MetaMask runs security alerts powered by Blockaid: transactions and signature requests are checked and flagged as "Malicious" or "Warning", the feature is on by default, and a warning does not block the transaction — you can still confirm it. That is malicious-transaction protection. Whether the address paying you is tied to a sanctioned entity, a darknet market or a scam cluster is a separate question, and the one that costs you an exchange account. Free in the Telegram bot, three checks a day.
Open @sanctuaryapp_bot, paste the address, get the verdict in seconds. Three checks a day, free, no signup.
MetaMask documents the feature: security alerts check transactions and signature requests and flag them as "Malicious" or "Warning", the alerts are on by default, and a warning does not block anything — the user can still confirm — MetaMask security alerts.
Two consequences worth being precise about. First, the alert is about the transaction in front of you: a signature that would drain an approval, a contract known to be hostile. Second, the alert is advisory, so a user in a hurry can click through it. That is a deliberate design choice for a self-custodial wallet, and it means the last control is always the user.
MetaMask is self-custodial. It cannot freeze your funds and does not review your deposits, because it never holds them.
A security alert asks whether this transaction is hostile. An AML check asks what the address on the other side has been doing and what a regulated venue will make of it.
| Question | MetaMask security alerts | AML check |
|---|---|---|
| Will this signature drain my wallet? | yes, flagged as Malicious or Warning | not its purpose |
| Is the counterparty tied to a sanctioned entity? | not stated | yes, named in the result |
| Did these funds come through a mixer, a darknet market or a scam? | not stated | yes, with the category named |
| Is the address on a stablecoin issuer freeze list? | not stated | yes |
| Will my exchange question this deposit? | not its purpose | that is the question it answers |
Leave the alerts on and check the counterparty separately. The result is a verdict — CLEAN, LOW, MEDIUM, HIGH, CRITICAL — a recommendation of Proceed, Caution, Review or Reject, and the decision drivers named in plain words. Screen the network the transfer settles on: Ethereum, Base, Arbitrum or Polygon.
Screening is read-only. There is no signature to approve, no gas to pay and no notification to the address owner — the opposite of the interaction a drainer needs from you.
Self-custody means there is no wallet provider to appeal to. The hold is at the venue you sent to, and that is where it is resolved.
| What you get | Free check in the Telegram bot | Workspace and API |
|---|---|---|
| Counterparty history | verdict with the reason named | the same, plus the counterparty breakdown |
| Coverage | 10 chains at full AML depth, 35+ networks screened | the same, in bulk and on a schedule |
| Volume | three checks a day | bulk lists, watchlists, continuous monitoring |
| Evidence | the result in the chat | a signed report you can forward |
| Cost | free, no signup | from $199/mo — see pricing |
Individual users check an address in the Telegram bot — three free a day, verdict in seconds. A protocol or a business paying out to self-custodial wallets screens every destination through the API and reviews exceptions in the workspace.
No. MetaMask runs security alerts powered by Blockaid that check transactions and signature requests and flag them as Malicious or Warning. That is protection against a hostile transaction, not a screening of a counterparty's history against sanctions, darknet or scam data.
No. MetaMask states that a warning does not block the transaction and the user can still confirm it. The alerts are on by default, and the final decision is always the user's — which is why a second, independent check of the counterparty is worth the few seconds it takes.
Copy the 0x address and send it to the Telegram bot — three free checks a day, no signup. The verdict comes back in seconds with the reason named, and the lookup signs nothing and costs no gas.
Also available in: · · ·
No. MetaMask is self-custodial and never holds your assets. What can be frozen is a stablecoin at the issuer level, and what can be held is a deposit at an exchange you send funds to.
Treat the wallet as compromised: stop using it, create a new one on a clean device, and check the destination before moving anything of value. Record the transaction hashes and the receiving address — that record is what a venue or the police will work from, and it is also what makes the theft traceable.
Send any wallet to the Telegram bot and get a verdict in seconds. Three checks a day, free, no signup. Desks that screen every deposit run it on plans from $199/mo.