Snapshot as of 2026-05-14. Live counts available to authenticated customers at /api/v1/intel/stats.
Sanctions and issuer freezes
Authoritative lists where a match is grounds to block or report. Total flagged addresses across these sources: 10,649.
OFAC SDN List
656 addresses
Publisher: US Treasury / OFAC · Refresh: Daily (changes typically once or twice a week) · Licence: Public, US government work — no licence
All crypto-tagged addresses on the SDN list, parsed from the official XML feed.
Tether USDT blacklist
5,938 addresses
Publisher: Tether (issuer) · Refresh: Per on-chain event (AddedBlackList) · Licence: Public on-chain data
Issuer-level freezes via AddedBlackList events. Counted in sanctions because the freeze is legally binding even when no OFAC listing exists.
Circle USDC blacklist
1,525 addresses
Publisher: Circle (issuer) · Refresh: Per on-chain event (Blacklist) · Licence: Public on-chain data
Issuer-level freezes via Blacklist events.
ScamSniffer reports
2,530 addresses
Publisher: ScamSniffer (open dataset) · Refresh: Daily fetch of the public feed · Licence: Open data, CC-BY
Filtered to scam and phishing addresses with at least one corroborating signal.
Entity labels and live signals
Lower-stakes labels and real-time risk signals. These do not by themselves trigger a block but they raise the risk score and surface in the narrative.
Known-entity registry (exchanges, DeFi, bridges)
Refresh: Manual curation, weekly review
Hand-curated to keep false-positive rate on big venues at zero.
GoPlus Security real-time check
Refresh: Per screen, 1-hour Redis cache per address
Address-level risk flags (sanctioned, mixer, phishing, honeypot) from GoPlus. Treated as live signal, not stored as a hard label.
Honeypot.is
Refresh: Per screen
Honeypot and high-tax contract detection on EVM chains.
MEW phishing dataset
Refresh: Captured 2026-04
Reviewed 652 entries; rejected for ingestion because most addresses were from disjoint eras and not corroborated. We mention this here for transparency about what we have looked at and chosen not to include.
False-positive policy
- Two-source minimum for label persistenceA label survives in our DB only when at least two independent sources agree, or one source has issuer-level authority (Tether, Circle, OFAC).
- Confidence floor for hard categorisationMixer / hack / ransomware are only treated as override-grade signals at confidence >= 0.95.
- Decay on graph exposureHop-based sanctions exposure uses a 90-day half-life so old taint stops dragging a score forever.
- Customer dispute pathIf we mislabel an address, email [email protected] with the screening ID. We re-screen within one business day and publish a public retraction if we were wrong.
Roadmap and growth
We are working through a phased intel ingestion plan that maps to a target of ~260,000 labels by end of 2026 (Chainabuse, additional stablecoin issuer freezes, public hack post-mortems, KYT-validated OFAC adjacencies). Every new source goes through a KYT-validation gate before it can affect scoring. We publish a changelog entry on this page when a phase lands.