A sanctions list search only checks the address itself
A direct address lookup, the kind people run when they ask for an OFAC wallet check or want to know if a wallet is sanctioned, tells you one thing: whether that exact string of characters has itself been added to a published list. If the address is not on it, the search comes back clear.
That clear result does not look at where the money in the wallet came from. If the wallet received a transfer last month from an address that is on the list, and the current search only checks today's address, the search will miss it.
This is the gap between a list search and a taint check. A list search matches an address. A taint check follows where the money came from, hop by hop, using the public record every transfer leaves on the blockchain.
Why a tainted deposit disappears into your existing balance
An ERC-20 or TRC-20 token keeps one balance per address, and a transfer adds to whatever the recipient already holds rather than setting the received tokens aside in a separate pool. So if a wallet took in a transfer from a flagged address last month and a clean transfer yesterday, both amounts sit inside the same balance today. The total on its own does not say which part came from where.
That is the indirect exposure a straight list search misses: the address itself was never listed, but part of what it holds moved through one that was. Seeing it requires opening the wallet's transaction history and checking each incoming transfer on its own. The balance, read as a single number, cannot show it.
A lookalike USDT contract is a different risk, and it hides in plain sight
Tether issues one USDT contract per network: TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t on TRON and 0xdAC17F958D2ee523a2206206994597C13D831ec7 on Ethereum. A token that uses the name USDT from any other contract is not Tether's USDT, no matter what a wallet app's interface displays. Before tracing a deposit's history, confirm the transfer sits under one of these two contracts. A transfer under a different contract is a different token that only copies the USDT name, and its history says nothing about the real USDT in the wallet.
Made-up example: picture two token contracts whose addresses are identical except for a handful of characters in the middle. One is Tether's. The other was deployed by someone else and labeled USDT inside an app that displays whatever name a contract reports. A transfer under the second contract can look, on the surface, like a USDT movement. Checking the contract address against Tether's two addresses before looking at anything else tells you which one you are actually tracing.
Four checks on Etherscan or Tronscan before you decide
Once you know which contract you are tracing, the explorer for that network does the rest. Etherscan shows the sender, the recipient, the token contract and the time for every transfer tied to an Ethereum address, and Tronscan does the same for TRON.
The first three steps need only the explorer and a few minutes of clicking through the sender field on each incoming transfer. The fourth adds TrustSniffer as a second source once you have a sender address you want to look at more closely.
- Open the address on Etherscan (Ethereum) or Tronscan (TRON) and confirm the token contract matches Tether's TRON address, TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t, or its Ethereum address, 0xdAC17F958D2ee523a2206206994597C13D831ec7.
- Open the transaction list and look at the sender for each incoming transfer. The current balance alone cannot tell you where the money came from, since a received amount merges into whatever the address already held.
- Click into any sender address that looks unfamiliar or appears more than once among the incoming transfers. On that address, repeat steps one and two: confirm the token contract is Tether's, then read the sender on each of its own incoming transfers.
- If a sender's address is one you want a second read on, run it through TrustSniffer's wallet checker. The explorer shows the raw transfers. The checker shows whether that address appears in the risk reports TrustSniffer has published, and what risk level those reports gave it. Read the two results together before you decide.
What a clear result on both checks does not rule out
A list search that comes back clear and a transaction trail that shows no contact with a flagged address together give a stronger result than either alone, but both describe the wallet's history only up to the moment you checked. Two situations should make you treat the result as unclear instead of clean: the chain of senders runs past the point where you can still follow each hop back to a source you recognise, or a sender address shows no transaction history on the explorer, or its page will not load. At that point, checking the website or exchange the deposit is tied to with TrustSniffer's website checker, or browsing TrustSniffer's sanctions directory for entities already flagged, adds a second source before you decide. If the list search and the transaction trail both come back unclear, hold the funds and ask the counterparty where the deposit originated before you rely on them.
