We publish our methodology in full. In a market full of scam-clone "AML bots", transparency is the only honest argument for trust.
If the address appears on at least one of the lists below, the final score is 100/100 and the verdict is 🔴 — regardless of anything else:
| Source | What it is |
|---|---|
| OFAC SDN | The official US sanctions list, 15 assets from BTC to Solana (refreshed at least daily) |
| Chainalysis Sanctions Oracle | US (OFAC) / EU / UN sanctions list, read directly from the on-chain Chainalysis oracle on EVM chains — independent of our own OFAC list |
| TRM Labs Sanctions | Independent sanctions screening |
| Tether blacklist (USDT) | Read directly from the USDT contracts on Ethereum and TRON: the issuer has already frozen the address |
| Circle blacklist (USDC) | From native USDC contracts on Ethereum, Polygon, Base, Arbitrum, Optimism, Avalanche |
| USDT0 block list (Plasma) | From the USDT0 contract (isBlocked function) |
| SPL account freezes (Solana) | Frozen state of USDC/USDT token accounts via public RPC |
| Open blacklists (ransomware/scam) | Ransomwhere, ScamSniffer and the MyEtherWallet darklist — 14,000+ ransomware, scam-drainer and phishing addresses; refreshed daily |
An issuer blacklist hit is not "a service's opinion" — it's an on-chain freeze that has already happened. We make these checks with direct calls to public blockchain nodes — anyone can reproduce them.
If there are no hard signals, the final score equals the MistTrack (SlowMist) assessment — 0–100 based on the address's connections: mixers, darknet markets, scams and phishing, stolen funds, extortion, risky exchanges, and "contamination" through chains of intermediaries.
We show the risk categories as a list — you see why the score is what it is, not just a number.
How connection categories affect risk (the closer and larger the exposure, the stronger the effect):
| Address connection category | Risk level |
|---|---|
| Sanctions, issuer freeze, stolen funds (exploits/hacks), CSAM/terrorism | 🔴 critical — automatically 100/100 |
| Mixers and anonymizers, ransomware, scam and phishing | 🔴 high |
| Gambling, unlicensed and risky exchanges, darknet services | 🟡 medium |
| P2P/OTC with mixed history, new/unverified venues | 🟡 moderate |
| Licensed exchanges, DEXes, ordinary user wallets | 🟢 low / neutral |
Additionally, the extended report shows a source-of-funds breakdown: which venues the address dealt with and what share of the flow came from risky sources (🟢 clean % · 🔴 risky %).
An AML check reveals direct and indirect links between an address and sources of funds — each source is tagged with an indicator. We use the industry-standard three-tier classification (the same categories the largest analytics systems score on).
🔴 Danger — highest risk. A match in these categories yields the maximum risk level:
Sanctions (OFAC/EU/UN) Terrorism financing Child exploitation (CSAM) Dark market Dark service Mixer Ransom Stolen coins Scam Fraudulent exchange Illegal service Gambling (unlicensed) Enforcement action
🟡 Suspicious sources — medium risk:
Crypto ATM Unlicensed exchange Unlicensed P2P Liquidity pools (DeFi)
🟢 Trusted sources — low risk:
Licensed exchange Licensed P2P Mining Marketplace Payment provider Seized assets Verified wallet Airdrop / other
The report shows not just the final score but which indicators fired for the address — you see what the verdict is built on, not an abstract percentage.
If graph analysis is unavailable (source limit, outage, unsupported chain — e.g. the new Plasma) while sanctions lists and blacklists are clean, the report is marked "limited data" and the check is not charged. We don't paint an invented score.
| Score | Verdict | P2P recommendation |
|---|---|---|
| 0–29 | 🟢 Low risk | Safe to accept |
| 30–69 | 🟡 Medium risk | Ask for a different wallet (e.g. a direct exchange withdrawal) |
| 70–100 | 🔴 High risk | Refuse the deal |
Thresholds are conservative, calibrated against automatic freeze practices of the exchanges P2P traders actually use (MEXC, BingX, HTX, Gate, KuCoin, Bitget, CoinEx, Bybit). Every platform's own threshold is unpublished.
AML