Risk Scoring
Every address in a trace receives a risk score (0–100) computed from multiple signals.
Risk Levels
A sanctions designation that names the address, confirmed hacker. API level critical
Law-enforcement attribution (e.g. FBI: Lazarus Group), address frozen by the stablecoin issuer, seized (court/ministerial order), mixer interaction, phishing. API level high
Suspicious patterns, unverified risk signals, an exchange wallet frozen by the issuer. API level medium
Minor flags, low-confidence signals. API level low
Known exchange, DeFi protocol, verified entity. API level clean
Risk Signals
| Signal | Weight | Source |
|---|---|---|
| SignalSanctions match | Weight+50 → 100 | SourceA sanctions designation naming the address — US OFAC and the other authorities that publish addresses; floors the score to 100 (critical) |
| SignalKnown sanctioned entity | Weight+30 → 100 | SourceChainHint entity DB, same floor to 100 |
| SignalLaw-enforcement attribution | Weight+45 → 75 | SourceA law-enforcement agency attributes the address to a named actor (e.g. US FBI — Lazarus Group); high band on its own. Not a sanctions designation — never the level Sanctioned |
| SignalSeized (court/ministerial order) | Weight+40 → 70 | SourceA state's court or ministerial seizure order for the address (e.g. Israel NBCTF); high band. Not a sanctions designation. As a counterparty it is a taint class of its own — "seized", weighted 0.8 against a sanction's 1.0 in exposure and path taint, and it floors a traced flow to 80 against a designation's 100 |
| SignalFrozen by issuer | Weight+35 → 70 | SourceThe stablecoin issuer froze the address (Tether USDT, Circle USDC blacklists); high band. A freeze is the issuer's decision about its token — not a sanctions designation, and not proof the owner is a scammer. On a confirmed exchange's own wallet the floor is 45 (medium), not 70: there the freeze means stablecoins sent to that address can no longer move, not that the exchange is risky; the finding and its weight are unchanged. One exception: when the address is the freezing issuer's own token contract on any chain (Tether blacklisted the USDT held by the USDT contract — on Ethereum, or sent to that address on Arbitrum), the finding is shown as "Tether blacklisted tokens held by this contract" with no weight and no floor |
| SignalIndustry blocklist | Weight+25 → 40 | SourceIndustry phishing / scam lists (ScamSniffer); same weighting as a scam entity, not added twice. Not a sanctions designation |
| SignalRestricted-asset exposure | Weight+45 | SourceHolds or moved an asset the EU prohibits transactions in (Annex LIII — A7A5), matched by contract against the restricted-asset registry; one factor per address, never a sanctions listing; on its own it lands in the medium band — a holder of a prohibited asset never prints Low Risk. A balance worth under $10 at par (unsolicited dust — A7A5 has been sprayed to famous wallets in 2-token lots) is shown and not scored; a balance whose value cannot be computed, and any transfer the address itself sent, always score |
| SignalRestricted-asset contract | Weight→ 70 | SourceThe asset contract itself (entity category restricted_asset) floors to 70 / high — the contract is not a person |
| SignalGoPlus malicious flag | Weight+30 | SourceGoPlus Security API |
| SignalKnown hacker/exploiter | Weight+40 | SourceChainHint entity DB, min floor 70 |
| SignalKnown scam entity | Weight+25 | SourceScamSniffer / entity DB |
| SignalMixer interaction | Weight+20 | SourceChainHint entity DB (mixer category) or GoPlus on-chain mixer flag — never a label/name keyword match (KIR-116) |
| SignalStructured scam flag | Weight+25 → 40 | SourceA source's own scam verdict for the address (e.g. TonAPI is_scam) — same weighting as a scam entity. Never a label/name keyword match (KIR-116; the old "High-risk labels" +15 signal was removed for exactly that reason) |
| SignalHeuristic detector flag (Forta) | Weight0 | SourceShown as “Flagged by a heuristic detector (Forta), unverified”. Never scored, never floors or buckets another address (owner decision 2026-09-16) |
| SignalExternal AML registry flag | Weight+10 | SourceA weak signal from an external AML address registry |
| SignalNew address (< 7 days) | Weight+5 | SourceOn-chain age check |
| SignalHigh tx velocity | Weight+5 | SourceBehavioral analysis |
Sanctioned is set only by a sanctions designation naming the address, from the lists we screen addresses against: OFAC SDN, EU (via FR DG Trésor), France DG Trésor, UK Sanctions List, Japan MOF, Australia DFAT (Japan MOF and Australia DFAT are a snapshot taken on Apr 3, 2026, not a live sync). We hold no UN list of wallet addresses, because the UN publishes none — its designations are screened by name instead, on Compliance. Every other finding is shown as what the source establishes — its authority, document and date — with the note "Not a sanctions designation." An arrow (→ 70) is a floor: the finding alone lifts the score to at least that value.
Verified labels and third parties. A counterparty's category can floor or bucket another address — the exposure floor, flow risk, Attacker-controlled sums and the freeze packet — only when the label is verified: an active sanctions designation, law-enforcement attribution, a court/ministerial seizure order, issuer freeze or analyst verification on that address. No label source verifies by itself. A label from a named clustering or tracing source — clustering (WalletExplorer, GraphSense, Arkham), the Bybit HackScan trace, incident reports (Ransomwhere, PeckShield / CertiK, DeFiHackLabs) or a public label registry (Etherscan exploit tags, ton-labels) — is shown and counted as "attributed, unverified" — in the Risky bucket and the attacker-controlled sums, with its marker — but never floors, weighs or becomes a freeze target. Industry blocklists, behavioural labels, heuristic detectors and unconfirmed attributions are shown and do not count. A counterparty floor also needs materiality: funds received never set a floor (a $10 dust from a hacker condemns nobody — the inbound flow stays visible), and funds sent set one only when at least 10% of the address's priced outbound volume and at least $1,000 went to that counterparty — in a traced graph, the value that reached the verified address. Funds sent to a sanctions-designated address set the sanctioned floor at any amount.
