wurrly

CustodianInferred

Coinbase Custody Trust Company

30 registry addresses

Observed portfolio value

Reading balances

No successful balance read yet.

Nine single-key P-Chain vaults that stake in monthly cycles ending at midnight UTC on the last day of the month, at a 100 percent fee, each its own reward owner; their six C-Chain counterparts; the five C-Chain wallets that consolidated 4,060,687 AVAX on 9 June 2026 and delivered it to the treasury the next day; and three more wallets of the same family, two of which stake below the floor the block walk used. The cluster is matched to the filed quantity at three dates as a set, not key by key; that is an inference, and the filings call the figures approximate. Corrected 17 Sep 2026: this entry first said proven by filed quantity, and on this site proven means a match to the unit. The nine stakes match three filed dates by one method: 99.452 percent of the 8,329,871 AVAX filed at 31 December 2025, 99.458 percent of the 8,462,227 AVAX at 31 March 2026 and 98.854 percent of the 4,510,207 AVAX at 30 June 2026. Read instead as C-Chain balances at the filed instant, fourteen wallets give 99.9878 and 99.9779 percent at the two testable dates, gaps of 1,015.83 and 996.01 AVAX. No member is pinned on its own, and only the three cold wallets have their own flow tie. Who operates the batch stays an inference from those filed quantities: no filing prints an address. The same job stakes for other clients, and those keys are named here so nobody re-finds them as AVAT's. The full account is on the research pages.

Holdings

AVAX and the listed tokens, across the addresses in scopeThe price read has not finished. The quantities below are measured; USD values follow.24 h value change unavailable. No read returns a second valued endpoint 24 hours earlier.

Reading balances

Requested: Registered AVAX and liquid-staking balances. Returned coverage unavailable. Chains requested: C, P. 30 eligible addresses; none read yet.

Source: Avalanche C-Chain RPC, Wurrly Intel registry. No successful read yet.

Read method

Every figure is summed in exact decimal over one asset key at a time. A chain figure adds the priced holdings measured on that chain; an asset the price read could not answer for is left out of the sum, and the cell says how many were left out. A share is that chain figure over the summed priced holdings in the selected scope, divided at 60 decimal places and shown at two.

The P-Chain balance is one measurement for the whole owner group, so an address row on that chain shows the group note instead of a figure of its own. C-Chain AVAX and P-Chain AVAX are separate asset keys and are never added into one line.

No route this card reads returns a valued endpoint twenty-four hours back over the same addresses and assets, so the 24 h change is unavailable in every row. The price route’s own daily move is the AVAX market, which is a different measurement.

Balance history

History range
Display unit
Requested dates follow the read's own successful timestamp.Daily balance, rebuilt from returned transactions and anchored to the live balance

Reading balance history

Requested: C-Chain AVAX only, daily. Returned coverage unavailable. Chains requested: C. 30 eligible addresses; none read yet.

Source: Routescan, Wurrly Intel registry. No successful read yet.

Transaction count unavailable. Anchor time unavailable.

Current positions. Read time unavailable. Staking positions unavailable for this read.

Reading current staking positions

Read method

The series is rebuilt from the transactions the feeds return and then shifted so its last figure equals the live balance the node reported. The shift is the anchor adjustment, and the reach of the feeds behind it is stated above. Nothing is drawn before that shift is proved.

A day's figure is that UTC day's close: the balance after every movement dated that day.

Historical USD is each slot day's own final recorded close for AVAX, from Coinbase Exchange, joined on the UTC day. A day that has not finished has no close, and no other day's price stands in for it. The C-Chain and P-Chain AVAX are the same asset in that market, so both join the one AVAX close. Price join revision 2026-09-14.

Quantity coverage start unavailable.

Flows

Transfers summed by counterparty over the selected window
Flow window

Reading transfer history

Requested: External AVAX transfers of at least 1 AVAX, summed by counterparty. Returned coverage unavailable. Minimum transfer: 1 AVAX. Chains requested: C, P. 30 eligible addresses; none read yet.

Source: Routescan, Wurrly Intel registry. No successful read yet.

Read method

A trailing window is the interval from the read’s own time minus 30 periods of 24 hours up to that time. The start instant is excluded and the end instant is included, so two adjacent windows never both count the moment they share. Every figure in a trailing window is summed from the dated transfer rows the read returned, one row at a time, in exact decimal.

The returned history is the source’s own aggregate, summed over every row it read rather than over the rows it sent. It is never filtered by its first and last date to make a trailing total: a window that the returned rows cannot reach is reported as unavailable instead.

Inflow is AVAX this subject received and outflow is AVAX it sent. A movement with this subject on both sides is internal and is counted but never summed into an external total; a row with this subject on neither side is unmatched and is counted the same way. A row the feeds dated unreadably belongs to no trailing window, and the count of those is stated above.

Every amount on this card arrived from the source as a JavaScript number, so the sums are exact over the figures received and the received figures are not exact to the last digit of the chain. Each row’s Details says so beside the figure it applies to.

Transfers

Returned transfers, newest firstMinimum transfer: 1 AVAX

Reading transfer history

Requested: Returned AVAX transfers of at least 1 AVAX, newest first, including movements between the subject's own addresses. Returned coverage unavailable. Minimum transfer: 1 AVAX. Chains requested: C, P. 30 eligible addresses; none read yet.

Source: Routescan, Wurrly Intel registry. No successful read yet.

Read method

These are the transfers the flow read returned, newest first. The same request answers the card above: one read of the source, two measurements of it. Every row is at least 1 AVAX, because the source drops everything below that before it answers, and there are no token rows in it, so no token quantity is ever compared against the numeric 1 of another asset’s unit. A different threshold would need a source that reads to a different depth, which is not a setting on this page.

TRANSFERS shows every returned row, including movements between this subject’s own addresses, each marked Internal. A subject’s own P-Chain key counts as its own in both spellings, so a wallet moving value between its C-Chain and P-Chain sides is Internal rather than a pair of external flows to itself. INFLOW and OUTFLOW are external directions relative to this subject and exclude those rows, and they exclude rows with this subject on neither side and rows whose other endpoint is a chain rather than an address, which have no direction to sort into. CROSS-CHAIN holds the movements between two Avalanche chains: two endpoint chains that differ, or the atomic feed, which returns nothing else.

No pair identifier reaches this page, so a cross-chain export and its matching import are two rows with two amounts and two links. Nothing on this card adds them into one movement, and no figure here counts a pair once.

A historical USD value is that row’s own UTC day’s final closing price multiplied by its exact quantity. A day that has not finished has no close and says so; a day the price read did not return says so separately. Today’s price is never substituted for either.

Pages are windows on the frozen read named in the footer. A newer read landing while you are reading does not replace these rows; it offers itself at the top of the card, and adopting it returns to page 1.

Visualizer

Registry addresses as boxes, and the transfers the read observed between themRegistry addresses are grouped by role. Arrows show transfers returned by the selected read.A counterparty is the address or organisation on the other side of a transfer.

Coinbase Custody Trust Company. Reading transfers

Visualizer view

Coinbase Custody Trust Company: registry addresses by role, and the transfers this read observed between them20 boxes and no arrows. Transfer coverage is being read.Custody8 addresses shown of 13 addressestreasury, vaults, signersWorking3 addressesstaging, pass-throughs, forwardersStaking8 addresses shown of 13 addressesvalidator owners, P-Chain keys, protoco…Exits1 addressdeposit addresses, exchanges, sinksCoinbase Custody cold w…custody · C-Chain · Inferred0x8de2…a142Coinbase Custody cold w…custody · C-Chain · Inferred0x628e…a791Coinbase Custody cold w…custody · C-Chain · Inferred0x720e…8f35Coinbase Custody satell…custody · C-Chain · Inferred0xb524…3eb7Coinbase Custody satell…custody · C-Chain · Inferred0x9738…e2f9C-Chain side of the oth…custody · C-Chain · Unattri…0xa0b2…3100Coinbase Custody batch …vault · C-Chain · Inferred0x1c90…e417Coinbase Custody batch …vault · C-Chain · Inferred0x4d87…d0ccPayer of the 909,000.00…other · C-Chain · Candidate0x37df…50b8Payer of the 909,000.00…other · C-Chain · Candidate0x273a…61d7Payer of the 909,000.00…other · C-Chain · Candidate0xd91b…c61dCoinbase Custody batch …validator-owner · P-Chain ·…P-avax1ahc3…xjnjjaCoinbase Custody batch …validator-owner · P-Chain ·…P-avax1fdlv…geds7jCoinbase Custody batch …validator-owner · P-Chain ·…P-avax1px56…82dgsgCoinbase Custody batch …validator-owner · P-Chain ·…P-avax1xped…2mkcwaCoinbase Custody batch …validator-owner · P-Chain ·…P-avax1lhew…f39zmdCoinbase Custody batch …validator-owner · P-Chain ·…P-avax175jv…kwlqwmCoinbase Custody batch …validator-owner · P-Chain ·…P-avax1wyd5…djs8t2Coinbase Custody batch …validator-owner · P-Chain ·…P-avax1gd8j…6890y8Family indexfamily · C-Chain · Inferred0xc9ce…ae53

Select an address to read its identity and observed transfers.

Registry addresses in scope, with each one's role. 30 of 30 addresses read.

Wurrly Intel registry: compiled with this page.

Reading transfers. Transfer coverage is being read.

No transfer read has answered for this scope.

Read method

The boxes are the registry’s own rows, placed by the role the research gave each one: custody first, the working wallets next, the staking and protocol keys, then the exits. Whoever was on the other side of a returned transfer joins an outer column, on the right when this subject paid them and on the left when they only paid in. Grouping is not attribution: a box is named only where the registry names it.

Arrows are the transfers this read returned, summed by pair, asset, chain and kind. Two assets between one pair of boxes are two arrows, never one; a token quantity is never added to an AVAX total and never takes the AVAX reporting threshold. Reverse directions stay apart. A sum is labelled At least only where the source states the depth it reports to and says its coverage was partial; otherwise it is labelled Observed, which is still scoped to this request.

An endpoint the feed left as a chain rather than an address is not a counterparty, so no arrow is drawn to it and the count of transfers that were excluded for that reason is stated in the scope line above.

A column of more than 8 addresses folds its tail behind one control. Folding changes the drawing and nothing else: Connections still lists every canonical relationship, and any movement whose two ends fold into one box is kept as that group’s own internal subtotal, so the arrows plus the subtotals still add up to the same per-asset totals.

Proven: a filed quantity matched to the unit, or a transaction identified by its hash. Inferred: behaviour or timing, with the base rate stated in the source. Candidate: a lead, one tier below inferred, with a written test for promoting it and a written test for killing it. Explorer tag: an explorer's attribution label. Standing describes the cited claim. A transfer alone does not establish ownership.

Minimum transfer: 1 AVAX.

Evidence

Registry claims, address by address, with each claim's standing32 registry addresses.

Proven: a filed quantity matched to the unit, or a transaction identified by its hash. Inferred: behaviour or timing, with the base rate stated in the source. Candidate: a lead, one tier below inferred, with a written test for promoting it and a written test for killing it. Explorer tag: an explorer's attribution label. Unattributed: no ownership attribution is established in the registry. Standing describes the cited claim. A transfer alone does not establish ownership.

Evidence class: A flow tie, B co-signature or shared infrastructure, C filed-quantity match, D node or provider continuity, E adjacency.

Registry method states a review on 4 September 2026. No record states a review date of its own.

  1. Coinbase Custody cold wallet 0x8de2cf20

    InferredC-Chaincustody

    0x8de2cf20044bcef9067d38dd086410334616a142

    Attribution
    Filed under Coinbase Custody Trust Company as custody. Open entity
    Claim supported
    took the five-wallet consolidation between 18:36:02 and 18:47:03 UTC on 9 Jun 2026 and paid 4,060,686.5278 AVAX to the Coinbase Prime deposit address 0x7f744757 at 15:42:01 UTC on 10 Jun 2026, 80 minutes before the treasury was credited 4,060,744.2591 AVAX; 1,505,055.0647 AVAX at block 74,824,633
    Evidence
    scratch/hunt/blue/coinbase-custody.md: class A through one omnibus hop, the Coinbase Prime hot wallet, and a same-date fit inside the December custodian figure. Re-run: GET https://api.routescan.io/v2/network/mainnet/evm/43114/etherscan/api?module=account&action=txlist&address=0x8de2cf20044bcef9067d38dd086410334616a142&sort=asc, then eth_getBalance against https://avalanche.drpc.org at blocks 74,824,633 and 89,166,730
    Source
    Related research: source destination unavailable.

    How this row was graded

    Evidence class
    A, flow tie
    Confidence
    0.80 on a scale of 0 to 1
    Customer
    AVAT
    What would promote it
    its 31 Dec 2025 balance found inside a Q1 10-Q or 10-K custodian figure to the unit, or the whole batch passing the C-Chain-counterpart test
    What would kill it
    the 10 Jun 2026 delivery shown to be pooled from several Coinbase Prime clients

    Promotion is a person's decision, and every promotion writes the re-runnable query into the evidence above.

    Open addressOpen in Snowscan (opens in a new tab)

  2. Coinbase Custody cold wallet 0x628eef4d

    InferredC-Chaincustody

    0x628eef4de1b5d6db3fa183b6ce9d3a5f28c4a791

    Attribution
    Filed under Coinbase Custody Trust Company as custody. Open entity
    Claim supported
    sent 1,245,363.0931 AVAX into the consolidation at 18:42:01 UTC on 9 Jun 2026; its 1 Jan 2026 stake rose 65,510.1791 AVAX over its own 31 Dec 2025 balance, the amount the two satellite wallets held at block 74,824,633
    Evidence
    scratch/hunt/blue/coinbase-custody.md and custody-batch.md: class A into the consolidation, class C on the December sum, class D on node continuity. Re-run: GET https://api.routescan.io/v2/network/mainnet/evm/43114/etherscan/api?module=account&action=txlist&address=0x628eef4de1b5d6db3fa183b6ce9d3a5f28c4a791&sort=asc
    Source
    Related research: source destination unavailable.

    How this row was graded

    Evidence class
    A, flow tie
    Confidence
    0.80 on a scale of 0 to 1
    Customer
    AVAT
    What would promote it
    its 31 Dec 2025 balance found inside a Q1 10-Q or 10-K custodian figure to the unit, or the whole batch passing the C-Chain-counterpart test
    What would kill it
    the 10 Jun 2026 delivery shown to be pooled from several Coinbase Prime clients

    Promotion is a person's decision, and every promotion writes the re-runnable query into the evidence above.

    Open addressOpen in Snowscan (opens in a new tab)

  3. Coinbase Custody cold wallet 0x720efa4a

    InferredC-Chaincustody

    0x720efa4a6193f1d25234674f8b041009c2608f35

    Attribution
    Filed under Coinbase Custody Trust Company as custody. Open entity
    Claim supported
    sent 1,259,388.6891 AVAX into the consolidation at 18:47:03 UTC on 9 Jun 2026; it held 483,923.9955 AVAX at 16 Sep 2026, and that refill is six payments and nothing else, all six payers the six C-Chain vaults of the batch. The refill is no longer a separate question at 0.35: it is accounted to the unit and carries this row's grade
    Evidence
    scratch/hunt/blue/coinbase-custody.md: class A into the consolidation, class C on the December sum, class D on NodeID-4gp6z23DrgtRKN3Z8PEmac7drgVxHmdQR, the node this wallet's P key staked from Oct 2025 to Apr 2026 and AVAT's treasury key used from 17 Jul to 6 Aug 2026; platform.getCurrentValidators returns no validator on that node at the 16 Sep 2026 read. The refill: scratch/hunt/blue2/batch-counterparts.md section 4 and deposit-provenance.md section 4 read every inbound row and find six, all from the six vaults, including P-avax1gd8jekz's 100,068.3557 AVAX on 2 Jul 2026 and P-avax1j9tgjlu's 146,175.6398 AVAX on 3 Aug 2026, which is where the 245,623 AVAX left by the two keys that stopped validating went. Re-run: GET https://api.routescan.io/v2/network/mainnet/evm/43114/etherscan/api?module=account&action=txlist&address=0x720efa4a6193f1d25234674f8b041009c2608f35&sort=desc and check every payer against the six vaults. Node continuity, evidence class D, is weak on its own here and the row does not rest on it. MEASURED: one private key unrelated to either company, P-avax1qtrykwgqkpj8c9wl93cymu6q9ffssyyu95q8wp, has delegated to NodeID-DVh35F3R11HAAxzeSTbk3eR9w2BzPrJQt since 2022-01-01 21:17:23 and to NodeID-3kUUeZB7umtaENekUfWxa1bxrAU2eq1AD since 2021-09-29 20:48:15, years before Avalanche Treasury Corp existed, and its automation re-delegated 130,455.60 AVAX twice on 2026-08-06 at a 100 percent fee that pays it nothing. These are rented commercial validators, so any node must be age-checked before its overlap is printed as corroboration (scratch/hunt/blue2/delegator-sweep.md section 5). The same read withdraws the claim that a 100 percent fee means no third party can delegate: that node reports delegatorCount 2 and delegatorWeight 260,911.20 AVAX. Re-run: POST https://avalanche-p-chain-rpc.publicnode.com platform.getCurrentValidators with the nodeID, then platform.getTx on the delegation's consumed UTXOs back through the key's own history.
    Source
    Related research: source destination unavailable.

    How this row was graded

    Evidence class
    A, flow tie
    Confidence
    0.80 on a scale of 0 to 1
    Customer
    AVAT
    What would promote it
    its 31 Dec 2025 balance found inside a Q1 10-Q or 10-K custodian figure to the unit, or the whole batch passing the C-Chain-counterpart test
    What would kill it
    the 10 Jun 2026 delivery shown to be pooled from several Coinbase Prime clients

    Promotion is a person's decision, and every promotion writes the re-runnable query into the evidence above.

    Open addressOpen in Snowscan (opens in a new tab)

  4. Coinbase Custody satellite wallet 0xb5244a69

    InferredC-Chaincustody

    0xb5244a69813ffa75f8218011c582b9b88a923eb7

    Attribution
    Filed under Coinbase Custody Trust Company as custody. Open entity
    Claim supported
    sent 18,253.2760 AVAX into the consolidation of 9 Jun 2026; 50,070.6990 AVAX at block 74,824,633, which with 0x97387b9b accounts for the 65,510.1791 AVAX rise in 0x628eef4d's 1 Jan 2026 stake to 0.0001 AVAX
    Evidence
    scratch/hunt/blue/coinbase-custody.md and scratch/hunt/blue2/batch-counterparts.md section 7: no longer an arithmetic tie only. The transfer the arithmetic implied was read: this wallet paid 0x628eef4d 50,070.6990 AVAX at 17:46:10 UTC on 1 Jan 2026 and 0x97387b9b paid it 15,439.4800 AVAX at 17:34:02, 74 and 86 minutes before that wallet staked 1,122,679.6561 AVAX. With the two satellites in, the five December balances sum to 3,347,208.4909 AVAX and the three January stakes sum to the same figure; the three cold wallets alone are 3,281,698.31. Re-run: eth_getBalance against https://avalanche.drpc.org at block 74,824,633, then GET https://api.routescan.io/v2/network/mainnet/evm/43114/etherscan/api?module=account&action=txlist&address=0x628eef4de1b5d6db3fa183b6ce9d3a5f28c4a791&sort=asc for the two 1 Jan 2026 payments
    Source
    Related research: source destination unavailable.

    How this row was graded

    Evidence class
    A, flow tie
    Confidence
    0.75 on a scale of 0 to 1
    Customer
    AVAT
    What would promote it
    met: the 1 Jan 2026 transfer to 0x628eef4d is read. The row stays inferred because no member of the batch is pinned on its own
    What would kill it
    an outflow from it to a wallet tied to another named entity

    Promotion is a person's decision, and every promotion writes the re-runnable query into the evidence above.

    Open addressOpen in Snowscan (opens in a new tab)

  5. Coinbase Custody satellite wallet 0x97387b9b

    InferredC-Chaincustody

    0x97387b9b292add0317c615d97f1f15dd408ee2f9

    Attribution
    Filed under Coinbase Custody Trust Company as custody. Open entity
    Claim supported
    sent 11,177.6401 AVAX into the consolidation of 9 Jun 2026 and is still live: 5,615.0000 AVAX at block 89,166,730, a payment to the Prime deposit address 0x7f744757 on 1 Jul 2026, and 19,700.72 AVAX at 16 Sep 2026
    Evidence
    scratch/hunt/blue/coinbase-custody.md and scratch/hunt/blue2/batch-counterparts.md section 7: no longer an arithmetic tie only. It paid 0x628eef4d 15,439.4800 AVAX at 17:34:02 UTC on 1 Jan 2026 and 0xb5244a69 paid 50,070.6990 at 17:46:10, which is the 65,510.1791 AVAX rise in that wallet's 1 Jan 2026 stake. It also paid 12,689.2100 AVAX into 0x628eef4d in the 1 Apr 2026 rebalance. Re-run: eth_getBalance against https://avalanche.drpc.org at blocks 74,824,633 and 89,166,730, then GET https://api.routescan.io/v2/network/mainnet/evm/43114/etherscan/api?module=account&action=txlist&address=0x628eef4de1b5d6db3fa183b6ce9d3a5f28c4a791&sort=asc
    Source
    Related research: source destination unavailable.

    How this row was graded

    Evidence class
    A, flow tie
    Confidence
    0.70 on a scale of 0 to 1
    Customer
    AVAT
    What would promote it
    met: the 1 Jan 2026 transfer to 0x628eef4d is read. The row stays inferred because no member of the batch is pinned on its own
    What would kill it
    an outflow from it to a wallet tied to another named entity

    Promotion is a person's decision, and every promotion writes the re-runnable query into the evidence above.

    Open addressOpen in Snowscan (opens in a new tab)

  6. Coinbase Custody batch key of 0x8de2cf20

    InferredP-Chainvalidator-owner

    P-avax1ahc32g2x340g2r09m2u4vv7lcr6lsqhdxjnjja

    Attribution
    Filed under Coinbase Custody Trust Company as validator-owner. Open entity
    Claim supported
    staked 1,505,055.0647 AVAX on NodeID-Cgdu1GhrbwSD4x3vRTp9fFe3sitWckyPD at 17:41:05 UTC on 1 Jan 2026 to 31 Jan, one of five monthly cycles on that node between Nov 2025 and Apr 2026; the same node carries AVAT's 9 Sep 2026 validator key P-avax1qjukw4p
    Evidence
    scratch/hunt/blue/custody-batch.md: a walk of 10,670 P-Chain blocks with platform.getBlockByHeight over three windows found nine AddPermissionlessValidatorTx of 100,000 AVAX or more in the 1 Jan 2026 re-stake window sharing one fingerprint: a 100 percent delegation fee, a threshold-1 reward owner equal to the staking key, and an end at an exact month-end 00:00:00 UTC. Three walks of the same 68,196 blocks by two sessions return those nine and no tenth. The cluster is now matched to filed quantities at three dates by that one method: the nine stakes sum to 8,284,248.39 AVAX against the 8,329,871 AVAX filed at Coinbase Custody at 31 Dec 2025, which is 99.452 percent; 8,416,336.28 AVAX against the 8,462,227 AVAX in the 424B3 at 31 Mar 2026, which is 99.458 percent; and six of the nine exported to the C-Chain between 00:08:02 and 00:09:05 UTC on 30 Jun 2026 summing 4,458,518.01 AVAX against the 4,510,207 AVAX filed at 30 Jun 2026, which is 98.854 percent. On the refined fourteen-wallet set, read as C-Chain balances at the filed instant itself, the two testable dates read 99.9878 percent (gap 1,015.83 AVAX) and 99.9779 percent (gap 996.01 AVAX). The cluster is matched to the filed quantity at three dates as a set, which is an inference and not a proof: the tie to this key is collective and arithmetic, not a flow, and no member is pinned on its own. The June 98.854 percent is a subset-sum fit from a 63-second export window, which cannot see a stake that spans the filed instant; at least four fingerprint keys held 1,647,622 AVAX across 30 Jun 2026 and are excluded by quantity alone (scratch/hunt/blue2/SEARCHES-2.md sections 2.1 and 2.2, from tenth-member.md and batch-counterparts.md). Re-run: POST https://avalanche-p-chain-rpc.publicnode.com platform.getBlockByHeight across 23:30 to 01:30 UTC around each month end, then GET https://data-api.avax.network/v1/networks/mainnet/blockchains/p-chain/transactions?addresses={key}&pageSize=100 (glacier-api.avax.network answers 429 to unkeyed callers; data-api serves the same routes). Node continuity, evidence class D, is weak on its own here and the row does not rest on it. MEASURED: one private key unrelated to either company, P-avax1qtrykwgqkpj8c9wl93cymu6q9ffssyyu95q8wp, has delegated to NodeID-DVh35F3R11HAAxzeSTbk3eR9w2BzPrJQt since 2022-01-01 21:17:23 and to NodeID-3kUUeZB7umtaENekUfWxa1bxrAU2eq1AD since 2021-09-29 20:48:15, years before Avalanche Treasury Corp existed, and its automation re-delegated 130,455.60 AVAX twice on 2026-08-06 at a 100 percent fee that pays it nothing. These are rented commercial validators, so any node must be age-checked before its overlap is printed as corroboration (scratch/hunt/blue2/delegator-sweep.md section 5). The same read withdraws the claim that a 100 percent fee means no third party can delegate: that node reports delegatorCount 2 and delegatorWeight 260,911.20 AVAX. Re-run: POST https://avalanche-p-chain-rpc.publicnode.com platform.getCurrentValidators with the nodeID, then platform.getTx on the delegation's consumed UTXOs back through the key's own history.
    Source
    Related research: source destination unavailable.

    How this row was graded

    Evidence class
    A, flow tie
    Confidence
    0.80 on a scale of 0 to 1
    Customer
    AVAT
    What would promote it
    its 31 Dec 2025 balance found inside a Q1 10-Q or 10-K custodian figure to the unit, or the whole batch passing the C-Chain-counterpart test
    What would kill it
    the 10 Jun 2026 delivery shown to be pooled from several Coinbase Prime clients

    Promotion is a person's decision, and every promotion writes the re-runnable query into the evidence above.

    Open addressOpen in Avascan (opens in a new tab)

  7. Coinbase Custody batch key of 0x628eef4d

    InferredP-Chainvalidator-owner

    P-avax1fdlvwr4zjl9kd6r4rtppqnlunvct7x97geds7j

    Attribution
    Filed under Coinbase Custody Trust Company as validator-owner. Open entity
    Claim supported
    staked 1,122,679.6561 AVAX on NodeID-C5sarWUtC3rB3YEt9cnjK7NWMT4fZ9AH8 at 19:00:09 UTC on 1 Jan 2026, having closed the previous cycle with an export of 1,057,169.5770 AVAX at 00:47:07 UTC on 30 Dec 2025, 2 days and 18 hours earlier
    Evidence
    scratch/hunt/blue/custody-batch.md: a walk of 10,670 P-Chain blocks with platform.getBlockByHeight over three windows found nine AddPermissionlessValidatorTx of 100,000 AVAX or more in the 1 Jan 2026 re-stake window sharing one fingerprint: a 100 percent delegation fee, a threshold-1 reward owner equal to the staking key, and an end at an exact month-end 00:00:00 UTC. Three walks of the same 68,196 blocks by two sessions return those nine and no tenth. The cluster is now matched to filed quantities at three dates by that one method: the nine stakes sum to 8,284,248.39 AVAX against the 8,329,871 AVAX filed at Coinbase Custody at 31 Dec 2025, which is 99.452 percent; 8,416,336.28 AVAX against the 8,462,227 AVAX in the 424B3 at 31 Mar 2026, which is 99.458 percent; and six of the nine exported to the C-Chain between 00:08:02 and 00:09:05 UTC on 30 Jun 2026 summing 4,458,518.01 AVAX against the 4,510,207 AVAX filed at 30 Jun 2026, which is 98.854 percent. On the refined fourteen-wallet set, read as C-Chain balances at the filed instant itself, the two testable dates read 99.9878 percent (gap 1,015.83 AVAX) and 99.9779 percent (gap 996.01 AVAX). The cluster is matched to the filed quantity at three dates as a set, which is an inference and not a proof: the tie to this key is collective and arithmetic, not a flow, and no member is pinned on its own. The June 98.854 percent is a subset-sum fit from a 63-second export window, which cannot see a stake that spans the filed instant; at least four fingerprint keys held 1,647,622 AVAX across 30 Jun 2026 and are excluded by quantity alone (scratch/hunt/blue2/SEARCHES-2.md sections 2.1 and 2.2, from tenth-member.md and batch-counterparts.md). Re-run: POST https://avalanche-p-chain-rpc.publicnode.com platform.getBlockByHeight across 23:30 to 01:30 UTC around each month end, then GET https://data-api.avax.network/v1/networks/mainnet/blockchains/p-chain/transactions?addresses={key}&pageSize=100 (glacier-api.avax.network answers 429 to unkeyed callers; data-api serves the same routes).
    Source
    Related research: source destination unavailable.

    How this row was graded

    Evidence class
    A, flow tie
    Confidence
    0.80 on a scale of 0 to 1
    Customer
    AVAT
    What would promote it
    its 31 Dec 2025 balance found inside a Q1 10-Q or 10-K custodian figure to the unit, or the whole batch passing the C-Chain-counterpart test
    What would kill it
    the 10 Jun 2026 delivery shown to be pooled from several Coinbase Prime clients

    Promotion is a person's decision, and every promotion writes the re-runnable query into the evidence above.

    Open addressOpen in Avascan (opens in a new tab)

  8. Coinbase Custody batch key of 0x720efa4a

    InferredP-Chainvalidator-owner

    P-avax1px56m7z0sugl45pj8ykt3uyx2wfw80rm82dgsg

    Attribution
    Filed under Coinbase Custody Trust Company as validator-owner. Open entity
    Claim supported
    staked 719,473.7702 AVAX on NodeID-4gp6z23DrgtRKN3Z8PEmac7drgVxHmdQR at 17:53:04 UTC on 1 Jan 2026, the node AVAT's treasury key validated from 17 Jul to 6 Aug 2026 and AVAT validator 2 validated until 13 Sep 2026; nothing is validating on it at the 16 Sep 2026 read
    Evidence
    scratch/hunt/blue/custody-batch.md: a walk of 10,670 P-Chain blocks with platform.getBlockByHeight over three windows found nine AddPermissionlessValidatorTx of 100,000 AVAX or more in the 1 Jan 2026 re-stake window sharing one fingerprint: a 100 percent delegation fee, a threshold-1 reward owner equal to the staking key, and an end at an exact month-end 00:00:00 UTC. Three walks of the same 68,196 blocks by two sessions return those nine and no tenth. The cluster is now matched to filed quantities at three dates by that one method: the nine stakes sum to 8,284,248.39 AVAX against the 8,329,871 AVAX filed at Coinbase Custody at 31 Dec 2025, which is 99.452 percent; 8,416,336.28 AVAX against the 8,462,227 AVAX in the 424B3 at 31 Mar 2026, which is 99.458 percent; and six of the nine exported to the C-Chain between 00:08:02 and 00:09:05 UTC on 30 Jun 2026 summing 4,458,518.01 AVAX against the 4,510,207 AVAX filed at 30 Jun 2026, which is 98.854 percent. On the refined fourteen-wallet set, read as C-Chain balances at the filed instant itself, the two testable dates read 99.9878 percent (gap 1,015.83 AVAX) and 99.9779 percent (gap 996.01 AVAX). The cluster is matched to the filed quantity at three dates as a set, which is an inference and not a proof: the tie to this key is collective and arithmetic, not a flow, and no member is pinned on its own. The June 98.854 percent is a subset-sum fit from a 63-second export window, which cannot see a stake that spans the filed instant; at least four fingerprint keys held 1,647,622 AVAX across 30 Jun 2026 and are excluded by quantity alone (scratch/hunt/blue2/SEARCHES-2.md sections 2.1 and 2.2, from tenth-member.md and batch-counterparts.md). Re-run: POST https://avalanche-p-chain-rpc.publicnode.com platform.getBlockByHeight across 23:30 to 01:30 UTC around each month end, then GET https://data-api.avax.network/v1/networks/mainnet/blockchains/p-chain/transactions?addresses={key}&pageSize=100 (glacier-api.avax.network answers 429 to unkeyed callers; data-api serves the same routes).
    Source
    Related research: source destination unavailable.

    How this row was graded

    Evidence class
    A, flow tie
    Confidence
    0.80 on a scale of 0 to 1
    Customer
    AVAT
    What would promote it
    its 31 Dec 2025 balance found inside a Q1 10-Q or 10-K custodian figure to the unit, or the whole batch passing the C-Chain-counterpart test
    What would kill it
    the 10 Jun 2026 delivery shown to be pooled from several Coinbase Prime clients

    Promotion is a person's decision, and every promotion writes the re-runnable query into the evidence above.

    Open addressOpen in Avascan (opens in a new tab)

  9. Coinbase Custody batch key, largest member

    InferredP-Chainvalidator-owner

    P-avax1xpedzqexwkzjhuj4dp5dcmc0nvphvwld2mkcwa

    Attribution
    Filed under Coinbase Custody Trust Company as validator-owner. Open entity
    Claim supported
    staked 2,524,680.76 AVAX on 1 Jan 2026, exported 2,534,260.22 AVAX at 00:08:02 UTC on 30 Jun 2026, and had 2,500,060 AVAX on NodeID-DVh35F3R11HAAxzeSTbk3eR9w2BzPrJQt to 25 Sep 2026 00:00:00 UTC at the 16 Sep read. AVAT's BitGo-era key P-avax1r2jcftp ran five validation periods on that same full node ID between 3 Nov 2025 and 15 Apr 2026, the third node shared with the trail after NodeID-Cgdu1Ghr and NodeID-F5Ecwd5q. Nodes are rented and serve many customers, so a shared node corroborates and does not prove
    Evidence
    scratch/hunt/blue/custody-batch.md: a walk of 10,670 P-Chain blocks with platform.getBlockByHeight over three windows found nine AddPermissionlessValidatorTx of 100,000 AVAX or more in the 1 Jan 2026 re-stake window sharing one fingerprint: a 100 percent delegation fee, a threshold-1 reward owner equal to the staking key, and an end at an exact month-end 00:00:00 UTC. Three walks of the same 68,196 blocks by two sessions return those nine and no tenth. The cluster is now matched to filed quantities at three dates by that one method: the nine stakes sum to 8,284,248.39 AVAX against the 8,329,871 AVAX filed at Coinbase Custody at 31 Dec 2025, which is 99.452 percent; 8,416,336.28 AVAX against the 8,462,227 AVAX in the 424B3 at 31 Mar 2026, which is 99.458 percent; and six of the nine exported to the C-Chain between 00:08:02 and 00:09:05 UTC on 30 Jun 2026 summing 4,458,518.01 AVAX against the 4,510,207 AVAX filed at 30 Jun 2026, which is 98.854 percent. On the refined fourteen-wallet set, read as C-Chain balances at the filed instant itself, the two testable dates read 99.9878 percent (gap 1,015.83 AVAX) and 99.9779 percent (gap 996.01 AVAX). The cluster is matched to the filed quantity at three dates as a set, which is an inference and not a proof: the tie to this key is collective and arithmetic, not a flow, and no member is pinned on its own. The June 98.854 percent is a subset-sum fit from a 63-second export window, which cannot see a stake that spans the filed instant; at least four fingerprint keys held 1,647,622 AVAX across 30 Jun 2026 and are excluded by quantity alone (scratch/hunt/blue2/SEARCHES-2.md sections 2.1 and 2.2, from tenth-member.md and batch-counterparts.md). Re-run: POST https://avalanche-p-chain-rpc.publicnode.com platform.getBlockByHeight across 23:30 to 01:30 UTC around each month end, then GET https://data-api.avax.network/v1/networks/mainnet/blockchains/p-chain/transactions?addresses={key}&pageSize=100 (glacier-api.avax.network answers 429 to unkeyed callers; data-api serves the same routes). The eight-character node prefix the merge held back was confirmed on 16 Sep 2026 from both sides. POST https://avalanche-p-chain-rpc.publicnode.com platform.getCurrentValidators with nodeIDs NodeID-DVh35F3R11HAAxzeSTbk3eR9w2BzPrJQt returns this key as the threshold-1 reward owner of 2,500,060.1177 AVAX ending 2026-09-25 00:00:00 UTC, and GET https://data-api.avax.network/v1/networks/mainnet/blockchains/p-chain/transactions?addresses=P-avax1r2jcftpt0tz6l0wlx4qsc8jqd90kvk7hy997qp&pageSize=100 returns 39 transactions across eleven node IDs, five of them validation periods on that same full node ID between 2025-11-03 22:21:51 and 2026-04-15 16:48:17 UTC. The Glacier host answers 429 for unkeyed callers; data-api.avax.network serves the same route. Node continuity, evidence class D, is weak on its own here and the row does not rest on it. MEASURED: one private key unrelated to either company, P-avax1qtrykwgqkpj8c9wl93cymu6q9ffssyyu95q8wp, has delegated to NodeID-DVh35F3R11HAAxzeSTbk3eR9w2BzPrJQt since 2022-01-01 21:17:23 and to NodeID-3kUUeZB7umtaENekUfWxa1bxrAU2eq1AD since 2021-09-29 20:48:15, years before Avalanche Treasury Corp existed, and its automation re-delegated 130,455.60 AVAX twice on 2026-08-06 at a 100 percent fee that pays it nothing. These are rented commercial validators, so any node must be age-checked before its overlap is printed as corroboration (scratch/hunt/blue2/delegator-sweep.md section 5). The same read withdraws the claim that a 100 percent fee means no third party can delegate: that node reports delegatorCount 2 and delegatorWeight 260,911.20 AVAX. Re-run: POST https://avalanche-p-chain-rpc.publicnode.com platform.getCurrentValidators with the nodeID, then platform.getTx on the delegation's consumed UTXOs back through the key's own history. Its C-Chain counterpart is 0x1c90D5440c0E768CF7Ed984770E0D51A6fe8E417 (scratch/hunt/blue2/batch-counterparts.md section 1).
    Source
    Related research: source destination unavailable.

    How this row was graded

    Evidence class
    C, filed-quantity match
    Confidence
    0.75 on a scale of 0 to 1
    Customer
    AVAT
    What would promote it
    met three ways on two chains, and the row still does not stand alone. The December departure the condition asked for is ExportTx in P-Chain block 23,988,236 at 2025-12-31 00:52:05 UTC for 2,524,680.8611 AVAX, threshold 1 to the C-Chain; the C-Chain ImportTx is block 74,763,695 at 00:55:04 for 2,524,680.7611; and eth_getBalance on the counterpart 0x1c90D544 at block 74,824,633 returns the identical figure, so the money sat on the C-Chain through the filed instant. No individual batch key is pinned on its own, so the cluster's collective grade stands
    What would kill it
    a tenth fingerprint-matching stake of real size in the un-walked hours of 1 Jan 2026, or the C-Chain counterpart failing the two block tests

    Promotion is a person's decision, and every promotion writes the re-runnable query into the evidence above.

    Open addressOpen in Avascan (opens in a new tab)

  10. Coinbase Custody batch key on NodeID-8QDaNCzY

    InferredP-Chainvalidator-owner

    P-avax1lhewhmafsejpyj5dt2crtvnpculex5vhf39zmd

    Attribution
    Filed under Coinbase Custody Trust Company as validator-owner. Open entity
    Claim supported
    staked 1,170,222.30 AVAX on 1 Jan 2026, exported 1,174,845.07 AVAX at 00:09:05 UTC on 30 Jun 2026, and had 1,158,985 AVAX on NodeID-8QDaNCzYhAPBE5ZPQbXwPpQphyftWCMrK to 25 Sep 2026 at the 16 Sep read
    Evidence
    scratch/hunt/blue/custody-batch.md: a walk of 10,670 P-Chain blocks with platform.getBlockByHeight over three windows found nine AddPermissionlessValidatorTx of 100,000 AVAX or more in the 1 Jan 2026 re-stake window sharing one fingerprint: a 100 percent delegation fee, a threshold-1 reward owner equal to the staking key, and an end at an exact month-end 00:00:00 UTC. Three walks of the same 68,196 blocks by two sessions return those nine and no tenth. The cluster is now matched to filed quantities at three dates by that one method: the nine stakes sum to 8,284,248.39 AVAX against the 8,329,871 AVAX filed at Coinbase Custody at 31 Dec 2025, which is 99.452 percent; 8,416,336.28 AVAX against the 8,462,227 AVAX in the 424B3 at 31 Mar 2026, which is 99.458 percent; and six of the nine exported to the C-Chain between 00:08:02 and 00:09:05 UTC on 30 Jun 2026 summing 4,458,518.01 AVAX against the 4,510,207 AVAX filed at 30 Jun 2026, which is 98.854 percent. On the refined fourteen-wallet set, read as C-Chain balances at the filed instant itself, the two testable dates read 99.9878 percent (gap 1,015.83 AVAX) and 99.9779 percent (gap 996.01 AVAX). The cluster is matched to the filed quantity at three dates as a set, which is an inference and not a proof: the tie to this key is collective and arithmetic, not a flow, and no member is pinned on its own. The June 98.854 percent is a subset-sum fit from a 63-second export window, which cannot see a stake that spans the filed instant; at least four fingerprint keys held 1,647,622 AVAX across 30 Jun 2026 and are excluded by quantity alone (scratch/hunt/blue2/SEARCHES-2.md sections 2.1 and 2.2, from tenth-member.md and batch-counterparts.md). Re-run: POST https://avalanche-p-chain-rpc.publicnode.com platform.getBlockByHeight across 23:30 to 01:30 UTC around each month end, then GET https://data-api.avax.network/v1/networks/mainnet/blockchains/p-chain/transactions?addresses={key}&pageSize=100 (glacier-api.avax.network answers 429 to unkeyed callers; data-api serves the same routes). Its C-Chain counterpart is 0x4d8708374a1Dc42126534Ba989C796313c0fD0cc, which held 1,170,222.3006 AVAX at block 74,824,633 and 1,174,844.9725 AVAX at block 89,166,730 (scratch/hunt/blue2/batch-counterparts.md sections 1 and 2).
    Source
    Related research: source destination unavailable.

    How this row was graded

    Evidence class
    C, filed-quantity match
    Confidence
    0.75 on a scale of 0 to 1
    Customer
    AVAT
    What would promote it
    its C-Chain counterpart found through the evmOutputs of the 30 Jun 2026 ImportTx and read with eth_getBalance against https://avalanche.drpc.org at blocks 74,824,633 and 89,166,730; its December 2025 export found
    What would kill it
    a tenth fingerprint-matching stake of real size in the un-walked hours of 1 Jan 2026, or the C-Chain counterpart failing the two block tests

    Promotion is a person's decision, and every promotion writes the re-runnable query into the evidence above.

    Open addressOpen in Avascan (opens in a new tab)

  11. Coinbase Custody batch key on NodeID-DQdJGdg9

    InferredP-Chainvalidator-owner

    P-avax175jvtclx70razxnfxq6kf7vdw50kvj4mkwlqwm

    Attribution
    Filed under Coinbase Custody Trust Company as validator-owner. Open entity
    Claim supported
    staked 644,165.10 AVAX on 1 Jan 2026 and exported 351,986.39 AVAX on 30 Jun 2026, a fall of 292,179 AVAX; 166,676 AVAX on NodeID-DQdJGdg9CBTzq6rg4t1XMNg86MMmi4vEa to 25 Sep 2026 at the 16 Sep read, 185,310 AVAX lower again. Neither fall is explained
    Evidence
    scratch/hunt/blue/custody-batch.md: a walk of 10,670 P-Chain blocks with platform.getBlockByHeight over three windows found nine AddPermissionlessValidatorTx of 100,000 AVAX or more in the 1 Jan 2026 re-stake window sharing one fingerprint: a 100 percent delegation fee, a threshold-1 reward owner equal to the staking key, and an end at an exact month-end 00:00:00 UTC. Three walks of the same 68,196 blocks by two sessions return those nine and no tenth. The cluster is now matched to filed quantities at three dates by that one method: the nine stakes sum to 8,284,248.39 AVAX against the 8,329,871 AVAX filed at Coinbase Custody at 31 Dec 2025, which is 99.452 percent; 8,416,336.28 AVAX against the 8,462,227 AVAX in the 424B3 at 31 Mar 2026, which is 99.458 percent; and six of the nine exported to the C-Chain between 00:08:02 and 00:09:05 UTC on 30 Jun 2026 summing 4,458,518.01 AVAX against the 4,510,207 AVAX filed at 30 Jun 2026, which is 98.854 percent. On the refined fourteen-wallet set, read as C-Chain balances at the filed instant itself, the two testable dates read 99.9878 percent (gap 1,015.83 AVAX) and 99.9779 percent (gap 996.01 AVAX). The cluster is matched to the filed quantity at three dates as a set, which is an inference and not a proof: the tie to this key is collective and arithmetic, not a flow, and no member is pinned on its own. The June 98.854 percent is a subset-sum fit from a 63-second export window, which cannot see a stake that spans the filed instant; at least four fingerprint keys held 1,647,622 AVAX across 30 Jun 2026 and are excluded by quantity alone (scratch/hunt/blue2/SEARCHES-2.md sections 2.1 and 2.2, from tenth-member.md and batch-counterparts.md). Re-run: POST https://avalanche-p-chain-rpc.publicnode.com platform.getBlockByHeight across 23:30 to 01:30 UTC around each month end, then GET https://data-api.avax.network/v1/networks/mainnet/blockchains/p-chain/transactions?addresses={key}&pageSize=100 (glacier-api.avax.network answers 429 to unkeyed callers; data-api serves the same routes). Its C-Chain counterpart is 0xC9CEDe653245689928AE513209F2215138E5aE53, which held 644,165.1049 AVAX at block 74,824,633 and 351,986.2871 AVAX at block 89,166,730 (scratch/hunt/blue2/batch-counterparts.md sections 1 and 2).
    Source
    Related research: source destination unavailable.

    How this row was graded

    Evidence class
    C, filed-quantity match
    Confidence
    0.75 on a scale of 0 to 1
    Customer
    AVAT
    What would promote it
    its C-Chain counterpart found through the evmOutputs of the 30 Jun 2026 ImportTx and read with eth_getBalance against https://avalanche.drpc.org at blocks 74,824,633 and 89,166,730; its December 2025 export found
    What would kill it
    a tenth fingerprint-matching stake of real size in the un-walked hours of 1 Jan 2026, or the C-Chain counterpart failing the two block tests

    Promotion is a person's decision, and every promotion writes the re-runnable query into the evidence above.

    Open addressOpen in Avascan (opens in a new tab)

  12. Coinbase Custody batch key on NodeID-CS2Rnk3P

    InferredP-Chainvalidator-owner

    P-avax1wyd54qc3fen63q6hvzzzg9rjp9rct8ewdjs8t2

    Attribution
    Filed under Coinbase Custody Trust Company as validator-owner. Open entity
    Claim supported
    staked 150,685.93 AVAX on 1 Jan 2026, exported 151,803.13 AVAX at 00:09:04 UTC on 30 Jun 2026, and had 149,493 AVAX on NodeID-CS2Rnk3PiBd6p7N2v86PiDFRT7hVWLMjm to 25 Sep 2026 at the 16 Sep read
    Evidence
    scratch/hunt/blue/custody-batch.md: a walk of 10,670 P-Chain blocks with platform.getBlockByHeight over three windows found nine AddPermissionlessValidatorTx of 100,000 AVAX or more in the 1 Jan 2026 re-stake window sharing one fingerprint: a 100 percent delegation fee, a threshold-1 reward owner equal to the staking key, and an end at an exact month-end 00:00:00 UTC. Three walks of the same 68,196 blocks by two sessions return those nine and no tenth. The cluster is now matched to filed quantities at three dates by that one method: the nine stakes sum to 8,284,248.39 AVAX against the 8,329,871 AVAX filed at Coinbase Custody at 31 Dec 2025, which is 99.452 percent; 8,416,336.28 AVAX against the 8,462,227 AVAX in the 424B3 at 31 Mar 2026, which is 99.458 percent; and six of the nine exported to the C-Chain between 00:08:02 and 00:09:05 UTC on 30 Jun 2026 summing 4,458,518.01 AVAX against the 4,510,207 AVAX filed at 30 Jun 2026, which is 98.854 percent. On the refined fourteen-wallet set, read as C-Chain balances at the filed instant itself, the two testable dates read 99.9878 percent (gap 1,015.83 AVAX) and 99.9779 percent (gap 996.01 AVAX). The cluster is matched to the filed quantity at three dates as a set, which is an inference and not a proof: the tie to this key is collective and arithmetic, not a flow, and no member is pinned on its own. The June 98.854 percent is a subset-sum fit from a 63-second export window, which cannot see a stake that spans the filed instant; at least four fingerprint keys held 1,647,622 AVAX across 30 Jun 2026 and are excluded by quantity alone (scratch/hunt/blue2/SEARCHES-2.md sections 2.1 and 2.2, from tenth-member.md and batch-counterparts.md). Re-run: POST https://avalanche-p-chain-rpc.publicnode.com platform.getBlockByHeight across 23:30 to 01:30 UTC around each month end, then GET https://data-api.avax.network/v1/networks/mainnet/blockchains/p-chain/transactions?addresses={key}&pageSize=100 (glacier-api.avax.network answers 429 to unkeyed callers; data-api serves the same routes). Its C-Chain counterpart is 0x75B0870CE99Bb97cA5313C75c3fCDad062aeE82c, which held 150,685.9331 AVAX at block 74,824,633 and 151,803.0272 AVAX at block 89,166,730 (scratch/hunt/blue2/batch-counterparts.md sections 1 and 2).
    Source
    Related research: source destination unavailable.

    How this row was graded

    Evidence class
    C, filed-quantity match
    Confidence
    0.75 on a scale of 0 to 1
    Customer
    AVAT
    What would promote it
    its C-Chain counterpart found through the evmOutputs of the 30 Jun 2026 ImportTx and read with eth_getBalance against https://avalanche.drpc.org at blocks 74,824,633 and 89,166,730; its December 2025 export found
    What would kill it
    a tenth fingerprint-matching stake of real size in the un-walked hours of 1 Jan 2026, or the C-Chain counterpart failing the two block tests

    Promotion is a person's decision, and every promotion writes the re-runnable query into the evidence above.

    Open addressOpen in Avascan (opens in a new tab)

  13. Coinbase Custody batch key on NodeID-FTbhiFzL

    InferredP-Chainvalidator-owner

    P-avax1gd8jekzy9q4j5tr937mygd77kjactxna6890y8

    Attribution
    Filed under Coinbase Custody Trust Company as validator-owner. Open entity
    Claim supported
    staked 278,192.42 AVAX on NodeID-FTbhiFzLkcsfs1nMQ4zrkeqnmuRthWdV7 on 1 Jan 2026 and exported 100,068.46 AVAX at 00:08:03 UTC on 30 Jun 2026; not validating at the 16 Sep read, and where its AVAX went is not established
    Evidence
    scratch/hunt/blue/custody-batch.md: a walk of 10,670 P-Chain blocks with platform.getBlockByHeight over three windows found nine AddPermissionlessValidatorTx of 100,000 AVAX or more in the 1 Jan 2026 re-stake window sharing one fingerprint: a 100 percent delegation fee, a threshold-1 reward owner equal to the staking key, and an end at an exact month-end 00:00:00 UTC. Three walks of the same 68,196 blocks by two sessions return those nine and no tenth. The cluster is now matched to filed quantities at three dates by that one method: the nine stakes sum to 8,284,248.39 AVAX against the 8,329,871 AVAX filed at Coinbase Custody at 31 Dec 2025, which is 99.452 percent; 8,416,336.28 AVAX against the 8,462,227 AVAX in the 424B3 at 31 Mar 2026, which is 99.458 percent; and six of the nine exported to the C-Chain between 00:08:02 and 00:09:05 UTC on 30 Jun 2026 summing 4,458,518.01 AVAX against the 4,510,207 AVAX filed at 30 Jun 2026, which is 98.854 percent. On the refined fourteen-wallet set, read as C-Chain balances at the filed instant itself, the two testable dates read 99.9878 percent (gap 1,015.83 AVAX) and 99.9779 percent (gap 996.01 AVAX). The cluster is matched to the filed quantity at three dates as a set, which is an inference and not a proof: the tie to this key is collective and arithmetic, not a flow, and no member is pinned on its own. The June 98.854 percent is a subset-sum fit from a 63-second export window, which cannot see a stake that spans the filed instant; at least four fingerprint keys held 1,647,622 AVAX across 30 Jun 2026 and are excluded by quantity alone (scratch/hunt/blue2/SEARCHES-2.md sections 2.1 and 2.2, from tenth-member.md and batch-counterparts.md). Re-run: POST https://avalanche-p-chain-rpc.publicnode.com platform.getBlockByHeight across 23:30 to 01:30 UTC around each month end, then GET https://data-api.avax.network/v1/networks/mainnet/blockchains/p-chain/transactions?addresses={key}&pageSize=100 (glacier-api.avax.network answers 429 to unkeyed callers; data-api serves the same routes). Its C-Chain counterpart is 0x8CADa8839c830e6f67a5E6837CBD0477E9c2384E, which held 100,068.3557 AVAX at block 89,166,730 and paid the whole of it to the cold wallet 0x720efa4a on 2 Jul 2026 (scratch/hunt/blue2/batch-counterparts.md sections 1, 2 and 4).
    Source
    Related research: source destination unavailable.

    How this row was graded

    Evidence class
    C, filed-quantity match
    Confidence
    0.70 on a scale of 0 to 1
    Customer
    AVAT
    What would promote it
    restated, because the written condition can no longer decide it: the July destination is 0x720efa4a, a Coinbase Custody cold wallet the registry already carries at 0.80 inferred, which is neither the AVAT trail nor anywhere else. The money stayed inside the family, which is consistent with membership and is not the flow tie the old condition asked for. What would promote it: an outflow into a wallet the registry grades proven for AVAT with no omnibus between, or a filed quantity matching it to the unit
    What would kill it
    paying a wallet tied to another named entity

    Promotion is a person's decision, and every promotion writes the re-runnable query into the evidence above.

    Open addressOpen in Avascan (opens in a new tab)

  14. Coinbase Custody batch key on NodeID-F5Ecwd5q

    InferredP-Chainvalidator-owner

    P-avax1j9tgjlu7xl40p68u5gp2gc32g59te6mgfwqczx

    Attribution
    Filed under Coinbase Custody Trust Company as validator-owner. Open entity
    Claim supported
    staked 169,093.37 AVAX on NodeID-F5Ecwd5qinZSTxacdEfWWsnz2eXyp8uK6 on 1 Jan 2026, the node that now carries AVAT validator 1, and exported 145,554.75 AVAX at 00:09:05 UTC on 30 Jun 2026; it ran one more cycle, importing 145,554.8551 AVAX on 2 Jul and staking 146,175.7428 the same minute, then exported 146,175.7398 AVAX at 00:10:03 UTC on 1 Aug 2026 and has not validated since
    Evidence
    scratch/hunt/blue/custody-batch.md: a walk of 10,670 P-Chain blocks with platform.getBlockByHeight over three windows found nine AddPermissionlessValidatorTx of 100,000 AVAX or more in the 1 Jan 2026 re-stake window sharing one fingerprint: a 100 percent delegation fee, a threshold-1 reward owner equal to the staking key, and an end at an exact month-end 00:00:00 UTC. Three walks of the same 68,196 blocks by two sessions return those nine and no tenth. The cluster is now matched to filed quantities at three dates by that one method: the nine stakes sum to 8,284,248.39 AVAX against the 8,329,871 AVAX filed at Coinbase Custody at 31 Dec 2025, which is 99.452 percent; 8,416,336.28 AVAX against the 8,462,227 AVAX in the 424B3 at 31 Mar 2026, which is 99.458 percent; and six of the nine exported to the C-Chain between 00:08:02 and 00:09:05 UTC on 30 Jun 2026 summing 4,458,518.01 AVAX against the 4,510,207 AVAX filed at 30 Jun 2026, which is 98.854 percent. On the refined fourteen-wallet set, read as C-Chain balances at the filed instant itself, the two testable dates read 99.9878 percent (gap 1,015.83 AVAX) and 99.9779 percent (gap 996.01 AVAX). The cluster is matched to the filed quantity at three dates as a set, which is an inference and not a proof: the tie to this key is collective and arithmetic, not a flow, and no member is pinned on its own. The June 98.854 percent is a subset-sum fit from a 63-second export window, which cannot see a stake that spans the filed instant; at least four fingerprint keys held 1,647,622 AVAX across 30 Jun 2026 and are excluded by quantity alone (scratch/hunt/blue2/SEARCHES-2.md sections 2.1 and 2.2, from tenth-member.md and batch-counterparts.md). Re-run: POST https://avalanche-p-chain-rpc.publicnode.com platform.getBlockByHeight across 23:30 to 01:30 UTC around each month end, then GET https://data-api.avax.network/v1/networks/mainnet/blockchains/p-chain/transactions?addresses={key}&pageSize=100 (glacier-api.avax.network answers 429 to unkeyed callers; data-api serves the same routes). Node continuity, evidence class D, is weak on its own here and the row does not rest on it. MEASURED: one private key unrelated to either company, P-avax1qtrykwgqkpj8c9wl93cymu6q9ffssyyu95q8wp, has delegated to NodeID-DVh35F3R11HAAxzeSTbk3eR9w2BzPrJQt since 2022-01-01 21:17:23 and to NodeID-3kUUeZB7umtaENekUfWxa1bxrAU2eq1AD since 2021-09-29 20:48:15, years before Avalanche Treasury Corp existed, and its automation re-delegated 130,455.60 AVAX twice on 2026-08-06 at a 100 percent fee that pays it nothing. These are rented commercial validators, so any node must be age-checked before its overlap is printed as corroboration (scratch/hunt/blue2/delegator-sweep.md section 5). The same read withdraws the claim that a 100 percent fee means no third party can delegate: that node reports delegatorCount 2 and delegatorWeight 260,911.20 AVAX. Re-run: POST https://avalanche-p-chain-rpc.publicnode.com platform.getCurrentValidators with the nodeID, then platform.getTx on the delegation's consumed UTXOs back through the key's own history. Its C-Chain counterpart is 0x2444CE0428Ac2aEd55B663E664966D942eF3Ca62, which held 145,554.6521 AVAX at block 89,166,730 and paid 146,175.6398 AVAX to the cold wallet 0x720efa4a on 3 Aug 2026 (scratch/hunt/blue2/batch-counterparts.md sections 1, 2 and 4, and deposit-provenance.md section 4).
    Source
    Related research: source destination unavailable.

    How this row was graded

    Evidence class
    D, node or provider continuity
    Confidence
    0.70 on a scale of 0 to 1
    Customer
    AVAT
    What would promote it
    restated, because the written condition can no longer decide it: the August destination is 0x720efa4a, a Coinbase Custody cold wallet the registry already carries at 0.80 inferred, which is neither the AVAT trail nor anywhere else. The money stayed inside the family, which is consistent with membership and is not the flow tie the old condition asked for. What would promote it: an outflow into a wallet the registry grades proven for AVAT with no omnibus between, or a filed quantity matching it to the unit
    What would kill it
    paying a wallet tied to another named entity

    Promotion is a person's decision, and every promotion writes the re-runnable query into the evidence above.

    Open addressOpen in Avascan (opens in a new tab)

  15. Coinbase Custody batch key of another client

    UnattributedP-Chainvalidator-owner

    P-avax1n7sgakzfml8ea4fg76qm7pnsn0v06gw5r5wc0l

    Attribution
    Filed under Coinbase Custody Trust Company as validator-owner. Open entity
    Claim supported
    exported 616,217.1938 AVAX at 00:09:01 UTC on 30 Jun 2026 inside the same 63-second window, has cycled since 1 Aug 2023, and had 619,983 AVAX on NodeID-Eeg2Huipo4K5oURLwd6EJNm286b1js6rL to 30 Sep 2026; adding it overshoots the filed June figure by 12.5 percent
    Evidence
    scratch/hunt/blue/custody-batch.md, cluster B: the same custodian fingerprint with a first cycle on 1 Aug 2023, two years before AVAT existed, and a June sum the filed figure has no room for. Re-run: GET https://data-api.avax.network/v1/networks/mainnet/blockchains/p-chain/transactions?addresses=P-avax1n7sgakzfml8ea4fg76qm7pnsn0v06gw5r5wc0l&pageSize=100
    Source
    Related research: source destination unavailable.

    How this row was graded, and why it is not attributed

    Evidence class
    C, filed-quantity match
    Customer
    Another client of the same operator, not AVAT
    What would promote it
    evidence that the company bought an existing custody position
    What would kill it
    a flow from it to a named third party, which would settle it for good

    Promotion is a person's decision, and every promotion writes the re-runnable query into the evidence above.

    Open addressOpen in Avascan (opens in a new tab)

  16. C-Chain side of the other client's batch key

    UnattributedC-Chaincustody

    0xa0b25c3168b7dc976282567257dc2a8e7fd63100

    Attribution
    Filed under Coinbase Custody Trust Company as custody. Open entity
    Claim supported
    the landing address of that key's 30 Jun 2026 export, recorded so the pair is not re-found as AVAT's
    Evidence
    scratch/hunt/blue/custody-batch.md, cluster B: resolved through the destination key's ImportTx evmOutputs. Re-run: GET https://data-api.avax.network/v1/networks/mainnet/blockchains/c-chain/transactions?addresses=C-avax1n7sgakzfml8ea4fg76qm7pnsn0v06gw5r5wc0l&pageSize=100
    Source
    Related research: source destination unavailable.

    How this row was graded, and why it is not attributed

    Evidence class
    C, filed-quantity match
    Customer
    Another client of the same operator, not AVAT
    What would promote it
    evidence that the company bought an existing custody position
    What would kill it
    a flow from it to a named third party

    Promotion is a person's decision, and every promotion writes the re-runnable query into the evidence above.

    Open addressOpen in Snowscan (opens in a new tab)

  17. Coinbase Custody batch vault of the largest…

    InferredC-Chainvault

    0x1c90d5440c0e768cf7ed984770e0d51a6fe8e417

    Attribution
    Filed under Coinbase Custody Trust Company as vault. Open entity
    Claim supported
    member - the C-Chain counterpart of P-avax1xpedzqexwkzjhuj4dp5dcmc0nvphvwld2mkcwa, which held 2,524,680.7611 AVAX at block 74,824,633 (2025-12-31 23:59:56 UTC), 2,534,260.1177 AVAX at block 89,166,730 (2026-06-30 23:59:59 UTC) and 0 today. Its first atomic row is an ExportTx of 2,500,000.2060 AVAX at 13:22:04 UTC on 28 Oct 2025, and it took the 31 Dec 2025 ImportTx of 2,524,680.7611 AVAX in block 74,763,695 at 00:55:04, three minutes after the P-Chain export in block 23,988,236. The only money it ever took from outside the family is two atomic rows on 21 Oct 2025, 0.1 AVAX and 3,658,982.70 AVAX, each of which is its own row here
    Evidence
    scratch/hunt/blue2/batch-counterparts.md sections 1 and 2, re-measured in batch-counterparts-VERIFY.md. Class A inside the family and class C at the filed dates. The counterpart was found through the key's own complete atomic history, 9 or 10 rows with nextPageToken null: every ExportTx carries one evmInputs[0].fromAddress and every ImportTx one evmOutputs[0].address, and across all 56 rows of the six keys that address is one and the same per key. Balances were then read at the two filed blocks, so these are balances at the filed instant rather than stakes read a day later or exports read 24 hours early. The six vaults sum to 4,937,039.894 AVAX at block 74,824,633 and 4,458,517.412 AVAX at block 89,166,730; with the five cold wallets and the three payees the vaults themselves paid, fourteen wallets sum to 8,328,855.165 AVAX at 31 Dec 2025, which is 99.9878 per cent of the filed 8,329,871, and 4,509,210.995 AVAX at 30 Jun 2026, which is 99.9779 per cent of the filed 4,510,207. The grade is capped at 0.80: these vaults pay a wallet that pays 0x8de2cf20, so they sit one hop further from the treasury than a wallet the registry already grades 0.80 inferred. Re-run: GET https://data-api.avax.network/v1/networks/mainnet/blockchains/c-chain/transactions?addresses=C-avax1{key body}&pageSize=100, then POST https://avalanche.drpc.org eth_getBalance at blocks 0x475bbb9 (74,824,633) and 0x550938a (89,166,730)
    Source
    Related research: source destination unavailable.

    How this row was graded

    Evidence class
    A, flow tie
    Confidence
    0.80 on a scale of 0 to 1
    Customer
    AVAT
    What would promote it
    an outflow from it into a wallet the registry grades proven for AVAT with no omnibus between, or a filed quantity matching this one vault's balance to the unit
    What would kill it
    it paying a wallet tied to another named entity, or a balance at a fourth filed date contradicting its export amount

    Promotion is a person's decision, and every promotion writes the re-runnable query into the evidence above.

    Open addressOpen in Snowscan (opens in a new tab)

  18. Coinbase Custody batch vault on NodeID-8QDaNCzY

    InferredC-Chainvault

    0x4d8708374a1dc42126534ba989c796313c0fd0cc

    Attribution
    Filed under Coinbase Custody Trust Company as vault. Open entity
    Claim supported
    the C-Chain counterpart of P-avax1lhewhmafsejpyj5dt2crtvnpculex5vhf39zmd, which held 1,170,222.3006 AVAX at block 74,824,633 (2025-12-31 23:59:56 UTC), 1,174,844.9725 AVAX at block 89,166,730 (2026-06-30 23:59:59 UTC) and 0 today. Its first atomic row is an ExportTx of 1,158,983.0060 AVAX at 15:13:03 UTC on 28 Oct 2025, six days after the largest vault kept 2,500,000 of its 3.66M and sent 1,158,982.80 here. It paid 0x628eef4d 26,710.8499 AVAX in the 1 Apr 2026 rebalance
    Evidence
    scratch/hunt/blue2/batch-counterparts.md sections 1 and 2, re-measured in batch-counterparts-VERIFY.md. Class A inside the family and class C at the filed dates. The counterpart was found through the key's own complete atomic history, 9 or 10 rows with nextPageToken null: every ExportTx carries one evmInputs[0].fromAddress and every ImportTx one evmOutputs[0].address, and across all 56 rows of the six keys that address is one and the same per key. Balances were then read at the two filed blocks, so these are balances at the filed instant rather than stakes read a day later or exports read 24 hours early. The six vaults sum to 4,937,039.894 AVAX at block 74,824,633 and 4,458,517.412 AVAX at block 89,166,730; with the five cold wallets and the three payees the vaults themselves paid, fourteen wallets sum to 8,328,855.165 AVAX at 31 Dec 2025, which is 99.9878 per cent of the filed 8,329,871, and 4,509,210.995 AVAX at 30 Jun 2026, which is 99.9779 per cent of the filed 4,510,207. The grade is capped at 0.80: these vaults pay a wallet that pays 0x8de2cf20, so they sit one hop further from the treasury than a wallet the registry already grades 0.80 inferred. Re-run: GET https://data-api.avax.network/v1/networks/mainnet/blockchains/c-chain/transactions?addresses=C-avax1{key body}&pageSize=100, then POST https://avalanche.drpc.org eth_getBalance at blocks 0x475bbb9 (74,824,633) and 0x550938a (89,166,730)
    Source
    Related research: source destination unavailable.

    How this row was graded

    Evidence class
    A, flow tie
    Confidence
    0.80 on a scale of 0 to 1
    Customer
    AVAT
    What would promote it
    an outflow from it into a wallet the registry grades proven for AVAT with no omnibus between, or a filed quantity matching this one vault's balance to the unit
    What would kill it
    it paying a wallet tied to another named entity, or a balance at a fourth filed date contradicting its export amount

    Promotion is a person's decision, and every promotion writes the re-runnable query into the evidence above.

    Open addressOpen in Snowscan (opens in a new tab)

  19. Coinbase Custody batch vault on NodeID-DQdJGdg9

    InferredC-Chainvault

    0xc9cede653245689928ae513209f2215138e5ae53

    Attribution
    Filed under Coinbase Custody Trust Company as vault. Open entity
    Claim supported
    the C-Chain counterpart of P-avax175jvtclx70razxnfxq6kf7vdw50kvj4mkwlqwm, which held 644,165.1049 AVAX at block 74,824,633 (2025-12-31 23:59:56 UTC), 351,986.2871 AVAX at block 89,166,730 (2026-06-30 23:59:59 UTC) and 0 today. Its first atomic row is an ExportTx of 638,910.7460 AVAX at 17:55:48 UTC on 6 Nov 2025. On 5 Nov 2025 it split 909,000.00 AVAX into five children inside 115 minutes, four of them registry rows, and it paid 0x720efa4a 305,444.1097 AVAX in the 1 Apr 2026 rebalance
    Evidence
    scratch/hunt/blue2/batch-counterparts.md sections 1 and 2, re-measured in batch-counterparts-VERIFY.md. Class A inside the family and class C at the filed dates. The counterpart was found through the key's own complete atomic history, 9 or 10 rows with nextPageToken null: every ExportTx carries one evmInputs[0].fromAddress and every ImportTx one evmOutputs[0].address, and across all 56 rows of the six keys that address is one and the same per key. Balances were then read at the two filed blocks, so these are balances at the filed instant rather than stakes read a day later or exports read 24 hours early. The six vaults sum to 4,937,039.894 AVAX at block 74,824,633 and 4,458,517.412 AVAX at block 89,166,730; with the five cold wallets and the three payees the vaults themselves paid, fourteen wallets sum to 8,328,855.165 AVAX at 31 Dec 2025, which is 99.9878 per cent of the filed 8,329,871, and 4,509,210.995 AVAX at 30 Jun 2026, which is 99.9779 per cent of the filed 4,510,207. The grade is capped at 0.80: these vaults pay a wallet that pays 0x8de2cf20, so they sit one hop further from the treasury than a wallet the registry already grades 0.80 inferred. Re-run: GET https://data-api.avax.network/v1/networks/mainnet/blockchains/c-chain/transactions?addresses=C-avax1{key body}&pageSize=100, then POST https://avalanche.drpc.org eth_getBalance at blocks 0x475bbb9 (74,824,633) and 0x550938a (89,166,730)
    Source
    Related research: source destination unavailable.

    How this row was graded

    Evidence class
    A, flow tie
    Confidence
    0.80 on a scale of 0 to 1
    Customer
    AVAT
    What would promote it
    an outflow from it into a wallet the registry grades proven for AVAT with no omnibus between, or a filed quantity matching this one vault's balance to the unit
    What would kill it
    it paying a wallet tied to another named entity, or a balance at a fourth filed date contradicting its export amount

    Promotion is a person's decision, and every promotion writes the re-runnable query into the evidence above.

    Open addressOpen in Snowscan (opens in a new tab)

  20. Coinbase Custody batch vault on NodeID-CS2Rnk3P

    InferredC-Chainvault

    0x75b0870ce99bb97ca5313c75c3fcdad062aee82c

    Attribution
    Filed under Coinbase Custody Trust Company as vault. Open entity
    Claim supported
    the C-Chain counterpart of P-avax1wyd54qc3fen63q6hvzzzg9rjp9rct8ewdjs8t2, which held 150,685.9331 AVAX at block 74,824,633 (2025-12-31 23:59:56 UTC), 151,803.0272 AVAX at block 89,166,730 (2026-06-30 23:59:59 UTC) and 0 today. Its first atomic row is an ExportTx of 149,485.6860 AVAX at 22:49:08 UTC on 7 Nov 2025, the day after 0xC9CEDe65 paid it 149,485.48 AVAX. It paid 0x720efa4a 3,192.1712 AVAX in the 1 Apr 2026 rebalance
    Evidence
    scratch/hunt/blue2/batch-counterparts.md sections 1 and 2, re-measured in batch-counterparts-VERIFY.md. Class A inside the family and class C at the filed dates. The counterpart was found through the key's own complete atomic history, 9 or 10 rows with nextPageToken null: every ExportTx carries one evmInputs[0].fromAddress and every ImportTx one evmOutputs[0].address, and across all 56 rows of the six keys that address is one and the same per key. Balances were then read at the two filed blocks, so these are balances at the filed instant rather than stakes read a day later or exports read 24 hours early. The six vaults sum to 4,937,039.894 AVAX at block 74,824,633 and 4,458,517.412 AVAX at block 89,166,730; with the five cold wallets and the three payees the vaults themselves paid, fourteen wallets sum to 8,328,855.165 AVAX at 31 Dec 2025, which is 99.9878 per cent of the filed 8,329,871, and 4,509,210.995 AVAX at 30 Jun 2026, which is 99.9779 per cent of the filed 4,510,207. The grade is capped at 0.80: these vaults pay a wallet that pays 0x8de2cf20, so they sit one hop further from the treasury than a wallet the registry already grades 0.80 inferred. Re-run: GET https://data-api.avax.network/v1/networks/mainnet/blockchains/c-chain/transactions?addresses=C-avax1{key body}&pageSize=100, then POST https://avalanche.drpc.org eth_getBalance at blocks 0x475bbb9 (74,824,633) and 0x550938a (89,166,730)
    Source
    Related research: source destination unavailable.

    How this row was graded

    Evidence class
    A, flow tie
    Confidence
    0.80 on a scale of 0 to 1
    Customer
    AVAT
    What would promote it
    an outflow from it into a wallet the registry grades proven for AVAT with no omnibus between, or a filed quantity matching this one vault's balance to the unit
    What would kill it
    it paying a wallet tied to another named entity, or a balance at a fourth filed date contradicting its export amount

    Promotion is a person's decision, and every promotion writes the re-runnable query into the evidence above.

    Open addressOpen in Snowscan (opens in a new tab)

  21. Coinbase Custody batch vault on NodeID-FTbhiFzL

    InferredC-Chainvault

    0x8cada8839c830e6f67a5e6837cbd0477e9c2384e

    Attribution
    Filed under Coinbase Custody Trust Company as vault. Open entity
    Claim supported
    the C-Chain counterpart of P-avax1gd8jekzy9q4j5tr937mygd77kjactxna6890y8, which held 278,192.4207 AVAX at block 74,824,633 (2025-12-31 23:59:56 UTC), 100,068.3557 AVAX at block 89,166,730 (2026-06-30 23:59:59 UTC) and 0 today. Its first atomic row is an ExportTx of 275,000.3060 AVAX at 22:03:06 UTC on 14 Oct 2025. It paid 0x720efa4a 183,152.7467 AVAX in the 1 Apr 2026 rebalance and the whole of its 100,068.3557 AVAX on 2 Jul 2026, which is where part of the 245,623 AVAX left by the two keys that stopped validating went
    Evidence
    scratch/hunt/blue2/batch-counterparts.md sections 1 and 2, re-measured in batch-counterparts-VERIFY.md. Class A inside the family and class C at the filed dates. The counterpart was found through the key's own complete atomic history, 9 or 10 rows with nextPageToken null: every ExportTx carries one evmInputs[0].fromAddress and every ImportTx one evmOutputs[0].address, and across all 56 rows of the six keys that address is one and the same per key. Balances were then read at the two filed blocks, so these are balances at the filed instant rather than stakes read a day later or exports read 24 hours early. The six vaults sum to 4,937,039.894 AVAX at block 74,824,633 and 4,458,517.412 AVAX at block 89,166,730; with the five cold wallets and the three payees the vaults themselves paid, fourteen wallets sum to 8,328,855.165 AVAX at 31 Dec 2025, which is 99.9878 per cent of the filed 8,329,871, and 4,509,210.995 AVAX at 30 Jun 2026, which is 99.9779 per cent of the filed 4,510,207. The grade is capped at 0.80: these vaults pay a wallet that pays 0x8de2cf20, so they sit one hop further from the treasury than a wallet the registry already grades 0.80 inferred. Re-run: GET https://data-api.avax.network/v1/networks/mainnet/blockchains/c-chain/transactions?addresses=C-avax1{key body}&pageSize=100, then POST https://avalanche.drpc.org eth_getBalance at blocks 0x475bbb9 (74,824,633) and 0x550938a (89,166,730)
    Source
    Related research: source destination unavailable.

    How this row was graded

    Evidence class
    A, flow tie
    Confidence
    0.80 on a scale of 0 to 1
    Customer
    AVAT
    What would promote it
    an outflow from it into a wallet the registry grades proven for AVAT with no omnibus between, or a filed quantity matching this one vault's balance to the unit
    What would kill it
    it paying a wallet tied to another named entity, or a balance at a fourth filed date contradicting its export amount

    Promotion is a person's decision, and every promotion writes the re-runnable query into the evidence above.

    Open addressOpen in Snowscan (opens in a new tab)

  22. Coinbase Custody batch vault on NodeID-F5Ecwd5q

    InferredC-Chainvault

    0x2444ce0428ac2aed55b663e664966d942ef3ca62

    Attribution
    Filed under Coinbase Custody Trust Company as vault. Open entity
    Claim supported
    the C-Chain counterpart of P-avax1j9tgjlu7xl40p68u5gp2gc32g59te6mgfwqczx, which held 169,093.3737 AVAX at block 74,824,633 (2025-12-31 23:59:56 UTC), 145,554.6521 AVAX at block 89,166,730 (2026-06-30 23:59:59 UTC) and 0 today. Its first atomic row is an ExportTx of 167,501.9560 AVAX at 20:19:05 UTC on 29 Oct 2025. It paid 0x720efa4a 27,756.2558 AVAX in the 1 Apr 2026 rebalance and 146,175.6398 AVAX on 3 Aug 2026, the rest of that 245,623 AVAX
    Evidence
    scratch/hunt/blue2/batch-counterparts.md sections 1 and 2, re-measured in batch-counterparts-VERIFY.md. Class A inside the family and class C at the filed dates. The counterpart was found through the key's own complete atomic history, 9 or 10 rows with nextPageToken null: every ExportTx carries one evmInputs[0].fromAddress and every ImportTx one evmOutputs[0].address, and across all 56 rows of the six keys that address is one and the same per key. Balances were then read at the two filed blocks, so these are balances at the filed instant rather than stakes read a day later or exports read 24 hours early. The six vaults sum to 4,937,039.894 AVAX at block 74,824,633 and 4,458,517.412 AVAX at block 89,166,730; with the five cold wallets and the three payees the vaults themselves paid, fourteen wallets sum to 8,328,855.165 AVAX at 31 Dec 2025, which is 99.9878 per cent of the filed 8,329,871, and 4,509,210.995 AVAX at 30 Jun 2026, which is 99.9779 per cent of the filed 4,510,207. The grade is capped at 0.80: these vaults pay a wallet that pays 0x8de2cf20, so they sit one hop further from the treasury than a wallet the registry already grades 0.80 inferred. Re-run: GET https://data-api.avax.network/v1/networks/mainnet/blockchains/c-chain/transactions?addresses=C-avax1{key body}&pageSize=100, then POST https://avalanche.drpc.org eth_getBalance at blocks 0x475bbb9 (74,824,633) and 0x550938a (89,166,730)
    Source
    Related research: source destination unavailable.

    How this row was graded

    Evidence class
    A, flow tie
    Confidence
    0.80 on a scale of 0 to 1
    Customer
    AVAT
    What would promote it
    an outflow from it into a wallet the registry grades proven for AVAT with no omnibus between, or a filed quantity matching this one vault's balance to the unit
    What would kill it
    it paying a wallet tied to another named entity, or a balance at a fourth filed date contradicting its export amount

    Promotion is a person's decision, and every promotion writes the re-runnable query into the evidence above.

    Open addressOpen in Snowscan (opens in a new tab)

  23. Coinbase Custody batch member below the walk…

    InferredC-Chainvalidator-owner

    0x8da8c161a493e957c0a3e44a3ce920b8ab0a2c45

    Attribution
    Filed under Coinbase Custody Trust Company as validator-owner. Open entity
    Claim supported
    floor - holds P-avax1gfddpgxxld3qgkl53evddup6ly2c95356524mu on NodeID-145uWMw7TbEZuhU4EaerESBBaDsmLneiu. Took 12,572.36 AVAX from the vault 0xC9CEDe65 at 22:02:09 UTC on 5 Nov 2025, sat unstaked until 1 Apr 2026, staked 12,572.3600 AVAX to 30 Jun 2026 and 12,744.4865 AVAX on 3 Jul 2026 to 25 Sep 2026 00:00:00 UTC. Its 1 Apr 2026 export sits in C-Chain block 81,847,285, one second after batch key P-avax1gd8jekz's own export in block 81,847,284
    Evidence
    scratch/hunt/blue2/batch-counterparts.md sections 3 and 4, re-measured in batch-counterparts-VERIFY.md. Class A, B and C: funded by the vault 0xC9CEDe65 on 5 Nov 2025 inside the same 115 minutes as three other family wallets, a second funding link from the family index 0xC9CE3688, the full batch stake fingerprint (delegationFeePercent 1000000, a threshold-1 self-paying reward owner and an exact midnight end), the 0.206 AVAX export-gas ping from 0xe1597df1 minutes before each export, and a balance inside both filed sums. Re-run: GET https://api.routescan.io/v2/network/mainnet/evm/43114/address/{addr}/transactions?limit=100 for the atomic_tx rows that give the P-Chain key, then GET https://data-api.avax.network/v1/networks/mainnet/blockchains/p-chain/transactions?addresses={key}&pageSize=100, which returns five transactions
    Source
    Related research: source destination unavailable.

    How this row was graded

    Evidence class
    A, flow tie
    Confidence
    0.80 on a scale of 0 to 1
    Customer
    AVAT
    What would promote it
    its 25 Sep 2026 export landing with the other four
    What would kill it
    it paying a wallet outside the family

    Promotion is a person's decision, and every promotion writes the re-runnable query into the evidence above.

    Open addressOpen in Snowscan (opens in a new tab)

  24. Coinbase Custody batch member below the walk…

    InferredC-Chainvalidator-owner

    0xf9059a012fa69b3e8d7d0488b30d0c7db36a84ef

    Attribution
    Filed under Coinbase Custody Trust Company as validator-owner. Open entity
    Claim supported
    floor - holds P-avax13ajllh5hujtrmuhds67nz0twa0yjxxzdxywtus on NodeID-2VwCwLusvnfiZ55tQY6g7UEZdpBVAgs6W. Took 21,894.07 AVAX from the vault 0xC9CEDe65 at 22:19:08 UTC on 5 Nov 2025, sat unstaked until 1 Apr 2026, staked 21,894.0700 AVAX to 30 Jun 2026 and 22,193.7460 AVAX on 3 Jul 2026 to 25 Sep 2026 00:00:00 UTC. Its 1 Apr 2026 export sits in C-Chain block 81,847,286, two seconds after batch key P-avax1gd8jekz's own export in block 81,847,284
    Evidence
    scratch/hunt/blue2/batch-counterparts.md sections 3 and 4, re-measured in batch-counterparts-VERIFY.md. Class A, B and C: funded by the vault 0xC9CEDe65 on 5 Nov 2025 inside the same 115 minutes as three other family wallets, a second funding link from the family index 0xC9CE3688, the full batch stake fingerprint (delegationFeePercent 1000000, a threshold-1 self-paying reward owner and an exact midnight end), the 0.206 AVAX export-gas ping from 0xe1597df1 minutes before each export, and a balance inside both filed sums. Re-run: GET https://api.routescan.io/v2/network/mainnet/evm/43114/address/{addr}/transactions?limit=100 for the atomic_tx rows that give the P-Chain key, then GET https://data-api.avax.network/v1/networks/mainnet/blockchains/p-chain/transactions?addresses={key}&pageSize=100, which returns five transactions
    Source
    Related research: source destination unavailable.

    How this row was graded

    Evidence class
    A, flow tie
    Confidence
    0.80 on a scale of 0 to 1
    Customer
    AVAT
    What would promote it
    its 25 Sep 2026 export landing with the other four
    What would kill it
    it paying a wallet outside the family

    Promotion is a person's decision, and every promotion writes the re-runnable query into the evidence above.

    Open addressOpen in Snowscan (opens in a new tab)

  25. Idle family wallet

    CandidateC-Chainvault

    0x03ff64055443b1228549793e9e49391b07101751

    Attribution
    Filed under Coinbase Custody Trust Company as vault. Open entity
    Claim supported
    10,140.35 AVAX, unchanged for ten months and the same figure at both filed blocks and today. Two rows in its life and no atomic row at all, so it has never touched the P-Chain
    Evidence
    scratch/hunt/blue2/batch-counterparts.md sections 3 and 4, re-measured in batch-counterparts-VERIFY.md. Class A and C, weakly: one funding payment of 10,140.35 AVAX from the vault 0xC9CEDe65 at 20:54:11 UTC on 5 Nov 2025, a second ping from the family index 0xC9CE3688, and a balance inside both filed sums. It stakes nothing and does nothing, so nothing beyond the family links it. Re-run: GET https://api.routescan.io/v2/network/mainnet/evm/43114/etherscan/api?module=account&action=txlist&address=0x03ff64055443b1228549793e9e49391b07101751&sort=asc, then POST https://avalanche.drpc.org eth_getBalance at blocks 0x475bbb9 and 0x550938a
    Source
    Related research: source destination unavailable.

    A candidate, and the tests on it

    Evidence class
    A, flow tie
    Confidence
    0.60 on a scale of 0 to 1
    Customer
    AVAT
    What would promote it
    any movement at all, which would name its operator
    What would kill it
    an outflow to another named entity

    Promotion is a person's decision, and every promotion writes the re-runnable query into the evidence above.

    Open addressOpen in Snowscan (opens in a new tab)

  26. Possible small batch key

    CandidateP-Chainvalidator-owner

    P-avax1tqu4ynzwfsr8lahxedkr6q8xdrlalcduma772l

    Attribution
    Filed under Coinbase Custody Trust Company as validator-owner. Open entity
    Claim supported
    exported 2,102.3160 AVAX at 00:09:03 UTC on 30 Jun 2026 in block 25,143,513, inside the same 63-second window as six of the nine and with the same band, shape and threshold as the two members that stake below the walk floor; absent from the December and March windows
    Evidence
    scratch/hunt/blue2/tenth-member.md and SEARCHES-2.md section 2.4. Class D and C: the band, the shape and the threshold match and nothing else does, and 2,102 AVAX is too small to move any filed sum either way. The customer is unassigned. Re-run: POST https://avalanche-p-chain-rpc.publicnode.com platform.getBlockByHeight at 25,143,513 with a browser User-Agent, then GET https://data-api.avax.network/v1/networks/mainnet/blockchains/p-chain/transactions?addresses=P-avax1tqu4ynzwfsr8lahxedkr6q8xdrlalcduma772l&pageSize=100
    Source
    Related research: source destination unavailable.

    A candidate, and the tests on it

    Evidence class
    D, node or provider continuity
    Confidence
    0.50 on a scale of 0 to 1
    What would promote it
    its C-Chain counterpart read and found inside the family's payee graph
    What would kill it
    a funder outside that graph

    Promotion is a person's decision, and every promotion writes the re-runnable query into the evidence above.

    Open addressOpen in Avascan (opens in a new tab)

  27. Upstream key of the largest batch vault

    CandidateC-Chaincustody

    C-avax17xjk40aekl9026c77sneuur50hkm87s4my5uj4

    Attribution
    Filed under Coinbase Custody Trust Company as custody. Open entity
    Claim supported
    imported 3,658,982.7000 AVAX into 0x1c90D544 at 21:32:10 UTC on 21 Oct 2025, the only money that vault ever took in from outside the family. Written in the C-avax1 spelling of the P-Chain key body, because nobody has read the key
    Evidence
    scratch/hunt/blue2/batch-counterparts.md section 6 and batch-counterparts-VERIFY.md, which refuted the claim that 0x1c90D544 has exactly one inbound edge in its life and found two: 0.1000 AVAX at 14:21:12 UTC on 21 Oct 2025 from C-avax15nhrx5g8cn83ey6az2k90ge2adq3f5per9vkkn, then 3,658,982.7000 AVAX at 21:32:10 from C-avax17xjk40aekl9026c77sneuur50hkm87s4my5uj4, seven hours apart. Class B, ancestry only: confidence 0.40 that the two belong to the same operation, with the customer unassigned. The other five counterparts have no foreign inbound atomic rows at all. The 3.66M moved during the period the company was buying and it is the only money the largest vault ever took in, which is why these two are the best next target in the family. Re-run: GET https://data-api.avax.network/v1/networks/mainnet/blockchains/c-chain/transactions?addresses={this key}&pageSize=100 and the same route on p-chain
    Source
    Related research: source destination unavailable.

    A candidate, and the tests on it

    Evidence class
    B, co-signature or shared infrastructure
    Confidence
    0.40 on a scale of 0 to 1
    What would promote it
    its own history read, which would name the vaults' funding path
    What would kill it
    it paying a wallet in another named entity's set

    Promotion is a person's decision, and every promotion writes the re-runnable query into the evidence above.

    Open address

  28. Provisioning ping of the largest batch vault

    CandidateC-Chaincustody

    C-avax15nhrx5g8cn83ey6az2k90ge2adq3f5per9vkkn

    Attribution
    Filed under Coinbase Custody Trust Company as custody. Open entity
    Claim supported
    sent it 0.1000 AVAX at 14:21:12 UTC on 21 Oct 2025, seven hours before the 3.66M arrived, the same shape as the 0.206 AVAX gas ping that indexes this operation. Written in the C-avax1 spelling of the P-Chain key body, because nobody has read the key
    Evidence
    scratch/hunt/blue2/batch-counterparts.md section 6 and batch-counterparts-VERIFY.md, which refuted the claim that 0x1c90D544 has exactly one inbound edge in its life and found two: 0.1000 AVAX at 14:21:12 UTC on 21 Oct 2025 from C-avax15nhrx5g8cn83ey6az2k90ge2adq3f5per9vkkn, then 3,658,982.7000 AVAX at 21:32:10 from C-avax17xjk40aekl9026c77sneuur50hkm87s4my5uj4, seven hours apart. Class B, ancestry only: confidence 0.40 that the two belong to the same operation, with the customer unassigned. The other five counterparts have no foreign inbound atomic rows at all. The 3.66M moved during the period the company was buying and it is the only money the largest vault ever took in, which is why these two are the best next target in the family. Re-run: GET https://data-api.avax.network/v1/networks/mainnet/blockchains/c-chain/transactions?addresses={this key}&pageSize=100 and the same route on p-chain
    Source
    Related research: source destination unavailable.

    A candidate, and the tests on it

    Evidence class
    B, co-signature or shared infrastructure
    Confidence
    0.40 on a scale of 0 to 1
    What would promote it
    its own history read, which would name the vaults' funding path
    What would kill it
    it paying a wallet in another named entity's set

    Promotion is a person's decision, and every promotion writes the re-runnable query into the evidence above.

    Open address

  29. Family index

    InferredC-Chainfamily

    0xc9ce3688e88e447734187289fce0bf3f2650ae53

    Attribution
    Filed under Coinbase Custody Trust Company as family. Open entity
    Claim supported
    seven transactions in its life to seven distinct recipients, all of them family: 0x03ff6405, 0x8da8c161, 0xf9059a01, 0x6f86a8de, 0x75B0870C, 0x720efa4a and 0x273aa9ff, between 20:18:17 UTC on 5 Nov 2025 and 15:34:30 UTC on 1 Jul 2026. It is a near-twin by prefix and suffix of the vault 0xC9CEDe65...E5aE53, which is worth a look on its own
    Evidence
    scratch/hunt/blue2/batch-counterparts-VERIFY.md, the second dispenser: seven of seven payments land on family wallets, which gives the three wallets found by the payee walk a second independent link, so their membership does not rest on one funding payment. The customer is unassigned, because a dispenser holds nobody's balance. Re-run: GET https://api.routescan.io/v2/network/mainnet/evm/43114/etherscan/api?module=account&action=txlist&address=0xC9CE3688e88e447734187289fCE0bf3f2650aE53&sort=asc and check each recipient against the registry
    Source
    Related research: source destination unavailable.

    How this row was graded

    Evidence class
    A, flow tie
    Confidence
    0.70 on a scale of 0 to 1

    Open addressOpen in Snowscan (opens in a new tab)

  30. Payer of the 909,000.00 AVAX that started the…

    CandidateC-Chainother

    0x37dfb89e40b93ffeedb693c8ec0d8972044650b8

    Attribution
    Filed under Coinbase Custody Trust Company as other. Open entity
    Claim supported
    vault 0xC9CEDe65 - paid 328,774.90 AVAX in one of three consecutive seconds on 5 Nov 2025, and holds 0 or dust at both filed blocks
    Evidence
    scratch/hunt/blue2/batch-counterparts.md section 6: 0xC9CEDe65 was funded at 20:10:03, 20:10:04 and 20:10:05 UTC on 5 Nov 2025 by three payers, 328,774.90 plus 300,794.69 plus 279,430.41, which is exactly 909,000.00 AVAX, and all three read 0 or dust at both filed blocks. Class B and nothing else: paying a vault is ancestry, not identity, and who these three are is not established. Re-run: GET https://api.routescan.io/v2/network/mainnet/evm/43114/etherscan/api?module=account&action=txlist&address=0xC9CEDe653245689928AE513209F2215138E5aE53&sort=asc for the three payments, then the same call on each payer for its own funders
    Source
    Related research: source destination unavailable.

    A candidate, and the tests on it

    Evidence class
    B, co-signature or shared infrastructure
    Confidence
    0.35 on a scale of 0 to 1
    What would promote it
    its own funders read
    What would kill it
    a flow from it to another named entity

    Promotion is a person's decision, and every promotion writes the re-runnable query into the evidence above.

    Open addressOpen in Snowscan (opens in a new tab)

  31. Payer of the 909,000.00 AVAX that started the…

    CandidateC-Chainother

    0x273aa9ff8975c0c9daa05e5b40f8b23bef1561d7

    Attribution
    Filed under Coinbase Custody Trust Company as other. Open entity
    Claim supported
    vault 0xC9CEDe65 - paid 300,794.69 AVAX in one of three consecutive seconds on 5 Nov 2025, and holds 0 or dust at both filed blocks
    Evidence
    scratch/hunt/blue2/batch-counterparts.md section 6: 0xC9CEDe65 was funded at 20:10:03, 20:10:04 and 20:10:05 UTC on 5 Nov 2025 by three payers, 328,774.90 plus 300,794.69 plus 279,430.41, which is exactly 909,000.00 AVAX, and all three read 0 or dust at both filed blocks. Class B and nothing else: paying a vault is ancestry, not identity, and who these three are is not established. Re-run: GET https://api.routescan.io/v2/network/mainnet/evm/43114/etherscan/api?module=account&action=txlist&address=0xC9CEDe653245689928AE513209F2215138E5aE53&sort=asc for the three payments, then the same call on each payer for its own funders
    Source
    Related research: source destination unavailable.

    A candidate, and the tests on it

    Evidence class
    B, co-signature or shared infrastructure
    Confidence
    0.35 on a scale of 0 to 1
    What would promote it
    its own funders read
    What would kill it
    a flow from it to another named entity

    Promotion is a person's decision, and every promotion writes the re-runnable query into the evidence above.

    Open addressOpen in Snowscan (opens in a new tab)

  32. Payer of the 909,000.00 AVAX that started the…

    CandidateC-Chainother

    0xd91bd15232b0672aec37236f9352888d76dfc61d

    Attribution
    Filed under Coinbase Custody Trust Company as other. Open entity
    Claim supported
    vault 0xC9CEDe65 - paid 279,430.41 AVAX in one of three consecutive seconds on 5 Nov 2025, and holds 0 or dust at both filed blocks
    Evidence
    scratch/hunt/blue2/batch-counterparts.md section 6: 0xC9CEDe65 was funded at 20:10:03, 20:10:04 and 20:10:05 UTC on 5 Nov 2025 by three payers, 328,774.90 plus 300,794.69 plus 279,430.41, which is exactly 909,000.00 AVAX, and all three read 0 or dust at both filed blocks. Class B and nothing else: paying a vault is ancestry, not identity, and who these three are is not established. Re-run: GET https://api.routescan.io/v2/network/mainnet/evm/43114/etherscan/api?module=account&action=txlist&address=0xC9CEDe653245689928AE513209F2215138E5aE53&sort=asc for the three payments, then the same call on each payer for its own funders
    Source
    Related research: source destination unavailable.

    A candidate, and the tests on it

    Evidence class
    B, co-signature or shared infrastructure
    Confidence
    0.35 on a scale of 0 to 1
    What would promote it
    its own funders read
    What would kill it
    a flow from it to another named entity

    Promotion is a person's decision, and every promotion writes the re-runnable query into the evidence above.

    Open addressOpen in Snowscan (opens in a new tab)

Registry claims, address by address, with each claim's standing. 32 of 32 addresses read.

Wurrly Intel registry: compiled with this page.

Source: research address registry. 32 registry addresses for this subject, every one of them shown.

Read method

Nothing here is a new claim. The registry is the research’s label sheet: an address enters it when a figure on one of the research pages established it, and it takes that figure’s standing. This card restates those rows; it does not add to them, and it never upgrades a standing.

Registry method states a review on 4 September 2026. That is the method’s assertion about the whole sheet rather than a date filed against any one row, so it is not copied into a record. A record the registry files no review date against says so.

A source link renders only where this application resolved the destination itself. The one destination the registry files per entity is the research article that entity is written up on, and it is labelled Related research rather than presented as the citation for an individual address’s figure. No anchor, filing URL or transaction hash is derived from evidence prose.

A candidate is a lead one tier below inferred, and it attributes nothing. Where the registry grades a row, the grade, the evidence class and the two tests are printed as the research wrote them, and a confidence appears only on a row that carries a number. A proven row prints no confidence and neither test: nobody measured a number for it, and a row already at the top standing has nothing written that would move it up or out. Promotion is a person's decision, and every promotion writes the re-runnable query into the evidence above.

An explorer link, where one is shown, is an inspection destination and not evidence of ownership. Snowscan reads the C-Chain and Avascan reads the P-Chain.