Ethereum Address Check — AML Risk, Balance and Transactions

Ethereum is a blockchain launched in 2015 that runs smart contracts alongside plain transfers: programs that live at their own address on the network. The native coin is ETH (ether). It pays for gas, the fee charged for every operation, including transfers of tokens that have no coin of their own to pay with. Since 2022 the network has run on proof-of-stake: blocks are confirmed by validators who lock up ETH, not by miners.

For an AML check the accounting model matters more. Bitcoin history is scattered across unspent outputs, and a wallet usually generates a fresh address for every change output. An Ethereum address is an account: it has a single balance, and its whole history accumulates on it for years. An ETH address therefore tends to have a long, continuous biography, and checking one address covers all of its activity rather than a fragment.

The second difference is tokens. USDT, USDC, DAI and thousands of other assets exist on Ethereum as entries inside smart contracts, not as separate coins. A USDT ERC-20 transfer is a call to the Tether contract, and the ETH balance of the sender can be close to zero at the same time. When you check an address, pick the asset: the ETH transfer history and the USDT transfer history of the same address are different sets of operations.

The third is that the same 0x address exists on every EVM network: BNB Chain, Polygon, zkSync and others. It is one key pair, but the history on each network is separate, and an address that is clean on Ethereum can carry labels on a neighbouring chain. The service detects the networks where the address has been active and lets you choose the right one.

• Address: the 0x prefix followed by 40 hexadecimal characters, 42 in total. Letter case does not change the address: the mix of upper and lower case is a checksum (EIP-55) that wallets use to catch typos. You can check it in any case.
• Contract address: looks exactly like a wallet address. The string alone will not tell an exchange hot wallet from a DEX or bridge contract; the check does, because contracts and exchanges have long histories and their own labels.
• Transaction hash: 0x followed by 64 hexadecimal characters, 66 in total. A single transaction can contain an ETH transfer and several token transfers when a contract executed it.
• ENS name such as name.eth is an alias that points to a regular 0x address. The check needs the address itself; your wallet or a block explorer shows it.

Ethereum is the main network for USDT ERC-20, USDC and DeFi, so a large share of OTC and P2P deals settle on it. Every address you receive funds from carries a history: where the coins came from, which contracts they passed through, which labels they are tied to. The point of the check is to learn this before the transfer, not after.

• Exchange freezes. Centralised exchanges screen incoming deposits with their own AML systems. Funds linked to theft, phishing or a sanctioned address can be held until the case is reviewed, and the burden of proving good faith falls on you.
• Token-level freezes. The USDT and USDC contracts contain a blacklist: the issuer can freeze the balance of an address at the request of a regulator or law enforcement. If tokens from a flagged source land on your address, more than your exchange account is at risk.
• Sanctions. Sanctions lists include Ethereum wallet addresses and smart contract addresses. Sending to or receiving from one is a risk for any counterparty regardless of the amount.
• Phishing and drainers. Ethereum is home to schemes where the victim signs a token allowance (approve) that lets the attacker drain the wallet. Collector addresses end up in provider databases under the Phishing and Theft labels, and the funds keep moving through the network.

Screening before a deal is routine practice, like checking a counterparty in a company register before signing a contract. The principles are covered in our AML and KYC guide.

1. Paste the address or the transaction hash into the field on the search page. The service detects the networks where the address has been active and lists the available assets: ETH, USDT, USDC and other tokens.
2. Pick the network and the asset. The free overview shows the balance, the number of transactions, the amounts received and sent, and the dates of the first and last activity.
3. For the AML score, sign up (the first 5 checks are free) and run the check in your account. For a transaction hash the account asks which of its addresses to check: the sender or the recipient.
4. Read the report: a risk score from 0 to 100, detected signals, the structure of the sources of funds and a map of incoming and outgoing flows. The report can be downloaded as a PDF and opened by a counterparty through a secure view-only link.
5. When you need a fresh assessment, rerun the check from the report: the score is recalculated against the current blockchain history. A rerun is charged according to your plan.

The report is built on blockchain analytics: the history of the address is matched against the label databases of the data provider, and the flows of funds are broken down by counterparty category.

Risk score

A number from 0 to 100: 0 to 30 is low risk, 31 to 60 medium, 61 to 100 high. Low means no critical links were found and standard due diligence is usually enough; medium means risk factors are present and the categories and counterparties deserve a look before you transfer; high means an exchange may block a transfer from this address.

Detected signals

The labels under which the address or its counterparties appear in the databases: theft, phishing, scam, ransom, darknet, mixer, sanctions, high-risk exchange, dusting attack. Each label has a severity: high, medium or informational. If the address appears in a known incident, the report shows a separate warning.

Sources of funds and flow map

The shares of the categories found in the history of the address, and a diagram of how funds move: incoming and outgoing flows with their risk categories and their share of the turnover. Node size on the map follows the share of the category, so the dominant source is visible at a glance.

Address data

Balance, total number of transactions, amounts received and sent, first and last activity, and the share of the incoming volume that remains on the balance.

PDF and secure link

The report exports to a PDF with a document number and the date of the check, and opens through a secure view-only link that you can send to a counterparty or attach to a client file.

For a hash, the search page shows the status of the transfer, the amount, the time, the sender and the recipient. There are three statuses: confirmed, pending and failed. Failed means the transaction made it into a block but the contract reverted it: the gas was spent and the transfer did not happen. On Ethereum this is a normal outcome that is easy to mistake for a successful payment.

The hash itself carries no risk; the addresses do. For the AML score the account therefore asks you to pick a side: check the sender if you are being paid, or the recipient if you are paying. If the addresses cannot be extracted from the transaction, the hash itself is checked.

How a transaction identifier is built and where to find it is covered in View Transaction and Check Transaction Hash.

• Asset and network. USDT on Ethereum and USDT on TRON are different contracts with independent histories; the same goes for one 0x address on Ethereum and on BNB Chain. Check the network and the asset in which you expect the transfer.
• Contracts and exchanges. An exchange, DEX or bridge address pools the funds of thousands of users, so it always has a long history and a category label. A high share of exchange sources is not a red flag by itself; look at which exchanges they are and whether any of them are high-risk.
• Fresh addresses. No signals on an address with no history only means there is no data. Scammers create a new address for every deal; recheck such an address after its first transfers.
• Dusting. Someone can send a tiny amount or a token from a flagged address to tie it to a foreign history. The report marks this as a dusting attack: it does not make the recipient an accomplice, but it explains unexpected labels.