Correcting myself: those "6 addresses I could not parse" are not holdings I missed. They are your destination lookup table, and I misread my own gap. Your tracked set is 97 and my coverage of it is complete.
bc1qp6yzmq5kjr8yvyw7453gxvq4z3tvkdyadqm794 THORChain BTC vault
3KMmeqPeQcngyTehdfSwsGqvxfU7J7qtc8 P2SH service hub
3CTpBmp8uWTcHJBjmyVe8VPPyCHTzj2hBH Bullish.com deposit
bc1qactqjuk4kghfgaqqt454hzzzs5lsaysunf80gh P2WPKH service hub
bc1qdj58duywm3ng0twrxk5kykup9q6jmmj72n60ms Coinbase Prime Custody
bc1qdt6cswq9pld5e96el8ljhk4zfqmv423atgsrqw parked sibling
I have wired those labels into the monitor, so when a tracked address spends, the alert names the venue instead of printing a bare address.
AND ONE OF THEM MATTERS RIGHT NOW, GIVEN YOU HAVE BEEN ASKING FOR EYES AT COINBASE
That 147 BTC consolidation I mentioned — the one where the Wave 4 park contributed 1.91% — landed at the address you label Coinbase Prime Custody.
txid 23a84f33fe49943e34f58bcecc945f719208f10c2a65f1ea12944ec103bc709c
block 960818, confirmed 2026-08-03 03:55:07 UTC
34 inputs totalling 147.27993809 BTC
output 146.77351359 BTC -> bc1qdj58duywm3ng0twrxk5kykup9q6jmmj72n60ms
I checked whether the label holds up by shape rather than taking it on faith:
ever received 346,899.92582567 BTC
balance 499.13205632 BTC
tx count 1,929
That is an institutional custody profile, not a hop address. It does not prove the operator is Coinbase — I cannot confirm that from the chain and I am not going to pretend otherwise — but it is entirely consistent with your label, and it is a venue with a compliance desk.
NOW THE PART THAT WEAKENS MY OWN HEADLINE, WHICH YOU SHOULD HAVE BEFORE YOU SEND ANYTHING
Of that 146.77 BTC, only 2.81971503 came from a tracked address — 1.91%. The other 33 inputs I have not attributed. So the defensible claim is:
"a consolidation transaction that includes 2.82 BTC traceable to a tracked
Wave 4 park address delivered 146.77 BTC into this deposit at 03:55 UTC"
and NOT "146 BTC of stolen funds went to Coinbase". If you send the second version to an exchange and they check it, you lose the credibility you need for the next report. The first version is smaller, survives scrutiny, and is still enough to justify them freezing and looking.
The Bullish one remains your strongest artifact because it needs no such hedging: txid 6f19b1b9e3d602335c62861ce3d90631b34945fd2998d9bcd7e6a14a68fdd235, a single input, 100% from the tracked address, 2.575 BTC straight to their deposit. One hop, no shared-input guesswork, nothing for anyone to argue with.
If it helps, send those two to the exchanges in that order: the clean single-input one first to establish you are precise, then the consolidation with the 1.91% stated openly. Being the person who volunteers the weakness in their own evidence is what gets the second email read.
