A custodian is a regulated firm that safekeeps assets for clients, often inside pooled infrastructure where no address belongs to any one customer. That was the working assumption on this page for a month, and for the Coinbase Custody row it holds. The Anchorage row is different, and the filing says so itself: the collateral is “held in a segregated custody account with Anchorage Digital Bank N.A. pursuant to an Account Control Agreement”.

A segregated account can be read. At block 89,166,730, the last C-Chain block at or before 2026-06-30 23:59:59 UTC, the treasury wallet held 7,809,589 AVAX and the wallet this page has been calling the counterparty held 2,992,571. Together that is 10,802,160.57 against the 10,802,156 the 10-Q puts at Anchorage on the same date, a difference of 4.57 AVAX, or 0.00004 percent. Every other traced C-Chain wallet read zero at that block.

Two consequences follow, and both change how the rest of this page should be read. The traced trail is the Anchorage position: the collateral wallet, the staging wallet and the six validator keys were all funded by those two wallets afterwards. And the counterparty is not a third party. It is the second wallet in the same custody account. The filed figure the trail does not reach is Coinbase Custody’s, and that side has its own chapter: nine vaults on a monthly clock.

What stays inferred is the custodian’s name. No filing prints an address, so Anchorage is attached to these two wallets by elimination among three named custodians and by three filed sentences that agree. The balance is measured; the nameplate is read off the filing.

An account’s nonce counts the transactions it has sent, so it only rises when the account itself sends something. This address has sent zero EVM transactions and holds no contract code, yet its nonce is 2. It is also short by 2,242,503 AVAX. The trailing fraction on the balance is gas, spent by an address that supposedly never transacted.

One mechanism fits: an atomic cross-chain export. Moving AVAX from the C-Chain to the P-Chain for staking increments the nonce but produces no EVM transaction, so no transfer list on any explorer built for EVM chains records it. Some $15M moved and left no row anywhere.

In a database, a join key is the field two tables share, so their rows can be matched. The disclosed quantity provides that comparison. The recorded balance, its share of token supply, and the BitGo custody pattern support the attribution. The rounding differences remain visible in the two historical source records.

Neither company holds these tokens now. AVAT had closed out its liquid-staking position by 8 July 2026 (S-1: “approximately 0%… of stAVAX and… sAVAX”), and the token’s supply has since collapsed from about 2.0M to 473,077. That is why a current holder list shows nothing, and why three earlier passes, two of them by other AI models, concluded there was no wallet to find. The blockchain, though, is permanent. At the block of each filing date the filed quantities are still there, and reading the chain at those historical blocks is what recovers them.

The protocol behind AVAT’s trail is shutting down

There is a reason that supply is falling. stAVAX is issued by Hypha, formerly GoGoPool, and the protocol is shutting down. Its own end-of-life page states that operations end on 15 August 2026, after which stAVAX stops accruing yield and holders must redeem for AVAX before the site goes dark on 31 December. AVAT was the single largest holder, at about 42%, of a liquid-staking token whose protocol is now winding down, and it was fully out weeks before the shutdown date. The current redemption rate is 1.1938 AVAX per stAVAX.

Proven versus inferred

A wallet label is a name someone typed. A join key is an unrounded number a company filed with the SEC that matches a single wallet on the chain. The match is proven. That the wallet belongs to the company is inferred, from that quantity, from each filer being the only registrant disclosing that position, and from the BitGo custody pattern. An inference is weaker than a disclosure, and no address has been disclosed. The method also reaches only the liquid-staking slice; the custodied and natively staked bulk of each treasury stays invisible.

The company withheld the address and published the quantity. A number stated to the last token is harder to hide than a wallet.

The route: the second Anchorage wallet 0xefe6e557 sent a 5-AVAX test to a fresh wallet, 0xb33c0018, then 521,159 AVAX in two tranches the next day. The wallet sat still for five days. Then, on the morning of the Q2 earnings call, about three and a half hours before management restated its strategy as “accumulating AVAX”, 100,000 AVAX went to deposit #1, an address explorers label as a Coinbase deposit. That was the first of 12 such transfers. By 15 September the cumulative total was 1,200,000 AVAX across 6 deposit addresses, and the staging wallet held 349,668. Same-day closes value the twelve at $9,000,200, which measures value moved rather than proceeds. A deposit address forwards what it receives into the exchange’s internal ledger, and once there the public trail ends. What the chain establishes is that the AVAX reached these addresses. Whose account they belong to is not established, no sale is established, and neither is the use of any proceeds. The Q3 10-Q’s token count at 30 September is what will say whether the 1,200,000 AVAX left the company’s holdings.

The trail did not stop when this page first published. About seven hours later, on the evening of 27 Aug, the counterparty staged 1,028,504 AVAX more into the same wallet — and its remaining balance then fell by exactly 4,000,000 AVAX with no EVM transaction and no internal transaction to show for it. This page first called that “consistent with a P-Chain move, unprovable from the C-Chain side.” It is now proven: the atomic layer shows two exports of exactly 2,000,000 AVAX each on 28 Aug, and the P-Chain answers what they became — two brand-new validators, started within a minute of each other.

The profiles diverge on purpose, or so the shapes suggest: one node charges a 5% delegation fee and is open for business; the other charges 100% — the exact uniform of the private 16-node ladder on the Fleet page, on a 15-day term to the ladder’s ~16. Its reward address is not the ladder’s, so this is a pattern match, not a fingerprint. Correction, 17 September 2026: this sentence used to call a 100% fee one no outsider would ever delegate to. That is wrong. A 100% fee leaves a delegator nothing to earn, and delegators come anyway. The node carrying the largest Coinbase Custody vault’s stake charges 100% and returned two delegators with 260,911.20 AVAX between them when platform.getCurrentValidators was read on 17 September 2026. That same reward address has history: it validated 1,125,595 AVAX from 2 to 16 April at a 5% fee and earned 2,319 AVAX — the exact window in which the stAVAX position of Figure 06 was being redeemed. The staking arm is not new; it has been running since April.

Two more on 9 September, and one ended on the 13th. At 16:17 and 16:18 UTC on 9 Sep the counterparty exported 1,134,000 AVAX twice, to two P-Chain keys with no prior history. Both imported at 16:20 and staked 1,133,999 AVAX each within eight minutes: P-avax1xnywps55r3tsssxklsj6039l9e67t3h2qxedps on NodeID-…Ej4R8ukp to 24 September, and P-avax1qjukw4p93pyygk0zdgw2zqsyspatw829d5gtqn on NodeID-…itWckyPD to 29 September. That emptied the counterparty’s C-Chain balance. Four days later the second of the 28 August validators reached the end of its term. Its owner key P-avax1pgjtvez2rr7yf9yejs6pkr7kpu4xnw76uynl9n read 2,004,596 AVAX unlocked and zero staked on the evening of 13 September, the returned stake plus its reward, with nothing done with it at the read. Four validator positions across the record, three of them staked at that read. The two collateral keys are separate and were re-committed on 3 September: 1,126,094 and 1,128,858 AVAX, both staked until 29 September.

The provenance also closed upstream. A sixth wallet — 0x98a90680, now on the watch below — was funded in June with 3,409,469 AVAX routed via BitGo wallet A and 4,060,744 AVAX delivered out of Coinbase Custody: five cold wallets consolidated on 9 June and the money reached the treasury through a Coinbase Prime deposit address and the Prime hot wallet the next day, 79 minutes end to end. That route is measured on either side of the hot wallet and matched by amount and timing across it, and it is the subject of the Custody chapter. On 13 Aug — the day the company set its Q2 date — it sent exactly 5,600,000 AVAX, the FalconX pledge figure, to the counterparty — and on 2 September, at 16:07 UTC, the rest: 2,215,234 AVAX down the same route, leaving it with 0 AVAX. The staging wallet 0xb33c0018 holds 349,668 AVAX, and the counterparty holds 0 AVAX. The counterparty held 2,566 when Figure 03 was written, 5.08M on results day and 2,268,132 after the treasury emptied into it. On 9 September it exported the lot in two atomic hops of 1,134,000 each, both of which became stakes. These figures read live from the same call as Figure 08. When the call has not answered, the numbers shown are the snapshot of 2026-09-16 and are labelled as a snapshot.

The transfers kept coming. On 31 Aug at 16:04 UTC another 100,000 AVAX left the staging wallet, and on 1 Sep at 14:55 another, each to a different Coinbase deposit address and each rehearsed first: at 15:29 and 15:31 on 31 Aug the staging wallet sent 0.05 and 0.08 AVAX to two untouched addresses, the same dust test that opened this trail eleven days earlier. A fourth went on 2 Sep and a fifth on 3 Sep, each through one of the addresses dusted on 31 Aug and left unused until then. The sixth, on 4 Sep, took the last of the dusted three. Then the addresses began to repeat: 7 Sep to deposit #2, 8 Sep to #3, 9 Sep to #4, 10 Sep to #5, 11 Sep to #6. A twelfth followed on 15 Sep. Twelve transfers of exactly 100,000 AVAX, through six addresses, over twenty days, which is 1,200,000 AVAX in total. In the same thirteen minutes as the dust tests, the wallet also topped up the gas of 0x46d1b5d9, which has collected sub-AVAX payments since December 2025, the first direct link between this ramp and an operation that predates the listing.

Six deposit addresses could mean six accounts, and a shared mailbox proves nothing by itself. So the question was first put to the clock. Every transfer was swept out of its deposit address within minutes. Nine of the twelve went to the same Coinbase hot wallet, and after the early ones the hot wallet forwarded a comparable sum onward within four minutes to one address, 0xC9F151: measured against every inflow of 50,000 AVAX or more into that hot wallet since 7 August, five times out of five for this trail against three of twenty-seven for unrelated deposits. That measurement stands; the reading this page first gave it — one customer account on the far side — is withdrawn. Re-read on 2 September, 0xC9F151 takes AVAX in from the hot wallet and sends it out to exactly one place, the same hot wallet: 2,479,090 in, 2,094,791 back. The address that took the forwards after tranches four and five behaves the same way. A key that only ever returns funds to the hot wallet is the exchange moving its own float, and says nothing about whose account the tranches reached. What the far side can be made to say — Coinbase’s own market, read for the hour after each sweep — is on The Watch.

Three sweeps broke the pattern, and each is named with its date. On 4 September deposit #6 forwarded its 100,000 AVAX 40 seconds later to 0xb6242194, which the chain record carries a label for: Coinbase internal float. That is a label, not a disclosure. On 8 September deposit #3 forwarded its 100,000 AVAX 119 seconds later to 0xe1a0ddeb9b5b55e489977b438764e60e314e917c, an address this trail had not seen before. Who owns it is not established. On 15 September deposit #2 forwarded its 100,000 AVAX 242 seconds later, the longest wait on the trail, to 0x333d17d3, which Snowtrace tags Coinbase 6. The other nine went to the hot wallet. A label on an exchange’s own key is a label, and none of the three says whose account took the deposit.

And then there is what the staging wallet did in thirteen minutes on 31 August. Between 15:18 and 15:31 it sent sub-AVAX dust to six addresses. Two it used for size within a day, the transfers above. The other three sat unused for a further day or more, then took a transfer each on 2, 3 and 4 September, and a second each on 9, 10 and 11 September. All three had already received 2,000,000 AVAX between them, arriving as atomic imports from the staking layer.

Dust before size is ordinary practice: you confirm an address before trusting it with a fortune. This page once read the thirteen minutes as an operator enumerating its own deposit addresses, and withdrew that reading on 16 September. Correction, 17 September 2026: dust followed by size is a weak prior and not a fingerprint. A sweep of the P-Chain delegator population found the same sequence on an ordinary exchange withdrawal that has nothing to do with this trail. It is worth something only with a second signal beside it, such as a sender already in the record or a transfer of 100,000 AVAX or more within a day. Two sources fed these six addresses in the same weeks, and one of them was not this trail. The staking desk above exported into five of the six between 12 and 26 August. That is the August tranche of a longer run: from 11 June to 26 August 2026 the desk paid those five 2,750,001.50 AVAX in 15 transfers, and its own AVAX was outside AVAT’s filed holdings at 30 June. So a deposit address here took money from two parties whose holdings the filings separate, and the chain does not say whose account the mailbox belongs to. Either a desk delivered somebody else’s AVAX into an account this trail also uses, which a stated strategy of accumulating AVAX allows, or this trail delivered its AVAX into somebody else’s. Nothing measured decides it.

The columns below are two reads and are not added together. The staging column is verified transaction by transaction through 2026-09-16: 1,200,000 AVAX across all 12 transfers, each broken out to the address that took it. A separate read on 2026-09-01 found 2,750,000 AVAX of atomic imports into the same six, the transfer type no EVM explorer lists and the same blind spot that hid the 4,000,000 above. The ordinary-transfer history behind the third column has not been re-verified since 1 September. The first atomic import landed on 2026-06-11, the day AVAT began trading.

Four sweep destinations. The Coinbase hot wallet took nine of the twelve; the address labelled Coinbase internal float took deposit #6’s on 4 September; an unidentified address took deposit #3’s on 8 September; and the address labelled Coinbase 6 took deposit #2’s on 15 September, 242 seconds after the transfer landed, the longest wait on the trail. The staging column above breaks out all twelve transfers of 26 August to 15 September address by address.

Correction, 17 September 2026: this page used to call the six addresses a deposit family, as though they were one household and that household were AVAT’s. Reading how each of them opened says otherwise. Five of the six were opened on 11 June 2026 by a ladder of dust from the shared-custody desk: 0.5, 0.4, 0.3, 0.2 and 0.1 AVAX, sent within 7 minutes 47 seconds by four keys of the 38-key shared-custody family. From 11 June to 26 August 2026 that same desk paid those five 2,750,001.50 AVAX in 15 cross-chain transfers, signed between them by 34 P-Chain keys, 31 of which this research already held. From 31 August to 15 September 2026 AVAT’s staging wallet paid the same five 1,100,000.32 AVAX, opening the way the desk had opened eleven weeks earlier: 0.05, 0.03, 0.09, 0.07 and 0.08 AVAX, sent within 93 seconds on 31 August, with the first 100,000 AVAX following 33 minutes later. The denominations differ and the signer differs, and the ritual is the same. Nothing else above dust has ever paid those five addresses. Their transaction lists show 15 other inbound rows, and every one is an address-poisoning payment of the kind the Watch chapter documents. Eleven came from 0xb33c4d973c6ef918bd1139efc82858aaec482d20 and three from 0xb33c303716404452ffa353f9d03d827ad6892d20, between 0.00001 and 0.00001195 AVAX, each one inside 8 minutes of a 100,000 AVAX transfer from the staging wallet. The fifteenth is the same pattern on a larger transfer: 0.00000023 AVAX reached deposit #4 from 0xb6247ca4bec7dfe1f8ff19683922ee7b7b3fffe0 at 14:10:50 UTC on 14 Jul 2026, 5 minutes and 43 seconds after that deposit sent 250,000.30 AVAX to 0xb624219480543c54603fb6b07d5eb347e51bffe0, the address the record labels Coinbase internal float, and the sender copies that address's first four and last four hex characters. All 15 are inbound, and an inbound payment settles nothing about who holds the account. Re-run: the Routescan v2 txlist on each of the five, paged to the end, read 16 Sep 2026.

The sixth address is deposit #1 in the table above, and it is different in every respect. AVAT's staging wallet paid this Coinbase deposit address once, on 26 August 2026, and has not paid it since. It has never taken anything from the P-Chain, it has been in service since 9 December 2025, and its 552,494.11 AVAX of lifetime inflow came from four unrelated groups of payers over nine months. The account holder is not established. That one transfer is 18.1 percent of the nine months of inflow. Calling it an AVAT exchange deposit address in use since December 2025, which this research did until 17 September 2026, said more than the measurements support.

The twelve transfers of 100,000 AVAX out of the staging wallet come to 1,200,000 AVAX: 1,100,000 into the five and 100,000 into the sixth. The five also took 0.32 AVAX of opening dust from the same wallet on 31 August, which is why the payer total above reads 1,100,000.32 AVAX and not 1,100,000.

A deposit address is a receiving address, so anyone can pay one and a set of payers is not a set of owners. Two separate parties paid the same five addresses in the same quarter, and no key of the family that paid the larger share sits inside either quantity the company filed for its custodians. Whether the twelve transfers of 100,000 AVAX left the company's holdings or moved inside them is not something the chain can settle. The token count at 30 September 2026 in the Q3 10-Q will settle it.

So where do the 2,750,000 atomic AVAX come from? An atomic import’s sender prints as a C-avax1… address, and that is the same key as the P-avax1… address with the same characters — so every import can be walked back onto the P-Chain and asked what it was doing there. The nine sender keys are one wallet. Its hub, P-avax1jygrh3y…, held 1,025,974 AVAX unlocked and 261,358 staked at the 2026-09-01 read, and its history reads like a staking desk’s diary: on 2026-01-19 it gathered 2,619,827 AVAX from 34 addresses, split it into 100,000-AVAX lots, and has since run a rolling programme of about 90-day validations, 9 of them, each paying out about three months on. Every time one does, 250,000 AVAX is exported into five of the six Coinbase deposit addresses. Its first export landed on 11 June, the day AVAT listed; its most recent, 52 minutes after tranche 1.

This desk is a different operation from the private ladder of the Fleet page. Ninety-day terms rather than sixteen, fees of 2 to 20% rather than 100%, cloud hosts, small outside delegators accepted, and no key, beneficiary or NodeID in common with the 70 validators scanned there. It is a professional staking operation.

Withdrawn: the reading this page gave it, that the desk is Coinbase Custody staking AVAT’s tokens. Two measurements replace it. Coinbase Custody’s staking for this client is now enumerated, and it runs as nine single-key vaults on monthly cycles that never co-sign, which is a different arrangement from a co-signing desk on 90-day terms. And at 30 June 2026 23:59:59 UTC this hub held 968,474 AVAX unlocked and 468,858 staked, at an instant when the two Anchorage wallets and the six Coinbase vaults already fill the filed custodian figures to 99.7 percent. Its 1.44M AVAX was outside AVAT’s filed holdings on that date.

What stands is what was measured. This desk exports into the same Coinbase deposit addresses the staging wallet uses: 250,000 AVAX into deposit #6 on 11 June, AVAT’s listing day, and five more round exports of 250,000 to 500,000 AVAX into deposits #2, #6, #5, #4 and #3 between 12 and 26 August, the last of them 52 minutes after the first transfer reached deposit #1. The same family of keys delivered AVAX One's treasury, 15,980,900 AVAX on 28 October 2025, on P-avax1r836g3a… rather than the hub. Two sources whose AVAX was not the same client’s at 30 June fed the same six addresses in the same weeks, and the chain does not say which way the ownership runs. The 0.05 AVAX rider on each of the desk’s exports is the prepaid import fee the network charges, which a verifier settled; it marks nobody.

Four dated facts stand around the same weeks, and none of them explains another. The Q2 10-Q discloses $10.0 million of realised losses in the quarter, “primarily related to dispositions of AVAX at values below their carrying amounts”. The Galaxy loan comes due on 10 Jan 2027, and the 8-K’s $10M repayment earmark is still unconfirmed in any filing. The same week’s press release announced a $10M share repurchase program, and no filing read here reports a purchase under it. The arithmetic of the discount is on its own page. What connects any of these to the twelve transfers is not on the record, and the line that would settle whether AVAX left the holdings is the token count at 30 September in a 10-Q that does not exist yet.

Within minutes of every real transfer, dust and zero-value transactions arrive from lookalike addresses that share the first and last four characters of the real endpoint, and fake tokens named AVAX emit transfer events mirroring the real amounts — address poisoning, seeding false history in the hope a future copy-paste sends real funds their way. The full record is on The Watch. Whoever runs these wallets, professional watchers already track them in real time.