Scoring methodology
Blockalysis produces a 0–100 risk score and severity band for each address. Scores are automated estimates derived from public on-chain data and third-party label sources — not legal or compliance determinations.
1. Data ingestion
We index Bitcoin and Tron transactions into an analytical store. Labels are ingested from sanctions lists, on-chain blacklists, community abuse reports, and curated entity tags, then linked to individual addresses and wallet clusters.
2. Wallet clustering
- Bitcoin: co-spend heuristic — addresses that appear as inputs in the same transaction are grouped into a cluster (common-input ownership assumption).
- Tron: deposit-hub heuristic — addresses that receive deposits from many unrelated senders (typical exchange hot wallets) are clustered; only service-type labels propagate across cluster members.
3. Graph traversal (taint analysis)
For each queried address we walk the transaction graph up to several hops in both directions (incoming and outgoing flows). At each hop we attribute value to labeled entities and accumulate exposure shares by risk category.
4. Category weights
Each entity category contributes differently to the final score:
- Sanctions (Critical): OFAC SDN and other sanctions-list addresses
- Darknet / illicit markets (High): Known darknet market and illicit service wallets
- Ransomware / scam (High): Community-reported scam and ransomware addresses
- Mixers / privacy (Medium–High): CoinJoin, mixing services, privacy tools
- Gambling / high-risk services (Medium): Unregulated gambling and high-risk processors
- Exchange / payment / wallet (Low–Neutral): Licensed exchanges, payment processors, custodial wallets
5. Score aggregation
Direct labels on the address (or its cluster) set a floor. Indirect exposure from fund-flow tracing adds weighted contributions. Multiple corroborating sources increase label confidence. The result is mapped to a severity band: low, medium, high, or critical.
6. Limitations
- Results depend on indexed history depth and label coverage — newly created or unlabeled addresses may score lower than reality.
- Clustering heuristics can produce false positives or miss sophisticated obfuscation.
- Sanctions and scam lists update asynchronously; always verify independently before acting.
7. Shareable reports
Every check can generate a public report at https://blockalysis.ai/r/{chain}/{address} with the score, breakdown, and source attribution for due-diligence sharing.