Direct flags
countFlag sets that list the address itself, each named with its source.
Dashboard · VantagePlanned
Crypto Address Checker: Flagged, Sanctioned or Hacked
Has this address sent to or received from sanctioned, frozen, hacked or phishing-linked addresses?
Check an address before you send or accept funds: direct flags and one-hop links to sanctioned, frozen, hacked or phishing addresses.
ShareEmail it
Blueprint
What the dashboard will show.
The dashboard as it will open in Vantage. Each figure is named here and arrives with its receipt; until its data is published, its place stays empty.
Check
Direct flags and one-hop matches for the address.
Flagged counterparties
countDistinct flagged addresses the address has sent funds to or received funds from directly.
Received from flagged addresses
USDValue the address received directly from flagged addresses, valued at each transfer's block.
Sent to flagged addresses
USDValue the address sent directly to flagged addresses, valued the same way.
Every match and its evidence
Each match's flag set, flagged address, direction, amount, transaction, block and source, newest first.
Matches over time
countOne-hop matches by month, so an old incidental transfer reads differently from recent repeated contact.
Flag sets
Which lists are checked, their sources and when each was refreshed.
Flag sets checked
countHow many flag sets the check compares an address against.
Addresses frozen by issuers
countAddresses currently frozen by USDT or USDC issuers on covered chains, from their blacklist events.
Addresses in each flag set
countHow many distinct addresses each flag set holds at its latest refresh.
Flag sets and their sources
Each flag set's name, source, what it lists, the chains it covers and when it was last refreshed.
- Address
- Any EVM or Tron address
- Chain
- Every covered chain, or all
About
What it answers, and for whom.
Before sending funds to an address, or accepting them from one, it helps to know whether it is already flagged. This dashboard checks an address against public flag sets (sanctions lists, stablecoin issuer freezes, addresses tied to recorded hacks and known phishing drainers) and then looks one hop out, at the addresses it has sent to and received from.
Every match names its flag set, its source and the transaction that links the two addresses, so the reader sees why an address matched and not only that it did. A match one hop away is weaker evidence than a direct flag: exchanges, bridges and busy contracts touch flagged addresses every day without being part of anything.
An empty result means no match in these flag sets at the block read, not that the address is safe. New scam addresses appear faster than any list can record them, so treat the result as one check among several.
Method
How it will be measured.
Every figure will be read at a block, kept with its source and its exact read, and open a receipt anyone can re-check.
How receipts work →- Direct flags compare the address with each flag set: sanctioned addresses from the published OFAC list, USDT and USDC blacklist events, attacker addresses in the incident registry and recorded drainer receivers.
- One-hop matches come from the address's native transfers and token Transfer logs on each covered chain, intersected with the same flag sets.
- Each match cites its flag set and source, the transaction hash and block that link the two addresses and the amount that moved.
- Counterparties labelled as exchanges, bridges or major protocols are shown but not counted as matches, since they touch flagged addresses routinely.
- Each flag set carries the date it was last refreshed; the check itself reads chain data at the latest block.
The data it needs
Chain data, with some off-chain sources
- address_labelsTo buildAddress labelsLabels for known addresses: exchanges, bridges, protocols, funds, treasuries, sanctioned addresses and known attackers.
- stablecoin_freezesTo buildStablecoin freezes and blacklistsAddresses frozen or blacklisted by stablecoin issuers, the balances frozen, and later unfreezes or destroyed funds, per stablecoin and chain.
- security_incidentsTo buildHacks and exploitsA registry of exploits, hacks and rug pulls: date, chain, protocol, attack type, amount lost and the transactions involved.
- The OFAC SDN list's digital currency addresses, recorded with the list's publication date (off-chain)
- USDT AddedBlackList and USDC Blacklisted events on each covered chain
- Attacker and drainer receiver addresses from the incident registry, each with its source
- Native transfers and ERC-20 Transfer logs to and from the address on each covered chain
- The transaction hash and block of each one-hop match
Questions
Questions people ask.
How can I check if a crypto address is a scam?
Enter it here to see whether it appears in public flag sets for sanctions, issuer freezes, hacks and phishing drainers. The check also shows whether it has transacted with addresses that do. A match is a strong reason for caution; no match is not proof of safety.
What is a sanctioned crypto address?
An address that a government has placed on a sanctions list, such as the US Treasury's list of specially designated nationals, which includes some digital currency addresses. Dealing with it can be illegal for people under that jurisdiction.
Why does a frozen stablecoin address matter?
Issuers freeze addresses tied to hacks, scams or legal orders. A frozen address cannot move that issuer's stablecoin, so funds sent there in that coin are stuck.
My address shows a one-hop match. Am I flagged?
No. A one-hop match means your address sent to or received from a flagged one, perhaps through an airdrop, dust or a scammer's unsolicited transfer. The match shows the transaction so you can judge it; it does not place your address in any flag set.
Is an address with no matches safe to send to?
Not necessarily. New scam addresses are created constantly, and lookalike addresses imitate ones you know. Check the full address against a trusted source before sending; the address poisoning tracker shows how lookalikes work.
- Flag set
- A list of addresses that share a reason for caution, such as a sanctions list or a set of known drainer receivers, kept with its source.
- One-hop counterparty
- An address that has sent funds directly to, or received funds directly from, the address being checked.
- Drainer
- A phishing kit or contract that tricks users into signing approvals or transfers that empty their wallets to an attacker's address.
Related
More apps like this.
Wallet Drainer Tracker: Phishing Losses by Month
What wallet drainers take each month, on which chains and through which signatures: approvals, permits, NFT listings and delegations.
Multi-chainEthereumUSDT Blacklist Tracker: Frozen USDT and USDC Wallets
Check whether an address is frozen by Tether or Circle, and follow how much USDT and USDC the issuers freeze, unfreeze and destroy.
Multi-chainEthereumTronAddress Poisoning Tracker: Lookalike Address Scams
Lookalike addresses planted in wallet histories with zero-value and dust transfers, and the funds victims later send to them.
Multi-chainEthereumBNB Chain+1Stolen Crypto Tracker: Where Hacked Funds Went
Follow a hack's stolen funds hop by hop into bridges, swap protocols, mixers and exchanges, or see what still sits in attacker wallets.
Multi-chainToken Approval Checker: Open Allowances by Wallet
Every spender that can still move a wallet's tokens or NFTs, with the allowance, when it was granted and the transaction that set it.
Multi-chainETH Rich List: Top Ethereum Addresses by Balance
The Ethereum addresses holding the most ETH: what kind of address each one is, who it belongs to where known and how its balance moved.
EthereumBuild Crypto Address Checker: Flagged, Sanctioned or Hacked on verified data.
Start free in Voltfin Studio: boards, tables and reports where every number opens its receipt. Tell us which data you need first and we will build it next.