What these examples are good for
Use these addresses below to:- Confirm your integration works (request/response structure, latency, pagination, error handling)
- Validate risk outcomes (flags, severity, labels, and explainability fields)
- Test decisioning logic (block, warn, allow, review)
- Prototype dashboards (monitoring views, alert feeds, triage workflows)
Notes
- These examples are provided for testing and development only.
- Address risk is contextual and time-sensitive. Results may change as new on-chain activity occurs.
- If you’d like a broader sample set (including “clean,” borderline, and mixed-risk examples), reach out and we can provide a curated testing bundle.
Sanctioned Addresses
These addresses are on sanctions lists and will returnis_sanctioned: true from the /addresses/sanctioned/{address} endpoint.
| Address | Chain | Attribution |
|---|---|---|
0x098B716B8Aaf21512996dC57EB0615e2383E2f96 | ETH | Lazarus Group (North Korea) - Ronin Bridge heist |
1295rkVyNfFpqZpXvKGhDqwhP1jZcNNDMV | BTC | Suex - OFAC SDN List |
19D8PHBjZH29uS1uPZ4m3sVyqqfF8UFG9o | BTC | Sanctioned Address |
Hacker Addresses
These addresses are associated with known hacks and exploits. They return high-risk scores with tags likehack, stealing_attack, and blacklist_doubt.
| Address | Chain | Attribution | Risk Score |
|---|---|---|---|
0x3b09A3c9aDD7D0262e6E9724D7e823Cd767a0c74 | ETH | Bittensor Hack | 100 |
0xd967113224c354600b3151e27aaba53e3034f372 | ETH | WazirX Malware / Spear Phishing | 100 |
0x44f887cfbd667cb2042dd55ab1d8951c94bb0102 | ETH | Loopring Guardian 2FA Exploit | 10 |
0x889b49ef0bf787c3ddc2950bfc7d1d439320004b | ETH | Woo X Exploiter | 3.1 |
DPRK (North Korea) Linked
These addresses are associated with North Korean cyber operations and return thedprk tag.
| Address | Chain | Risk Score | Tags |
|---|---|---|---|
0x0fa09c3a328792253f8dee7116848723b72a6d2e | ETH | 100 | dprk, hack, stealing_attack |
Address Poisoning
These addresses are involved in address poisoning attacks. The/addresses/{address}/poisoning endpoint will return poisoning_detected: true for attackers.
| Address | Chain | Type | Notes |
|---|---|---|---|
0x70c5698da7f86487837f59642b1ebe5682dfa3c7 | ETH | Attacker | Returns poisoning_detected: true with suspicious transactions |
0xCF03Aa88AfDA357C837b9DDD38A678E3Ad7Cd5D7 | ETH | Victim | Address was targeted by a poisoning attempt |
Phishing Addresses
These addresses are associated with phishing campaigns and return thephishing_activities tag.
| Address | Chain | Attribution | Risk Score |
|---|---|---|---|
0x1aDf5DAc035AE7FEC116e8345e005FB88d542f53 | ETH | ScamSniffer reported phishing | 23 |
0x5f90e59d0a03fd2f8c56b8cc896c5b42594eb3a0 | ETH | $50M Address Poisoning Drain | 20.1 |
Mixers
These addresses are associated with mixing services and return tags likeassociated_mixer and sanctioned.
| Address | Chain | Attribution | Risk Score |
|---|---|---|---|
0x722122dF12D4e14e13Ac3b6895a86e84145b6967 | ETH | Tornado Cash Router | 10.1 |
Pool Analysis Examples
Pool Analysis examples:| Address | Chain | Pool |
|---|---|---|
V79vihUymP25ypDCRVmED106MvTI3AfPajSqWJ1M | SOL | - |
0x397ff1542f962076d0bfe58ea045ffa2d347aca0 | ETH | Sushiswap v2 |
0xb4e16d0168e52d35cacd2c6185b44281ec28c9dc | ETH | Uniswap v2 |
Other Examples
| Address | Chain | Type |
|---|---|---|
7gGRg15D2vGbeqwp5J5bQatAFVSrG6doNx2V3i8aVYEv | SOL | Automated Trader Account |
23JPm15PgYWV5uTnjADEVN8uSma2rdcULq3EGciTArzS | SOL | Upbit Hack Related Wallet |
0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045 | ETH | Vitalik Buterin (clean wallet for comparison) |
