Exchange Wallet Screening

In March 2022, the Lazarus Group drained $625M from Ronin Bridge in a single attack. The deposit address was already flagged—but no one checked. Don’t make the same mistake. This guide shows you how to screen every deposit and withdrawal in real-time, across 13 chains, with one API.

Why Wallet Screening Matters

Compliance

Stay ahead of OFAC and AML requirements—sanctions lists update daily

Risk Management

Stop bad actors at the door, not after they’ve moved funds

User Protection

Catch address poisoning before your users lose millions

Why exchanges choose Webacy:

One integration, 13 chains — ETH, SOL, BTC, and 10 more. No vendor sprawl.
Sub-500ms responses — Screen in real-time without blocking transactions
Sanctions + fraud in one call — Compliance and security, unified
Address poisoning detection — The threat most providers miss

Prerequisites

Before implementing wallet screening, ensure you have:

A Webacy API key (sign up here)
Basic familiarity with REST APIs or the Webacy SDK
Your application’s deposit/withdrawal flow identified for integration points

Deposit Screening

Every deposit is a potential liability until you verify the source. Screen every incoming deposit address to catch sanctioned entities, mixer activity, and high-risk wallets.

Sanctions Check

The fastest compliance check—verify if an address is on OFAC or other sanctions lists.

curl -X GET "https://api.webacy.com/addresses/sanctioned/0x098B716B8Aaf21512996dC57EB0615e2383E2f96?chain=eth" \
  -H "x-api-key: YOUR_API_KEY"

import { ThreatClient, Chain } from '@webacy-xyz/sdk';

const client = new ThreatClient({ apiKey: process.env.WEBACY_API_KEY });

const result = await client.addresses.checkSanctioned(
  '0x098B716B8Aaf21512996dC57EB0615e2383E2f96',
  { chain: Chain.ETH }
);

if (result.is_sanctioned) {
  console.log('BLOCKED: Sanctioned address');
}

import requests

response = requests.get(
    "https://api.webacy.com/addresses/sanctioned/0x098B716B8Aaf21512996dC57EB0615e2383E2f96",
    params={"chain": "eth"},
    headers={"x-api-key": "YOUR_API_KEY"}
)
data = response.json()

Try it now: Paste 0x098B716B8Aaf21512996dC57EB0615e2383E2f96 into the sanctions endpoint. This is the actual Lazarus Group wallet from Ronin Bridge—instant hit.

Full Risk Analysis

For addresses that pass sanctions screening, perform a comprehensive risk analysis.

curl -X GET "https://api.webacy.com/addresses/0x722122dF12D4e14e13Ac3b6895a86e84145b6967?chain=eth" \
  -H "x-api-key: YOUR_API_KEY"

const analysis = await client.addresses.analyze(
  '0x722122dF12D4e14e13Ac3b6895a86e84145b6967',
  { chain: Chain.ETH }
);

console.log(`Risk Score: ${analysis.overallRisk}/100`);
console.log(`Issues: ${analysis.issues.map(i => i.tag).join(', ')}`);

response = requests.get(
    "https://api.webacy.com/addresses/0x722122dF12D4e14e13Ac3b6895a86e84145b6967",
    params={"chain": "eth"},
    headers={"x-api-key": "YOUR_API_KEY"}
)

Response fields to use:

Field	Description	Action
`overallRisk`	0-100 risk score	Set your threshold (e.g., >50 = review)
`issues[]`	Array of risk tags	Check for specific threats
`labels[]`	Entity labels	Identify mixers, exchanges, etc.

Try it now: Test 0x722122dF12D4e14e13Ac3b6895a86e84145b6967—the Tornado Cash Router. You’ll get high risk scores and mixer tags in the response.

Multi-Chain Support

The same endpoints work across all supported chains—just change the chain parameter.

curl "https://api.webacy.com/addresses/{address}?chain=eth" -H "x-api-key: YOUR_KEY"

curl "https://api.webacy.com/addresses/{address}?chain=sol" -H "x-api-key: YOUR_KEY"

curl "https://api.webacy.com/addresses/{address}?chain=btc" -H "x-api-key: YOUR_KEY"

curl "https://api.webacy.com/addresses/{address}?chain=base" -H "x-api-key: YOUR_KEY"

Withdrawal Protection

Your users trust you to protect their funds—even from their own mistakes. Protect users from sending funds to risky destinations, including address poisoning attacks.

Address Poisoning Detection

Address poisoning is a sophisticated attack where scammers create lookalike addresses to trick users into sending funds to the wrong destination.

Real Case: In May 2024, a victim lost $68 million in WBTC by copying a poisoned address from their transaction history. The legitimate and scam addresses looked nearly identical.

The Attack Pattern—Can You Spot the Difference?

	Address
✅ Legitimate	`0xd9A1b0B1e1aE382DbDc898Ea68012FfcB2853a91`
❌ Attacker	`0xd9A1C3788D81257612E2581A6ea0aDa244853a91`

Both start with 0xd9A1. Both end with 53a91. The victim couldn’t tell them apart—and lost $68 million.

curl -X GET "https://api.webacy.com/addresses/0xd9A1C3788D81257612E2581A6ea0aDa244853a91/poisoning?chain=eth" \
  -H "x-api-key: YOUR_API_KEY"

const poisoning = await client.addresses.checkPoisoning(
  '0xd9A1C3788D81257612E2581A6ea0aDa244853a91',
  { chain: Chain.ETH }
);

if (poisoning.is_poisoned) {
  console.log('WARNING: Address poisoning detected!');
  console.log(`Similar to: ${poisoning.similar_addresses}`);
}

response = requests.get(
    "https://api.webacy.com/addresses/0xd9A1C3788D81257612E2581A6ea0aDa244853a91/poisoning",
    params={"chain": "eth"},
    headers={"x-api-key": "YOUR_API_KEY"}
)

One API call, millions saved: Add this check before every withdrawal. Your users won’t notice the 300ms latency—but they’ll notice when you save them from a $68M mistake.

Withdrawal Destination Check

Screen withdrawal destinations for general risk factors.

async function screenWithdrawal(destination: string, chain: Chain) {
  // 1. Sanctions check (immediate block)
  const sanctions = await client.addresses.checkSanctioned(destination, { chain });
  if (sanctions.is_sanctioned) {
    return { allowed: false, reason: 'Sanctioned address' };
  }

  // 2. Address poisoning check (warn user)
  const poisoning = await client.addresses.checkPoisoning(destination, { chain });
  if (poisoning.is_poisoned) {
    return {
      allowed: false,
      reason: 'Potential address poisoning attack',
      warning: 'Please verify this address carefully'
    };
  }

  // 3. Risk analysis (flag high risk)
  const risk = await client.addresses.analyze(destination, { chain });
  if (risk.overallRisk >= 50) {
    return {
      allowed: true,
      warning: `High risk destination (score: ${risk.overallRisk})`,
      issues: risk.issues
    };
  }

  return { allowed: true };
}

Complete Integration Workflow

Here’s how it all fits together.

Recommended Deposit Flow

Recommended Withdrawal Flow

Implementation Example

Full TypeScript Implementation

import { ThreatClient, Chain } from '@webacy-xyz/sdk';

const client = new ThreatClient({
  apiKey: process.env.WEBACY_API_KEY,
  defaultChain: Chain.ETH,
});

// Deposit screening
async function screenDeposit(address: string, chain: Chain) {
  // Step 1: Sanctions (must block)
  const sanctions = await client.addresses.checkSanctioned(address, { chain });
  if (sanctions.is_sanctioned) {
    return {
      action: 'BLOCK',
      reason: 'Sanctioned address',
      report: true
    };
  }

  // Step 2: Risk analysis
  const risk = await client.addresses.analyze(address, { chain });

  if (risk.overallRisk >= 80) {
    return {
      action: 'BLOCK',
      reason: 'Extremely high risk',
      riskScore: risk.overallRisk,
      issues: risk.issues
    };
  }

  if (risk.overallRisk >= 50) {
    return {
      action: 'REVIEW',
      reason: 'High risk - manual review required',
      riskScore: risk.overallRisk,
      issues: risk.issues
    };
  }

  return {
    action: 'ACCEPT',
    riskScore: risk.overallRisk
  };
}

// Withdrawal screening
async function screenWithdrawal(destination: string, chain: Chain) {
  // Step 1: Sanctions
  const sanctions = await client.addresses.checkSanctioned(destination, { chain });
  if (sanctions.is_sanctioned) {
    return {
      action: 'BLOCK',
      reason: 'Cannot withdraw to sanctioned address'
    };
  }

  // Step 2: Address poisoning
  const poisoning = await client.addresses.checkPoisoning(destination, { chain });
  if (poisoning.is_poisoned) {
    return {
      action: 'WARN',
      reason: 'Possible address poisoning attack detected',
      requireConfirmation: true,
      message: 'Please verify this is the correct address. It appears similar to addresses that have been used in phishing attacks.'
    };
  }

  // Step 3: Risk analysis
  const risk = await client.addresses.analyze(destination, { chain });
  if (risk.overallRisk >= 50) {
    return {
      action: 'FLAG',
      reason: 'High risk destination',
      riskScore: risk.overallRisk,
      showWarning: true
    };
  }

  return { action: 'PROCEED' };
}

Example Addresses for Testing

Use these addresses to test your integration:

OFAC Sanctioned Addresses

Address	Chain	Attribution
`0x098B716B8Aaf21512996dC57EB0615e2383E2f96`	ETH	Lazarus Group (Ronin Bridge heist)
`0x566f827a4988d4a3eb9da469d8d3d0b536da196e`	ETH	OFAC SDN List
`0x55da7813a4314cc896bf0cf61886529b7769be81`	ETH	OFAC SDN List
`bc1qy78e6ml7f3p438jqrrlzsewx625y0sr7jsesa7`	BTC	OpenSanctions
`115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn`	BTC	WannaCry Ransomware
`1295rkVyNfFpqZpXvKGhDqwhP1jZcNNDMV`	BTC	Suex (OFAC)

Known Hackers

Address	Chain	Attribution
`0x3b09A3c9aDD7D0262e6E9724D7e823Cd767a0c74`	ETH	Bittensor Hack
`0x7a503e3ab9433ebf13afb4f7f1793c25733b3cca`	ETH	GANA Hack
`0xd967113224c354600b3151e27aaba53e3034f372`	ETH	WazirX Malware/Spear Phishing
`0x889b49ef0bf787c3ddc2950bfc7d1d439320004b`	ETH	Woo X Exploiter
`0x44f887cfbd667cb2042dd55ab1d8951c94bb0102`	ETH	Loopring Guardian 2FA Exploit
`bc1ql9r9a4uxmsdwkenjwx7t5clslsf62gxt8ru7e8`	BTC	Trust Hack

Mixers & Money Laundering

Address	Chain	Type
`0x722122dF12D4e14e13Ac3b6895a86e84145b6967`	ETH	Tornado Cash Router
`0x5614987586c15f4e9b3ebcbec07c477b58f2e59b`	ETH	Tornado Cash Router (Primary)
`0x561376c5c8313bd742083d42e6b8b6d8da701fff`	ETH	Tornado Cash Pool (100 ETH)

Phishing & Scam Addresses

Address	Chain	Attribution
`0x84672cc56b6dad30cfa5f9751d9ccae6c39e29cd`	ETH	AI Protocol User Permit Phishing
`0x1aDf5DAc035AE7FEC116e8345e005FB88d542f53`	ETH	Phishing scammer
`0xe7d13137923142a0424771e1778865b88752b3c7`	ETH	Mailer Lite/WalletConnect Phishing Campaign
`0x624Fc3Dc249E37E8BFd3e834C4dF81Ff2dA1D0Ca`	BSC	Malicious Permit scammer

Address Poisoning

Address	Chain	Type
`0xd9A1C3788D81257612E2581A6ea0aDa244853a91`	ETH	Known poisoned address ($68M WBTC attack)
`0xCF03Aa88AfDA357C837b9DDD38A678E3Ad7Cd5D7`	ETH	Poisoning victim
`0x5f90e59d0a03fd2f8c56b8cc896c5b42594eb3a0`	ETH	$50M address poisoning drain

Address	Chain	Attribution
`0x0fa09c3a328792253f8dee7116848723b72a6d2e`	ETH	North Korean entities (High Risk)
`0x6eedf92fb92dd68a270c3205e96dccc527728066`	ETH	North Korean entities (High Risk)
`0xbdd077f651ebe7f7b3ce16fe5f2b025be2969516`	ETH	North Korean entities (High Risk)

Clean Addresses (for comparison)

Address	Chain	Type
`0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045`	ETH	Vitalik’s wallet (low risk)

For a complete list of test addresses, see Example Addresses.

API Quick Reference

Endpoint	Use Case	Response Time
`GET /addresses/sanctioned/{address}`	Sanctions screening	~100ms
`GET /addresses/{address}`	Full risk analysis	~500ms
`GET /addresses/{address}/poisoning`	Address poisoning check	~300ms

Authentication:

Header: x-api-key: YOUR_API_KEY
Base URL: https://api.webacy.com

Ready to Ship?

You’ve seen how it works. Now integrate it:

Get your API key — Takes 2 minutes
Test with the example addresses — Verify your integration
Go live — Start screening deposits today

Next Steps

Get Your API Key

Start screening in minutes

API Reference

Every endpoint, every parameter

Install the SDK

TypeScript bindings included

Understanding Risk Tags

Know what you’re looking at

Getting Started

Risk Ratings, Scoring, and Documentation

SDK

Integrations

Essentials

Glossary

Exchange Wallet Screening

Why Wallet Screening Matters

Compliance

Risk Management

User Protection

Prerequisites

Deposit Screening

Sanctions Check

Full Risk Analysis

Multi-Chain Support

Withdrawal Protection

Address Poisoning Detection

Withdrawal Destination Check

Complete Integration Workflow

Recommended Deposit Flow

Recommended Withdrawal Flow

Implementation Example

Example Addresses for Testing

OFAC Sanctioned Addresses

Known Hackers

Mixers & Money Laundering

Phishing & Scam Addresses

Address Poisoning

Clean Addresses (for comparison)

API Quick Reference

Ready to Ship?

Next Steps

Get Your API Key

API Reference

Install the SDK

Understanding Risk Tags

​Why Wallet Screening Matters

Compliance

Risk Management

User Protection

​Prerequisites

​Deposit Screening

​Sanctions Check

​Full Risk Analysis

​Multi-Chain Support

​Withdrawal Protection

​Address Poisoning Detection

​Withdrawal Destination Check

​Complete Integration Workflow

​Recommended Deposit Flow

​Recommended Withdrawal Flow

​Implementation Example

​Example Addresses for Testing

​OFAC Sanctioned Addresses

​Known Hackers

​Mixers & Money Laundering

​Phishing & Scam Addresses

​Address Poisoning

​DPRK-Related (North Korea)

​Clean Addresses (for comparison)

​API Quick Reference

​Ready to Ship?

​Next Steps

Get Your API Key

API Reference

Install the SDK

Understanding Risk Tags

Why Wallet Screening Matters

Prerequisites

Deposit Screening

Sanctions Check

Full Risk Analysis

Multi-Chain Support

Withdrawal Protection

Address Poisoning Detection

Withdrawal Destination Check

Complete Integration Workflow

Recommended Deposit Flow

Recommended Withdrawal Flow

Implementation Example

Example Addresses for Testing

OFAC Sanctioned Addresses

Known Hackers

Mixers & Money Laundering

Phishing & Scam Addresses

Address Poisoning

DPRK-Related (North Korea)

Clean Addresses (for comparison)

API Quick Reference

Ready to Ship?

Next Steps