Answer

Indirect crypto exposure means your wallet received funds that trace back to a flagged address several hops away, even with no direct contact; Plastron detects this one-hop indirect exposure free across seven EVM chains.

Indirect Crypto Exposure Explained

Indirect exposure means your wallet received funds that trace back to a flagged source through one or more intermediate addresses — and exchange compliance systems flag it just like direct exposure.

Indirect exposure is the most misunderstood concept in crypto AML. Most users think that as long as they never directly sent money to a mixer, a sanctioned address, or a darknet market, they are safe from compliance flags. This is wrong. Exchange blockchain analytics systems trace fund flows multiple hops deep — they follow the money from its origin through a chain of intermediate wallets to identify whether your wallet received funds that originated from a flagged source, even if there were several steps between the original bad actor and your wallet. The concept works like this: if Address A (a Tornado Cash withdrawal address) sends ETH to Address B (a DeFi trader), and Address B then sends ETH to Address C (your wallet), Address A's mixer exposure is now in your transaction history one hop removed. Your wallet did not interact with Tornado Cash. But you received funds that came directly from a TC withdrawal. From a blockchain analytics perspective, your wallet has indirect mixer exposure, which appears in your risk report at a severity set by the hop distance and the share of value traced back to the mixer. Two hops of separation — where the flagged source funded B, which funded C, which funded you — creates lower-severity indirect exposure but is still visible to sophisticated analytics systems. The deeper the hop count, the lower the risk scoring, but the exposure does not disappear entirely. Common pathways for innocent indirect exposure include: DeFi swaps that route through pools containing mixer-affiliated liquidity, P2P trades with counterparties you did not know had flagged wallets, OTC trades with anonymous counterparties, and NFT sales to buyers using mixer-withdrawn funds. Understanding that these pathways exist — and that the on-chain record of them is permanent — is essential context for anyone who actively uses crypto.

or check your own wallet →

Indirect Crypto Exposure Explained — where a wallet scan fits

One-Hop Indirect Exposure Detection

Plastron traces your wallet's direct counterparties and checks each of them against the flagged-address database and OFAC SDN list. If your counterparty themselves interacted with a flagged source, that one-hop indirect exposure appears in your report as a Medium to High severity flag depending on the category and volume. You see the specific counterparty, the flagged relationship it carries, and the transaction volume connecting it to your wallet.

Exposure Severity and Category Context

Not all indirect exposure is equal. Indirect sanctions exposure through a one-hop counterparty that received significant funds from an OFAC SDN address is scored more severely than indirect phishing exposure through a counterparty that received a dust transaction from a scam address. Plastron's severity scoring reflects these distinctions, and the report explains which category each flag belongs to and what the volume implications are.

Pre-Transaction Screening to Prevent New Exposure

The most effective defense against accumulating indirect exposure is screening counterparty wallets before accepting significant funds. Plastron can screen any Ethereum address — including wallets you are considering accepting payment from — to check whether they carry AML flags that would create indirect exposure in your wallet if you received funds from them. This pre-receipt screening is the most proactive compliance practice available.

What the scan looks for

Sanctions
OFAC SDN-listed addresses. Direct or indirect exposure flags your wallet instantly.
Mixer
Tornado Cash, Railgun and other labelled mixing protocols. Interaction with these services is a major red flag.
Stolen Funds
Wallets linked to hacks, exploits, and bridge attacks. Even receiving a fraction taints your address.
Darknet
Addresses associated with darknet marketplaces. Any connection triggers heightened scrutiny at exchanges.
1–7
Hops that major exchange analytics systems trace for indirect exposure
Source: Industry technical documentation
65%
Share of unexpected exchange holds involving indirect rather than direct exposure
Source: Industry compliance estimates

What we actually screen against

Measured from Plastron’s own screening corpus, rebuilt on every deploy.

1,047
sanctioned addresses in the corpus
one of the risk categories this page covers
34
mixer contracts and routers in the corpus
one of the risk categories this page covers
250
hack and exploit addresses in the corpus
one of the risk categories this page covers

Page last updated

Questions people ask

Keep checking

What Is AML in Crypto? — Plain-Language GuideTornado Cash Exposure Check — Screen Your WalletDeFi AML Risks Explained — Wallet Compliance GuideMixer Exposure Check — Detect Cryptocurrency MixersCrypto Risk Levels Explained — Low to Critical

Find out before an exchange does

Paste any address for a free instant check. Nothing to connect · Never a transaction · No history kept. Sign in for the full report: your own wallet is always free.

Explore More

Free AML Screening for Crypto WalletsWallet Risk Check — Before You Send or DepositCrypto Compliance Check — Free Wallet ScanKYC Wallet Check — Screen Your Address FreeWallet Address Checker — Free, Instant, 10 Chains