Tags and inferred location

How to use it. See Forensics in the user guide for the card that shows these on a wallet, Scout for how they appear on the canvas and in the inspector, and Reading the report for how they appear in an audit.

Two questions come up whenever funds move: who is this address, and where does its activity point? Wallet Sleuth answers both from Allium's identity data. A tag says what kind of address it is. An inferred location says which country the wallet's activity most resembles. This page names every signal behind them and says plainly what they cannot tell you.

Deposit addresses

An exchange, a custodian, a payment service or a casino usually gives each customer their own deposit address. Funds sent to one are sitting in that customer's account at the service. Two consequences follow, and both are shown where they apply:

A cash-out endpoint. When a wallet sends funds to a deposit address, the trail ends at an account the service can identify. Wallet Sleuth says which service, how many deposits, the total value where it is known, the dates, and the country that Allium's exchange registry lists as the one the service operates from. That country describes the service, not the customer.
A possible shared owner. When several wallets deposit to the same deposit address, they may belong to one person. Wallet Sleuth separates a strong link from a possible link:
- A link is strong when the wallets deposited repeatedly, or when their deposits landed close together in time. Only exchange, custody and casino deposit addresses can make a strong link.
- Anything else is a possible link: one deposit, far from the others, could be one person paying into another's account. Payment-service deposit addresses can serve many unrelated payers of one merchant, so a shared payment-service address is only ever a possible link.

Neither kind of link is proof of common ownership. They are leads for a person to confirm.

Inferred location

Allium infers a country for some wallets from three kinds of evidence:

Exchange deposit and withdrawal patterns. Wallets that mostly move funds through exchanges serving one country look like users in that country.
Activity timing. The times of day at which a wallet is active point to a timezone.
Propagation. A wallet closely tied to wallets with a known location may inherit it. These results say "propagated" in Allium's reasoning and are weaker by construction.

Each location comes with a conviction tier (Very high, High, Moderate, Low or Very low) and Allium's own reasoning. Wallet Sleuth shows all five tiers, mutes the low ones, and shows the reasoning where there is room. Beside every location is the same note: it is inferred from exchange deposits, withdrawals and activity timing, and it describes the wallet's activity, not where a person is.

What it does not mean

It is not where a person is. A wallet is a set of on-chain actions. People travel, use VPNs, share wallets and trade through services in other countries.
It covers about 30 countries. Allium only infers a country where it has a local-exchange or timezone signal, so many countries cannot appear at all.
A missing location means nothing. It does not suggest that a wallet is outside the covered countries, and it does not suggest anything about the wallet's owner. Exchange deposit addresses, contracts and MEV bots are excluded by Allium and never have a location.
It is never a risk input. Location never changes a grade or a risk score. No wallet or country is coloured, ranked or sorted by country, and no country is described as risky. Three things in audits read it, and none changes a grade or a score: the opt-in sanctioned-jurisdiction screen, which is worded as a regulatory list and marked for review; the informational location findings, which never name a country; and, on the Identities tab, the comparison of a declared identity's country with the inferred location of its wallets, a note for the auditor that is never shared. All three are described below.

Coverage by chain

Wallet Sleuth reads tags and locations on Solana, Ethereum and Base. Coverage is uneven:

Entity tags and deposit-address tags exist on all three chains.
Illicit flags are strongest on Ethereum, thin on Base and absent on Solana. Allium has no illicit flags on Solana, so a Solana wallet without one is not a clean result: it only means nothing could be flagged.
Locations are inferred for only a minority of wallets, so most wallets have none.

How tags relate to risk

Illicit flags join the same labelled-address corpus as the other sources described under Threat intelligence and taint. A phishing or scam flag is treated as a scam label, a sanctioned address as a sanctions label, and an address frozen by a token issuer as its own adversarial kind, shown as "Frozen by token issuer". After that they behave like any other label: a wallet that matches one, or sends funds to one, is flagged under the rules in Risk score and grade.

When a later check finds that an address is no longer flagged, its label is withdrawn, and the next audit run drops the risk it caused.

Apart from that, and from the shared deposit account finding in audits (see below), entity tags, deposit-address tags, high-risk flags and locations are shown for context and do not change a grade.

In audits

An audit can read Allium's identity data for its wallets beside the funding and cash-out lookups described under Wallet relationships and clustering. It does so in three steps:

Tags and location for every audited wallet, both the wallets you submitted and the ones the audit discovered.
Tags on each submitted wallet's top counterparties, the addresses it exchanged the most value with. They give the wallet's counterparty exposure: the share of the value it sent and received that sat with exchanges, custodians, DeFi protocols, payment services, gambling services, illicit addresses, other services and untagged wallets. A counterparty Allium could not check is left out of the shares, never counted as untagged, and the report says how much of the value was checked.
Deposits to tagged deposit addresses. On Ethereum and Base, the audit reads each submitted wallet's transfers into addresses Allium tags as a deposit address of an exchange, a custodian, a casino or a payment service, inside the analysis window. On Solana it uses the deposit-address tags on the counterparties the wallet already sent funds to. Those come without transfer times.

What each step adds to the report:

A wallet's tag and location appear in the Wallets tab and in the wallet's detail panel, with the date they were checked.
Illicit flags count in the same run. A submitted wallet that carries an illicit flag, or that sent funds to a counterparty that carries one, gains the same risk factor as any other labelled address, and the grade reflects it at once.
Cash-outs and linked accounts come from the deposits (see the next section).
Findings. Besides the shared deposit account finding, the audit can raise:
- Coordinated exchange deposits: several of the largest audited holders of the target asset each sent it to exchange deposit addresses within a short span of one another, which can precede a coordinated sell. The finding prints the span it actually saw.
- Casino deposits: submitted wallets sent funds to deposit addresses that Allium tags as an online casino's.
- Who holds the supply: how the target asset held by the audited wallets splits by kind of holder, such as exchanges, custodians, DeFi pools, payment services and untagged wallets.
- Shared location inside a cluster: wallets that another finding already groups together, through a common funder, coordinated buys or a shared deposit account, are all inferred to the same country at High conviction or above, and none is inferred elsewhere at that level. The finding never names the country.
- Holder locations: how many audited wallets have an inferred location, how many of them at High conviction or above, how many countries they span, and the largest share any one country covers. It never names or ranks a country.
- Sanctioned-jurisdiction screen, only when the audit owner turns it on (see below).
- The existing cash-out venues finding names the exchanges from Allium's tags.

Only the shared deposit account finding and illicit flags change the grade. Coordinated exchange deposits, casino deposits and the jurisdiction screen carry a severity or a review badge for attention, but never change the grade; the other three are informational.

If a lookup fails, or a very large audit reaches the limit of lookups one audit may make, the report says that tags and location were partly checked, and the wallets left over show as not checked, never as untagged. An earlier run made without these lookups can show a note that tags and location were not analyzed; running the audit again adds them.

Linked deposit accounts

In an audit, submitted wallets that pay into the same deposit address are grouped into linked accounts, using the strong and possible links described under Deposit addresses above:

A strong link between two or more submitted wallets raises a shared deposit account finding (named for the kind of service: a shared exchange, custody or casino account). It is a risk finding and counts toward the grade, because these services issue one deposit address per customer account.
A possible link is shown in the wallet's detail panel, muted, and counts for nothing. A shared payment-service deposit address is only ever a possible link.
On Solana the deposits carry no transfer times, so only repeat deposits can make a strong link there.
One wallet, two chains. The same address on Ethereum and Base counts as one wallet.
Groups. Wallets joined by strong links, through one deposit address or a chain of them, form one linked-account group. The Wallets tab names each group by a letter and can gather its wallets together.
Review. In the wallet's detail panel, a strong link can be resolved as the same owner, or overridden as not the same owner, which removes it from the reviewed grade and requires a note.

The finding names the kind of service and the deposit address. The service's own name appears in the wallet's detail panel.

Effective concentration

The audit Overview shows an effective top-10 concentration beside the grade. It answers a question the raw holder list cannot: how concentrated the target asset really is once wallets that hold for many people are set aside and wallets that appear to share an owner are counted together.

Holders are the audited wallets, submitted and discovered, that hold the target asset.
Set aside: wallets Allium tags as an exchange, a custodian, a DeFi protocol or a payment service, because each holds for many people at once. They appear in Who holds the supply instead. A wallet Allium could not check stays in the ranking, because nothing says it holds for others.
Merged: wallets strongly linked through a shared deposit account count as one holder, and an address on two chains is one holder.
The figure is the share of the target asset's total supply held by the 10 largest holders. When the supply is not known, it is their share of the amount the audited wallets hold. An audit with no target asset uses the audited value instead.
As listed is the same top 10 without merging linked wallets, so the gap between the two figures shows how much the links change the picture.

Beside it, Who holds the supply splits the target asset held by the audited wallets by the kind of holder, and says how much of it could be checked. Effective concentration never changes the grade.

Sanctioned-jurisdiction screen (opt-in)

The screen is off by default. The audit's owner can turn it on in the audit's settings, and off again at any time; turning it off removes the finding from the report, the shared link and every export.

While it is on, it lists the audited wallets whose inferred location, at High or Very high conviction, is a country under comprehensive US sanctions. The finding is marked for review and never changes the grade. Its limits:

Country level only. Sanctions programmes that cover a region rather than a whole country cannot be matched, because a location is inferred as a country.
High conviction or above only. A location at Moderate, Low or Very low conviction is never screened.
Partial coverage. Allium infers only about 30 countries, and only some of the sanctioned countries are among them, so a screen that finds nothing says little.
Activity, not people. An inferred location describes a wallet's activity, not anyone's nationality or residence. Treat a result as a prompt for your own due diligence, never as a determination.

When the screen is on, a declared identity whose wallets it matches shows the same note on the Identities tab.

Declared country on the Identities tab

When an auditor gives a declared identity a country, the Identities tab compares it with the inferred location of that identity's wallets. Only locations at High conviction or above count, and a note appears only when most of the identity's located wallet value points to one other country, as a prompt to ask the client. The comparison changes no score and is never shared.

Client deliverables

The read-only shared link, the PDF report and the wallet CSV carry tags, locations, linked accounts, the effective concentration and the findings above only while Wallet Sleuth's administrators allow Allium data on client deliverables. When they do not, those deliverables carry none of it: the wallet CSV has no identity columns at all, and the cash-out venues finding is left out wherever its venue names came from Allium. The in-app report always keeps it.

The shared deposit account finding stays in deliverables either way, because it counts toward the grade. It names the kind of service and the deposit address, never the service itself.
A hidden finding never reaches a deliverable, and neither does a finding built on a hidden one, such as a shared location inside a cluster whose grouping finding is hidden.
The written executive summary never mentions these findings.
On the Identities tab, a declared country and the comparison with the wallets' inferred location are never shared.
The findings CSV on the Risk Management tab is the auditor's working file: it lists every finding, hidden ones included, whatever the setting above. Check it before sending it to anyone.

Freshness and limits

Results are looked up from Allium when first needed, kept, and refreshed from time to time. The Forensics card and the audit's wallet panel show the date a result was checked. A tag or location can be out of date, and an address can be tagged after Wallet Sleuth last looked.
Lookups are limited per user, and per audit, so a very large set of wallets may show some as not checked. They are marked as such and are never shown as untagged.
Wallet Sleuth sends Allium wallet addresses and nothing else.
Tuned values, such as how close together deposits must be to make a strong link, are not listed here. They would tell someone moving funds exactly how to space the deposits.

The sources are listed on Data sources.