Ethereum vs Layer-2 Wallets: Why One Address Gets Two Risk Scores

Screening every chain a wallet has touched beats screening Ethereum alone, because the same address carries a separate risk history on each EVM chain.

One address, one private key, and three separate transaction histories once that key starts signing on Ethereum, Arbitrum, and Base. A screening tool that only reads one of those ledgers is quietly assuming the other two are clean by omission, not by evidence. That gap gets used on purpose: a fresh address on a two-day-old Layer-2 wallet has nothing in any corpus to match against yet, and that silence gets sold back to the owner as a clean bill of health.

Why doesn't one wallet address carry one risk score?

An EVM address is deterministic. The same private key produces the same 0x string on Ethereum, Arbitrum, Base, Optimism, Polygon, BNB Chain, and Avalanche, so the label on the wallet never changes from chain to chain. What changes is everything behind it. Ethereum keeps its own ledger. Arbitrum keeps its own ledger. Each rollup settles to Ethereum for security, but the transaction history, the token approvals, and the counterparty graph a screening engine actually reads all live on the chain where the activity happened.

Plastron's own corpus makes the split concrete. It carries 3,901 labeled scam, exploit, and sanctions-adjacent addresses across seven EVM chains, plus 780 OFAC-designated entries that apply everywhere at once because a sanctions match is chain-agnostic. Everything else, the scam labels, the exploit tags, the counterparty graph, is chain-specific by construction. A wallet that's been active on Ethereum since 2019 has years of graph to check against. The same wallet, seen for the first time on a chain it joined last week, has almost none.

What actually changes in the risk read from chain to chain?

Four things move independently once you cross from Ethereum to a Layer-2, and only one of them travels with the address for free.

A sanctions hit is the one row that's identical everywhere, because OFAC designates an address, not a chain. Everything below it resets to whatever history that specific chain has recorded, and a thin history reads as low risk even when the honest answer is "not enough data yet."

Does a clean read on Ethereum mean the wallet is clean everywhere?

No. February 2025's $1.5 billion Bybit theft is the case that made this obvious at scale: the stolen ETH didn't stay on Ethereum. It moved through swaps and bridges into other chains within hours, precisely because a fresh address on an unfamiliar chain draws less scrutiny than the same funds sitting still on a heavily-watched mainnet address. A wallet that later received a slice of that money three or four hops downstream, on a chain where the receiving address had no prior footprint, could clear a single-chain check that never looked past its own ledger.

A wallet with zero labeled history on a two-day-old Layer-2 address is not a clean wallet. It is an unread one, and an exchange or counterparty that treats those as the same thing is the one taking the risk.

When is checking Ethereum alone actually enough?

Sometimes it genuinely is. A wallet that has only ever held ETH and stablecoins on mainnet, has never signed a transaction to a bridge contract, and shows no outbound transfers to another chain's deposit address carries no exposure a Layer-2 check could add. Screening seven chains for an address that's only ever touched one is wasted effort, not extra safety. The moment a bridge transaction shows up in that wallet's history, though, that assumption stops holding, because the funds on the other side of that bridge are a new address with its own separate story.

How do you check one address across every chain it has touched?

The manual version means opening Etherscan for the mainnet history, then Arbiscan, Basescan, or whichever block explorer matches each chain the address has bridged into, and cross-referencing scam and sanctions lists by hand for every single one. Screen the address with Plastron instead, and get the same address checked across Ethereum and six supplementary EVM chains in one pass, with the sanctions, mixer, and stolen-funds exposure for each chain shown side by side rather than assumed absent.

Before trusting a "no exposure found" result, confirm which chains it actually covers. A wallet screening tool that only reads mainnet is answering a narrower question than the one usually being asked, and the gap between those two questions is exactly where a bridged wallet slips through. The same logic applies going the other direction: for the mechanics of why Bitcoin and Ethereum screening go to different depths, the chain itself sets the ceiling on what any tool can see.

FAQ

Does bridging to a new chain reset a wallet's risk score?

No. Bridging creates a second, separate transaction history on the destination chain, but the funds that crossed the bridge carry whatever exposure they had before. A low match count on the new chain reflects thin data, not a reset.

Can the same address be sanctioned on Ethereum but not on Arbitrum?

No. An OFAC designation names the address itself, so it applies on every chain that address can transact on. What differs chain to chain is everything outside the sanctions list: scam labels, exploit tags, and counterparty history.

Why did my wallet show a different risk level on Arbitrum than on Ethereum?

Because the two chains hold separate transaction histories for the same address. A wallet active on Ethereum for years but new to Arbitrum will show far less matching history there, which can read as lower risk even when the underlying funds are identical.

Does a wallet screening tool check more than just Ethereum?

It depends on the tool. Some check mainnet only. Others screen the same address across Ethereum and six supplementary EVM chains at once, Arbitrum, Base, Optimism, Polygon, BNB Chain, and Avalanche, which is the only way to catch exposure that only shows up after a bridge.