The Horizon Bot Network: Following 254 Wallets to One Kraken Account
An on-chain investigation. The wallet that activated the Horizon trading app's fee collector (horizonxrpl.com) also sits at the root of a 254-wallet trading fleet — and every cash-out from those wallets lands in the same Kraken account, under the same deposit tag. Here is the full money trail, with addresses and transaction hashes you can verify yourself.
On-chain snapshot · measured 2026-06-14 · every figure reproducible from public ledger data
Tip: click any blue address or transaction hash to open it in xrpl.to, Bithomp, or XRPScan.
Wallets, one owner
254
activation-linked cluster
Net XRP to Kraken
32,407+
~$40,833
Cluster trades
671k
12,295 tokens
Fee wallet domain
horizonxrpl.com
on-chain Domain field
Update · June 15, 2026
The Horizon operator has responded.
Posting publicly as @Daniel_Horizon_, the operator confirmed running the bot and addressed the claims directly:
“I'm aware of claims being made about me, Horizon, and an XRPL trading bot. Yes, I have operated an independent on-chain trading bot. I do not believe algorithmic trading using public XRPL data is inherently wrongdoing.”
“Horizon does not operate the bot. The bot does not use Horizon private user data, private order flow, hidden routing, or privileged platform access.”
“I understand why people are asking questions because I operate Horizon. I'm reviewing the claims carefully and will not speculate live or turn this into drama. The relevant Horizon question is whether Horizon users, data, or infrastructure were involved. I'll address factual claims directly.”
Our note.The statement confirms the central, on-chain-provable finding: the same individual operates both Horizon and the trading fleet. It denies that the bot used Horizon's private user data, order flow, hidden routing, or privileged access — and this report makes no such claim. We found no evidence of front-running Horizon users, and noted that the tokens the fleet trades are largely disjoint from those Horizon retail buys. The open questions are therefore narrow and factual: (1) disclosure— were users told that the platform's operator runs a large fleet trading under Horizon's own source tag? (2) was that fleet ever a counterparty to a Horizon-routed user order? and (3) fund separation— the same wallet that created Horizon's fee collector also settles the trading fleet's proceeds to one personal Kraken account (tag 3950984417); is there a corporate entity that keeps the platform's funds separate from personal trading, or do business and personal funds run through the same wallets and the same exchange account? All three are answerable, and we'll update this report as they are.
How value moves: Kraken seeds the operator wallet, which activates the Horizon fee collector and a 254-wallet fleet; trading proceeds are swept back to the same Kraken account under one destination tag.
The findings, one layer at a time
Tap any section to expand the on-chain evidence.
Horizon tags its trades with XRPL source tag 111. Every Horizon swap pays a fee to one collector wallet, , whose on-chain Domain field decodes to horizonxrpl.com— the app's own domain.
That fee wallet was created (activated) by with a 3 XRP funding payment. The activation transaction is public:
On the XRP Ledger the account that funds a new account's creation is recorded as its parent. So the operator wallet is, on-chain, the creator of the Horizon fee collector. We refer to it below as the operator wallet.
Horizon's tag-111 era begins on April 22, 2025 — the earliest trade on record carrying source tag 111:
Five days later, on April 27, 2025, the cluster's own first Horizon-tagged trade was the deployer wallet selling the token literally named "Horizon" for XRP (tx ).
On the XRP Ledger, a brand-new wallet cannot exist until an olderwallet sends it a little XRP to switch it on. That funding step is permanent and public — think of it as a birth certificate that names the parent wallet. Starting from the operator's wallet and following those links outward, like a family tree, reveals 254 wallets across six generations: the operator created a first group of wallets, those wallets created the next group, and so on. The counts per generation are 67, 35, 67, 50, 31, 3 — which add up to 254. Together they hold roughly 4,140 XRP and have made about 670,800 trades across 12,295 different tokens — and every single one traces back to that same starting wallet.
How to read it: each dot is a wallet. The operator (far left) funded the first generation of wallets into existence; those funded the next; and so on, six generations deep — 67, then 35, 67, 50, 31, and 3, which add up to 254. All 254 are listed in full in section 8.
On its own, a funding link only shows who paid to switch a wallet on — and technically anyone can fund anyone. So this family tree is strong evidence of a single owner, but not yet proof. Section 3 is what makes it airtight: all of these wallets send their money to the same account at one exchange.
Notable members: the 2nd-tier deployer (activated by the operator, also with a 3 XRP payment), the primary trading bot (holds 3,226 trustlines), and — tellingly — a wallet vanity-prefixed "rMEV": .
On an exchange, a destination tag is your account number — it routes a deposit to a specific customer. Multiple independent-looking cluster wallets deposit to the same Kraken hot wallet (, labelled "Kraken") under the identical destination tag 3,950,984,417.
Wallets that look unrelated on a block explorer all deposit to one Kraken hot wallet under the same destination tag — which, on an exchange, is a single customer account.
Same tag = same Kraken account = same person. Wallets that look unrelated on a block explorer are provably funnelling their proceeds into one human's exchange account. The operator wallet was itself first funded from that same Kraken wallet (13.5 XRP):
The cluster is a custom multi-tag trading client. Its own trades carry a mix of source tags — not just Horizon's:
tag 777: 45%tag 111 (Horizon): 27%tag none: 18%tag 12345678: 8%
Holding period is bimodal. The volume-weighted median hold is 9 seconds — roughly three-quarters of all volume is flipped inside a minute (high-frequency market-making, near break-even). But the profitconcentrates in positions held hours to days. Realized round-trip P&L, matched buy-to-sell:
Realized round-trip profit by holding period (FIFO-matched). The edge is in hour-to-day swing holds; sub-minute high-frequency is near break-even and only the longest-held bags (>7 days) lost money.
Holding period
Round-trips
Realized XRP
< 1 min
115,708
+5,081
1–10 min
29,621
+2,867
10–60 min
34,196
+9,291
1–6 h
32,273
+14,722
6–24 h
47,520
+11,713
1–7 d
44,385
+37,553
> 7 d
87,116
-18,976
Round-trip total
+62,251
The biggest single bucket is the 1–7 day swing hold (+37,553 XRP). Sub-second high-frequency is roughly break-even; only the longest bags (>7 days) lost money. Separately, ~376,910 XRP of sells had no matching on-book buy (inventory acquired via token-to-token hops or received), so headline realized profit is a range, not a single number.
Why the sub-second activity is the real concern.Horizon runs trading bots on its own backend on behalf of users. That means the same infrastructure that builds and submits user swaps also runs automated strategies — and the operator's own wallets trade sub-second through it under the Horizon source tag. When the party operating the order-construction-and-submission backend is simultaneously running high-frequency bots tagged to the same app, it holds a structural latency and order-flow-information advantage over the very users whose trades pass through that backend.
Proceeds are swept up the cluster — small bots convert token inventory to XRP via self-directed path payments (example: ) and forward it to the hubs, which deposit to Kraken. The hubs only ever send to Kraken; they are not topped up from it (so this is extraction, not the operator cycling his own exchange balance).
Cash-out wallet
→ Kraken (XRP)
← Kraken (XRP)
28,175
2,374
5,369
0
640
0
597
0
Net extracted
34,781
2,374
All deposits carry destination tag 3,950,984,417 — the link that ties every wallet to one account.
We tested the strongest version of the "trading against its own users" claim and could not confirm it:
The cluster is almost never the order-book maker against Horizon users (~0% of tagged user trades).
The tokens the cluster trades heavily and the tokens Horizon retail buys are largely disjoint — on the single most retail-traded token, the cluster made just 4 buys in the token's entire life.
We found no token-shuffling between wallets to disguise positions, and negligible wallet-to-wallet wash trades.
So what is provenis narrower and cleaner than "front-running": the operator of a trading platform secretly runs a large, undisclosed proprietary trading fleet and routes its profits to one exchange account — a serious, verifiable conflict of interest. The stronger MEV/front-running narrative is not supported by the ledger.
Open the fee wallet and decode its Domain hex → horizonxrpl.com.
Check its activation parent → the operator wallet . Activation tx (full hash): .
On any of the cash-out wallets, filter Payments to and read the destination tag → 3,950,984,417 on all of them.
Cross-check the same tag on a second, unrelated-looking cluster wallet. Same tag = same Kraken account.
Tools: any XRPL explorer, a full-history node (s1/s2.ripple.com), or the XRPL.to address and transaction pages linked above.
Does the money cashed out to Kraken match the trading profit?It tracks it closely — and that is the tell. The handful of wallets that earn the most from trading are exactly the ones depositing to Kraken; the wallets that ‘lose’ the most send nothing.
Wallet
Role
Net from trading
→ Kraken
operator hub
+82,919
25,801
2nd-tier hub
+23,303
5,369
"rMEV" bot
−144,170
—
accumulator bot
−97,222
—
accumulator bot
−95,635
—
accumulator bot
−51,658
—
Realized profit leaves to the exchange; unrealized token inventory stays in the cluster. Net cashed out so far is roughly 31,000+ XRP(the two hubs alone, fully traced) — about half of the cluster's realized round-trip trading profit (~62,000 XRP), with the rest still cycling inside as wallet balances and open positions. The big ‘losing’ bots are not losing money so much as holding it: they spend XRP on tokens they have not sold yet.
And where do those bots get the XRP to keep buying? Not from Kraken— the exchange sends them nothing. We traced the largest accumulator (the "rMEV" wallet) and found zero XRP in from Kraken and zero from outside the cluster; it funds itself by recycling — converting its own token holdings back into XRP through self-directed swaps. XRP only ever flows out of the cluster to the exchange; it never flows back in to subsidise the bots, which is the signature of an extraction operation rather than a funded one.
Below is the entire cluster, every address in full, each linking to its on-chain account page — check the activation parent of any wallet and walk the tree yourself. The figure after each address is that wallet's net traded XRP (green = net seller / realized gains, red = net buyer / accumulated inventory). Nothing here asks you to take our word for it.
254wallets total, ordered roughly by on-chain activity. ‘Net traded’ = XRP received from sells minus XRP spent on buys; a negative figure means the wallet is holding token inventory it bought but has not sold (not necessarily a loss). Wallets with no figure have no significant DEX trading.
Methodology: cluster mapped by BFS over XRP Ledger account-activation parents; trades and P&L computed from the XRPL.to full trade index (670,800 cluster trades), with realized profit FIFO-matched per wallet and token; money trail verified against full-history nodes (s1/s2.ripple.com). This article analyzes publicly visible on-chain activity and wallet behaviour; it does not assert the legal identity of any person. Figures are a snapshot as of 2026-06-14 and may drift as trading continues.
