IS THIS CRYPTO
WALLET
SAFE?
Before you send crypto, submit a supported Ethereum or TRON address. TrustSniffer checks the risk signals currently available from configured sources and explains the resulting assessment. Processing time and evidence availability vary.
We follow
the money.
Most tools just check a wallet against a list. We go further — we follow the money trail to see how much of it came from scams or stolen funds, and how close this wallet is to the source. So you get a real sense of the risk, not just a yes/no.
- 1 Blocked wallets — We keep an up-to-date list of wallets that have been frozen or flagged for crime.
- 2 The money trail — We follow the money from those bad wallets to see who received it, and how close this address is.
- 3 Cash-out spotting — We flag when dirty money is being moved to an exchange or mixed to hide where it came from.
risk score = combined risk from every path · closer & larger transfers count more ▌
One of five simple ratings
Supported Ethereum and TRON addresses receive one of five ratings based on the available risk signals and official sanctions or issuer lists. Insufficient evidence may require additional review.
No taint above noise floor
Indirect exposure, low share
Significant taint path
High-confidence exposure
Funds frozen on-chain
We don't blame the innocent
Money touches big exchanges all the time — that doesn't make everyone who uses them a criminal. We're careful not to flag ordinary wallets just because dirty money once passed through a busy exchange.
Handy before you send money
Single endpoint.
Structured response.
Integrate wallet risk screening into your compliance pipeline. Known stored addresses resolve from the local index. Unknown addresses may require additional processing and can return a provisional status while evidence is collected.
- Structured JSON — band, score, signals, taint paths
- Webhook delivery for cashout alerts
- JWT multi-tenant auth with per-tenant quotas
- EVM and TRON address formats supported
How the scoring works
Scoring model — contribution() and noisy-OR
Each tainted predecessor contributes cᵢ = (T(u)/100) · decay(hop) · valueShare(v,u) · temporal(age).
Multi-path aggregation uses noisy-OR: P(v) = 1 − Π(1 − cᵢ) — bounded in [0,1], monotonic, order-independent, and auditable.
Contributions below C_MIN=0.02 are pruned (noise floor). This prevents dust-poisoning attacks where an attacker sends tiny amounts from a sanctioned wallet to inflate clean wallet scores.
Hop decay and value-share haircut
decay(hop) = γ^(hop−1) where γ=0.55. At hop 1: 1.0. At hop 2: 0.55. At hop 3: 0.30. Hard cut at hop 4.
Value share: share = receivedFromSource / totalReceived. Shares below 0.5% (SHARE_FLOOR) are treated as dust and contribute zero — defeating dust-poisoning attacks.
Storage architecture — LMDB + Bloom filter
Stored verdict records use an off-heap LMDB memory-mapped index. A Bloom filter provides a negative-cache hint; a negative lookup means no stored risk record was found in the currently available evidence, not that an address is provably safe.
Addresses without a stored risk record may still require live verification or additional review. Absence from the store is not evidence of a CLEAR verdict.
Durability: wallet_risk.jsonl and edges.jsonl provide append-only restart replay. The full index can be rebuilt from these files at any time.
Chain coverage and freshness behavior
Configured issuer-event sources: supported network, asset, contract, and provider combinations are processed when those sources are available. Support is not implied for every asset on every named network.
Additional verification: some cache misses can enter a queued RPC verification path where the relevant network and provider are configured.
Worker liveness is tracked by heartbeat. Detection timing, verification availability, and freshness vary by source and network; an unavailable or stale source must not be interpreted as proof that an address is safe.
Watching the blocked wallets
Supported issuer events are processed from configured network, asset, contract, and provider sources. Detection timing and freshness vary by source and network.
Check a supported wallet address.
Submit a supported Ethereum or TRON address for an assessment based on the evidence currently available. Processing time varies.