How to check a crypto address before sending funds: 5-minute AML hygiene
On-chain, you inherit the risk of the funds' path, even if you knew nothing about it. Five minutes of checking before a transfer costs less than weeks of correspondence with compliance after a freeze. Here are the three levels of checking: what each shows, what it costs, and where its limits are.
Why check if I'm not doing anything wrong
Exchange AML engines don't assess you as a person; they assess the transaction graph: where the tokens came from, through how many hops, and which clusters the path addresses are linked to. Accept a transfer from an address two steps away from a mixer, and a share of its risk is now in your score. Checking a counterparty's address before a deal is not paranoia; it is the same hygiene as vetting a counterparty in ordinary business. How it works under the hood is covered in our breakdown of exchange AML screening.
Level 1: Tether's contract blacklist (free, seconds)
If you deal in USDT, start with the hardest and most honest signal: whether the address is blacklisted by the issuer itself. Tether freezes addresses at the smart-contract level, through the isBlackListed function in the USDT contracts on Ethereum and TRON. This is not a "risk estimate"; it is a binary fact: a blacklisted address cannot move USDT at all.
You can check with our free checker: it reads the contract state directly, with no registration. Know the limits: the blacklist catches only the heaviest cases (sanctions, major thefts, authority requests). Not blacklisted ≠ clean; it only means the issuer hasn't frozen it.
Level 2: commercial risk scoring
Risk-scoring services (from AMLBot to exchangers' built-in checkers) sell a "contamination" estimate, a risk percentage across categories: mixers, darknet, scams, sanctions. Under the hood are the same cluster-attribution databases the exchanges use.
What to know about the limits of these scores:
A score is a probability, not a verdict
Different providers give different numbers for the same address, because attribution databases and category weights differ. "15% risk" at one service can be "45%" at another.
A score is only a snapshot of today
Attribution updates retroactively: an address that is clean today may get linked to a hack six months later, and the exchange will then re-score your old transaction. A saved report with a check date is your good-faith evidence for that scenario.
Every exchange has its own threshold
No external score guarantees a deposit will pass a specific exchange: engine settings are not public.
Level 3: five minutes in an explorer (free and underrated)
A basic manual check on Etherscan/Tronscan catches a large share of problem counterparties:
- Address age and history: an address created yesterday that has already moved millions is a typical transit wallet for someone else's flows.
- Transit pattern: funds enter and leave within minutes and the balance stays near zero, which marks a pass-through address.
- A fan of small incoming transfers from dozens of addresses quickly swept into one is a collection pattern typical of scam projects and mule networks.
- Explorer labels: major services and known incidents are often tagged right on the address page.
- For P2P deals: save a dated screenshot of the check. Together with the rest of the deal evidence, it is your line of defence against a possible complaint.
The address is dirty: now what
If the counterparty is on Tether's blacklist, there is no deal: their USDT technically cannot arrive. If scoring shows high risk, ask for a different address; a counterparty's refusal to provide a clean one is an answer in itself. If the transfer has already landed and the exchange is asking questions, don't panic and don't "shuffle" the funds onward: that only extends the dirty trail. The route is the same as in every AML case: preserve evidence, build Source of Funds, send one measured compliance response. The first moves are in our first-24-hours breakdown.
Checklist before a large transfer
- USDT? Run a contract blacklist check on the sender and the recipient: free checker.
- Significant amount? Order commercial scoring of the counterparty address and save the report with its date.
- Five minutes in an explorer: age, patterns, labels.
- P2P? Collect evidence per the checklist: who the counterparty is, how they pay, the chat log.
- Doubt = different address or different deal. A missed profit costs less than a frozen deposit.
Bottom line
Address checking is the cheapest AML self-defence there is: the blacklist check is free, the explorer is free, commercial scoring costs less than a coffee. If the flag has already happened and the exchange is asking questions, that is a different discipline: assess your case or request a free assessment.