aug, 100,000 on 7 Sep and 100,000 on 15 Sep 2026, the last of the twelve. It took 0.5 AVAX in the 11 Jun 2026 dust ladder, which ran into five of the six addresses and not into deposit #1
    Evidence
    chain read, 16 Sep 2026. The staging-wallet edge is class A: each transfer has a hash and the sweep followed within 14 to 242 seconds. Who holds the account behind the address is not established. The shared custody hub's AVAX was outside AVAT's filed holdings at 30 June 2026, so the two feeds were not the same client's money at that date, and the chain does not decide which of them the account belongs to. The 11 Jun 2026 dust ladder ran into five of the six: 0.5 AVAX into deposit #2 at 21:24:47 UTC, 0.4 into #3 at 21:24:50, 0.3 into #4 at 21:31:32, 0.1 into #6 at 21:31:58 and 0.2 into #5 at 21:32:34, each the first row in that address's life. Deposit #1 took none: it had been in use since 9 Dec 2025 (scratch/hunt/blue2/deposit-provenance-verify.md, findings 1 and 5). The five round exports of August 2026 are ExportTx 29eo2TzDNiHMTTfFZW1Nzw8W2ob5qpRVYTLyQ2QGit7yZFPVyJ (12 Aug 16:44 UTC, 250,000 AVAX into deposit #2), QK95Hss5cAYvQmjB (18 Aug 20:19, 250,000 into #6), 2n59eqkvVKcZQbTT (20 Aug 15:59, 250,000 into #5), imC5wyD4fTmD3L5X (21 Aug 13:10, 500,000 into #4) and CB1sWbC9HGhRP3M8 (26 Aug 16:15, 250,000 into #3), each carrying a 0.05 AVAX prepaid import fee as a second output to the same key (scratch/hunt/blue/atomic-hops-VERIFY.md section M1). Re-run: the Routescan v2 atomic rows for 11 Jun 2026 and GET https://data-api.avax.network/v1/networks/mainnet/blockchains/c-chain/transactions?addresses={C-avax1 form}&pageSize=100, whose ImportTx consumedUtxos give the creating ExportTx and its P-Chain input owners. Provenance, and it is short: these five addresses were opened on 11 Jun 2026 by a P-Chain dust ladder, five payments of 0.5, 0.4, 0.3, 0.2 and 0.1 AVAX inside 7 minutes 47 seconds from four keys of the registry's shared-custody family, each the first row in that address's life. From 11 Jun to 26 Aug 2026 that same family paid them 2,750,001.50 AVAX in fifteen cross-chain transfers, four of which (1,000,000 AVAX on 17 Jun, 23 Jun and twice on 14 Jul) were not previously in the record; the fifteen were signed by 34 different P-Chain keys between them, 31 of them already in the registry, so the family signs as one wallet. From 31 Aug to 15 Sep 2026 AVAT's staging wallet paid the same five 1,100,000.32 AVAX, beginning with its own dust ladder of 0.05, 0.03, 0.09, 0.07 and 0.08 AVAX inside 93 seconds on 31 Aug, with the first 100,000 AVAX 33 minutes later. Nothing else has ever paid these five: the only other inbound rows are zero-value and 0.00001 AVAX pings from the lookalike dusters the registry already carries as excluded. A deposit address is a receiving address, so a set of payers is not a set of owners; whether the twelve transfers of 100,000 AVAX left the company's holdings or moved inside them is not something the chain can settle, and the 30 Sep 2026 token count in the Q3 10-Q will. Re-run: GET https://api.routescan.io/v2/network/mainnet/evm/43114/address/{addr}/transactions?limit=100 paged to exhaustion, then GET https://data-api.avax.network/v1/networks/mainnet/blockchains/p-chain/transactions/{txHash} on each ExportTx the atomic rows name, for its input owners
    Source

    Open addressOpen in Snowscan (opens in a new tab)

  8. Coinbase deposit #3

    ProvenC-Chaindeposit-address

    0x20a55c11a98ce5ecf4cd724216b789576cde9c59

    Attribution
    Filed under Avalanche Treasury Corp (AVAT) as deposit-address. Open entity
    Claim supported
    account holder not established. The shared P-Chain custody desk exported 250,000 AVAX into it at 16:15 UTC on 26 Aug 2026 with a 0.05 AVAX prepaid import fee, and AVAT's staging wallet sent 100,000 AVAX on 1 Sep and 100,000 on 8 Sep 2026; the second was forwarded to an exchange withdrawal processor 119 seconds later. It took 0.4 AVAX in the 11 Jun 2026 dust ladder, which ran into five of the six addresses and not into deposit #1
    Evidence
    chain read, 16 Sep 2026. The staging-wallet edge is class A: each transfer has a hash and the sweep followed within 14 to 242 seconds. Who holds the account behind the address is not established. The shared custody hub's AVAX was outside AVAT's filed holdings at 30 June 2026, so the two feeds were not the same client's money at that date, and the chain does not decide which of them the account belongs to. The 11 Jun 2026 dust ladder ran into five of the six: 0.5 AVAX into deposit #2 at 21:24:47 UTC, 0.4 into #3 at 21:24:50, 0.3 into #4 at 21:31:32, 0.1 into #6 at 21:31:58 and 0.2 into #5 at 21:32:34, each the first row in that address's life. Deposit #1 took none: it had been in use since 9 Dec 2025 (scratch/hunt/blue2/deposit-provenance-verify.md, findings 1 and 5). The five round exports of August 2026 are ExportTx 29eo2TzDNiHMTTfFZW1Nzw8W2ob5qpRVYTLyQ2QGit7yZFPVyJ (12 Aug 16:44 UTC, 250,000 AVAX into deposit #2), QK95Hss5cAYvQmjB (18 Aug 20:19, 250,000 into #6), 2n59eqkvVKcZQbTT (20 Aug 15:59, 250,000 into #5), imC5wyD4fTmD3L5X (21 Aug 13:10, 500,000 into #4) and CB1sWbC9HGhRP3M8 (26 Aug 16:15, 250,000 into #3), each carrying a 0.05 AVAX prepaid import fee as a second output to the same key (scratch/hunt/blue/atomic-hops-VERIFY.md section M1). Re-run: the Routescan v2 atomic rows for 11 Jun 2026 and GET https://data-api.avax.network/v1/networks/mainnet/blockchains/c-chain/transactions?addresses={C-avax1 form}&pageSize=100, whose ImportTx consumedUtxos give the creating ExportTx and its P-Chain input owners. Provenance, and it is short: these five addresses were opened on 11 Jun 2026 by a P-Chain dust ladder, five payments of 0.5, 0.4, 0.3, 0.2 and 0.1 AVAX inside 7 minutes 47 seconds from four keys of the registry's shared-custody family, each the first row in that address's life. From 11 Jun to 26 Aug 2026 that same family paid them 2,750,001.50 AVAX in fifteen cross-chain transfers, four of which (1,000,000 AVAX on 17 Jun, 23 Jun and twice on 14 Jul) were not previously in the record; the fifteen were signed by 34 different P-Chain keys between them, 31 of them already in the registry, so the family signs as one wallet. From 31 Aug to 15 Sep 2026 AVAT's staging wallet paid the same five 1,100,000.32 AVAX, beginning with its own dust ladder of 0.05, 0.03, 0.09, 0.07 and 0.08 AVAX inside 93 seconds on 31 Aug, with the first 100,000 AVAX 33 minutes later. Nothing else has ever paid these five: the only other inbound rows are zero-value and 0.00001 AVAX pings from the lookalike dusters the registry already carries as excluded. A deposit address is a receiving address, so a set of payers is not a set of owners; whether the twelve transfers of 100,000 AVAX left the company's holdings or moved inside them is not something the chain can settle, and the 30 Sep 2026 token count in the Q3 10-Q will. Re-run: GET https://api.routescan.io/v2/network/mainnet/evm/43114/address/{addr}/transactions?limit=100 paged to exhaustion, then GET https://data-api.avax.network/v1/networks/mainnet/blockchains/p-chain/transactions/{txHash} on each ExportTx the atomic rows name, for its input owners
    Source

    Open addressOpen in Snowscan (opens in a new tab)

  9. Coinbase deposit #4

    ProvenC-Chaindeposit-address

    0x03c5c5b801a413fa4c27577cd544268ccd2577a2

    Attribution
    Filed under Avalanche Treasury Corp (AVAT) as deposit-address. Open entity
    Claim supported
    account holder not established. The shared P-Chain custody desk exported 500,000 AVAX into it at 13:10 UTC on 21 Aug 2026 with a 0.05 AVAX prepaid import fee, and AVAT's staging wallet sent 100,000 AVAX on 2 Sep and 100,000 on 9 Sep 2026. It took 0.3 AVAX in the 11 Jun 2026 dust ladder, which ran into five of the six addresses and not into deposit #1
    Evidence
    chain read, 16 Sep 2026. The staging-wallet edge is class A: each transfer has a hash and the sweep followed within 14 to 242 seconds. Who holds the account behind the address is not established. The shared custody hub's AVAX was outside AVAT's filed holdings at 30 June 2026, so the two feeds were not the same client's money at that date, and the chain does not decide which of them the account belongs to. The 11 Jun 2026 dust ladder ran into five of the six: 0.5 AVAX into deposit #2 at 21:24:47 UTC, 0.4 into #3 at 21:24:50, 0.3 into #4 at 21:31:32, 0.1 into #6 at 21:31:58 and 0.2 into #5 at 21:32:34, each the first row in that address's life. Deposit #1 took none: it had been in use since 9 Dec 2025 (scratch/hunt/blue2/deposit-provenance-verify.md, findings 1 and 5). The five round exports of August 2026 are ExportTx 29eo2TzDNiHMTTfFZW1Nzw8W2ob5qpRVYTLyQ2QGit7yZFPVyJ (12 Aug 16:44 UTC, 250,000 AVAX into deposit #2), QK95Hss5cAYvQmjB (18 Aug 20:19, 250,000 into #6), 2n59eqkvVKcZQbTT (20 Aug 15:59, 250,000 into #5), imC5wyD4fTmD3L5X (21 Aug 13:10, 500,000 into #4) and CB1sWbC9HGhRP3M8 (26 Aug 16:15, 250,000 into #3), each carrying a 0.05 AVAX prepaid import fee as a second output to the same key (scratch/hunt/blue/atomic-hops-VERIFY.md section M1). Re-run: the Routescan v2 atomic rows for 11 Jun 2026 and GET https://data-api.avax.network/v1/networks/mainnet/blockchains/c-chain/transactions?addresses={C-avax1 form}&pageSize=100, whose ImportTx consumedUtxos give the creating ExportTx and its P-Chain input owners. Provenance, and it is short: these five addresses were opened on 11 Jun 2026 by a P-Chain dust ladder, five payments of 0.5, 0.4, 0.3, 0.2 and 0.1 AVAX inside 7 minutes 47 seconds from four keys of the registry's shared-custody family, each the first row in that address's life. From 11 Jun to 26 Aug 2026 that same family paid them 2,750,001.50 AVAX in fifteen cross-chain transfers, four of which (1,000,000 AVAX on 17 Jun, 23 Jun and twice on 14 Jul) were not previously in the record; the fifteen were signed by 34 different P-Chain keys between them, 31 of them already in the registry, so the family signs as one wallet. From 31 Aug to 15 Sep 2026 AVAT's staging wallet paid the same five 1,100,000.32 AVAX, beginning with its own dust ladder of 0.05, 0.03, 0.09, 0.07 and 0.08 AVAX inside 93 seconds on 31 Aug, with the first 100,000 AVAX 33 minutes later. Nothing else has ever paid these five: the only other inbound rows are zero-value and 0.00001 AVAX pings from the lookalike dusters the registry already carries as excluded. A deposit address is a receiving address, so a set of payers is not a set of owners; whether the twelve transfers of 100,000 AVAX left the company's holdings or moved inside them is not something the chain can settle, and the 30 Sep 2026 token count in the Q3 10-Q will. Re-run: GET https://api.routescan.io/v2/network/mainnet/evm/43114/address/{addr}/transactions?limit=100 paged to exhaustion, then GET https://data-api.avax.network/v1/networks/mainnet/blockchains/p-chain/transactions/{txHash} on each ExportTx the atomic rows name, for its input owners
    Source

    Open addressOpen in Snowscan (opens in a new tab)

  10. Coinbase deposit #5

    ProvenC-Chaindeposit-address

    0xe07fb0baefcc5e25144b5e4ba14ccc1a4aa66551

    Attribution
    Filed under Avalanche Treasury Corp (AVAT) as deposit-address. Open entity
    Claim supported
    account holder not established. The shared P-Chain custody desk exported 250,000 AVAX into it at 15:59 UTC on 20 Aug 2026 with a 0.05 AVAX prepaid import fee, and AVAT's staging wallet sent 100,000 AVAX on 3 Sep and 100,000 on 10 Sep 2026. It took 0.2 AVAX in the 11 Jun 2026 dust ladder, which ran into five of the six addresses and not into deposit #1
    Evidence
    chain read, 16 Sep 2026. The staging-wallet edge is class A: each transfer has a hash and the sweep followed within 14 to 242 seconds. Who holds the account behind the address is not established. The shared custody hub's AVAX was outside AVAT's filed holdings at 30 June 2026, so the two feeds were not the same client's money at that date, and the chain does not decide which of them the account belongs to. The 11 Jun 2026 dust ladder ran into five of the six: 0.5 AVAX into deposit #2 at 21:24:47 UTC, 0.4 into #3 at 21:24:50, 0.3 into #4 at 21:31:32, 0.1 into #6 at 21:31:58 and 0.2 into #5 at 21:32:34, each the first row in that address's life. Deposit #1 took none: it had been in use since 9 Dec 2025 (scratch/hunt/blue2/deposit-provenance-verify.md, findings 1 and 5). The five round exports of August 2026 are ExportTx 29eo2TzDNiHMTTfFZW1Nzw8W2ob5qpRVYTLyQ2QGit7yZFPVyJ (12 Aug 16:44 UTC, 250,000 AVAX into deposit #2), QK95Hss5cAYvQmjB (18 Aug 20:19, 250,000 into #6), 2n59eqkvVKcZQbTT (20 Aug 15:59, 250,000 into #5), imC5wyD4fTmD3L5X (21 Aug 13:10, 500,000 into #4) and CB1sWbC9HGhRP3M8 (26 Aug 16:15, 250,000 into #3), each carrying a 0.05 AVAX prepaid import fee as a second output to the same key (scratch/hunt/blue/atomic-hops-VERIFY.md section M1). Re-run: the Routescan v2 atomic rows for 11 Jun 2026 and GET https://data-api.avax.network/v1/networks/mainnet/blockchains/c-chain/transactions?addresses={C-avax1 form}&pageSize=100, whose ImportTx consumedUtxos give the creating ExportTx and its P-Chain input owners. Provenance, and it is short: these five addresses were opened on 11 Jun 2026 by a P-Chain dust ladder, five payments of 0.5, 0.4, 0.3, 0.2 and 0.1 AVAX inside 7 minutes 47 seconds from four keys of the registry's shared-custody family, each the first row in that address's life. From 11 Jun to 26 Aug 2026 that same family paid them 2,750,001.50 AVAX in fifteen cross-chain transfers, four of which (1,000,000 AVAX on 17 Jun, 23 Jun and twice on 14 Jul) were not previously in the record; the fifteen were signed by 34 different P-Chain keys between them, 31 of them already in the registry, so the family signs as one wallet. From 31 Aug to 15 Sep 2026 AVAT's staging wallet paid the same five 1,100,000.32 AVAX, beginning with its own dust ladder of 0.05, 0.03, 0.09, 0.07 and 0.08 AVAX inside 93 seconds on 31 Aug, with the first 100,000 AVAX 33 minutes later. Nothing else has ever paid these five: the only other inbound rows are zero-value and 0.00001 AVAX pings from the lookalike dusters the registry already carries as excluded. A deposit address is a receiving address, so a set of payers is not a set of owners; whether the twelve transfers of 100,000 AVAX left the company's holdings or moved inside them is not something the chain can settle, and the 30 Sep 2026 token count in the Q3 10-Q will. Re-run: GET https://api.routescan.io/v2/network/mainnet/evm/43114/address/{addr}/transactions?limit=100 paged to exhaustion, then GET https://data-api.avax.network/v1/networks/mainnet/blockchains/p-chain/transactions/{txHash} on each ExportTx the atomic rows name, for its input owners
    Source

    Open addressOpen in Snowscan (opens in a new tab)

  11. Coinbase deposit #6

    ProvenC-Chaindeposit-address

    0xfec6479f637bd91158c3af30a10f9f55cc49d877

    Attribution
    Filed under Avalanche Treasury Corp (AVAT) as deposit-address. Open entity
    Claim supported
    account holder not established. The shared custody hub sent it 250,000 AVAX on 11 Jun 2026, listing day, and the same desk exported 250,000 AVAX more at 20:19 UTC on 18 Aug 2026; AVAT's staging wallet sent 100,000 AVAX on 4 Sep and 100,000 on 11 Sep 2026, and the first was swept to the Coinbase internal float 40 seconds later. It took 0.1 AVAX in the 11 Jun 2026 dust ladder, which ran into five of the six addresses and not into deposit #1
    Evidence
    chain read, 16 Sep 2026: staging-wallet transfers 0xcff29ff4728eafe84641d336469ef7f14e449ea07df1874aee755c5b16c14205 at 14:08:36 UTC on 4 Sep and 0xbba1b20b22abda7f4b28a0ecc0d836673c5cddfa4e5da93ea2446e12b526d113 at 15:05:24 UTC on 11 Sep, 100,000 AVAX each | chain read, 16 Sep 2026. The staging-wallet edge is class A: each transfer has a hash and the sweep followed within 14 to 242 seconds. Who holds the account behind the address is not established. The shared custody hub's AVAX was outside AVAT's filed holdings at 30 June 2026, so the two feeds were not the same client's money at that date, and the chain does not decide which of them the account belongs to. The 11 Jun 2026 dust ladder ran into five of the six: 0.5 AVAX into deposit #2 at 21:24:47 UTC, 0.4 into #3 at 21:24:50, 0.3 into #4 at 21:31:32, 0.1 into #6 at 21:31:58 and 0.2 into #5 at 21:32:34, each the first row in that address's life. Deposit #1 took none: it had been in use since 9 Dec 2025 (scratch/hunt/blue2/deposit-provenance-verify.md, findings 1 and 5). The five round exports of August 2026 are ExportTx 29eo2TzDNiHMTTfFZW1Nzw8W2ob5qpRVYTLyQ2QGit7yZFPVyJ (12 Aug 16:44 UTC, 250,000 AVAX into deposit #2), QK95Hss5cAYvQmjB (18 Aug 20:19, 250,000 into #6), 2n59eqkvVKcZQbTT (20 Aug 15:59, 250,000 into #5), imC5wyD4fTmD3L5X (21 Aug 13:10, 500,000 into #4) and CB1sWbC9HGhRP3M8 (26 Aug 16:15, 250,000 into #3), each carrying a 0.05 AVAX prepaid import fee as a second output to the same key (scratch/hunt/blue/atomic-hops-VERIFY.md section M1). Re-run: the Routescan v2 atomic rows for 11 Jun 2026 and GET https://data-api.avax.network/v1/networks/mainnet/blockchains/c-chain/transactions?addresses={C-avax1 form}&pageSize=100, whose ImportTx consumedUtxos give the creating ExportTx and its P-Chain input owners. Provenance, and it is short: these five addresses were opened on 11 Jun 2026 by a P-Chain dust ladder, five payments of 0.5, 0.4, 0.3, 0.2 and 0.1 AVAX inside 7 minutes 47 seconds from four keys of the registry's shared-custody family, each the first row in that address's life. From 11 Jun to 26 Aug 2026 that same family paid them 2,750,001.50 AVAX in fifteen cross-chain transfers, four of which (1,000,000 AVAX on 17 Jun, 23 Jun and twice on 14 Jul) were not previously in the record; the fifteen were signed by 34 different P-Chain keys between them, 31 of them already in the registry, so the family signs as one wallet. From 31 Aug to 15 Sep 2026 AVAT's staging wallet paid the same five 1,100,000.32 AVAX, beginning with its own dust ladder of 0.05, 0.03, 0.09, 0.07 and 0.08 AVAX inside 93 seconds on 31 Aug, with the first 100,000 AVAX 33 minutes later. Nothing else has ever paid these five: the only other inbound rows are zero-value and 0.00001 AVAX pings from the lookalike dusters the registry already carries as excluded. A deposit address is a receiving address, so a set of payers is not a set of owners; whether the twelve transfers of 100,000 AVAX left the company's holdings or moved inside them is not something the chain can settle, and the 30 Sep 2026 token count in the Q3 10-Q will. Re-run: GET https://api.routescan.io/v2/network/mainnet/evm/43114/address/{addr}/transactions?limit=100 paged to exhaustion, then GET https://data-api.avax.network/v1/networks/mainnet/blockchains/p-chain/transactions/{txHash} on each ExportTx the atomic rows name, for its input owners
    Source

    Open addressOpen in Snowscan (opens in a new tab)

  12. AVAT validator 1 owner

    ProvenP-Chainvalidator-owner

    P-avax16rq0ey0yezqax6cwwry4kvh2grrw58mdp2tct0

    Attribution
    Filed under Avalanche Treasury Corp (AVAT) as validator-owner. Open entity
    Claim supported
    NodeID-F5Ecwd5qinZSTxacdEfWWsnz2eXyp8uK6 (a pre-existing Chorus One node, 5 prior validations since Oct 2025) 1,999,999, 5% fee, to 21 Sep
    Evidence
    | Avascan label: Chorus One
    Source

    Open addressOpen in Avascan (opens in a new tab)

  13. AVAT validator 2 owner

    ProvenP-Chainvalidator-owner

    P-avax1pgjtvez2rr7yf9yejs6pkr7kpu4xnw76uynl9n

    Attribution
    Filed under Avalanche Treasury Corp (AVAT) as validator-owner. Open entity
    Claim supported
    NodeID-4gp6z23DrgtRKN3Z8PEmac7drgVxHmdQR 1,999,999, 100% fee, to 13 Sep
    Evidence
    Evidence text unavailable
    Source

    Open addressOpen in Avascan (opens in a new tab)

  14. AVAT staking wallet at BitGo (2-of-3)

    InferredP-Chainvalidator-owner

    P-avax1r2jcftpt0tz6l0wlx4qsc8jqd90kvk7hy997qp

    Attribution
    Filed under Avalanche Treasury Corp (AVAT) as validator-owner. Open entity
    Claim supported
    36 validation periods from 30 Oct 2025 to 1 Apr 2026 across eleven nodes (250K to 1.57M each), five of them on NodeID-DVh35F3R11HAAxzeSTbk3eR9w2BzPrJQt, which carries the largest Coinbase Custody batch key today; exported 3,071,470 into BitGo wallet A on 4 Jun 2026, the day that wallet sent 3,409,469 to the treasury
    Evidence
    Every output 2-of-3 (BitGo); the export landed in the filed BitGo wallet A (S-4 quantity match). Operator not disclosed; the flow into a filed wallet is the tie. Re-run: GET https://data-api.avax.network/v1/networks/mainnet/blockchains/p-chain/transactions?addresses=P-avax1r2jcftpt0tz6l0wlx4qsc8jqd90kvk7hy997qp&pageSize=100, which returns 39 transactions across eleven distinct node IDs. Node continuity, evidence class D, is weak on its own here and the row does not rest on it. MEASURED: one private key unrelated to either company, P-avax1qtrykwgqkpj8c9wl93cymu6q9ffssyyu95q8wp, has delegated to NodeID-DVh35F3R11HAAxzeSTbk3eR9w2BzPrJQt since 2022-01-01 21:17:23 and to NodeID-3kUUeZB7umtaENekUfWxa1bxrAU2eq1AD since 2021-09-29 20:48:15, years before Avalanche Treasury Corp existed, and its automation re-delegated 130,455.60 AVAX twice on 2026-08-06 at a 100 percent fee that pays it nothing. These are rented commercial validators, so any node must be age-checked before its overlap is printed as corroboration (scratch/hunt/blue2/delegator-sweep.md section 5). The same read withdraws the claim that a 100 percent fee means no third party can delegate: that node reports delegatorCount 2 and delegatorWeight 260,911.20 AVAX. Re-run: POST https://avalanche-p-chain-rpc.publicnode.com platform.getCurrentValidators with the nodeID, then platform.getTx on the delegation's consumed UTXOs back through the key's own history.
    Source

    How this row was graded

    Evidence class
    A, flow tie
    What would promote it
    the 31 Dec 2025 BitGo figure of 5,249,578 AVAX tested to the unit through a platform.getTx walk on the stake outputs, since Glacier's historical balance route returns 0 for multi-owner UTXOs
    What would kill it
    nothing; the key read 0 at both filed dates and is closed

    Promotion is a person's decision, and every promotion writes the re-runnable query into the evidence above.

    Open addressOpen in Avascan (opens in a new tab)

  15. AVAT staking wallet at BitGo (2-of-3)

    InferredP-Chainvalidator-owner

    P-avax1yk6lq95cwwsmu8aw7yacm07xynp2202cq82v0c

    Attribution
    Filed under Avalanche Treasury Corp (AVAT) as validator-owner. Open entity
    Claim supported
    6 validation periods from 19 Nov 2025 to 1 Mar 2026 on NodeID-bNUXzpyB and NodeID-NvsnF7zC (1.1M to 2.2M each); exported 2,253,321 into BitGo wallet B on 1 Apr 2026
    Evidence
    Glacier: every output 2-of-3 (BitGo); the export landed in the filed BitGo wallet B (424B3 custody schedule). Operator not disclosed
    Source

    How this row was graded

    Evidence class
    A, flow tie
    What would promote it
    the 31 Dec 2025 BitGo figure of 5,249,578 AVAX tested to the unit through a platform.getTx walk on the stake outputs, since Glacier's historical balance route returns 0 for multi-owner UTXOs
    What would kill it
    nothing; the key read 0 at both filed dates and is closed

    Promotion is a person's decision, and every promotion writes the re-runnable query into the evidence above.

    Open addressOpen in Avascan (opens in a new tab)

  16. Single-use P-Chain key

    ProvenP-Chaincustody

    P-avax12wg2m6py0gcglxl99tqan56vsygz3wsjhnw6zd

    Attribution
    Filed under Avalanche Treasury Corp (AVAT) as custody. Open entity
    Claim supported
    received the treasury's own 1,958,043 (its July stake plus reward) from the treasury validator key and exported it into the treasury wallet on 13 Aug 2026, 50 minutes before the 5,600,000 went to the counterparty
    Evidence
    Glacier: funded by ExportTx Eg6kVStxjTxi from P-avax1rpkrf095... at 17:06, the key the treasury itself exported to on 17 Jul; one export, into the treasury. The round trip is closed on-chain
    Source

    Open addressOpen in Avascan (opens in a new tab)

  17. Treasury validator key (single-key)

    ProvenP-Chainvalidator-owner

    P-avax1rpkrf095aqz88ulxl4c9tmxslwcxantvavk4z8

    Attribution
    Filed under Avalanche Treasury Corp (AVAT) as validator-owner. Open entity
    Claim supported
    imported the treasury's 1,952,397 on 17 Jul 2026, validated NodeID-4gp6z23DrgtRKN3Z8PEmac7drgVxHmdQR to 6 Aug, and on 13 Aug exported the 1,958,043 (stake plus reward) to the single-use key that fed the treasury 50 minutes later
    Evidence
    Glacier: ImportTx 2R2aCMMHA7WX (17 Jul 18:32), AddPermissionlessValidatorTx qF7SpYQ2rkkp, ExportTx Eg6kVStxjTxi to P-avax12wg2m6...; the C-Chain side is the treasury wallet's atomic export at 18:28 the same day
    Source

    Open addressOpen in Avascan (opens in a new tab)

  18. Collateral validator key A (single-key)

    ProvenP-Chainvalidator-owner

    P-avax1q4622mxlfprfs7j7j6qzht4mn22upq93sgqhy6

    Attribution
    Filed under Avalanche Treasury Corp (AVAT) as validator-owner. Open entity
    Claim supported
    imported 1,121,251 from the collateral wallet on 15 Jul 2026 and has validated NodeID-NXccpj75dHHFswk39PXtEqAv1qkNeDb5y since 22 Jul, rolled 18 Aug and 3 Sep; 1,126,094 staked until 29 Sep 2026
    Evidence
    Glacier: ImportTx bHK34qGbyhvt; AddPermissionlessValidatorTx ECbT96Lu7Tk4, LZ5aHPaw6k8C, 5B28Zp69vhn4, every output threshold 1 to this key; the C-Chain side is the collateral wallet's atomic export at 19:40
    Source

    Open addressOpen in Avascan (opens in a new tab)

  19. Collateral validator key B (single-key)

    ProvenP-Chainvalidator-owner

    P-avax1xvquf0kq6ggztpuzp6z2cs9ynmldt96p9e86kv

    Attribution
    Filed under Avalanche Treasury Corp (AVAT) as validator-owner. Open entity
    Claim supported
    imported 1,121,252 from the collateral wallet on 15 Jul 2026 and has validated NodeID-3kUUeZB7umtaENekUfWxa1bxrAU2eq1AD since 16 Jul, rolled 31 Jul, 18 Aug and 3 Sep; 1,128,858 staked until 29 Sep 2026
    Evidence
    Glacier: ImportTx 2M5oKBoFMp3d; AddPermissionlessValidatorTx dYHoDwPtCqTT, VJuzTck7XkZu, 28uJBsZSf3rg, 2iupx9tdiyPP, every output threshold 1 to this key; the C-Chain side is the collateral wallet's atomic export at 17:15
    Source

    Open addressOpen in Avascan (opens in a new tab)

  20. Counterparty-funded validator key (single-key)

    ProvenP-Chainvalidator-owner

    P-avax1xnywps55r3tsssxklsj6039l9e67t3h2qxedps

    Attribution
    Filed under Avalanche Treasury Corp (AVAT) as validator-owner. Open entity
    Claim supported
    imported 1,134,000 AVAX at 16:20 UTC on 9 Sep 2026 and staked 1,133,999 on NodeID-8RaaezhTdxy9p9vNLWVLRPw5PEj4R8ukp at 16:24, until 24 Sep 2026
    Evidence
    chain read, 13 Sep 2026: ExportTx 6wdKop1djSsuu3nT9SrLE4UR24PhtAPoS6BQDgbUh5dHyFEsH from the counterparty 0xefe6e557 at 16:17:22, then ImportTx and AddPermissionlessValidatorTx on this key. The node ID was completed from the 16 Sep 2026 merge (scratch/hunt/blue/custody-batch.md)
    Source

    Open addressOpen in Avascan (opens in a new tab)

  21. Counterparty-funded validator key (single-key)

    ProvenP-Chainvalidator-owner

    P-avax1qjukw4p93pyygk0zdgw2zqsyspatw829d5gtqn

    Attribution
    Filed under Avalanche Treasury Corp (AVAT) as validator-owner. Open entity
    Claim supported
    imported 1,134,000 AVAX at 16:20 UTC on 9 Sep 2026 and staked 1,133,999 on NodeID-Cgdu1GhrbwSD4x3vRTp9fFe3sitWckyPD at 16:28, until 29 Sep 2026
    Evidence
    chain read, 13 Sep 2026: ExportTx VjYpGFqpEaZKH2TymACTMM9QD1RNUCCVY3ZTKQrNckLPxZ5nB from the counterparty 0xefe6e557 at 16:18:24, then ImportTx and AddPermissionlessValidatorTx on this key. The node ID was completed from the 16 Sep 2026 merge: NodeID-Cgdu1Ghr carried the Coinbase Custody batch key P-avax1ahc32g for five cycles from Nov 2025 to Apr 2026. Node continuity, evidence class D, is weak on its own here and the row does not rest on it. MEASURED: one private key unrelated to either company, P-avax1qtrykwgqkpj8c9wl93cymu6q9ffssyyu95q8wp, has delegated to NodeID-DVh35F3R11HAAxzeSTbk3eR9w2BzPrJQt since 2022-01-01 21:17:23 and to NodeID-3kUUeZB7umtaENekUfWxa1bxrAU2eq1AD since 2021-09-29 20:48:15, years before Avalanche Treasury Corp existed, and its automation re-delegated 130,455.60 AVAX twice on 2026-08-06 at a 100 percent fee that pays it nothing. These are rented commercial validators, so any node must be age-checked before its overlap is printed as corroboration (scratch/hunt/blue2/delegator-sweep.md section 5). The same read withdraws the claim that a 100 percent fee means no third party can delegate: that node reports delegatorCount 2 and delegatorWeight 260,911.20 AVAX. Re-run: POST https://avalanche-p-chain-rpc.publicnode.com platform.getCurrentValidators with the nodeID, then platform.getTx on the delegation's consumed UTXOs back through the key's own history.
    Source

    Open addressOpen in Avascan (opens in a new tab)

  22. Coinbase Prime deposit address for AVAT

    InferredC-Chainprime-deposit

    0x7f74475783a0c8586cc469d10b2f4afc280a0a08

    Attribution
    Filed under Avalanche Treasury Corp (AVAT) as prime-deposit. Open entity
    Claim supported
    carried 1,960,040.20 AVAX on 14 Nov 2025, 448,344.60 AVAX on 17 Nov 2025 and 4,060,686.53 AVAX on 10 Jun 2026, each of which reached an AVAT-proven wallet within days; takes monthly pings of 1,300 to 2,000 AVAX from the three cold wallets, and BitGo wallet B paid it 2,000 AVAX on 16 Dec 2025 and again on 2 Jan 2026. It carries traffic the AVAT trail does not explain: thirteen deliveries of 100,000 AVAX or more from nine senders reached it between 5 Oct 2025 and 10 Jun 2026, and the nine that are not the three above, 3,405,933 AVAX from five senders between 5 Oct and 7 Nov 2025, are not accounted for. All 10,182,209 AVAX it has ever paid out went to the Coinbase Prime hot wallet 0x1d67bd45
    Evidence
    scratch/hunt/blue/CANDIDATES.md item 2, and a chain read of 16 Sep 2026: the address has 97 rows, 10,171,904 AVAX in and 10,182,209 AVAX out, every outbound payment to 0x1d67bd45. The 14 Nov 2025 delivery is two payments in three seconds, 859,977.00 from 0x5f81a08b and 1,100,063.00 from 0x2ed32aa7. The nine unexplained deliveries are 472,312.89 and 502,343.43 from 0x1157a207, 176,575.91, 609,425.87, 236,708.50 and 109,543.50 from 0x9c7b3c57, 844,024.31 from 0x7d70e5f5, 161,999.26 from 0xefae7955 and 292,999.00 from 0x3a28dcae. Re-run: GET https://api.routescan.io/v2/network/mainnet/evm/43114/etherscan/api?module=account&action=txlist&address=0x7f74475783a0c8586cc469d10b2f4afc280a0a08&sort=asc&page=1&offset=1000. That Coinbase Prime issues a deposit address per customer is the inference, not a measurement, and the killWhen is not met: none of the nine landed in another named entity's wallet
    Source

    How this row was graded

    Evidence class
    A, flow tie
    Confidence
    0.85 on a scale of 0 to 1
    What would promote it
    a fourth delivery through it into a proven AVAT wallet, or a filing exhibit naming it
    What would kill it
    a delivery through it landing in another named entity's wallet

    Promotion is a person's decision, and every promotion writes the re-runnable query into the evidence above.

    Open addressOpen in Snowscan (opens in a new tab)

  23. AVAT BitGo forwarder

    ProvenC-Chaindeposit-channel

    0x273c7127c9051620e7feda011567f1cc53264864

    Attribution
    Filed under Avalanche Treasury Corp (AVAT) as deposit-channel. Open entity
    Claim supported
    created by an internal call from BitGo wallet B at 20:26:25 UTC on 29 Sep 2025 and swept 2,906,285.1 AVAX out of the Coinbase Prime hot wallet into wallet B: 497,900 AVAX on 5 Oct 2025, 1,960,045 on 17 Nov 2025 and 448,340 on 18 Nov 2025, after a 0.1 AVAX rehearsal on 4 Oct 2025
    Evidence
    scratch/hunt/blue/CANDIDATES.md item 1: the createForwarder() call is transaction 0xb25384c602... from the signer 0x1705500d, and every sweep arrives in wallet B in the same transaction. Re-run: GET https://api.routescan.io/v2/network/mainnet/evm/43114/etherscan/api?module=account&action=txlistinternal&address=0x9862a32092c7bf61df1d36cbeaa2243c3c4a6802
    Source

    How this row was graded

    Evidence class
    A, flow tie

    Open addressOpen in Snowscan (opens in a new tab)

  24. AVAT BitGo export leg, 18 Nov 2025

    ProvenC-Chainpass-through

    0x5d78decde0d344c329c427905ef2789437bc2266

    Attribution
    Filed under Avalanche Treasury Corp (AVAT) as pass-through. Open entity
    Claim supported
    took 1,764,042 AVAX out of BitGo wallet B by sendMultiSig at 21:15:26 UTC and made one atomic export into the 2-of-3 key P-avax1yk6lq95cwwsmu8aw7yacm07xynp2202cq82v0c
    Evidence
    scratch/hunt/blue/CANDIDATES.md item 3: one sendMultiSig in, one atomic export out, nothing else in its life. Re-run: GET https://api.routescan.io/v2/network/mainnet/evm/43114/etherscan/api?module=account&action=txlist&address=0x5d78decde0d344c329c427905ef2789437bc2266&sort=asc
    Source

    How this row was graded

    Evidence class
    A, flow tie

    Open addressOpen in Snowscan (opens in a new tab)

  25. AVAT BitGo export leg, 19 Nov 2025

    ProvenC-Chainpass-through

    0xb061ccf0289d63696fe939457b7fd9e68200d5ef

    Attribution
    Filed under Avalanche Treasury Corp (AVAT) as pass-through. Open entity
    Claim supported
    took 448,340 AVAX out of BitGo wallet B by sendMultiSig at 16:04:45 UTC and made one atomic export into the 2-of-3 key P-avax1yk6lq95cwwsmu8aw7yacm07xynp2202cq82v0c
    Evidence
    scratch/hunt/blue/CANDIDATES.md item 3: one sendMultiSig in, one atomic export out, nothing else in its life. Re-run: GET https://api.routescan.io/v2/network/mainnet/evm/43114/etherscan/api?module=account&action=txlist&address=0xb061ccf0289d63696fe939457b7fd9e68200d5ef&sort=asc
    Source

    How this row was graded

    Evidence class
    A, flow tie

    Open addressOpen in Snowscan (opens in a new tab)

  26. AVAT third BitGo wallet, never used

    CandidateC-Chaincustody

    0x028811ddc744ebec8c9c98e6f3ca1a30c5bf70ea

    Attribution
    Filed under Avalanche Treasury Corp (AVAT) as custody. Open entity
    Claim supported
    created by the same signer at 19:37:57 UTC on 29 Sep 2025, 22 minutes 58 seconds before wallet B and in the same minute-scale batch; balance 0 and one row in its life
    Evidence
    scratch/hunt/blue/CANDIDATES.md item 6: same creator key, same creation batch as the two filed wallets, and nothing else. Re-run: GET https://api.routescan.io/v2/network/mainnet/evm/43114/etherscan/api?module=account&action=txlist&address=0x028811ddC744ebeC8C9c98e6F3ca1a30C5bF70Ea&sort=asc and eth_getBalance
    Source

    A candidate, and the tests on it

    Evidence class
    A, flow tie
    Confidence
    0.75 on a scale of 0 to 1
    What would promote it
    any inbound transfer, or any sendMultiSig out of it
    What would kill it
    a call to it from a signer other than 0x1705500d

    Promotion is a person's decision, and every promotion writes the re-runnable query into the evidence above.

    Open addressOpen in Snowscan (opens in a new tab)

  27. Owner of the second April 2026 stake

    Candidatevalidator-owner

    NodeID-3kUUeZB7umtaENekUfWxa1bxrAU2eq1AD

    Attribution
    Filed under Avalanche Treasury Corp (AVAT) as validator-owner. Open entity
    Claim supported
    nobody has read the key. 1,125,595 AVAX on NodeID-3kUUeZB7umtaENekUfWxa1bxrAU2eq1AD from 2026-04-02 21:40:46 to 2026-04-16 22:00:00 UTC, 55 seconds after the proven AVAT stake on P-avax1pgjtvez and ending at the same second; both nodes now carry AVAT's collateral keys
    Evidence
    Node continuity, evidence class D, is weak on its own here and the row does not rest on it. MEASURED: one private key unrelated to either company, P-avax1qtrykwgqkpj8c9wl93cymu6q9ffssyyu95q8wp, has delegated to NodeID-DVh35F3R11HAAxzeSTbk3eR9w2BzPrJQt since 2022-01-01 21:17:23 and to NodeID-3kUUeZB7umtaENekUfWxa1bxrAU2eq1AD since 2021-09-29 20:48:15, years before Avalanche Treasury Corp existed, and its automation re-delegated 130,455.60 AVAX twice on 2026-08-06 at a 100 percent fee that pays it nothing. These are rented commercial validators, so any node must be age-checked before its overlap is printed as corroboration (scratch/hunt/blue2/delegator-sweep.md section 5). The same read withdraws the claim that a 100 percent fee means no third party can delegate: that node reports delegatorCount 2 and delegatorWeight 260,911.20 AVAX. Re-run: POST https://avalanche-p-chain-rpc.publicnode.com platform.getCurrentValidators with the nodeID, then platform.getTx on the delegation's consumed UTXOs back through the key's own history. scratch/hunt/2026-09-16-NEXT-WALLETS.md section 2 and section 6 search 5. Node continuity and co-timing only, and the node is one of the two the private delegator above has used since 2021. Re-run: POST https://avalanche-p-chain-rpc.publicnode.com platform.getBlockByHeight around unix 1775166046 for the AddPermissionlessValidatorTx, read its owner, then GET https://data-api.avax.network/v1/networks/mainnet/blockchains/c-chain/transactions?addresses={owner}&pageSize=100 for the funder
    Source

    A candidate, and the tests on it

    Evidence class
    D, node or provider continuity
    Confidence
    0.60 on a scale of 0 to 1
    What would promote it
    the owner read from the block around unix 1775166046 and its funder resolved: a funder already on the trail gives inferred, a common-input co-spend with a registry key gives proven
    What would kill it
    that funder belonging to another named entity

    Promotion is a person's decision, and every promotion writes the re-runnable query into the evidence above.

    No address page: this identifier is not an Avalanche address.

Registry claims, address by address, with each claim's standing. 26 of 26 addresses read.

Wurrly Intel registry: compiled with this page.

Source: research address registry. 26 registry addresses for this subject, every one of them shown. 1 registry identifier shown as well: no address page answers for it.

Read method

Nothing here is a new claim. The registry is the research’s label sheet: an address enters it when a figure on one of the research pages established it, and it takes that figure’s standing. This card restates those rows; it does not add to them, and it never upgrades a standing.

Registry method states a review on 4 September 2026. That is the method’s assertion about the whole sheet rather than a date filed against any one row, so it is not copied into a record. A record the registry files no review date against says so.

A source link renders only where this application resolved the destination itself. The one destination the registry files per entity is the research article that entity is written up on, and it is labelled Related research rather than presented as the citation for an individual address’s figure. No anchor, filing URL or transaction hash is derived from evidence prose.

A candidate is a lead one tier below inferred, and it attributes nothing. Where the registry grades a row, the grade, the evidence class and the two tests are printed as the research wrote them, and a confidence appears only on a row that carries a number. A proven row prints no confidence and neither test: nobody measured a number for it, and a row already at the top standing has nothing written that would move it up or out. Promotion is a person's decision, and every promotion writes the re-runnable query into the evidence above.

An explorer link, where one is shown, is an inspection destination and not evidence of ownership. Snowscan reads the C-Chain and Avascan reads the P-Chain.