How Crypto Wallet Risk Scoring Works: 0–100 Explained

The six risk vectors

Every AML check returns a composite 0–100 score built from six independent risk vectors, each scored separately:

• Sanctions (OFAC, UN, EU, UK) — Direct match against government blacklists. A hit scores 95–100. Indirect exposure through 1–2 hops scores 40–80 depending on amount.
• Darknet market exposure — Transactions with wallets attributed to Hydra, AlphaBay successors, Mega, Solaris. Direct: 80–100. Hop-1: 40–70. Hop-2: 20–40.
• Mixer/tumbler interaction — Use of Tornado Cash, Wasabi CoinJoin, ChipMixer, Sinbad. Direct: 60–90. Any interaction in the history raises the flag.
• Ransomware payments — Connection to known ransomware wallets (LockBit, Conti, BlackCat/ALPHV). Direct: 90–100.
• Scam & rug-pull contracts — Interactions with honeypot tokens, drainer contracts, rug-pull deployers. Moderate weight — 30–60.
• Exchange freeze flags — Addresses linked to publicly disclosed exchange freezes at Binance, OKX, Bitstamp, Kraken. Weight: 50–80.

How the composite score is calculated

The six vector scores are not simply averaged. Each is weighted by: (1) the severity of the risk category, (2) the hop distance from the flagged entity, and (3) the proportion of funds involved relative to the wallet's total transaction volume.

A wallet that received 0.01 BTC from a mixer 3 hops away will score differently than a wallet that directly sent 5 BTC to a sanctioned address. The model is designed to reflect economic materiality, not just binary flag presence.

What each score range means