Pi Network Suspected-Address Analysis Report
Part 1: Group classification / Part 2: Directed analysis and tracing the flow of funds / Part 3: Verifying inflows to the hubs (victim hop)

Japanese version: pi_thief_trace_report.html

Back to report index

Summary

• Tracing transfers within the list, the 8,132 suspected addresses split into one giant group of 8,126, one small group of 3, and 3 isolated addresses (Part 1).
• In directed terms, the strongly connected mutual-transfer core has 6,365 addresses. Entry points are few (41 send-only addresses), while 1,503 addresses only ever receive within the list (Part 2).
• After the Open Network launch (20 Feb 2025), 295,373,814 Pi flowed out of the list to external addresses. The largest destination is an exchange wallet: OKX received 103,624,335 Pi from 2,792 listed addresses.
• 4,464 listed addresses sent directly to exchanges, but amounts are concentrated: the top 100 senders account for 50.8% of all exchange-bound funds.
• Some terminal addresses never sent funds out at all and still hold large balances (largest: 373,298 Pi, zero outflows).
• Tracing the six largest unknown consolidation destinations beyond the exits over their full histories, the two primary targets (GCQH… and GAL4…) turned out not to hoard funds: they are pass-through points that disperse roughly what they receive in over 100,000 small payments each. The only large retention among the six was GANH…, holding a balance of 7,061,704 Pi (about 54% of its inflows). GAL4… was later identified as Pi Chain Mall's previous fund-storage wallet and GANH… as its new fund-storage wallet (official X post of 11 July 2025) (Part 2).
• GDIO… sent 99.96% of its payment outflows to exchanges, but a balance gap of about 7.95 million Pi, attributable to claimable balances, means it cannot be concluded that all of its funds reached exchanges (Part 2).
• The largest destination of GCP3, GDGII…, is a general large wallet whose biggest source of funds is OKX itself (about 86% of its inflows), and 88.8% of its outflows went to exchanges. The funds from GCP3 make up only about 1.7% of its inflows, so this branch terminates at the exchanges (Part 2).
• Applying the original three conditions (no incoming payments ever + first send within 3 minutes of the lockup release + post-send balance below 2 Pi), with effects, to inflows from outside the list into the two major hubs (pi chain mall / teltlk): of 21,141 non-list senders, only 5 matched fully on their first send (pi chain mall 2, teltlk 3), and only 6 including a later-send match. These are victim candidates, not suspected addresses, and this is not an addition to the suspected list (Part 3).

How the target list was built

The suspected-address list analysed here (findsp2.l_spam.txt, 8,132 addresses) was extracted by the list's creator from a specific period in 2023 using the following procedure:

1. Addresses that sent 1,000 Pi or more were treated as "tentative spam addresses".
2. Addresses that sent funds to a tentative spam address were treated as "tentative victim addresses".
3. A tentative victim address was excluded if its payment log contained any incoming payment record.
4. For a tentative victim, if the lockup release (end of the migration lock period) occurred less than 3 minutes before the victim's send time, the tentative spam address was confirmed as a "spam address".
5. The set of confirmed spam addresses forms the suspected-address list.

In other words, the list is the set of addresses that received funds sent within 3 minutes of a migration lockup release. The timing condition is designed to capture drainer-style receipts that target the moment of unlock, rather than coincidental ordinary transfers.

Basis for the two hub labels

This report refers to the two largest hubs in the list as "pi chain mall" and "teltlk". The basis for those attributions is set out here. A label shows only that the business itself has publicly stated the wallet is theirs; it does not by itself prove that the operator directed every flow. Because source pages can be deleted or changed, a preserved copy of each source (PDF or image) is hosted on this site.

pi chain mall — GDGVILYX4RATPIO6XTBXNIBEUZXI3EBI36NJXKGO4DVJINYJ5X42WXHF

• The official documentation of PiChain Global (GitBook, "PCM mainnet address", PCM mainnet address (GitBook)) states that PCM distributes its Pi across three mainnet wallets: Wallet 1 is this address, GDGVILYX4RATPIO6XTBXNIBEUZXI3EBI36NJXKGO4DVJINYJ5X42WXHF; Wallet 2 is GB7BHOTZXZXMSV7E22VAORD5PLOP7LMPKU2LO46DY27452PRQWSPRF67; and Wallet 3 (for Pi withdrawal) is GDUPXUGENG2YCX4BVYKS3LH4N4UT7BTYPMBOS5UCVTAX2E5IZ6VYLC4L.
• Cross-checked against the 8,132-address suspect list: Wallet 1 and Wallet 2 are in the list; Wallet 3 is not. In addition, the mainnet wallet address that pi chain mall's official account (@pichainmall) publicly announced on X on 1 October 2022 ("Our mainnet wallet address is …"), GBCRZX73YTPTA7HSHVXNXYGJCUUKVUQMASELPXZ5WQVDUT7RLINS6N3Y, as quoted by Newsway, is also in the list. By contrast, the two further wallets named in the official post of 11 July 2025 described next — the "previous" wallet GAL4NDELSPS2O74224ZAWIDOTC7NR3EOTWYOT2P5AXGSQCRL7ZUNS7PX and the newly announced wallet GANHBPJHHE6A2TNFIXPNBO3YH3PUYPMR5ZPTHKXIKFPVXTWX5YIBRFRE — are not in the list. So 3 of the 6 publicly known PCM wallets are members of the suspect list.
• As a further primary source, @pichainmall's X post of 11 July 2025, "PCM Wallet Update: New Fund Storage Pi Address Announced!" (X post (@pichainmall, 2025-07-11)), explicitly lists this address, GDGVILYX4RATPIO6XTBXNIBEUZXI3EBI36NJXKGO4DVJINYJ5X42WXHF, together with GAL4NDELSPS2O74224ZAWIDOTC7NR3EOTWYOT2P5AXGSQCRL7ZUNS7PX, as PCM's "Previous Wallet Addresses (Public)", and announces GANHBPJHHE6A2TNFIXPNBO3YH3PUYPMR5ZPTHKXIKFPVXTWX5YIBRFRE as its new fund-storage wallet. The reason given in the post is to enhance security and optimise fund management — a wallet rotation. A screenshot of the post, supplied by the list creator, is preserved below. The attribution of this address therefore rests on both PCM's official documentation and its own official post.

Preserved copy of the source (PDF): evidence_pcm_gitbook.pdf

Screenshot of the official X post of 11 July 2025 (supplied by the list creator): X post (@pichainmall, 2025-07-11)

teltlk — GBU7PR3VSIWZGQZYOHP6KEUEBJPX4HYN6FMHDB5VQNJ2NNVCWU4D5ANE

• The primary source is the official X post by TELTLK INTERNATIONAL (@teltlkteam) on 27 May 2024, "Regarding the Issue with Withdrawal of PI from TELTLK Addresses" (X post (@teltlkteam, 2024-05-27)). Its first point states in substance that all TELTLK users' Pi assets are stored on the PI NETWORK and gives this address, GBU7PR3VSIWZGQZYOHP6KEUEBJPX4HYN6FMHDB5VQNJ2NNVCWU4D5ANE. Points 2–6 say that withdrawals could not then be processed, that the issue had been reported to the Pi Core Team (@picoreteam) on May 23rd, that PCT was investigating it, and that TELTLK's global operations team urged a prompt resolution. The screenshot preserved below (supplied by the list creator) shows that post.
• The post is still live at the URL above. It was long thought to have been deleted because it does not surface in search results, but that belief was mistaken. A Binance Square article published the same day (republishing Beritabulukumba.com, Indonesia), "Regarding Alleged Pi Wallet Freezing, Teltlk International Urges Pi Network" (Binance Square article), is secondary coverage reporting this same statement.
• Supporting context: coverage in May 2024 (HokaNews / CoinGabbar) reported Teltlk's announcement that it held more than 18 million Pi, without printing the address.
• The withdrawal problem was temporary and has since been resolved: as checked on 2026-11-01 the account holds about 25.39M Pi, received payments on 2026-10-31, and its most recent outgoing payment was on 2026-10-26 (50,000 Pi) — the address is still active.

Screenshot of the official X post of 27 May 2024 (supplied by the list creator): X post (@teltlkteam, 2024-05-27) / Screenshot of the full text: evidence_teltlk_x_post2.jpg

Preserved copy of the source (PDF): evidence_teltlk_binance.pdf

Related files (links to GitHub Pages)

Each link points directly to a file hosted on the same GitHub Pages site as this report. Clicking a link opens the file in the browser.

Part 1: Group classification

Method

• The full payment history of every address was retrieved (5,722,075 payments scanned; 8,131 of 8,132 accounts retrieved successfully).
• Only payments where both sender and recipient are in the list were kept (self-transfers excluded; duplicate operations removed by operation id).
• Result: 1,464,362 intra-list payments, 108,010 directed pairs, of which 22,853 are reciprocal.
• Connected components were computed on the undirected graph of intra-list transfers. Connectivity follows multi-hop paths (A to B to C), not just direct pairs: only 0.26% of in-group pairs have a direct transfer, and the typical shortest path is 3 hops (mean 2.79).

Results

Group 1 (giant group): 8,126 addresses

• Each address transacts with an average of 26.6 other listed addresses.
• Largest hub: GCYGA2GHSEXGEWY5AO7JPAJZGKKCSZNAOOTHBXQDCUR6RWT7666IXBKX (involved in 2,205 intra-list pairs)
• Most frequent pair: GABGEE3UIGX3RZNWY7TGPWLFKVQOQEBHSZTP3Y65DSAUORYVMOQM5MM3 to GDPYUVUM6MXY5RUAWPTATGVWNT34DSTDNC3J6KGD4EAVW36XTNQALX7N (5,618 payments, 2022-10-20 to 2023-01-05)

Group 2 (small group): 3 addresses

• GA23OVVVUBQ4GVU57MRPYR5M3J6IWGTYFKZTNOHMGP34WOYQQ2COMVJC
• GBA4FSKGHYS5FJI2AXYQAQDHN6J64K5J4HGOCVJRSOMHRSITT6RQXCKR
• GCMPYHMMBVXPQTH36ZZY36M3BYD24KGFVB52YBEASKCKYFHUBTZ3DULT

Isolated addresses: 3

• GASI5VHBQIAQGCAT5LGZG3AWPSDEHDB2UUGRWVDNOLNTOHJ3RD5HB4KS (full history of 492 payments checked, 0 intra-list)
• GBBVVNPSCWICZOEZ3P3BSZAJEB7MZP27QQOU7XALFNDMKNBDFMFUHUIH (full history of 107 payments checked, 0 intra-list)
• GDP252PEO7OC2TJOZ34TZ7CPODLQFAKJYT4DQWFXRVEUBSQ3VMPRTYGL (full history of 105 payments checked, 0 intra-list)

Part 2: Directed analysis and tracing the flow of funds

Directed structure (strongly connected components)

• Total SCCs: 1,708. The largest strongly connected component has 6,365 addresses.
• Source-side components: 46; send-only addresses: 41.
• Sink SCCs: 1,536; addresses that only receive within the list: 1,503.
• The structure is "few entry points, the largest strongly connected component (6,365 addresses), and more than 1,500 endpoints".

Exit scan (native transfers to outside the list, on or after 2025-02-20T08:00Z)

The suspected activity is centred before the Open Network, and funds were expected to move out once external transfers became possible. All 8,132 addresses were scanned for payments after the Open Network launch only (0 errors, no HTTP 429).

• Listed addresses that sent funds out: 5,419
• External destinations: 28,155
• Total transfers: 678,353, amounting to 295,373,814 Pi

Top external destinations (final-destination candidates)

The top 4 destinations account for 61.7% of all outflows. The identified ones are major exchange wallets, and the earliest exits began on launch day itself (about 5 hours after the Open Network started). Exchange labels are based on a third-party investigation report (the BWX8 report) and news coverage, not on official exchange announcements.

Unidentified consolidation destinations

• GCQH27CCPDZGYFYD6U5RDK3E2THFATTE2XFSYZRALXZ6XUW42CSE4722: almost all of its 17,550,012 Pi came from a single sender, GBU7PR3VSIWZGQZYOHP6KEUEBJPX4HYN6FMHDB5VQNJ2NNVCWU4D5ANE (209 transfers, 2025-02-23 to 2026-10-26).
• GAL4NDELSPS2O74224ZAWIDOTC7NR3EOTWYOT2P5AXGSQCRL7ZUNS7PX: 13,801,320 Pi of its 13,821,491 Pi came from the largest hub, GDGVILYX4RATPIO6XTBXNIBEUZXI3EBI36NJXKGO4DVJINYJ5X42WXHF (585 transfers). This address was later publicly identified, in Pi Chain Mall's official X post of 11 July 2025, as PCM's own previous fund-storage wallet; with most of its inflow coming from GDGVILYX4RATPIO6XTBXNIBEUZXI3EBI36NJXKGO4DVJINYJ5X42WXHF, likewise a PCM wallet, the flows are consistent with movement between PCM's own wallets (see "Basis for the two hub labels").

Top exit addresses (within the list)

How many addresses send to exchanges?

• Listed addresses that sent directly to the four identified exchanges (OKX / Gate-linked / Bitget / MEXC): 4,464 in total (OKX 2,792; Gate-linked 1,229; Bitget 1,056; MEXC 756; duplicates removed).
• 1,091 of them used two or more exchanges, and 47 used all four.
• Amounts, however, are concentrated: of the 175,551,899 Pi sent to these exchanges, the top 100 senders account for 50.8% and the top 500 for 82.1%. Only 19 addresses sent 1,000,000 Pi or more. The median sender sent just 3,321 Pi.

Hoarding-type terminal addresses (funds never moved out)

By contrast, the largest hub GDGVILYX4RATPIO6XTBXNIBEUZXI3EBI36NJXKGO4DVJINYJ5X42WXHF is a pass-through, not a hoard: about 47.26 million Pi flowed in and the same amount flowed out over its lifetime, leaving a balance of only 2,923 Pi. An address that only receives within the list is therefore not necessarily a terminal point.

Tracing beyond the exits (second hop)

The large consolidation destinations that remained unidentified in the exit scan above were traced one step further. The targets are the top six non-exchange destinations of the outflow from the list. Their full payment histories were retrieved (no HTTP 429; all six completed; no scan caps reached) and aggregated for native Pi only. Amounts are all-time totals, unlike the exit scan above (which covered only the period from 20 Feb 2025), so each address's total inflows here are larger than the amount it received in the exit scan. Exchange labels are based on third-party investigation reports and news coverage, not on official exchange announcements.

Notes on each target

• GCQH27CCPDZGYFYD6U5RDK3E2THFATTE2XFSYZRALXZ6XUW42CSE4722: Not a hoard. It broke most of its inflows into 136,410 small payments dispersed to 10,892 destinations. Only about 1.8% of outflows went directly to exchanges, and 31,135 payments totalling 4,571,686 Pi went back to 713 listed addresses. It is a transit point, not a terminal.
• GAL4NDELSPS2O74224ZAWIDOTC7NR3EOTWYOT2P5AXGSQCRL7ZUNS7PX: Not a hoard. Its 111,391 payments dispersed funds to 6,771 destinations, and it circulates heavily with the list — including 28,729 payments totalling 5,113,374 Pi sent back to the in-list hub GDGVILYX4RAT…. It also circulates in both directions with GANHBPJHHE6A…. Note: this address was later publicly identified, in Pi Chain Mall's official X post of 11 July 2025, as PCM's own previous fund-storage wallet. GDGVILYX4RAT…, the source of most of its inflows, is likewise a PCM wallet (see "Basis for the two hub labels"), so the circulation observed here is consistent with movement between PCM's own wallets. A public label does not, however, prove who directed any given flow.
• GDIOBGWJZC7CZW32J3GAYUZGYGI5X3MK3O2W5KPF2OUPHCX3ZOYLLD24: 99.96% of its payment outflows went to exchange wallets (Gate.io-linked 4,450,200 Pi / OKX 1,030,000 Pi). However, there is a balance discrepancy of about 7.95 million Pi, and a check of /operations found 61 create_claimable_balance and 58 claim operations, which are outside the payments feed. This route is considered the main cause of the gap, so it cannot be concluded that all funds reached exchanges.
• GANHBPJHHE6A2TNFIXPNBO3YH3PUYPMR5ZPTHKXIKFPVXTWX5YIBRFRE: About 54% of inflows remain as balance, while most outflows are circulation to GAL4NDELSPS2… (3,780,000 Pi), an exit to the Gate.io-linked wallet (1,200,040 Pi), and a return to the in-list hub (1,050,002 Pi). It is neither a pure terminal nor a mere transit point. Note: this address is the new fund-storage wallet Pi Chain Mall announced in its official X post of 11 July 2025, replacing GDGV… and GAL4…. Its retained balance and its two-way flows with GAL4… (the previous wallet) are consistent with that wallet rotation inside PCM.
• GCP3OIKPKX2YUZ4M6ESNL4K22D4AZZHE6TJFJ7RIVLZBMOVVB3AMIW5F: Its balance is only 16,165 Pi. 67% of its outflows — 5,087,483 Pi — went to the unknown address GDGII3Q2US4L…, traced in the third-hop subsection below. It also sent 1,244,772 Pi to OKX and 1,100,000 Pi to GCQH27CCPDZ… (with which it exchanges payments in both directions).
• GD24QVE4R42E4XRDF6T5IN6UAQLD2WN7OQGUC2FBHFUUZM7GLE4KG6YA: It collected 46,307,778 Pi in 130,657 payments from 49,598 senders and forwarded almost all of it in 9,508 payments to a single external address, GDL66HS4YTUL…. Nothing went to exchanges or back to the list. However, only 1,054,409 Pi of its inflows (about 2.3%) was list-derived, and its senders include exchange wallets themselves, so this address looks like a large general relay only weakly connected to the list.

In conclusion, neither of the two primary targets (GCQH… and GAL4…) hoards funds: both are pass-through / dispersal hubs that break roughly the same amount they receive into a large number of small payments. The only large retention among the six was GANH…; GDIO… is exchange-exit in shape, but its verdict carries the claimable-balance caveat.

Third hop (GDGII…)

The unknown address GDGII3Q2US4L4NQSR3PYVXMLDEVGEIJA27A3LOFANWTLME2Q5IURFOFM — the largest destination of GCP3OIKPKX2Y… in the second-hop tracing above — was traced in the same way over its full payment history (3,472 records retrieved; no HTTP 429; no cap reached).

• Total inflows: 305,019,942 Pi (2,453 payments from 359 senders) / Total outflows: 293,497,102 Pi (1,019 payments to 74 destinations) / Current balance: 11,522,831 Pi (about 3.8% of all inflows).
• Sent to exchanges: 260,627,120 Pi in total (about 88.8% of outflows) — OKX 223,162,807 Pi, Gate.io-linked 28,681,952 Pi, Bitget 7,070,103 Pi, MEXC 1,712,258 Pi.
• Its largest source of funds is OKX itself: 263,382,413 Pi (about 86% of all inflows). It is a large two-way wallet that both receives from and sends to exchanges.
• Direct inflows from the suspected list: 0 Pi. The 5,087,483 Pi from GCP3OIKPKX2Y… is only about 1.7% of its total inflows. Flows back to the list amount to just 9.95 Pi, and flows to the second-hop consolidation addresses are 0 Pi.
• The difference between the balance and (inflows − outflows) is only −9.19 Pi, consistent with accumulated transaction fees. There is no large claimable-balance-type gap.

Verdict: GDGII… is not a consolidation or terminal point of the suspected network; it is a general, very large wallet with heavy two-way flows with exchanges. The funds from GCP3 most plausibly merged into this far larger flow and exited mainly to OKX, so this branch terminates at the exchanges. The largest non-exchange next destination is GBDCL7MLFVDZ… (27,830,915 Pi, with flows in both directions), but with about 89% of outflows already terminating at exchanges, a fourth hop would be of low value.

Part 3: Verifying inflows to the hubs (victim hop)

In the logic of the list's construction, drain-type transfers occur on the hop "victim address outside the list → address inside the list". The two major in-list hubs, pi chain mall (GDGVILYX4RATPIO6XTBXNIBEUZXI3EBI36NJXKGO4DVJINYJ5X42WXHF) and teltlk (GBU7PR3VSIWZGQZYOHP6KEUEBJPX4HYN6FMHDB5VQNJ2NNVCWU4D5ANE), were therefore tested by applying the list creator's original three conditions, unchanged, to all of their senders from outside the list, to check whether drain-shaped inflows actually exist. The full histories of both hubs were retrieved (no HTTP 429, 0 errors, no caps reached), covering 21,141 distinct non-list senders in total, all of which were scanned.

Method: lockup-release times from effects, and balance reconstruction

• Lockup-release times cannot be obtained from payments, so effects were used. From the rel_before predicate (in seconds) of type_i: 51 effects (claimable_balance_claimant_created), the release time = the effect's creation time + rel_before seconds. This reading was verified: for every case checked, the claim of the same balance_id (type_i: 52) occurred at or after the computed release time.
• The conditions are the original three, unchanged: (a) the address has never received any payment; (b) its first send occurred less than 3 minutes after its lockup release; (c) its balance after that send was below 2 Pi.
• Post-send balances were reconstructed by accumulating effects in ledger order and deducting transaction fees. Balances that could not be reconstructed were to be reported as "unknown" rather than guessed; for all senders passing condition (b), the balance was in fact determined (0 unknown).

The conditions are applied in stages, layered in the order (a) → (b) → (c); senders satisfying all of them are called (d) full matches.

The funnel

Most non-list inflows are of the ordinary kind and fail at (a) (the sender has received payments before); even among the senders passing (a), most sent more than 60 minutes after their release. In addition to the 5 (d) full matches on the first send, one further sender to pi chain mall matched all three conditions on a later send, for a total of 6.

The 6 (d) full matches (victim candidates)

*1 The first send was 0.02 Pi; its sends to the target total 0.232 Pi over 7 payments. *2 Matched on a later send, not on its first send.

All six are textbook drain shapes: claim and send immediately after the release (the shortest gap is 1 second), leaving a post-send balance of about 1 Pi (equivalent to the minimum balance). However, across both hubs there are only 6 such senders, and the amounts are small.

Limitations of this verification

Limitations

Generated by Moko (Muse) / Muse Spark 1.3 - Target list: https://github.com/tysseo7/Pi-Thief-Trace/blob/main/findsp2.l_spam.txt