Check a Bitcoin wallet for scams & sanctions

Bitcoin is the most-tracked blockchain on the planet. Every coin you receive carries a public history all the way back to the block where it was mined. That sounds great for transparency, but it also means a wallet with a bad past can quietly hand its problems to you.

Why checking a BTC address actually matters

You sold a used laptop on a crypto forum. The buyer pays 0.04 BTC. Three weeks later you deposit it to Binance to convert to euros — and your account gets frozen with a polite email asking where the funds came from.

That is not a hypothetical. It happens every day. The bitcoin you received touched, somewhere two hops back, a mixer that the U.S. Treasury sanctioned in 2022. Your buyer probably did not know. Your exchange does, and they treat your deposit the same as if you had earned it on the darknet.

A wallet that looks clean to your eye is not the same as a wallet that looks clean to a compliance algorithm. Binance, Kraken and Coinbase all run the same risk scoring — and they reject deposits silently before flagging the customer.

How "dirty" Bitcoin is born

BTC gets tainted in fairly predictable ways:

• Ransomware payouts. Conti, LockBit, REvil and the other big groups receive payments from victims and split them across thousands of wallets within hours.
• Sanctioned mixers. Tornado Cash gets the headlines, but Bitcoin's own list — Wasabi CoinJoins, ChipMixer (seized in 2023), Sinbad — is far longer.
• Darknet markets. AlphaBay, Hydra, and their successors. Coins exiting these markets are flagged for years.
• OFAC SDN entries. Specific addresses tied to North Korea's Lazarus Group or to Russian and Iranian wallets named in sanctions packages.
• P2P scammers. Wallets that ran fake LocalBitcoins ads, romance scams, or pig-butchering operations.

What our Bitcoin scan covers

Paste any BTC address into the checker above and we run it against:

• OFAC SDN, EU and UN consolidated sanctions lists (refreshed daily)
• 200+ active ransomware wallet clusters
• All known darknet market hot wallets and their direct counterparties
• Sanctioned and high-risk mixer clusters (ChipMixer, Sinbad, Bestmixer, etc.)
• Community scam reports from BitcoinAbuse, Chainabuse and our own crowdsourced database
• Exchange-frozen address lists collected from public freeze announcements

Address formats we accept

• bc1q… — native SegWit (Bech32), most common today
• 1A1z… — legacy P2PKH addresses, still seen on old wallets and exchanges
• 3J98… — pay-to-script-hash (P2SH), used by multisig and older SegWit

Reading the result

• 0–25 (low risk): Go ahead with the trade. Nothing in our databases ties this wallet to known illicit activity.
• 26–50 (medium risk): Worth pausing. The wallet may have interacted with a CoinJoin service, or one of its counterparties had a scam report. Ask for a different address if you can.
• 51–75 (high risk): Do not deposit anything from this wallet to a CEX. Direct exposure to flagged clusters is likely.
• 76–100 (critical): Walk away. This wallet appears in sanctions or ransomware lists. Interacting with it is, in many jurisdictions, illegal.

For a deeper check — full source-of-funds, every counterparty within 5 hops, downloadable PDF — use @scorechain_amlbot on Telegram. First 3 full reports are free.

Bitcoin-specific things to know

Coin reuse. Bitcoin is UTXO-based, meaning the same wallet can hold coins with very different histories. A "clean" balance can be ruined by a single dusting attack.

Mining pool taint. Coinbase rewards from sanctioned pools carry a tag, especially when paid out from a small solo-miner.

Whale rotations. Large wallets sometimes appear risky because they brushed against suspicious counterparties years ago. Score in context — a high-volume wallet with one ancient flagged hop is not the same as a fresh wallet with three recent ones.

Bitcoin AML — quick FAQ