TL;DR — Wallet screening checks a crypto address against sanctions lists, mixers, stolen-funds clusters and known scam wallets, then scores how risky its on-chain history looks before you transact.
Most people meet wallet screening on the worst possible day. You send funds to an exchange, the deposit lands, and then nothing happens — no credit, no error, just a support ticket that says "under compliance review". Somewhere in that exchange's stack, your address was screened, something in its history scored badly, and a human is now deciding whether to release your money. The check took milliseconds. The review takes weeks.
This guide explains what that check actually is, what it can and cannot see, and how to run it yourself before someone else runs it on you.
What is wallet screening?
Wallet screening is the practice of evaluating a blockchain address against known-bad data and its own transaction history, and returning a risk signal. It is the crypto equivalent of a sanctions and adverse-media check in traditional finance, except the evidence is public and permanent.
Three things make it different from a background check on a person. The subject is an address, not an identity — screening tells you what an address has touched, never who controls it. The evidence is on a public ledger, so anyone can verify a finding. And risk is transitive: an address can score badly because of who paid it, not because of anything its owner did.
That last property is the one that surprises people, and it is the reason this page exists. If you want the short version of the difference between screening and just looking at a block explorer, we wrote that up separately in Etherscan versus a wallet screening tool.
What does a screen actually check?
A screen resolves an address against several independent question sets. The categories below are the ones that move a score, listed roughly in the order of severity most screeners assign them:
- Sanctions. Is the address, or something it transacted with, on a government designation list? In the United States this is the OFAC Specially Designated Nationals list, which has carried digital-currency addresses since 2018; you can check an address against it directly. This category outranks everything else, because it is a legal fact rather than a risk estimate.
- Mixer exposure. Did funds arrive from, or leave toward, a service whose purpose is to break the link between sender and receiver — Tornado Cash and its imitators.
- Stolen funds. Do the coins trace to a named hack, bridge exploit or exchange breach.
- Darknet. Contact with marketplaces and the vendor wallets that serve them.
- Fraud and scams. Rug-pull deployers, pig-butchering collection wallets, fake-support drainers, phishing contracts.
The categories are not weighted equally, and they should not be. A single confirmed sanctions hit is decisive; a single interaction with an address that someone once reported as a scam is a signal, not a verdict. Plastron ranks them explicitly — sanctions at the top, then mixer and stolen funds, then darknet, then fraud and phishing — and the composite score takes the strongest signal rather than averaging everything into mush. Averaging is how a serious finding gets diluted by a hundred boring transactions.
Where does the data come from?
A screen is only as good as the lists behind it, and this is where screening tools genuinely differ. There are three kinds of input.
Government designations are published and unambiguous. The OFAC SDN list names specific addresses alongside the entity they belong to. There is no inference involved: an address is on the list or it is not. Worth knowing, because it shapes what every screening tool can do — the majority of OFAC-listed crypto addresses are Bitcoin addresses, with Tron second and Ethereum a distant third. Any tool that screens only Ethereum is blind to most of the list by construction.
Attributed clusters come from blockchain analytics work: this group of addresses belongs to that exchange, this cluster is the Lazarus Group's, these wallets received the Ronin bridge proceeds. Attribution is a research product, and different vendors disagree at the edges.
Community and open-source reports — scam databases, phishing blacklists, abuse reports — are the broadest and the noisiest. They catch fresh threats fast and they also carry false positives. Plastron merges more than a dozen upstream feeds and tracks which one made each claim, because a label that came from one anonymous report deserves less weight than a verified contract. We learned that the hard way: a single community report once mislabelled OpenSea's exchange contract as a scam deployer, which flagged anyone who had ever bought an NFT until we caught it.
The live counts for every category sit on the address screening page and update on every deployment, so they are worth checking there rather than trusting a number written into a blog post months ago.
Why does a wallet inherit risk it never asked for?
Because value is fungible and the ledger is not. When a tainted coin moves, the taint does not stop at the first hop — it propagates, diluted, through everything downstream.
Screeners model this with a haircut: at each hop the contribution of the original source is reduced, so a direct transfer from a sanctioned address is treated very differently from funds that passed through four intermediaries first. Distance matters, and so does proportion. Receiving one dollar of tainted value into a wallet holding fifty thousand is not the same event as receiving forty thousand, even though a naive "any contact" rule would flag both identically.
This is also why dust attacks work as harassment. Anyone can send you a tiny amount of tainted crypto without your consent, and a badly built screener will happily downgrade your wallet for it. A good one applies a materiality threshold. If you have found unexplained tokens in your wallet, we wrote about what to do with them — the short answer is do not interact.
Two specific propagation patterns are worth naming because they defeat casual inspection. A peel chain moves a large sum through a long series of transactions, peeling off a small amount each time. Chain hopping bridges value between networks to break a single-chain view. Neither hides anything from a screener that traces across hops; both hide everything from someone scrolling a block explorer by hand.
How does a score become a verdict?
Most screeners output a number between 0 and 100 and a band. Plastron's bands are:
| Score | Verdict | What it means in practice |
|---|
| 0–25 | Low | Nothing found in the categories screened. Normal deposits should clear. |
| 26–50 | Medium | Something is present but distant or immaterial. Usually clears; occasionally asks for source of funds. |
| 51–75 | High | A real exposure a compliance team will act on. Expect a hold. |
| 76–100 | Critical | Direct sanctions contact or an equivalent finding. Do not move funds to a regulated venue before taking advice. |
A number on its own is close to useless, which is why the verdict should always arrive with two extra pieces of information: which category drove it, and how confident the tool is. Confidence matters more than people expect. A Critical verdict resting on one indirect, low-value hop deserves different language from a Critical verdict resting on a direct transfer to a designated address, and a tool that presents them identically is telling you less than it knows.
How do you read a screening result?
A score and a colour are the least useful part of the output. What you actually need from a screen is the answer to three questions, and a tool that cannot answer them is giving you a verdict without evidence.
Which category fired? "High risk" means nothing on its own. High because of a mixer withdrawal, high because of stolen-funds proximity, and high because of a scam report are three different conversations with a compliance team, and only one of them is easy to explain away.
How direct is it? Direct contact — you transacted with the flagged address — is a fact. Indirect exposure is an inference whose strength falls off with every hop. A result that does not distinguish the two is hiding the most important variable.
What is the evidence? The specific address, the specific transaction, the source that made the claim. This is what turns a screen from an opinion into something you can act on: you can look it up, judge the source, and if it is wrong, say precisely why. A score you cannot audit is a score you cannot dispute.
Plastron surfaces all three — the driving category, whether the hit was direct or indirect, and a confidence figure that drops when a verdict rests on thin evidence. The confidence number is the one we would keep if forced to pick one, because it is the only part that tells you how much to trust the rest.
How is screening different from monitoring, forensics and ownership checks?
These four things get used interchangeably and they answer different questions.
- Address screening asks: what is the risk of this address, right now, given its history? It is a point-in-time check, fast enough to run before a transaction.
- Transaction monitoring asks: is this flow suspicious, given the customer's expected behaviour? It runs continuously and it is a bank-side discipline. We compared the two in address screening versus transaction monitoring.
- Blockchain forensics asks: where did these funds actually go, and who controls the endpoints? It is investigative, human-led and slow. The distinction matters when someone promises you "forensics" and delivers a list lookup.
- Ownership verification asks: does this person actually control this address? Screening cannot answer that — a clean screen is not proof of ownership, as we set out in screening versus ownership verification.
When should you screen a wallet?
Screening is cheap and the failure mode it prevents is expensive, so the honest answer is "more often than you do". The moments that matter most:
- Before you deposit to an exchange. This is the big one — a pre-deposit check costs seconds. The exchange screens on arrival, and by then your funds are already on their side of the wall.
- Before you accept a payment from someone you do not know. An OTC counterparty, a freelance client, a P2P buyer. Getting paid in tainted coin makes it your problem, not theirs — which is how people end up with a frozen bank account after a P2P trade.
- After an unexpected inbound transfer. Airdrops, dust, tokens you did not buy.
- Before a large withdrawal. Knowing your own score in advance tells you whether to prepare source-of-funds documentation, which is the difference between a two-day hold and a two-month one. If yours is already held, this is what usually triggers it.
- Before interacting with a new contract or front end. DeFi front ends increasingly screen wallets themselves, and being blocked by one is a signal worth reading rather than routing around.
What screening cannot tell you
This is the section most vendor pages leave out, and it is the one that protects you from over-trusting a green result.
A clean result is not a guarantee. It means nothing was found in the categories screened, against the lists held, to the depth traced. All three of those are bounded. New scam addresses are unlabelled until someone labels them, and the gap between an exploit happening and its addresses being attributed is measured in days.
Depth is limited, and different tools stop at different places. A free check typically covers direct counterparties — the addresses you actually transacted with. Exchanges run deeper graph analysis across many intermediate hops. A clean one-hop result and a clean exchange screen are not the same statement, and any tool that implies otherwise is overselling.
Coverage is per-chain, and nobody covers everything. Plastron runs the full analysis on seven EVM chains today, screens Solana addresses directly against sanctions and threat lists without counterparty analysis, and has the rest of the ecosystem on a roadmap. That is worth stating plainly, because "50+ chains supported" on a marketing page usually means something much narrower once you read the footnotes.
Attribution can be wrong. False positives are real, they cluster around heavily-used infrastructure contracts, and a good tool tells you where a label came from so you can judge it. If your wallet has been flagged and you believe it is wrong, there is a process for that.
What to do if your wallet is flagged
Do not panic-move the funds. Moving flagged value to a fresh address does not clean it; it adds a hop to a chain of custody that is already recorded, and it looks like structuring to anyone who reads it later.
Work out which category drove the score and how direct the exposure is. An indirect, low-value fraud signal from three hops away is a very different problem from a direct mixer withdrawal. If the finding is real and material, assemble source-of-funds evidence before you need it: exchange statements, transaction hashes, invoices, a plain-language timeline. If the finding looks wrong, document why and raise it — with the exchange if they are holding funds, and with the data source if the label itself is the error.
And if the exposure came from a counterparty rather than from you, that is worth knowing before the next payment, not after. Checking the other address first takes seconds.
FAQ
Is wallet screening the same as KYC?
No. KYC identifies a person; screening evaluates an address. An exchange does both, and they answer separate questions — you can pass KYC perfectly and still have a deposit held because the address you sent from scored badly.
Does screening my wallet tell anyone I did it?
It should not. Plastron's screen is read-only and non-custodial: it reads public ledger data and matches it against lists. It never asks for a signature that moves funds, and checking your own address is not a reportable event.
Can an exchange freeze my funds over an indirect hit?
Yes, and they regularly do. Compliance teams are making a risk decision, not a legal finding, and the threshold for a hold is much lower than the threshold for a seizure. That asymmetry is precisely why checking in advance is worth the two minutes.
How far back does screening look?
Over the whole visible history of the address, though the practical depth depends on the tool and the tier. Blockchains do not forget, which cuts both ways: an exposure from 2021 is still visible, and so is the evidence that it was a single small inbound transfer you never touched.
My wallet is brand new. Why would I screen it?
Mostly you would not — a new address with no history has nothing to find. Screening becomes useful the moment it receives value from somewhere you did not choose, which for a new wallet is usually the first inbound transfer.
Do I need to screen every address I own?
Screen the ones that receive from outside and the ones that send to regulated venues. Internal transfers between addresses you control add hops without adding information, and a wallet that only ever received from your own exchange account is not where the risk lives.
Is a Critical verdict the same as being sanctioned?
No. Critical means the strongest category fired with high confidence — most often direct sanctions contact, but it can also be a direct mixer or stolen-funds finding. Being on the SDN list is a specific legal status, and a screen will say so explicitly when that is what it found.
Disclaimer: This article is for educational and informational purposes only and is not legal, financial, tax, or compliance advice. Crypto carries risk; you act on this information at your own risk. Always do your own research and consult a qualified professional before making decisions. Views are the author's own and do not constitute financial, legal, or investment advice.