A Worked Case: Reading One Wallet End to End

Every prior chapter covered one instrument. This one plays them in sequence, on a single wallet, in the exact order the engine runs — because the discipline of reading a wallet is the discipline of a fixed interrogation order, where each question is asked once and each answer is allowed to be “nothing.”

The subject is a clean, public example address, one of the homepage’s own demo wallets, chosen because its trace exercises most of the method while accusing no one:

TAKDPhWbXzE3XBmicbGuMqKLP9vEVuJVJm

Every figure below is a live result, reproducible at the time of writing with a single call — the reproducibility the evidence chapter asks for:

curl -sS "https://tronorigin.io/api/analyze/TAKDPhWbXzE3XBmicbGuMqKLP9vEVuJVJm"

Stage 0 — Gather, then subtract the noise

The engine first gathers the wallet’s inbound history — here 36 transactions, on an account created in August 2020 that went quiet minutes later. Before anyone is ranked, it runs poisoning detection, tags behavior, and filters DEX-router traffic out of the scoring stream. You cannot read a wallet from its last transaction, and the engine will refuse to answer at all if nothing usable survives the filter. The one behavioral tag raised here is GENESIS_FUNDER; no poisoning, no mixer contact. Subtracting the noise first — routers, dust, spam — is what makes the candidate list an argument about who could plausibly matter, and it is the ground covered by DEX routers aren’t origin and Address Poisoning.

Stage 1 — Build the candidates

Every surviving unique sender becomes a candidate. This wallet has five. Their roles are already telling: three classify as PERSONAL, two as MASS_FUNDER — the mass-funder classification visibly demoting bulk distributors to “funds source, not end-user” so they cannot be mistaken for the wallet’s owner (Bot or Human? owns that threshold). No candidate is the target itself; the engine excludes self-initiated transactions so a wallet can never become its own origin.

Stage 2 & 3 — Two origin questions, asked separately

Origin is scored across two windows. Phase 1 (activation) asks who lit the account: the winner, TE4dtvCzHfixqa2hvcUnmhtPgiM1CnsRK3, scores a raw 100 as the authoritative activator — its record reads IMPLICIT_TRANSFER, HIGH confidence, sent within one minute of account creation, carrying the real activation transaction hash. There is no explicit AccountCreateContract here (creatorAddress is null), so no definitive +100 creation bonus — the caution Account Activation raises, playing out live. Phase 2 (funding history) asks who kept it alive: the same address wins, at a raw 26, with the phases in full agreement. A runner-up mass-funder normalizes to 88 on Phase 2 — nearly level with the winner on that window alone, despite scoring only 5 on activation — a clean reminder that no single phase carries the whole answer.

The reason the two windows are asked separately is corroboration: agreement between genuinely distinct windows is evidence, while agreement between overlapping windows is data agreeing with itself.

Stage 4 — Control, by rule not by score

Now the axis split from One Wallet, Two Answers does its work. Every candidate’s current-control score is zero; the control-phase winner is null. The answer comes instead from the rule path: the wallet’s controlOutcome is SELF_CUSTODY, sourced from a permission snapshot, at High confidence — the target holds its own single owner key, threshold one. And activatorIsController is false: the address that funded this wallet into existence is not the address that controls it today. A scored control phase of all zeros still yields a High-confidence control verdict, because control is a rule read from keys, never an average of signals.

Stage 5 & 6 — Handoff check, then grade the answer

Takeover and dormancy detection run on every wallet. Here both come back absent — no divergence between the genesis and operational leaders, no long silence to reactivate. The engine stayed silent where the evidence was absent, and that silence is itself the finding: this wallet did not change hands. (The Wallet That Woke Up is where that check lives.)

Only last does the engine grade its own answer. The top candidate holds 53% of the origin share against 27% for the runner-up, and stability is HIGH — “clear leader with significant margin,” a score gap of 49. Yet the global confidence band is only Medium. Why: data quality is LIMITED, because the wallet’s true on-chain history is just five transactions — under the ten-transaction threshold that separates a Limited record from an Adequate one, with no creator or delegation anchor to lift it — which caps the band at Medium regardless of how clear the leader is. The calibrated activation probability sits at 0.97 with a tight bracket. This is the lesson How Confident Is That Answer? exists to teach, shown in one wallet: strength of the leader and strength of the evidence are different dials. A clear winner on a thin record is a stable answer held at modest confidence.

The honest conclusion

Written the way the evidence supports it: a personal wallet, most plausibly originated by TE4dt…, self-custodied today by a different key than the one that funded it, on thin but internally consistent evidence. Every clause of that sentence is a stage output — origin from Phases 1 and 2, “personal” from the category, “self-custodied by a different key” from the ControlOutcome plus activatorIsController, and “thin but consistent” from the LIMITED-data cap over a HIGH-stability leader.

Reading it as an investigator

The value of walking the order is the discipline at each gate. Gather before judging. Subtract the noise before ranking. Ask the two origin questions separately, and never let one window’s agreement with itself pass for corroboration. Read control from keys, not scores, and let a scored phase of zeros stand aside for a rule that actually settles the question. Check for a handoff, and accept “no handoff” as an answer. And grade your own conclusion last — a strong leader and a strong record are not the same claim, and an honest report says which one it has. One wallet, one pass of the method, every chapter cited at the stage it governs. That is the whole field guide, run once.

Sources

• TRONORIGIN — live analysis of TAKDPhWbXzE3XBmicbGuMqKLP9vEVuJVJm — the reproducible result this walkthrough reads (heuristic 7.15.0), captured 2026-07; a re-run reads the same full on-chain history plus anything since.