A wallet risk score is the summary verdict a screening tool assigns a blockchain address: a level such as CLEAN, LOW, MEDIUM, HIGH or CRITICAL, paired with a recommendation and the reasons behind it. It describes what the address is connected to on-chain, not the character of the person holding the keys. Desks use it as the first filter on a deposit, a payout or a new counterparty, then read the named reasons before acting.
The score is the part of a check that people act on. An operator working a deposit queue does not read transaction graphs; they read a word and a recommendation, and they need that word to mean the same thing on Monday as it did on Friday. That consistency is the value — two reviewers looking at the same address on the same day reach the same decision, and the decision can be explained months later to someone who was not there.
It is not a credit score, although a lot of people search for it that way. A credit score predicts how a person will behave in the future. A wallet risk score describes what an address is connected to right now on a public ledger, and it is silent on everything else.
The result carries the verdict word, the recommendation, and the drivers behind them named in plain language — sanctions, mixer, darknet market, ransomware, scam, phishing, stolen funds, drainer, high-risk exchange, no-KYC exchange, issuer freeze. Where the address is attributed, the entity is named. The network and token are stated, because the same string can exist on more than one chain.
In the Telegram bot that arrives as one message in seconds, free, three checks a day. In the workspace it becomes a filter on your queue, a case with an owner and an audit trail, and a signed report you can forward.
| Verdict | Recommendation | What a desk usually does |
|---|---|---|
| CLEAN | Proceed | Settle. Keep the dated result with the deal record. |
| LOW | Proceed | Settle. Note the driver if the counterparty is new to you. |
| MEDIUM | Caution | Ask for source of funds before releasing. Smaller ticket, or delayed release. |
| HIGH | Review | Hold the transfer, escalate to a named second reviewer, document the decision either way. |
| CRITICAL | Reject | Do not accept or forward the funds. Preserve the record and follow your reporting policy. |
Those are conventions, not rules. Your written risk policy decides which level stops a transfer at your desk, and a policy written before the incident is what makes the decision defensible after it.
No. A credit score predicts a person's future repayment behaviour. A wallet risk score describes what a blockchain address is connected to at the time of the check, and says nothing about the person behind it.
Yes. Designations are published, thefts are attributed and services are identified after the fact, so an address that checked clean last month can carry a driver today. Re-check before a large settlement.
The result names the drivers: a link to a sanctioned entity, a darknet market, a mixer, a ransomware wallet, a drainer, documented stolen funds. Read them. A HIGH driven by sanctions and a HIGH driven by a scam report are different problems with different answers.
Also available in: · · ·
No. It means the address has a connection your policy should look at. Deposit addresses at large services carry other people's history, which is why the drivers and the entity name matter more than the word alone.
Send any wallet to the Telegram bot and get a verdict in seconds. Three checks a day, free, no signup. Desks that screen every deposit run it on plans from $199/mo.