How WalletVerdict scores a wallet

Verdicts

BLOCK if the address itself hits a direct high-severity signal: stablecoin freeze, OFAC sanctions, a high-severity threat flag, an operator safety-list block, or an unusable address such as the EVM zero address.

REVIEW if a caution signal is present (scam or phishing report, medium threat flag, a very new wallet with high sampled velocity, or a flagged direct counterparty on a signed-in check) or if an authoritative source did not run.

APPROVE only when no covered risk signal fired and the authoritative checks for that chain completed. A missing freeze list or OFAC cache downgrades the result to REVIEW. The product does not auto-approve through that gap.

The numeric score starts at 100 and is reduced by the signals that fired. A BLOCK score is 0. Caution signals cap the score. The score is an explanation of the verdict, not a probability that funds are safe.

Data sources

Tether USDT freeze list on TRON: a local cache of blacklist events for contract TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t. Default maximum age 24 hours.

EVM stablecoin freeze: Ethereum USDT (0xdAC17F958D2ee523a2206206994597C13D831ec7) and USDC where a freeze function or event pair is verified. BNB Chain USDT/USDC are recorded as having no freeze function. The event cache is refreshed out of band.

OFAC SDN crypto addresses, local cache, default maximum age 72 hours.

ScamSniffer and CryptoScamDB, local caches, default maximum age 168 hours.

GoPlus address security, requested live at check time. It is not an authoritative source: if it is down, that row is unavailable and does not by itself force REVIEW the way a missing OFAC or freeze check does.

TronGrid for TRON wallet activity. On EVM, public RPC is used for balances and freeze calls; wallet age and token-transfer history need an Etherscan API key.

An additional multi-jurisdiction sanctions list is optional and off by default. While it is off, it is not used in any check and cannot change a verdict. When it is turned on, it counts as an authoritative sanctions check, so a missing or stale copy downgrades the result to REVIEW. MistTrack and Scorechain are an optional commercial pack, off by default. The coverage matrix marks that pack not enabled. That status is the commercial pack, not the counterparty screen.

Counterparty screening

A signed-in check can screen direct stablecoin counterparties against the freeze, sanctions, and scam sets. TRON uses TronGrid, or a local transfer index when one is already stored. EVM uses Etherscan token transfers and does not run until an Etherscan API key is configured.

A bounded second hop is on by default and expands at most 12 non-hub counterparties, looking for a path to a frozen or sanctioned address. Counterparties seen many times are treated as hubs and annotated, not auto-flagged. A second-hop scam hit is informational and does not by itself force REVIEW.

The free public check does not run this graph. The homepage does not describe it as a trace that runs on every chain.

Free check and indexing

Anyone can run the address-level check without an account, inside the anonymous rate limits. The result URL is /address/{chain}/{address}.

That URL may be indexed only when the address is on the Tether freeze list, the OFAC list, or ScamSniffer / CryptoScamDB. Every other result is noindex.

Evidence PDF, watchlists, batch screening, cases, and the API require sign-in.