On-Chain Risk Intelligence

IS THIS CRYPTO
WALLET
SAFE?

Before you send crypto, paste an Ethereum or TRON address. TrustSniffer checks it against issuer freeze lists, sanctions designations and scam reports, follows the money where a trace is available, and explains the resulting risk rating in plain English. Ethereum and TRON are supported; other chains are not.

Check a Wallet Live Threat Radar
Configured Ethereum + TRON sources
Processing time varies
Follows the money, hop by hop
Variable
Processing time depends on evidence and sources
Free
To check a supported address
Ethereum + TRON
The chains we cover
Plain English
A clear answer, not a riddle
How we check

We follow
the money.

Most tools just check a wallet against a list. We go further — we follow the money trail to see how much of it came from scams or stolen funds, and how close this wallet is to the source. So you get a real sense of the risk, not just a yes/no.

  • 1 Blocked wallets — We keep an up-to-date list of wallets that have been frozen or flagged for crime.
  • 2 The money trail — We follow the money from those bad wallets to see who received it, and how close this address is.
  • 3 Cash-out spotting — We flag when dirty money is being moved to an exchange or mixed to hide where it came from.
fund-tracing engine · live SANCTIONED ROOT DETECTED
$2.4M · γ=1.0 $1.1M · γ=1.0 $310K · γ=1.0 $2.4M $50K · γ=0.55 $28K · γ=0.55 $12.5K $1.1M · γ=0.55 $310K · γ=0.55 γ=0.30 $12K ROOT OFAC·SDN 0xd8…3f2a T=100 HOP 1 0xa3…c1 T=78 HOP 1 0x7e…9b T=72 HOP 1 T=58 MIXER DEX·SWAP T=61 HOP 2 T=34 HOP 2 T=28 HOP 2 T=22 HOP 2 0x2c…f4 CEX 1 BINANCE DEPOSIT T=24 HOP 3 T=15 CEX 2 OKX T=19 COLD T=9
// live money-trail scan
risk score = combined risk from every path · closer & larger transfers count more ▌
16 paths traced · 3 dust paths ignored ● tracing
The verdict

One of five simple ratings

Supported Ethereum and TRON addresses receive one of five ratings based on the available risk signals and official sanctions or issuer lists. Insufficient evidence may require additional review.

risk-scoring engine · live
score: — band: —
CLEAR
0 – 29
No taint above noise floor
score < 30
CAUTION
30 – 54
Indirect exposure, low share
30 ≤ s < 55
WARN
55 – 79
Significant taint path
55 ≤ s < 80
DANGER
80 – 99
High-confidence exposure
80 ≤ s < 100
BLOCK
Hard sanctions hit
Funds frozen on-chain
hard hit
0305580100
Fair and accurate

We don't blame the innocent

Money touches big exchanges all the time — that doesn't make everyone who uses them a criminal. We're careful not to flag ordinary wallets just because dirty money once passed through a busy exchange.

EOA / Wallet
propagate
CEX Deposit
terminal
DEX / Pool
commingle
Mixer
mixer
Bridge
bridge
Drainer Contract
root
When it helps

Handy before you send money

Before you send

Sending to someone new?

About to send crypto to an address you do not know? Screen a supported address first and review the evidence currently available before acting.

Buying or selling

Trading with a stranger?

Doing a deal person-to-person? Check the other wallet before you hand over your crypto or your goods, so you're not left out of pocket.

Already been scammed?

See where the money went

If someone tricked you, follow the trail to see where your money ended up. It's helpful when you report it to the police or an exchange.

Trying a new app

Is this project clean?

Before you put money into a crypto app or project, check whether it's mixed up with stolen or blocked funds — so you invest with your eyes open.

Want the full story

See the whole trail

Every warning shows the full picture — where the money came from, how many steps away it is, and when it moved — so nothing is hidden from you.

Source-dependent updates

Freshness varies by source

Supported issuer events are processed from configured network, asset, contract, and provider sources. Detection timing and freshness vary by source and network.

Before you send

Sending to someone new?

About to send crypto to an address you do not know? Screen a supported address first and review the evidence currently available before acting.

Buying or selling

Trading with a stranger?

Doing a deal person-to-person? Check the other wallet before you hand over your crypto or your goods, so you're not left out of pocket.

Already been scammed?

See where the money went

If someone tricked you, follow the trail to see where your money ended up. It's helpful when you report it to the police or an exchange.

Trying a new app

Is this project clean?

Before you put money into a crypto app or project, check whether it's mixed up with stolen or blocked funds — so you invest with your eyes open.

Want the full story

See the whole trail

Every warning shows the full picture — where the money came from, how many steps away it is, and when it moved — so nothing is hidden from you.

Source-dependent updates

Freshness varies by source

Supported issuer events are processed from configured network, asset, contract, and provider sources. Detection timing and freshness vary by source and network.

API Integration

Single endpoint.
Structured response.

Integrate wallet risk screening into your compliance pipeline. Known stored addresses resolve from the local index. Unknown addresses may require additional processing and can return a provisional status while evidence is collected.

  • Structured JSON — band, score, signals, taint paths
  • Webhook delivery for cashout alerts
  • JWT multi-tenant auth with per-tenant quotas
  • EVM and TRON address formats supported
GET /api/wallet-risk/:address
Technical Methodology

How the scoring works

Scoring model — contribution() and noisy-OR

Each tainted predecessor contributes cᵢ = (T(u)/100) · decay(hop) · valueShare(v,u) · temporal(age).

Multi-path aggregation uses noisy-OR: P(v) = 1 − Π(1 − cᵢ) — bounded in [0,1], monotonic, order-independent, and auditable.

Contributions below C_MIN=0.02 are pruned (noise floor). This prevents dust-poisoning attacks where an attacker sends tiny amounts from a sanctioned wallet to inflate clean wallet scores.

Hop decay and value-share haircut

Owner-locked historical-association weights are hop 1: 1.00; hop 2: 0.70; hop 3: 0.30; hop 4: 0.17, with a hard cut after hop 4.

Value share: share = receivedFromSource / totalReceived. Shares below 0.5% (SHARE_FLOOR) are treated as dust and contribute zero — defeating dust-poisoning attacks.

Storage architecture — LMDB + Bloom filter

Stored verdict records use an off-heap LMDB memory-mapped index. A Bloom filter provides a negative-cache hint; a negative lookup means no stored risk record was found in the currently available evidence, not that an address is provably safe.

Addresses without a stored risk record may still require live verification or additional review. Absence from the store is not evidence of a CLEAR verdict.

Durability: wallet_risk.jsonl and edges.jsonl provide append-only restart replay. The full index can be rebuilt from these files at any time.

Chain coverage and freshness behavior

Configured issuer-event sources: supported network, asset, contract, and provider combinations are processed when those sources are available. Support is not implied for every asset on every named network.

Additional verification: some cache misses can enter a queued RPC verification path where the relevant network and provider are configured.

Worker liveness is tracked by heartbeat. Detection timing, verification availability, and freshness vary by source and network; an unavailable or stale source must not be interpreted as proof that an address is safe.

// Live updates

Watching the blocked wallets

Supported issuer events are processed from configured network, asset, contract, and provider sources. Detection timing and freshness vary by source and network.

sanctions feed · live
Network: All Token: USDT / USDC Period: Live
● CONNECTED
TimeEventNetworkAddressTokenFrozen Value
13:17:02 ● FREEZE TRX TXn9k…f3aB USDT $120,500
13:16:48 ● FREEZE ETH 0x4f2c…9d1e USDC $84,200
13:15:31 ● UNBAN TRX TLm7p…c8dF USDT —
13:14:09 ● FREEZE ETH 0x8a1d…2f7c USDT $2,100,000
Showing 4 of 1,284 events · Updated just now Launch Threat Radar
Get Started

Check a supported wallet address.

Submit a supported Ethereum or TRON address for an assessment based on the evidence currently available. Processing time varies.

Check a Wallet See today's scams

Read next

TrustSniffer's own analysis behind this check, written up in full.

Wallets TrustSniffer has a fact about

Every address on these lists is there for a reason we can name: frozen by a stablecoin issuer, named on a sanctions list, or reported as a scam wallet.

Crypto fraud

On-chain investigations