Wallet Sleuth keeps a corpus of labelled addresses drawn from public blocklists and research, and checks every audited wallet against it in three ways: is the wallet itself labelled, has it sent funds to a labelled address, and is it a short funding hop away from one. This page explains the labels and the third, graph-based check.

What a label is

A label attaches a kind and a severity to an address, with the source it came from, the date it was added, and a link to the evidence.

Kind	Meaning
Sanctions	Listed by a government sanctions programme
Hack	Involved in a theft or exploit, as the attacker's or a laundering address
Drainer	A wallet-draining or phishing operation
Mixer	A mixing or tumbling service
Scam	Fraud, honeypots, fake tokens and similar

Severity runs from 0 to 1 and expresses how strong the source's claim is. Sanctions are always 1. A confirmed exploiter address ranks above an address seen laundering the proceeds, which ranks above a community report.

An address can carry entries from several sources. The corpus keeps one entry per source, and the address as a whole reports its worst kind and highest severity. Sources are refreshed daily, and an address a source no longer lists is removed for that source, with a safeguard so a broken download can never wipe the corpus.

A second family of labels, entity labels, names an address as an exchange, custodian, market maker, bridge or router. These are shown for context and can never raise a risk factor or terminate a taint path.

How labels reach a wallet

• Direct label. The audited wallet's own address is in the corpus. This is always critical.
• Outbound exposure. The wallet has sent funds to a labelled address at any point in the history that was read.
• Taint proximity. The wallet received funds within a few hops of a labelled address. Described next.

Only the five risk kinds above count. An entity label on a counterparty, such as a known exchange, has no effect on any of the three.

Taint proximity

Taint proximity asks how much of a labelled address's "taint" could plausibly have reached this wallet through its funding history. It walks the relationship graph backwards from the wallet, along the addresses that sent it funds, for a small number of hops and following only the strongest few ties at each step.

Every path accumulates a multiplier that shrinks with each hop and with each weak tie on the way, so a labelled address two strong hops upstream matters far more than one five weak hops away. When the walk reaches a labelled address, the taint carried along that path is the label's severity times that multiplier. The wallet's taint score is the strongest such path found.

Three rules keep the walk honest:

• Exchanges are sinks. The walk stops at any recognised exchange or infrastructure address, because funds passing through an exchange lose their history. Taint never propagates through a Binance hot wallet.
• Labelled addresses are terminal. Once the walk hits a labelled address it records the taint and stops rather than continuing upstream of it.
• The strongest path wins. If an address is reached twice, only the stronger path is kept, so a shared intermediary never under-reports.

The score is reported on a 0 to 1 scale. Above a tuned threshold it raises a high-severity factor; any non-zero score raises an elevated one. A score of zero means no labelled address was found within reach, which is not the same as a guarantee that none exists beyond the search depth.

Coverage caveats

Blocklist coverage differs by chain. Ethereum and Base benefit from sanctions data, address-security flags and research covering EVM chains; Solana has fewer public sources. Audits mark Solana wallets as having limited coverage for this reason, and a Solana wallet with no factors reads as unknown rather than clear.

Labels are evidence, not verdicts. If you believe an address is labelled in error, the source and evidence link on the label tell you where the claim originated, and the Data sources page lists how to reach us.