# Crypto Address Checker: Flagged, Sanctioned or Hacked

> Crypto address checker: direct flags and one-hop links that show whether an address is sanctioned, frozen by a stablecoin issuer or tied to hacks or phishing.

Markdown copy of https://voltfincrypto.com/apps/crypto-address-checker

**Question:** Has this address sent to or received from sanctioned, frozen, hacked or phishing-linked addresses?

- Kind: Dashboard in Voltfin Vantage
- Topic: [Wallets and whales](https://voltfincrypto.com/topics/wallets)
- Chains: Multi-chain, Ethereum, Tron, BNB Chain
- Status: Planned. The data is not published yet, so this page states no figure; each figure will open its receipt when it is.

Before sending funds to an address, or accepting them from one, it helps to know whether it is already flagged. This dashboard checks an address against public flag sets (sanctions lists, stablecoin issuer freezes, addresses tied to recorded hacks and known phishing drainers) and then looks one hop out, at the addresses it has sent to and received from.

Every match names its flag set, its source and the transaction that links the two addresses, so the reader sees why an address matched and not only that it did. A match one hop away is weaker evidence than a direct flag: exchanges, bridges and busy contracts touch flagged addresses every day without being part of anything.

An empty result means no match in these flag sets at the block read, not that the address is safe. New scam addresses appear faster than any list can record them, so treat the result as one check among several.

## Blueprint

### Check

Direct flags and one-hop matches for the address.

- **Direct flags** (count): Flag sets that list the address itself, each named with its source.
- **Flagged counterparties** (count): Distinct flagged addresses the address has sent funds to or received funds from directly.
- **Received from flagged addresses** (USD): Value the address received directly from flagged addresses, valued at each transfer's block.
- **Sent to flagged addresses** (USD): Value the address sent directly to flagged addresses, valued the same way.
- **Every match and its evidence**: Each match's flag set, flagged address, direction, amount, transaction, block and source, newest first.
- **Matches over time** (count): One-hop matches by month, so an old incidental transfer reads differently from recent repeated contact.

### Flag sets

Which lists are checked, their sources and when each was refreshed.

- **Flag sets checked** (count): How many flag sets the check compares an address against.
- **Addresses frozen by issuers** (count): Addresses currently frozen by USDT or USDC issuers on covered chains, from their blacklist events.
- **Addresses in each flag set** (count): How many distinct addresses each flag set holds at its latest refresh.
- **Flag sets and their sources**: Each flag set's name, source, what it lists, the chains it covers and when it was last refreshed.

Filters: Address (Any EVM or Tron address); Chain (Every covered chain, or all).

## How it will be measured

- Direct flags compare the address with each flag set: sanctioned addresses from the published OFAC list, USDT and USDC blacklist events, attacker addresses in the incident registry and recorded drainer receivers.
- One-hop matches come from the address's native transfers and token Transfer logs on each covered chain, intersected with the same flag sets.
- Each match cites its flag set and source, the transaction hash and block that link the two addresses and the amount that moved.
- Counterparties labelled as exchanges, bridges or major protocols are shown but not counted as matches, since they touch flagged addresses routinely.
- Each flag set carries the date it was last refreshed; the check itself reads chain data at the latest block.

## Data it needs

- `address_labels` (to build): Labels for known addresses: exchanges, bridges, protocols, funds, treasuries, sanctioned addresses and known attackers.
- `stablecoin_freezes` (to build): Addresses frozen or blacklisted by stablecoin issuers, the balances frozen, and later unfreezes or destroyed funds, per stablecoin and chain.
- `security_incidents` (to build): A registry of exploits, hacks and rug pulls: date, chain, protocol, attack type, amount lost and the transactions involved.
- Source: The OFAC SDN list's digital currency addresses, recorded with the list's publication date (off-chain)
- Source: USDT AddedBlackList and USDC Blacklisted events on each covered chain
- Source: Attacker and drainer receiver addresses from the incident registry, each with its source
- Source: Native transfers and ERC-20 Transfer logs to and from the address on each covered chain
- Source: The transaction hash and block of each one-hop match

## Questions

### How can I check if a crypto address is a scam?

Enter it here to see whether it appears in public flag sets for sanctions, issuer freezes, hacks and phishing drainers. The check also shows whether it has transacted with addresses that do. A match is a strong reason for caution; no match is not proof of safety.

### What is a sanctioned crypto address?

An address that a government has placed on a sanctions list, such as the US Treasury's list of specially designated nationals, which includes some digital currency addresses. Dealing with it can be illegal for people under that jurisdiction.

### Why does a frozen stablecoin address matter?

Issuers freeze addresses tied to hacks, scams or legal orders. A frozen address cannot move that issuer's stablecoin, so funds sent there in that coin are stuck.

### My address shows a one-hop match. Am I flagged?

No. A one-hop match means your address sent to or received from a flagged one, perhaps through an airdrop, dust or a scammer's unsolicited transfer. The match shows the transaction so you can judge it; it does not place your address in any flag set.

### Is an address with no matches safe to send to?

Not necessarily. New scam addresses are created constantly, and lookalike addresses imitate ones you know. Check the full address against a trusted source before sending; the address poisoning tracker shows how lookalikes work.

## Glossary

- **Flag set**: A list of addresses that share a reason for caution, such as a sanctions list or a set of known drainer receivers, kept with its source.
- **One-hop counterparty**: An address that has sent funds directly to, or received funds directly from, the address being checked.
- **Drainer**: A phishing kit or contract that tricks users into signing approvals or transfers that empty their wallets to an attacker's address.

## Related apps

- [Wallet Drainer Tracker: Phishing Losses by Month](https://voltfincrypto.com/apps/wallet-drainer-tracker)
- [USDT Blacklist Tracker: Frozen USDT and USDC Wallets](https://voltfincrypto.com/apps/usdt-blacklist-tracker)
- [Address Poisoning Tracker: Lookalike Address Scams](https://voltfincrypto.com/apps/address-poisoning-tracker)
- [Stolen Crypto Tracker: Where Hacked Funds Went](https://voltfincrypto.com/apps/stolen-crypto-tracker)
- [Token Approval Checker: Open Allowances by Wallet](https://voltfincrypto.com/apps/token-approval-checker)
- [ETH Rich List: Top Ethereum Addresses by Balance](https://voltfincrypto.com/apps/eth-rich-list)

Build it in Voltfin Studio: https://app.voltfincrypto.com/signup?next=%2F