Plastron's Wallet Data: 86% of Flagged Wallets Are Scams

TL;DR - Scam-labeled wallets make up 3,354 of Plastron's 3,901 labeled addresses, 86% of the corpus, while hack exploiters number just 121 and the separate OFAC sanctions list holds 780.

Run any of Plastron's 3,901 labeled addresses through a risk check and there's a good chance it lands in the same bucket: scam. The dataset behind every wallet screen skews so hard toward that one label that hacks, sanctions hits, and mixer flags barely register next to it. That skew isn't a quirk of how Plastron built its corpus. It lines up with what law enforcement and researchers keep finding when they chase the same money in the real world.

Scam Addresses Make Up 86% of the Corpus

Plastron's labeled dataset holds 3,901 addresses, each carrying an entity type: scam, fraud, hack_exploit, exchange, defi, or mixer. Scam is the single largest label by a wide margin, at 3,354 addresses, 86% of the entire corpus. Add the 280 addresses tagged fraud and the two categories together cover 3,634 addresses, 93.2% of every labeled entry.

The skew reflects the shape of retail crypto crime. Phishing pages, fake token launches, and romance-investment scams each need a fresh receiving address, and every one gets reported and labeled on its own. A single scam operation can spin up dozens of wallets before it's shut down. Fraud, the second-largest label at 280 addresses, often overlaps with scam in practice - a fake-support wallet or a recovery-scam collection point can carry either tag depending on how it was first reported.

Hacks and Sanctions Barely Register by Comparison

Hack and exploit addresses total just 121, 3.1% of the corpus. Mixer addresses are smaller still at 28, 0.7%. Exchange and DeFi entries add another 41 and 45 respectively, tagged for identification rather than risk. None of these categories comes close to scam's share. Risk tier tells a similar story: 3,478 addresses sit in the high tier (89.2%) and 50 in critical (1.3%), a combined 90.4% flagged high or critical. Only 259 sit in medium (6.6%) and 114 in neutral (2.9%).

The OFAC sanctions list runs on a separate track entirely. It holds 780 crypto addresses, built through a government designation process rather than scam or fraud reporting, and it isn't folded into the entity-type breakdown above. At under a quarter the size of the scam count alone, it's a much smaller, much more formal list.

Does the Real World Match These Numbers?

Yes, and the timing checks out. On March 16, 2026, the U.S. Secret Service, the U.K.'s National Crime Agency, and Canadian police launched Operation Atlantic, an approval-phishing crackdown built on the same pig-butchering playbook. Investigators flagged more than 20,000 wallet addresses linked to victims across 30-plus countries and froze $12 million of the roughly $45 million identified.

The scale tracks a pattern researchers spotted earlier. A March 2024 study by University of Texas finance professor John Griffin and graduate student Kevin Mei traced more than 4,000 victim addresses over four years and found criminal networks moved upward of $75 billion through crypto exchanges. Chainalysis's 2026 crime report put 2025's on-chain scam revenue at roughly $17 billion, with impersonation scams alone up 1,400% year over year. Plastron's 86% skew isn't a data artifact. It's the same crime, counted twice.

What Should You Do With a Scam-Tagged Wallet?

Entity type matters more than the headline risk score. A scam or fraud tag, the outcome behind 93.2% of labeled addresses, usually traces back to a specific reported incident: a phishing site, a fake giveaway, a romance-scam collection wallet. A sanctions hit is rarer and carries different consequences, since it ties to one of only 780 addresses under a formal designation rather than a scam report.

Checking an address against 3,901 labeled entries and a separate 780-address sanctions list by hand isn't realistic before you send funds or accept a payment. Screen the wallet with Plastron to run both lookups at once, alongside a dedicated scam check and an OFAC sanctions check, and see exactly which category produced the flag.

Methodology

The address counts and percentages in this piece come from data/known-addresses.json, which holds 3,901 labeled entries. Each record carries an entity_type field (scam, fraud, hack_exploit, exchange, defi, mixer, and others) and a riskLevel field (high, medium, neutral, critical). Counts per type and per tier were read directly from that file and divided by 3,901 to produce each percentage, rounded to one decimal place.

The sanctions figure comes from a second, independent file, data/ofac-sdn.json, which holds 780 OFAC SDN crypto addresses. That list isn't merged into the entity-type counts above; it's tracked separately because a sanctions designation follows a government process, not a scam or fraud report. The Operation Atlantic, University of Texas, and Chainalysis figures are cited from the named public sources above and aren't part of either committed dataset.

FAQ

What share of the labeled addresses are scam wallets?

86%. Of 3,901 labeled addresses, 3,354 carry a scam entity type, and adding the 280 fraud-tagged addresses brings the combined share to 93.2%.

How many hack and exploit addresses are in the dataset?

121, just 3.1% of the corpus. Hack and exploit addresses tend to tie back to one incident each, rather than the dozens of fresh wallets a single scam operation can generate.

Is the OFAC sanctions list part of the same 3,901-address dataset?

No. The 780 OFAC SDN crypto addresses are tracked in a separate file, data/ofac-sdn.json, built from a government designation process rather than scam or fraud reporting.

Does this scam-heavy skew match real-world crypto crime data?

Yes. Operation Atlantic flagged more than 20,000 fraud-linked wallets in March 2026, and Chainalysis put 2025's on-chain scam revenue at roughly $17 billion, both consistent with scam wallets vastly outnumbering hack or sanctions addresses.