Bitcoin is the most-tracked blockchain on the planet — every coin you receive carries a public history all the way back to the block where it was mined. That sounds great for transparency, but it also means a wallet with a bad past can quietly hand its problems to you.
Why checking a BTC address actually matters
Imagine you sold a used MacBook on a crypto forum. The buyer pays you 0.04 BTC. Three weeks later you deposit it to Binance to convert into euros — and your account gets frozen, with a polite email asking where the funds came from.
That is not a hypothetical. It happens every day. The bitcoin you received touched, somewhere two hops back, a mixer that the U.S. Treasury sanctioned in 2022. Your buyer probably did not know. Your exchange does, and they treat your deposit the same as if you had earned it on the darknet.
A wallet that looks clean to your eye is not the same as a wallet that looks clean to a compliance algorithm. Binance, Kraken and Coinbase all run the same risk scoring — and they reject deposits silently before flagging the customer.
How "dirty" Bitcoin is born
BTC gets tainted in fairly predictable ways:
- Ransomware payouts. Conti, LockBit, REvil and the other big groups receive payments from victims and split them across thousands of wallets within hours.
- Sanctioned mixers. Tornado Cash gets the headlines, but Bitcoin's own list — Wasabi CoinJoins, ChipMixer (seized in 2023), Sinbad — is far longer.
- Darknet markets. AlphaBay, Hydra, and their successors. Coins exiting these markets are flagged for years.
- OFAC SDN entries. Specific addresses tied to North Korea's Lazarus Group or to Russian and Iranian wallets named in sanctions packages.
- P2P scammers. Wallets that ran fake LocalBitcoins ads, romance scams, or pig-butchering operations.
You do not need to send coins to a flagged wallet to get in trouble. Receiving from one — even by accident, even one hop away — is enough to put your address on a watch list.
What our Bitcoin scan covers
Paste any BTC address into the checker above and we will run it against:
- OFAC SDN, EU and UN consolidated sanctions lists (refreshed daily)
- 200+ active ransomware wallet clusters
- All known darknet market hot wallets and their direct counterparties
- Sanctioned and high-risk mixer clusters (ChipMixer, Sinbad, Bestmixer history, etc.)
- Community scam reports from BitcoinAbuse, Chainabuse and our own crowdsourced database
- Exchange-frozen address lists collected from public freeze announcements
Address formats we accept
You can paste any of the three Bitcoin address formats and we will handle them automatically:
bc1q…— native SegWit (Bech32), most common today1A1z…— legacy P2PKH addresses, still seen on old wallets and exchanges3J98…— pay-to-script-hash (P2SH), used by multisig and older SegWit
Reading the result like a pro
We score every address from 0 to 100. Here is how the numbers actually translate to a decision you have to make at the cash register:
- 0–25 (low risk): Go ahead with the trade. Nothing in our databases ties this wallet to known illicit activity.
- 26–50 (medium risk): Worth pausing. Maybe the wallet interacted with a CoinJoin service, or one of its counterparties had a scam report. Ask for a different address if you can.
- 51–75 (high risk): Don't deposit anything from this wallet to a CEX. Direct exposure to flagged clusters is likely.
- 76–100 (critical): Walk away. This wallet appears in sanctions or ransomware lists. Interacting with it is, in many jurisdictions, a crime.
Bitcoin-specific gotchas to remember
Coin reuse. Bitcoin is UTXO-based, which means the same wallet can hold coins with very different histories. A "clean" balance can be ruined by a single dusting attack.
Whale rotations. Large wallets sometimes appear "risky" because they brushed against suspicious counterparties decades ago. Score in context — a high-volume wallet with one ancient flagged hop is not the same as a fresh wallet with three recent ones.
Mining pool taint. Coinbase rewards from sanctioned pools (a handful exist) can carry a tag, especially when paid out from a small solo-miner.
Want the full transaction graph?
The free check on this page answers "is this address safe?" — yes or no, with a score. If you need the complete picture — full source-of-funds, every counterparty within 5 hops, and a downloadable PDF report you can show to an exchange or a tax advisor — open the Telegram bot. It is still free for the first three full reports.
Get the full BTC report in Telegram
Source of funds, counterparty risks, downloadable PDF — straight in your chat.
Open @scorechain_amlbot