What a crypto wallet risk score tells you, and how to check one

A crypto wallet risk score is an estimate of how closely an address is tied to money from crime, such as scams, hacks or sanctioned groups. Exchanges and payment services check it before they accept or send funds, and you can check any address yourself in a minute, often for free. Treat it as a warning light, not a verdict: low means nothing alarming turned up today, high means find out why before any money moves.

What the score is made of

Every transfer on a blockchain is public. Anyone can see that one address sent 200 USDT to another, even without knowing who owns either of them.

Blockchain analytics companies fill in the "who". They label addresses: this one belongs to a large exchange, that one to a known scam, a third to a mixer, a service that blends coins from many people so nobody can tell where they came from. Each company keeps its labels in its own database.

When you check an address, the tool traces where its money came from and where it went, then compares each step with those labels. The score sums up what it found, and most tools look at three things:

• Direct links. Money that came straight from a labelled address or went straight to one. Receiving USDT directly from a sanctioned address pushes the score up almost anywhere.
• Indirect links. Money that reached the address through one or more ordinary wallets in between. The more steps away and the smaller the share of the total, the less it weighs.
• Behaviour. Patterns that often go with laundering, such as money that lands and leaves within minutes or gets split into dozens of small transfers.

Here is how that plays out. A freelancer's wallet received 500 USDT last month from three clients, and 50 of those USDT can be traced, two steps back, to a hacked exchange. A checker will show a small share of stolen-funds exposure, and depending on its rules the headline score will land at low or medium.

The format differs from tool to tool. Some show a number from 0 to 10, some a percentage, some only a label: low, medium or high. Under the headline there is usually a breakdown by category, and that breakdown is the part worth reading.

A score is also a snapshot of today's labels. Labels get added and removed, so the same address can score differently next month. The US Treasury, for example, put the Tornado Cash mixer on its sanctions list in August 2022 and took it off on 21 March 2025 (US, OFAC). The sanctions label went away, but coins that passed through Tornado Cash still passed through a mixer, and checkers can keep flagging them for that.

What counts as a good risk score

There is no universal good number, because every tool uses its own scale. A good risk score is the lowest band of the tool you used, with nothing alarming in the breakdown. The bands usually mean this:

• Low. The check found no strong ties to criminal or sanctioned addresses. Go ahead as you would with any transfer.
• Medium. Something in the history deserves a look, but it is not proof of wrongdoing. Open the breakdown and see which category raised the score.
• High. A large share of the money, or a direct link, leads to a dangerous category. Don't send or accept funds until you know why.

The category matters more than the number. These are the ones checkers treat as the most serious:

• Sanctions. Addresses on government sanctions lists. The US Treasury has put specific crypto addresses on its sanctions list since November 2018 (US, OFAC).
• Stolen funds. Money taken in hacks of exchanges, wallets and apps.
• Scams and fraud. Addresses behind fake investment schemes, phishing and fake shops.
• Darknet markets and ransomware. Payments for illegal goods, and ransom paid to unlock someone's computers.
• Mixers. Services built to hide where coins came from.

So two medium scores can mean very different things. One address got there by trading on a lightly checked exchange; another has a small direct link to a sanctioned address. The second is the more serious one, even if its number is lower.

A low score has its limit too. A wallet created yesterday scores low because it has no history at all, and scammers know it. The score describes the past of an address, not the intentions of the person holding it.

How to check a wallet's risk score for free

Many screening companies run a free checker on their website or in a Telegram bot. A free version may cap how many addresses you can check before it asks you to pay. The steps are the same everywhere:

1. Copy the full address. Copy it from the transaction or the chat rather than retyping it: one wrong character makes a different wallet.
2. Pick the right network. A TRON address starts with T, an Ethereum address with 0x. USDT lives on both, and the checker needs to know which chain to search.
3. Open the breakdown. Look at the categories and their shares, not just the headline score.
4. Save the result. A screenshot with the date helps if an exchange or a client asks about the transfer later.

If a result looks strange, run the same address through a second checker. Each tool knows only its own labels, so one may have heard of an address the other has not.

A checker needs nothing but the public address. A site that asks you to connect your wallet, sign a message or type in your recovery phrase "to run the scan" is not measuring risk. It is trying to get control of your coins, and this is one of the usual ways crypto wallets get hacked.

Is a TRON or Trust Wallet address scored differently?

A risk score belongs to the address, not to the app that holds it. An address in Trust Wallet, on a hardware wallet or inside an exchange account is checked the same way, on the network where it lives.

TRON is worth a separate word because so much USDT moves on it. Tether, the company that issues USDT, can freeze USDT on a specific address, on TRON as on other networks, and the addresses it freezes are typically tied to hacks, scams or requests from law enforcement. Frozen USDT can't be moved by anyone, the owner included. That is one more reason to check a TRON address before you take USDT from it or send USDT to it.

Trust Wallet has a check of its own. Its built-in Security Scanner compares where a transaction is going with databases of known scams, wallet-draining tools and malicious approvals, and shows a warning before you confirm. That is scam protection, not a full risk score with a breakdown of where an address's money came from. Trust Wallet itself notes that a brand-new scam may not be in any database yet.

You can also read an address's history with your own eyes. A blockchain explorer is a public website that shows every transfer in and out of an address: Tronscan for TRON, Etherscan for Ethereum. Large exchanges are often labelled there, and a stream of tiny transfers from strangers is easy to spot. If the page looks like noise at first, here is how to read a transaction in a blockchain explorer.

What a clean score won't warn you about

A risk score answers one question: where has this address's money been? Several common ways to lose money happen outside that question, and a low score says nothing about them.

A lookalike address

Scammers create an address whose first and last characters match one you use, then send you a tiny transfer from it so that it sits in your transaction history. The trick costs them a few cents. Wallets usually shorten addresses on screen to a few characters at each end, which is exactly the part the scammer copied. The next time you copy "your" address from history, the money goes to them.

The fake address is brand new, so its risk score is low. Keeping trusted addresses in your wallet's address book, and picking the recipient from there rather than from recent transfers, avoids the trap. Beyond that, only comparing the whole address, character by character, against the one you saved catches it, and it is worth knowing how address poisoning tricks people into sending to fake wallets.

A fake token

The score looks at an address, not at what it sends. A token can be called USDT, carry the right logo and show up in your wallet with a dollar value while having nothing to do with Tether. The sender's address may score low; the token is still worthless.

Before you treat such a payment as received, check that the token's contract address, the identifier of the program that issues it, matches the official USDT contract for that network. A wallet balance alone proves nothing.

The person on the other side

A score can't tell you whether the deal itself is honest. Peer-to-peer trades, where you buy or sell USDT directly with another person for a bank transfer, carry risks no address check sees. The coins can be clean while the bank money comes from a scam victim, and then it is your bank account that gets frozen. An address check covers half the deal at best; the other half comes down to choosing the counterparty and the payment method, which is what buying and selling crypto safely on P2P is about.

What to do about a high-risk wallet address

Before money moves

If the address you are about to send to scores high, don't send. Ask the other side why the check flags it and whether they have another address. A real business with an exchange account can usually give one; someone who pushes you to pay anyway has answered the question.

If you are about to accept money and the payer's address scores high, the same logic works the other way round. Ask them to pay from another wallet or from an exchange account. Refusing a payment is easier than returning one later.

After money has already arrived

Sometimes the check comes after the fact: the money is already in your wallet, and the sender's score is high. A few rules help here:

• Don't try to "clean" it. Sending the coins through more wallets doesn't reset anything. Checkers follow every step, and the extra hops look like laundering.
• Keep records. An invoice, a chat with the payer, a trade receipt: anything that shows what the money was for and who sent it.
• Expect questions at the exchange. When those coins reach an exchange, it may hold the deposit and ask where they came from.

Those questions come from the exchange's own duties: it has to know who its customers are and where their money comes from, which is also why an exchange asks for your ID. Answer with the records you kept. A clear explanation with documents gives a reviewer something to close the case with; silence does not.

Why an exchange rejected your transfer over a risk score

If Crypto.com or another exchange stopped your transfer and pointed to a risk check, its screening tool most likely flagged one of the addresses involved. Regulated exchanges screen both directions: the coins coming in and the address you are sending to. Here is what can happen next:

• The deposit is held for review. The coins have arrived, but you can't use them until the exchange's compliance team finishes checking.
• The deposit is returned. Some exchanges send rejected coins back only to the address they came from, not to one you choose.
• The withdrawal is blocked. The exchange won't send to an address that scores high, however many times you retry.
• The account is restricted. After repeated flags, an exchange may limit what you can do until you explain.

The exchange rarely tells you which label triggered its decision, and sometimes its screening provider doesn't share that detail even with the exchange. What you can do:

1. Write to support through the official app or website. Not through a "recovery agent" who found you in the comments: those are scammers.
2. Explain where the funds came from. Attach the invoice, trade record or chat you saved.
3. Check the address yourself. A free check shows which category is likely behind the flag, so you know what to explain.
4. For a blocked withdrawal, ask the recipient for another address. Then run that address through a checker before you try again.

In the EU there is one more reason for a hold, and it has nothing to do with the score. Since 30 December 2024, Regulation (EU) 2023/1113, the EU "travel rule" for crypto, has required crypto providers to pass on sender and recipient details with each transfer (EU, as of October 2026). For a transfer above 1,000 euros to or from a self-hosted wallet, one you control yourself rather than an exchange account, the provider also has to check that the wallet belongs to its customer. An exchange may hold the deposit until you confirm in its app that the sending wallet is yours.

When you accept crypto payments, the payer's score becomes your problem

A shop or a freelancer doesn't choose which wallet a customer pays from. Most payments come from ordinary wallets and exchange accounts and raise no flags. The trouble shows up later, when the business moves the money on.

Say a store received 40 payments this month, and one of them came from an address tied to a hacked exchange. The store sends everything to its exchange account to cash out. The exchange screens the deposit, sees the flagged part and holds it, sometimes the whole transfer, clean money included. The bigger the batch, the more is stuck because of one customer. That is the step where a payer's score hurts most, so it pays to know how a business off-ramps crypto payments to its bank account before the first batch goes.

Catch it when the payment arrives

The cheapest moment to deal with a risky payment is when it lands, while it still sits apart from the rest of the money. Once it is mixed into one balance and sent on, the flag travels with everything it touched. A store that waits until cash-out day hears about it from the exchange, along with the rest of the batch.

So the sender's address becomes one more thing to look at when a payment comes in. A business already checks the payment itself. Screening adds a question about the payer: who sent the money, and what does that address's history look like?

For a handful of payments a month, a free checker and a screenshot in the order file are enough. At dozens a day, screening has to happen automatically, inside whatever takes the payments. The other checks have pitfalls of their own, from a transfer on the wrong network to a customer who sends a screenshot instead of money, and they are laid out in how to check a crypto payment by TXID, network, amount and status.

What to do with a flagged payment

When a payment does come back flagged, a business has three ways to go:

• Accept it and keep records. Reasonable for a small, indirect link: note the check result and what the customer bought.
• Hold the order and ask. For a medium or high score: ask the customer where the funds came from, and decide after the answer.
• Return the money. If the business decides not to keep it.

Returning money is less simple than it looks. The refund goes to an address, usually the one the money came from, which is the address that was flagged. The network fee comes out of the amount, and a customer who asks for a different address hands you a new address that needs its own check.

If the address is on a US sanctions list, sending the money back can itself be a prohibited transaction for a US person (US, as of October 2026). Under OFAC rules, such funds have to be blocked and reported to OFAC instead. That case goes to a lawyer before anyone presses send. For ordinary returns, here is how to handle crypto refunds, overpayments and mistaken transfers.

Keep money under review apart

Money under question shouldn't sit in the same pot the business pays salaries and suppliers from. If a flagged payment is mixed into the main balance and that balance pays a supplier, the supplier's exchange may now see the link and ask its own questions. Checkers follow money forward as well as back, so whoever receives part of a flagged payment inherits part of its history. The business's own payout address picks up the exposure too.

A practical rule: keep a separate address or sub-account for funds under review, and move them to the main balance only after the decision. For a small business, a second wallet address used only for this purpose does the job. When the review ends, the money moves on to wherever the decision sends it. It costs one more line in the books and can save a frozen supplier payment. It is part of the wider job of managing a stablecoin treasury once customers pay in USDT.

Count what screening finds

If payments are screened, the results are worth counting. Taken month by month, they turn scattered alerts into something a business can act on. Three numbers show whether it has a problem:

• Share of flagged payments. How many incoming payments a month score medium or high. A sudden jump is a reason to look at where those customers come from.
• Money on hold. How much sits under review at the end of the month, and for how long. Money stuck in review is money the business can't spend.
• Review time. How many days pass between the flag and the decision. Long reviews mean customers waiting for their orders.

None of this needs special software at the start. A spreadsheet with the date, the amount, the score band and the decision for each flagged payment shows the pattern after a few months.

These numbers sit next to the usual numbers for crypto payments, such as conversion and the share of underpayments, among the metrics CEO, CFO and growth teams track for crypto payments.

Who sees the result of a check

When screening runs inside the payment tool, nobody pastes addresses by hand any more, and that brings a new risk: a flag nobody reads protects no one. At that point the check is only as good as what happens after it. The result of each check has to reach two people:

• Whoever handles the order. They need to see that a payment is on hold, and why, before anything ships, and support needs the same view when the customer calls.
• The customer. A payment held for review is a status the checkout page should show. Otherwise the customer sees silence, assumes the money is lost and writes to support.

Both depend on how the payment tool reports what happened to each payment, and that is worth testing before it goes live rather than on the first flagged order. A status that lives only in someone's email inbox gets missed. Reporting is covered, together with the rest of an integration, in what to check in a crypto payment API before integrating it.

Whose job is the screening?

Behind all of this sits a question a risk score can't answer: how much of the anti-money-laundering work is the business's own job. The answer depends on the country and on what the business does with the money, and it decides whether screening is a legal duty or a precaution. Screening tools and payment services can help with that work, but they don't decide where it starts and ends.

Even as a precaution, screening is worth having: one flagged payment can freeze a whole deposit at the exchange, as the cash-out example above shows.

Banks and exchanges that serve the business may also ask how it checks crypto money before they agree to take it. A short written routine, with the check result kept alongside each order, answers that question in one email. What the rules ask of a seller, and what to ask a payment service about screening before signing up, is laid out in what crypto AML compliance actually requires from a business that accepts crypto.

In the EU, the coin matters as well as the address

A business in the EU has a second filter to think about, and it comes before any risk score: which coins to take at all. A stablecoin is a token built to hold the value of a currency, usually the US dollar or the euro; USDT and USDC are the best known. MiCA, the EU regulation on crypto-assets (Regulation (EU) 2023/1114), sets rules on which stablecoins licensed providers in the EU can list and offer (EU, as of October 2026).

In practice, that shows up at the exchange a business cashes out through: it may support some stablecoins for EU customers and not others. The risk score tells a business whether a payer's address is safe. MiCA decides whether the coin itself can move through the business's EU exchange and payment providers. Both answers count before a business settles on what it accepts, and the coin side is covered in which stablecoins a business in Europe can accept after MiCA.

When a processor takes the payments

When a business takes payments through a processor, much of this work sits with the processor rather than with the business. The processor sees each transfer before the money reaches the business, which makes it the natural place for the check described above, and the one point where a payment can be held before anyone has spent it.

For a business that uses one, many of the screening steps in this article become a question of what the processor does rather than a job for its own staff. Processors differ in how they treat a suspicious payment, so it is worth asking any of them what happens to a flagged one before signing up.

CryptumPay, a crypto payment processing service, catches suspicious funds and holds them before they reach the merchant's balance. It accepts payments from customers and pays the money out to the address the merchant names; here is how CryptumPay takes crypto payments for a business.

In short

A wallet's risk score is a quick look at where its money has been, not a judgement of the person behind it. What to take away:

• Read the category, not just the number. A small direct link to sanctions outweighs a bigger share from a lightly checked exchange.
• Check before money moves. Refusing a payment or picking another address costs nothing; undoing a transfer is rarely possible.
• Give a checker only the address. Any site that wants your recovery phrase or a wallet connection is after your coins.
• If an exchange has stopped you, explain with documents. Show where the money came from and what it was for.
• If you take payments, check each one as it arrives. Keep anything flagged apart from the money you pay out.

Questions people ask next

Is there a calculator to work out a wallet's risk score myself?

Not really. The score comes from each company's private database of labelled addresses, and no formula you can run by hand has access to it. Sites called a "risk score calculator" are the same checkers: you paste an address and they look it up in their own data.

What is an AML wallet checker, and is a free one good enough?

AML stands for anti-money laundering, the rules that make banks and exchanges check where money comes from. An AML wallet checker is the same address check described above, under the name the compliance world uses for it. For an occasional transfer, a free check is enough to see how risky an address looks before you send. A business that screens every incoming payment needs checks that run on their own, inside whatever takes the payments, rather than addresses pasted in by hand.

Can I lower a high risk score on my own wallet?

Not by moving money around: the history of an address is permanent, and extra transfers only add steps for a checker to follow. The score can drop on its own if a company removes a label, as happened when Tornado Cash came off the US sanctions list. What you control is the paperwork: keep records that explain the flagged money, and keep it apart from funds you send to exchanges.

This article is general information, not legal advice.