Show Me the Gold: Tracing Altura's Vault Through a Closed Loop of Wallets

On-chain records leave a timestamped trail even when the people involved offer conflicting explanations for what that trail means.

On December 30, 2025, a Tron wallet appeared and sat idle for months. Then, on April 29 and 30, it received three transfers from Kraken's hot wallets: 150,937.48 USDT, 99,500 USDT, and 99,999 USDT — round figures that look more like a business transfer than retail activity.

Wallet in question: TJLJjrH9BoxsX82a6XCMz7Y88Z7nEuHY3d

Each incoming batch moved on almost immediately, split across downstream addresses within the same block or the next.

A second wallet showed the same behavior. 0xCL, the researcher whose work prompted this inquiry, identified a second Tron address drawing from the same Kraken deposit flow, now independently confirmed to have received $14.95 million across 30 transactions.

Second wallet: TDrYQZGApHLq7pAu2oEgkkfmZyfZoXMzwL

Same exchange, same chain, same pattern of transfers too large for ordinary retail use. Altura has described this activity as payment to its RWA partner, which is possible — physical gold settlement, however, typically does not move this way; it tends to be slower and tied to an identifiable counterparty and signature.

None of this makes Tron activity inherently suspicious. Stablecoins move across that network constantly for reasons unrelated to gold, and Kraken's own documentation confirms that customer deposits land at generated addresses before being swept into the exchange's internal hot wallets — standard practice industry-wide.

What draws attention is the combination of factors: funds exiting a major exchange's infrastructure, landing on a low-cost, high-speed chain, and then fanning out quickly across multiple addresses rather than settling anywhere resembling custody. A legitimate gold purchase ends at a vault, with a counterparty and a signature. This pattern instead shows staging and dispersal — what blockchain forensics firms term layering, where funds are routed through legitimate rails in a way that can obscure their ultimate destination.

The question worth asking is why a vault claiming $39 million in gold-backed value shows so little movement that resembles actual gold trading, and so much that resembles something else entirely.

The pitch

Altura's offering came with a well-built narrative. The HyperEVM vault launched on December 23, 2025, taking USDT deposits and advertising yield through three strategies: delta-neutral market making, funding-rate arbitrage, and physical gold trading carried out through a UAE-based partner, Inessa Holdings.

The headline number was 20% APY — a yield high enough that it should invite scrutiny on its own.

Ranveer Arora served as CEO, listing prior stints at PwC, Optiver, and AllianceBernstein, along with a Columbia master's degree in financial engineering. Matthew Pinnock, known online as Aurellius, served as COO and handled most public communication. CoinTelegraph reported in April, citing Pinnock on the record, that Altura claimed to have facilitated the movement of roughly 185 kilograms of gold, representing about $28.5 million in cumulative transaction volume.

Pinnock told the outlet that the gold was tokenized at the point of acquisition, with tokens escrowed through each trade and custody transitions recorded via dual cryptographic signatures — specific claims with specific mechanics, the kind that should be straightforward to verify or disprove.

Established gold-tokenization models already exist for comparison. Pax Gold ties each token to London Good Delivery gold held by Paxos Trust Company, with monthly attestations. Tether Gold (XAUT) is backed by gold held in Swiss vaults, also with attestations. Both rely on a direct claim against vaulted metal held by a named custodian, verified through regular attestation — neither requires routing funds through Tron, exchange relays, or same-block fund splitting, because the underlying metal sits in one place under one name.

Altura's model differed: gold trading was wrapped inside a broader trading strategy, asking depositors to trust the entire structure rather than a single custodian-and-attestation relationship.

Supporting that structure were several additional entities: Inessa Holdings, Aurellion Labs, and Accountable, the dashboard Altura used to claim transparency around fund movements. Six audits from three firms — Adevar Labs, Omniscia, and Sherlock — were also displayed prominently. By June, the vault had reached $39 million in peak TVL.

The gap between that polished presentation and a Tron wallet feeding four anonymous downstream addresses raises the question of what was actually holding the structure together.

A closed circuit

A credible proof-of-reserves arrangement typically requires an independent verifier with no stake in the outcome. Aurellion Labs was positioned as that independent check on Altura's gold strategy. But the wallet that deployed Aurellion's contracts appears to trace back to Matthew Pinnock's own address — the same Pinnock running Altura as COO. Pinnock has confirmed this connection himself, acknowledging when asked directly that the deployer wallet was funded from his own, without qualification.

The path traced by the original investigator describes funds moving out of Kraken, into a Crypto.com deposit address, through two Aurellion wallets, and back into the same Kraken hot wallet they originated from. It's worth noting the full chain has not been independently confirmed end-to-end, since some legs pass through exchange-controlled addresses. If the trace holds, though, it describes a closed loop rather than a payment to an external counterparty — capital that returns to its starting point does not resemble money spent on gold, though that remains this analysis's interpretation of the pattern rather than a settled fact.

Accountable, the firm engaged to provide oversight, disclosed its own limitations. A disclaimer on its dashboard states that its audit does not constitute independent verification of the existence, custody, segregation, valuation, or backing of the specific assets referenced in the data it was given. That disclosure, made voluntarily, carries weight precisely because Accountable didn't have to make it.

Inessa Holdings is the entity named as counterparty for the gold itself, described as managing $450 million in assets with more than 50 years of combined investment experience among its leadership. Accountable's dashboard puts Altura's exposure to Inessa at roughly $17.97 million, while the same dashboard states that Inessa's own IFRS-audited financials disclose a related-party balance payable to Altura of AED 20.2 million — about $5.5 million at current exchange rates. The roughly $12.5 million gap between those two figures is not explained in the materials publicly available. Inessa itself has no visible Twitter presence, and its website offers only broad business categories and legal disclaimers, without identifiable public figures or operating data.

Zeal Global was named as the logistics partner moving bullion between counterparties. Its NSE listing and own website describe a company operating as a general sales and services agent for airlines, focused on cargo and passenger services — nothing in the public record supports treating it as a precious-metals logistics specialist.

Taken together, the structure shows a verifier whose funding traces back to Altura's own COO, an oversight firm that disclosed the limits of what it actually checked, and a stated logistics partner whose public business has no apparent connection to precious metals.

Pinnock responds

When questions about the wallet connections reached Matthew Pinnock — through the same Twitter thread that started the inquiry — he answered publicly under his own account rather than staying silent or routing the response through a lawyer.

His central statement read: "Addressing the wallet and deployer funding, yes the deployers wallet was funded from my own." Everything else in his response built context around that admission rather than contradicting it. He pointed to his handle, "Aurellius," as evidence the relationship had never been concealed, and described the shared funding as a natural consequence of how the trade operates — two parties moving USDC on and off exchanges each cycle, since the actual buyers and sellers of the gold aren't crypto-native. On the exploit question, he said the Aurellion team had already worked with security researchers who published post-mortems. On why Aurellion's history predates Altura's involvement, he pointed to an online presence stretching back years before the partnership began.

Some of this holds up under examination. The funding admission is a direct, plainly stated confirmation of the link between Pinnock and the Aurellion deployer wallet. The claim that Aurellion predates Altura also checks out on paper: an account under that handle has existed since 2022, though it describes itself as "the future of decentralised shipping," with no mention of gold — meaning the claim is true of the account's age but says little about what business it actually ran.

Other parts hold up less well. A shared handle is a thin form of disclosure, particularly coming from a COO explaining a conflict of interest to people whose deposits he manages. The trade-mechanics explanation is internally coherent but unverifiable without visibility into the off-chain side of those trades. No post-mortem matching his description turned up in available coverage, though Pinnock did share a security alert from ExVul. That alert is relevant: Aurellion Labs was in fact exploited in May 2026, losing roughly $456,000 in USDC on Arbitrum, with the stolen funds deposited into Spark Lend rather than withdrawn or converted. Asked directly why stolen funds went into a lending market instead of being cashed out, Pinnock's response was rhetorical rather than substantive: "If the funds are that easy to freeze I'm sure the team would appreciate your help in doing so."

None of this amounts to a denial. It reads instead as an acknowledgment of the connections, paired with a request that they be interpreted generously.

What remains unresolved

Four downstream Tron wallets received the same-block disbursements described above, and three of the four now trace to identifiable destinations. Two resolve directly to Kraken's own infrastructure — labeled deposit addresses forwarding everything into the same Kraken hot wallet:

Wallet 1: THvJyTuc664nVFb5c2agxSfHLztUfXDzBU Wallet 2: TNqNNpt72D5kvyR1aCGeShVp6pxcQsoFea

A third shows genuine layering, receiving funds from OKX, Binance, KuCoin, Biconomy, MEXC, and Kraken, then distributing across more than a dozen transfers to deposit addresses at Binance, MEXC, OKX, Near Intents, KuCoin, and Binance again:

Wallet 3: TWRoRnNYpKMxB5TPhj6xMT87A4xEMyXxjt

The fourth exits Tron via NEAR Intents:

Wallet 4: TU4DBf5rU1vooo8bWjbBsTDnPHRLP1vpeD

These are documented paths through named exchange infrastructure, but the chain confirms only the route, not who was using it. Notably, the same Kraken deposit address (Wallet 1) that absorbed Altura's downstream funds also received transfers from three previously unidentified Tron wallets between April and June 2026, in amounts reaching as high as $2 million.

Rekt News disclaimer: these secondary wallets strengthen the observed pattern but remain corroborating evidence rather than conclusive proof — they do not, by themselves, establish who controlled the funds or what the transfers were ultimately meant to accomplish. The intent here is to highlight a routing pattern, not to assert proven ownership or motive.

0xCL's original investigation traced the two primary Tron wallets back to Altura's EVM-side wallets through bridges and instant-exchange services, specifically naming FixedFloat, ChangeNOW, and Bridgers.xyz, and flagging downstream exposure to sanctioned entities, merchant-payment services, casinos, and high-risk non-KYC OTC desks. Arkham counterparty data corroborates several of these claims: Bridgers appears across more than a hundred transactions tied to Wallet 3, consistent with instant-exchange off-ramping.

Primary wallet 1: TJLJjrH9BoxsX82a6XCMz7Y88Z7nEuHY3d Primary wallet 2: TDrYQZGApHLq7pAu2oEgkkfmZyfZoXMzwL

Arkham Intel's counterparty data shows ChangeNOW appearing across several separate outflows from the first primary wallet, while the second primary wallet shows $1.42 million moved across 50 transactions to HTX. HTX, formerly Huobi, was sanctioned by the UK government on May 26, 2026, over allegations of channeling more than $1.5 billion to Russian sanctions-evasion networks. That sanction postdates most of the Altura-linked flow, but a transaction to that exchange is now part of the public record.

The Aurellion exploit remains its own open thread. 0xCL's follow-up investigation found that the exploited vulnerability was already well known among security researchers rather than a novel discovery, and that the stolen $456,000 in USDC was deposited into Spark Lend instead of being cashed out — unusual behavior for an external attacker, given that Circle can freeze USDC at the address level on request. Pinnock has neither confirmed nor denied either point, which on its own proves nothing either way.

On the gold itself: the underlying mechanism — USDT moving through Tron wallets — makes large-scale physical gold trading difficult to reconcile with standard practice. Physical gold settlement typically involves accredited refiners, vault custody, and book-entry transfers between clearing members, not stablecoin transfers disbursed to anonymous addresses within a single block. Implausible is not the same as impossible, however, and no amount of unusual wire activity proves that a vault somewhere doesn't hold what it's supposed to — that question remains genuinely open. Aurellion's account does predate Altura; whether it ever operated an actual gold-trading business during that period, or sat dormant until a partnership required an aged shell, is not established either way.

A case this incomplete in places does not prove fraud, and it does not prove the absence of it.

The unwind

On June 21, 2026, Altura announced it was winding down its yield-bearing stablecoin vault. Roughly $8.5 million left the vault within 24 hours as depositors reacted to the news, and AVLT dropped 11% against its peg over the same period. Ranveer Arora characterized the reaction as misinformation and speculation.

Altura's own statement described something closer to an admission: a maturity mismatch between on-chain and off-chain positions had forced the pause, with RWA positions taking longer to unwind "due to their inherent nature," in the company's words. A maturity mismatch, in practice, describes a situation where funds a company claims to hold elsewhere have not yet materialized. Notably, it wasn't the $8.5 million in withdrawals that created the underlying problem — it was the withdrawals that exposed a problem already present.

As of July 2, full redemptions have not been completed. Altura's community update states that recovery is progressing via bank transfers from Inessa, tracked through JPMorgan's Payment Tracker on the Accountable dashboard, arriving in installments — a gold-backed vault repaying depositors by wire transfer is itself a notable detail.

Taken as a whole, the available evidence describes money raised for one stated purpose being routed elsewhere, wrapped in a verification loop that primarily confirmed itself. This is an interpretation the trail supports, not a legal finding or a confession — it is simply what the pattern looks like once traced from end to end.

Altura's depositors were pursuing 185 kilograms of gold that, per the available evidence, may never have moved beyond marketing materials, verified through a system that explicitly disclaimed independent verification, overseen by a company whose own COO funded the wallet behind the entity meant to check his work.

Legitimate gold operations do not typically depend on same-block Tron disbursements, instant-exchange rails, and cross-chain bridging to move funds. In this case, the trail no longer terminates in silence: two routes lead to Kraken's own hot wallet, one scatters across multiple exchanges, one bridges off-chain — and no name has been definitively attached to any of it. The wallets themselves are on-chain and verifiable. What remains unverified is the gold.