Risk scale
A score of
0 means no suspicious patterns were detected, not that the address was verified by a third party.How the score is calculated
The score is the weighted sum of every detected pattern, adjusted by its severity, capped at 100:
For example, a single
mixing pattern detected as critical scores 72 (60 × 1.2), while an exchange_hopping pattern at medium scores 14 (20 × 0.7).
Detected patterns
Detected patterns
The engine analyzes the transaction graph to detect suspicious patterns like mixing, peel chains, structuring, and more. Each pattern has a base weight (e.g.
mixing and malicious_actor weight 60, peel_chain 50, round_tripping 40) that is multiplied by the severity multiplier of the detected severity. See Risk analysis for the full weight table.Detection context
Detection context
Address labels guide the detection process but never discount the score. For example, smart contracts skip
wash_trading and exchange_hopping detection, and exchanges, mixers, bridges, and addresses with more than 500 interactions are treated as opaque nodes in the graph.Determinism and caching
Determinism and caching
The system is fully deterministic: the same address and date range always produce the same result. Quick checks are cached for 1 hour and async analysis jobs for 24 hours.
Actions by risk level
Reading the result
Each result includes:risk— the score from 0 to 100patterns— the detected patterns, each withname,severity,involvedWallets,involvedTxs,usdAmount, and a human-readablemessagereason— reserved for additional context; currently alwaysnull
Suspicious activity
Escalate an address when any of the following conditions are met:- Risk score is 70 or higher
- Any pattern with
criticalseverity is detected - Three or more patterns with
highseverity are detected
Risk analysis
See the full technical reference with pattern weights, severity levels, and detailed examples.