Avalanche Treasury Corp.

12 transfers of exactly 100,000 AVAX went from the staging wallet into six Coinbase deposit addresses between 26 August and 15 September, 1,200,000 in all. Every one was swept out of its deposit address within minutes, the fastest in 14 seconds and the slowest in 242. Nine sweeps went to the Coinbase hot wallet 0x4a4e8595. The 4 September sweep went to 0xb6242194, which the chain record labels Coinbase internal float; the 8 September sweep went to 0xe1a0ddeb9b5b55e489977b438764e60e314e917c, whose owner is not established; and the 15 September sweep, from deposit #2, went to 0x333d17d3, labelled Coinbase 6. After that the chain goes dark, because a hot wallet is the exchange’s own ledger. Whose account the deposit addresses belong to is not established either. Five of the six were opened on 11 June 2026 by a shared-custody desk, which paid them 2,750,001.50 AVAX between then and 26 August, before the staging wallet paid the same five 1,100,000.32 AVAX. The sixth has been in service since 9 December 2025, took one of the twelve transfers, and draws 18.1 percent of its lifetime inflow from this trail. Whether the twelve transfers left the company’s holdings or moved inside them is not something the chain can settle. The token count at 30 September 2026 in the Q3 10-Q will settle it. The one thing the chain can still say is that nothing has come back out: no AVAX, and no real USDC, USDT or wrapped AVAX, had reached any of the seven trail wallets since 20 August, checked by contract address on 2026-09-03.

A correction first. The Wallets reported that every early sweep was followed within four minutes by a forward from the hot wallet to one address, 0xC9F151, five times out of five against three of twenty-seven for unrelated deposits, and read that as one customer account on the far side. The timing was measured correctly; the reading was wrong. Over its last hundred rows that address took 2,479,090 AVAX in, nearly all of it from the hot wallet, and sent 2,094,791 out — every unit of it back to the same hot wallet. The address that took the forwards after tranches four and five, 0x0dF676, has behaved the same way since June (2,127,086 in, 1,884,381 back), and the two share upstream addresses. A key that only ever returns funds to the hot wallet is the exchange moving its own float between its own keys. It says nothing about whose account the tranches landed in, and that reading is withdrawn.

So the question was put to the market instead. If a transfer were sold at market on arrival, it would have to trade: Coinbase’s own AVAX-USD book, in the hour after the sweep, would need at least 100,000 AVAX of taker selling it did not otherwise have. The table below reads that hour for the first 5 transfers only, 26 Aug – 3 Sep 2026, against every rolling hour of the prior day. The seven transfers of 4 to 15 September have no rows here. Each needs its own hour of candles and its own trade tape, and neither has been measured. The study’s scope has not moved since it was made.

Four of the five hours were ordinary: the whole book traded a tenth to a third of a tranche. The fifth, on 3 September, was the busiest hour of its day, so it was read trade by trade: 1,862 prints, 47,638 AVAX of taker buying against 17,996 of taker selling — a sell share of 27%, down from 43% the hour before, with 25,961 of taker buying between 14:39 and 14:49. The price rose 1.94%. That is the shape of buyers, not of a hundred thousand being unloaded. The most taker selling measured in any post-sweep hour is 17,996 AVAX, against the 100,000 a market sale of one tranche would need.

A slower programme would show at the daily scale instead, as Coinbase carrying volume it did not carry before. It does not: Coinbase’s AVAX-USD daily volume fell from a median of 820,033 AVAX in the three weeks before the tranches to 542,483 after, and its share of volume against Kraken, the control, moved from 76.2% to 77.8%. A hundred thousand a day would be a fifth of that book.

What that leaves is stated as the inference it is. The AVAX went to the exchange side of Coinbase, not to its custody arm: the deposit addresses sweep into the trading hot wallet, while the wallet that funded this whole trail was itself funded from an address Arkham attributes to Coinbase Prime. On the exchange side it is either being held, or being sold somewhere the public tape cannot see — over the counter, or in pieces small enough to hide in a shrinking market. Nothing measured requires the second reading, and nothing rules it out. The definitive answer is in a filing that does not exist yet: the line for proceeds from sales of digital assets in the third-quarter 10-Q. Until then the same hour can be measured the same way for any transfer. The table above holds the 5 hours that have been measured, 26 Aug – 3 Sep 2026. The seven transfers of 4 to 15 September are recorded on the ledger and the map, and their market hours are not in this table.

Since the day the treasury wallet first paid the counterparty, every real transfer on this trail has been answered within minutes by dust — sixteen billionths of an AVAX, a millionth, ten millionths — from addresses built to look like the transfer’s other end: the same first four and last four characters as the real deposit address, the real counterparty, the real ops wallet. Across seven waves, 26 such addresses have sent 37 of these into the treasury and staging wallets. The trap is the wallet’s own history: whoever next copies “the address I last sent to” from a transaction list may copy a poisoner’s and send a tranche to a stranger. The practice has a name, address poisoning, and it is not aimed at AVAT in particular — the same senders dust the hot wallet’s own peers with lookalikes of the hot wallet.

It runs the other way too. Two addresses that imitate the staging wallet itself — 0xb33c4D97…2d20 and 0xB33c3037…2D20 — dusted each real deposit address minutes after its transfer, all five times in the window this study covers, so that the deposit address’s own history shows a fake “staging” sender beside the real one. The waves after 3 September have not been read.

And there is a second layer. A token contract named, literally, AVAX emits transfer events that mirror the real amounts to the lookalike addresses: 2,215,234.4768 “from” the treasury wallet the afternoon it emptied, 100,000 “from” the staging wallet after each tranche. Any explorer that matches tokens by symbol shows these wallets sending AVAX to addresses they never touched. Only the contract address separates the real token from the fake — which is why the ledger above matches on contract, never on name.

Proven: every send in the table, its sender, its timing. Inferred: that it is one operation — the same five dust sizes recur in every wave, whichever address is being imitated. Not inferred, because it is measurable and false so far: that the trap has worked. Every send out of the staging wallet has gone to a real address on this trail.

Nothing on the map is a new claim. Each box cites the figure on The Wallets that established it, and inherits that figure’s standing: a filed quantity matched to the unit, a transaction with a hash, a stake read from the P-Chain — proven; a dust test, a timing correlation, an explorer label — inferred, and drawn dashed. When a new address joins the trail it is added to the map file with its figure, and the ledger and balances pick it up on the next read. When a reading fails, as the forwarding reading did, it is withdrawn here in words, not quietly edited.

Four readers. C-Chain balances come from the public RPC. Transfers come from Routescan’s v2 address endpoint, chosen because it returns atomic rows — the exports and imports between chains that the etherscan-compatible endpoints, and every explorer built on them, omit. P-Chain balance and stake come from the platform API, batched, because the public node rate-limits. The market comes from Coinbase Exchange’s public candles and trade tape, no key required. All are read server-side; the browser only ever talks to this site.

What it cannot do. It cannot see an exchange’s internal ledger, the account behind a deposit address, or the P-Chain owner behind a NodeID unless the chain names one. It cannot see an over-the-counter sale. It does not attribute. A custodian is not uniformly opaque, and the difference matters here: the Anchorage position is a segregated account whose two wallets a filed quantity pins to the unit, while Coinbase Custody’s side is reached only through the staking job its keys run, and six of those nine keys are tied as a set rather than one by one. When a box is inferred, the inference is on The Wallets or on Custody with its base rate; the map only carries the verdict.