Screen a Wallet for Risk

Wallet screening is a common first step in onchain due diligence. Before interacting with an address, processing a transaction, onboarding a counterparty, or investigating activity, you can use Webacy to understand the risks associated with that wallet. This guide walks through a basic wallet screening workflow.

What you’ll learn

By the end of this guide, you’ll know how to:

Screen a wallet address
Interpret its overall risk score
Identify the risk factors contributing to that score
Review historical transaction activity
Understand exposure to risky counterparties
Use the results in an automated decision workflow

Get your API key

Follow this guide to get an API key.Create or log in to your Webacy Developer account and generate an API key from your dashboard. Your API key authenticates requests to the Webacy API and determines the usage associated with your account.Keep your API key secure and never expose it in client-side code or public repositories.Once you have your key, you’re ready to make your first request.

Submit a wallet for screening

Pass the wallet address you want to evaluate to the Webacy wallet screening endpoint.Webacy analyzes the address using its onchain activity, transaction history, counterparties, known entities, and proprietary risk intelligence.Try this example:

curl -X GET "https://api.webacy.com/addresses/0x0fa09c3a328792253f8dee7116848723b72a6d2e?chain=eth" \
  -H "x-api-key: YOUR_API_KEY"

const analysis = await client.addresses.analyze(
  '0x722122dF12D4e14e13Ac3b6895a86e84145b6967',
  { chain: Chain.ETH }
);

console.log(`Risk Score: ${analysis.overallRisk}/100`);
console.log(`Issues: ${analysis.issues.map(i => i.tag).join(', ')}`);

response = requests.get(
    "https://api.webacy.com/addresses/0x722122dF12D4e14e13Ac3b6895a86e84145b6967",
    params={"chain": "eth"},
    headers={"x-api-key": "YOUR_API_KEY"}
)

The example address we will use is 0x0fa09c3a328792253f8dee7116848723b72a6d2e

Because risk changes continuously onchain, Webacy evaluates wallets against the latest available data rather than relying solely on a static historical assessment.

Tip: A wallet’s risk profile can change at any time. An address that appears safe today may later interact with a sanctioned entity, exploit, scam, or other high-risk address.

Check the overall risk score

Start with the wallet’s overall risk assessment. This provides a quick indication of whether Webacy has identified potentially concerning activity associated with the address.A lower-risk wallet may have few or no significant indicators, while an elevated assessment means one or more risk factors warrant additional attention.For the example above, below is an example response:

{
  "high": 2,
  "count": 2,
  "issues": [
    {
      "tags": [
        {
          "key": "DPRK",
          "name": "DPRK",
          "type": "addressRisk",
          "context": {
            "detected_at": "2026-08-11T15:35:11.620Z"
          },
          "severity": 10,
          "description": "This address has been identified as having connections to North Korean (DPRK) entities or activities. DPRK-linked addresses are considered extremely high risk due to international sanctions and the regime's involvement in cybercrime, including cryptocurrency theft, ransomware operations, and illicit financing. Interaction with these addresses may violate sanctions regulations and expose users to significant legal and financial risks."
        },
        {
          "key": "HACK",
          "name": "Hack Related",
          "type": "addressRisk",
          "context": {
            "detected_at": "2026-08-11T15:35:11.620Z"
          },
          "severity": 10,
          "description": "This address is associated with a known hack or security incident."
        }
      ],
      "score": 100,
      "riskScore": "High Risk",
      "categories": {
        "fraudulent_malicious": {
          "key": "fraudulent_malicious",
          "name": "Fraudulent/Malicious",
          "tags": {
            "DPRK": true,
            "HACK": true
          },
          "gradedDescription": {
            "low": "Properties of this transaction indicate the possibility of nefarious activity, but we have not detected anything that would constitute elevated risk",
            "high": "The smart contract/address in this transaction has been used in and is associated with confirmed fraud and malicious activity, or the asset is a known malicious token. Interacting with it may also cause your address to be marked as fraudulent.",
            "medium": "Elements of the smart contract in this transaction can be used a fraudulent and malicious fashion, or the address in this transaction has been involved in some risk activity."
          }
        }
      }
    }
  ],
  "medium": 0,
  "details": {
    "fund_flows": null,
    "marketData": {
      "market_cap": 0
    },
    "token_risk": {},
    "address_info": {
      "dprk": true,
      "hack": true,
      "balance": 0.07983634986921333,
      "flagged": false,
      "sanctioned": false,
      "time_1st_tx": "2025-02-18T14:53:23.000Z",
      "time_verified": 1761344633930,
      "has_no_balance": false,
      "open_sanctions": false,
      "ofac_sanctioned": false,
      "automated_trading": false,
      "transaction_count": 60,
      "has_no_transactions": false,
      "usdt_banned": false,
      "usdc_banned": false,
      "eurc_banned": false,
      "busd_banned": false,
      "pyusd_banned": false,
      "usdp_banned": false
    },
    "buy_sell_taxes": {
      "has_buy_tax": false,
      "has_sell_tax": false
    }
  },
  "expiresAt": 1786548911638,
  "isContract": false,
  "addressType": "EOA",
  "analyzed_at": "2026-08-11T15:35:11.434Z",
  "overallRisk": 100
}

In this example, overallRisk: 100 which means this address is HIGH RISK

The overall score is a useful starting point, but deeper due diligence should also consider the underlying signals contributing to it.

Review the risk factors

Next, inspect the individual risk factors identified for the wallet.Webacy evaluates hundreds of proprietary risk signals across areas such as:

Sanctions exposure
Known scams and malicious addresses
Hacks and exploits
Stolen funds
Suspicious transaction patterns
High-risk counterparties
Address poisoning
Indirect or multi-hop exposure
Other anomalous onchain behavior

These signals provide context for why a wallet received its risk assessment.This allows you to distinguish between different types and severities of risk rather than treating every flagged wallet the same way.

...
  "issues": [
    {
      "tags": [
        {
          "key": "DPRK",
...
        },
        {
          "key": "HACK",
...
      ],
...
  "details": {
...
    },
    "token_risk": {},
    "address_info": {
      "dprk": true,
      "hack": true,
...
}

In our working example, under "issues" and "tags" you will see risk factors associated with the address. This one has the risk factors "DPRK" and "HACK" associated with it, which provides insight into why the overall score is high. Additionally in the “details” and “address_info” section, you can find a quick list of risk-associated factors in boolean format. For this example, you can see "dprk": true and "hack": true

Take action based on the result

Once you’ve evaluated the wallet, you can incorporate Webacy’s risk intelligence into your own application or policy engine. The appropriate action depends on your use case, jurisdiction, risk tolerance, and internal policies.Webacy provides the underlying intelligence so your system can determine what happens next.

In our example, it would be highly recommended to block this wallet address from interaction with your platform, transaction, asset, or other activity.

Continue monitoring

A wallet screening represents the risk associated with an address at the time of analysis. For many applications, screening once is not enough. New transactions can introduce new counterparties, exposures, and risk factors at any time. For ongoing protection, combine wallet screening with Webacy’s transaction monitoring and Wallet Watch capabilities to identify changes in risk as new activity occurs.

Common use cases

Wallet screening can be incorporated anywhere your application needs to make a decision about an onchain address, including:

User onboarding — evaluate wallets before allowing access or activity
Deposits and withdrawals — assess addresses before processing funds
Compliance workflows — identify sanctions and other high-risk exposure
Investigations — analyze suspicious wallets and related activity
Trading platforms — evaluate addresses interacting with your platform
Treasury operations — assess counterparties before sending funds
AI agents — evaluate wallet risk before executing an autonomous action

Monitor

Agentic

Digital Assets

Wallets and Accounts

Transactions

Tokens

Apps

DD.xyz

Screen a Wallet for Risk

What you’ll learn

Continue monitoring

Common use cases

​What you’ll learn

​Continue monitoring

​Common use cases

What you’ll learn

Continue monitoring

Common use cases