Monitoring

Address Watchlist

Save addresses you want to track without creating a full investigation. The watchlist automatically enriches each address with entity attribution and risk scores from our database of 48M+ attributed addresses.

How it works

• Click the ⭐ Save button on any address lookup result
• Or add addresses directly from the Dashboard watchlist section
• Each address is automatically enriched with entity name, category, and risk score
• Access your watchlist from the Dashboard — click any row to view full lookup
• Limit: 50 saved addresses per account

Watchlist vs Monitoring: The watchlist is a passive bookmark for quick access. For active alerts when an address moves funds, use the Monitor feature (available on Investigator and Agency plans with 5 and 50 monitored addresses respectively).

Monitoring alert types

Each new transfer of a monitored address gets exactly one type — the first rule that matches, in this order. Alerts appear in the bell and on the Alerts page and are sent by e-mail.

• Sanctioned counterparty · funds sent — the monitored address sent funds to a sanctions-designated address (an official designation record, e.g. OFAC SDN). Any amount, no threshold. It is never inferred from an entity label or a risk score. The highest priority: listed first everywhere and named in the e-mail subject.
• Sanctions exposure · funds received — the monitored address received funds from a sanctions-designated address. Exposure to review — a separate alert from a send, never merged with it, and it does not change any risk score. Ranked right below funds sent.
• Exchange deposit — funds reached an attributed exchange — the freeze window.
• Mixer — funds were sent to an attributed mixer.
• Bridge — funds were bridged to another chain.
• Large transfer — an outbound transfer of $10,000 or more.
• Fund movement — any other outbound transfer. Transfers between wallets of the same investigation and incoming transfers are recorded but do not alert (unless the counterparty is sanctioned).

Velocity Dashboard

The Stolen Funds Velocity Dashboard tracks the movement speed and destination of funds across all ChainHint incidents in aggregate. It shows where stolen crypto ends up — which exchanges, mixers, or bridges are most commonly used by hackers.

What It Shows

Access the dashboard at chainhint.com/velocity. Filter by incident status, time range, and chain.