What is a wallet risk score?
A wallet risk score is a numerical assessment of how likely a blockchain address is to be involved in illicit activity. WalletScreen analyzes on-chain data — transaction patterns, sanctions list matches, token holdings, and counterparty exposure — to produce a score from 0 (clean) to 100 (maximum risk).
Compliance teams, exchanges, and DeFi protocols use wallet risk scores to make automated decisions: approve a deposit, flag a withdrawal for manual review, or block a sanctioned address entirely.
How the risk score is calculated
WalletScreen's scoring engine combines multiple independent signals into a single composite score:
OFAC sanctions & known exploiters
Addresses on the US Treasury SDN list or in our known exploiter registry are automatically assigned a score of 100. The SDN list is refreshed from the Treasury XML feed every 6 hours.
Transaction behavioral analysis
We analyze the last 1,000 transactions via Alchemy's getAssetTransfers API and flag suspicious patterns:
- Rapid fan-out — many outbound transfers in a short window (mixing behavior)
- Rapid fan-in — many inbound transfers from distinct addresses (consolidation)
- Round-trip transfers — funds sent and returned between the same pair of addresses
- High-value transfers — single transactions above a dynamic threshold
- Sanctioned counterparties — any interaction with a known bad address
ERC-20 token forensics
We fetch all token balances and check them against known scam token registries, meme token lists, and metadata quality signals. Wallets holding known scam tokens, high meme token exposure, or many unverified tokens receive additional risk points.
Score ranges
| Score | Label | Typical action |
|---|---|---|
| 0–24 | Low | Auto-approve |
| 25–49 | Medium | Enhanced due diligence |
| 50–74 | High | Manual review required |
| 75–100 | Critical | Block / escalate |
API integration in 60 seconds
One endpoint, one header, one response. No SDKs to install.
curl https://walletscreener.io/wallet/0x1f9840a85d5aF5bf1D1762F925BDADdC4201F984?chain=ethereum \ -H "X-API-Key: ws_your_key_here"
{
"address": "0x1f9840a85d5aF5bf1D1762F925BDADdC4201F984",
"chain": "ethereum",
"risk_score": 73,
"risk_label": "high",
"labels": ["RAPID_FAN_OUT", "HOLDS_SCAM_TOKEN"],
"balance_eth": 12.4801,
"transaction_count": 847,
"is_contract": false,
"tx_analysis": { "flagged_interactions": [...] },
"token_analysis": { "total_value_usd": 48291.33 }
}
Multi-chain coverage
Pass a chain parameter to scan wallets on any supported network. Same API key, same response format.
- Ethereum — mainnet
- Polygon — PoS chain
- Arbitrum — L2 rollup
- Base — Coinbase L2
- Optimism — L2 rollup
- zkSync — ZK rollup
Need to check a wallet across all chains at once? Use the /wallet/{address}/crosschain endpoint to get an aggregate worst-of-all-chains score.
Batch screening
Screen up to 100 wallets in a single API call with POST /wallets. All addresses are scanned concurrently — ideal for onboarding flows, deposit screening, and periodic portfolio audits.
Continuous monitoring
Set up webhook or email alerts on any wallet. WalletScreen re-scans monitored wallets every 15 minutes and notifies you when risk scores cross thresholds, change significantly, or new risk labels appear. See Monitors API.
Who uses wallet risk scoring?
- Centralized exchanges — screen deposits and withdrawals in real time
- DeFi protocols — gate access to lending pools and liquidity vaults
- Compliance teams — automate SAR filing triggers and audit trails
- VASPs — meet Travel Rule counterparty due diligence requirements
- Neobanks — screen crypto on-ramp and off-ramp transactions