Every transaction on a public blockchain is visible to anyone, yet the address that sent or received it says very little about who stands behind it. That gap is what wallet screening tries to narrow. It asks two separate questions about an address: is it known to be linked to sanctions or financial crime, and what has it actually done on-chain? This guide walks through both, and the traps that catch careful people.
What a wallet address is, and what it is not
A wallet address is an identifier derived from a public key. It looks like a long string of letters and numbers and, on its own, carries no name. Three facts shape everything that follows:
- Addresses are pseudonymous. Anyone can create as many as they like for free, and nothing in the address links it to a person.
- One address can serve many people. An exchange or a payment processor typically holds funds for many customers in shared addresses, so activity on such an address is not the activity of one person.
- The same string can exist on several networks. Ethereum-style addresses work on many compatible chains, and the same address can have unrelated activity on each of them. The network is part of the question.
Step 1: confirm the address and the network
Start by making sure you are checking what you think you are checking. Each network has its own format: Ethereum-style addresses begin with 0x followed by 40 hexadecimal characters, Bitcoin addresses begin with 1, 3 or bc1, TRON addresses begin with T, and XRP addresses begin with r. A typo produces a different, valid-looking address, and some malware swaps a copied address for the attacker's own. Paste the address rather than retyping it, then compare the first and last characters with the source. Note the network and, for stablecoins, which chain the token lives on: the same token can exist on several chains with separate balances.
Step 2: check the lists
The first screening question is whether the address is already known. Sanctions authorities, including the US Treasury's OFAC, publish crypto addresses alongside the names of designated parties, and specialist datasets add addresses tied to scams, ransomware, theft and other financial crime. This kind of check is often called KYT, short for know your transaction.
A listed address is a strong lead and a reason to stop and review. An unlisted one proves much less. Lists only contain what authorities and data providers have identified so far, new addresses are cheap to create, and coverage differs from one provider to another. Treat a no-match result as "nothing found in these sources today", not as proof that the address is safe.
Step 3: look at what the address did
The second question is about behavior, and here the public ledger helps. An analyst can usually see:
- Balances and holdings: which tokens and NFTs the address holds.
- Transfers: when the address first appeared, how much value moved, how often, and in which direction.
- Counterparties: which other addresses it sent funds to or received funds from, and whether any of them are labeled, for example as an exchange.
- Approvals: which contracts the owner has allowed to spend its tokens, which matters when an approval was granted to a malicious contract.
- Protocol activity: swaps, lending, bridging and governance votes through DeFi protocols, where the network exposes them.
Look for patterns, not single events. A new address that receives a large amount and forwards almost all of it within minutes behaves differently from an address that has held and traded for years.
Exposure to a mixer or another privacy protocol deserves a careful reading. It is a signal to review, and plenty of people use privacy tools for lawful reasons. It is not proof of wrongdoing, and it says nothing about who the owner is.
Common pitfalls
- Treating an address as an identity. Control of an address is not ownership of the activity around it. A deposit address at an exchange belongs to the exchange.
- Blaming a recipient. Attackers sometimes send tiny amounts from a flagged address to many other addresses, or create addresses that imitate a victim's own so that a user later copies the wrong one. Receiving a transfer does not make someone responsible for the sender.
- Missing the hop. Funds can move between networks through bridges. A check on one chain can miss the part of the story that happened on another.
- Checking the wrong network or token. The right address on the wrong chain is the wrong question.
- Relying on a stale answer. Lists change, so record when you ran the check.
Document what you found
The ledger is permanent, but the answers you get from list and data providers change over time. Write down the address, the network, the date and time of the check, the sources consulted, what each returned and your conclusion. A short, dated note makes the work repeatable and defensible.
How wallet screening works in OSINT Search Engine
Wallet screening in OSINT Search Engine has two parts that are kept clearly apart, so a list match is never mistaken for transaction evidence. AML Wallet Screening checks one address, on the blockchain you choose, against listed-wallet, KYT and financial-crime datasets. It is a list and dataset check, not on-chain tracing. Wallet Intelligence shows tokens, NFTs, transfers and approvals for an address on supported networks, plus DeFi protocol activity on Ethereum and Base, and marks every section that a network does not provide.
Neither part tells you who owns a wallet, and a no-match result is not a clearance. Wallet screening is limited to accounts with an explicit AML wallet entitlement, which is granted to approved institutional customers. The Service Providers page explains what is shared with each integration. For the wider concepts behind list checks, read What Is AML Screening?
A lead, not a verdict
Screening results are research aids. Use them to decide what to look at next, confirm important findings with a second source, and leave final compliance decisions to the people accountable for them. To talk about access, see the pricing page or contact our sales team.
