Trading & Capital Markets
Crypto Wallet Risk Scoring API
Before you credit an incoming transfer you need to know where it came from. After you release a withdrawal it is too late to ask.
- Crypto exchanges
- Payment companies
- Custody providers
- Compliance teams
What your customers would see
example interfaceMockupIllustrative mockup of the interface we would build. Figures shown are examples, not results from a live deployment.
The problem this solves
Exchanges and crypto payment firms face a hard compliance requirement with a short decision window. An incoming transfer arrives; you must decide quickly whether crediting it exposes you to sanctioned funds, proceeds of a known theft, or mixing activity that will make your regulator uncomfortable.
The commercial tools for this are mature but expensive, priced for large institutions, and frequently opaque about why an address scored the way it did. For a mid-sized exchange the cost is painful, and the inability to explain a decision to a customer or a regulator is a genuine operational problem.
A great deal of what these tools do is tractable from public chain data combined with official sanctions lists and well-documented incident attributions. Graph traversal from known-bad addresses, mixer interaction detection, and exposure scoring by hop distance are all buildable — and the result can be made fully explainable, which the incumbents often are not.
Who buys this
Crypto exchanges, Payment companies, Custody providers, Compliance teams
What the API returns
What comes back
- Risk score per address with the reasoning that produced it
- Direct and indirect exposure to sanctioned addresses by hop distance
- Mixer and tumbler interaction detection
- Exposure to addresses attributed to documented thefts and exploits
- Counterparty classification: exchange, custodial, contract, personal
- Transaction pattern anomalies such as peeling chains and rapid layering
- Address clustering into likely common ownership
- Full audit trail for every score, suitable for regulatory review
Endpoints
| Method | Path | Returns |
|---|---|---|
| GET | /v1/addresses/{address}/risk | Risk score with explanation |
| POST | /v1/addresses/batch | Score many addresses in one call |
| GET | /v1/addresses/{address}/exposure | Exposure paths to flagged entities |
| POST | /v1/transactions/screen | Screen a transaction before crediting or releasing |
| GET | /v1/addresses/{address}/counterparties | Classified counterparties |
| POST | /v1/monitoring | Register addresses for ongoing monitoring and alerts |
Request and response
illustrativeRequest
{
"address": "0x7a3f...c219",
"chain": "ethereum",
"max_hops": 5,
"include_explanation": true
}Response
{
"address": "0x7a3f...c219",
"chain": "ethereum",
"risk_score": 81,
"band": "high",
"screened_at": "2026-10-21T15:08:12Z",
"exposure": [
{
"category": "sanctioned_entity",
"hops": 2,
"value_share": 0.34,
"source": "official_sanctions_list",
"path": ["0x7a3f...c219", "0x18bd...4a01", "0xf2c7...9e33"]
},
{
"category": "mixer",
"hops": 1,
"value_share": 0.21,
"source": "known_mixer_contracts"
}
],
"counterparties": { "exchange": 0.31, "contract": 0.44, "unknown": 0.25 },
"recommendation": "manual_review",
"audit_reference": "scr_2026102115081200731"
}Where the data comes from
| Public blockchain data | Full transaction history from public nodes — open, verifiable and the backbone of the whole service |
| Official sanctions lists | Published designations from the relevant authorities for your jurisdictions |
| Documented incident attributions | Publicly reported thefts and exploits with addresses identified in credible disclosures |
| Known mixer contracts | Publicly documented mixing service addresses |
| Exchange address attribution | Built from deposit patterns and public disclosures |
| Your own case outcomes | Optional, and only with your agreement — confirmed outcomes improve calibration considerably |
The intelligence layer
The difference between a demo and a service is mostly in this section. These are the parts that keep the answer trustworthy once real traffic is hitting it.
- Graph traversal from flagged addresses with value-weighted exposure rather than simple hop counting
- Address clustering using established heuristics, with the heuristic used recorded per cluster
- Decay functions so distant indirect exposure is not treated like direct receipt
- Pattern detection for peeling chains, layering and structuring behaviour
- Counterparty classification from behavioural signatures and public attribution
- Full explainability: every score decomposes into the specific paths and sources that produced it
- Calibration against confirmed outcomes where you can share them
- Versioned scoring logic, so a historical decision can be reproduced exactly as it was made
What it changes for the business
Compliance evidence
A full audit trail per decision, reproducible months later, which is what reviews actually ask for.
Lower screening cost
Owning the layer changes the economics against per-query commercial pricing at volume.
Explainable decisions
You can tell a customer why a transfer was held, which opaque vendor scores make impossible.
Faster crediting
Clear addresses clear automatically, so review capacity goes to the cases that need it.
How it fits into your product
How it embeds
- Synchronous screening at deposit and withdrawal with sub-second response for cached addresses
- Batch endpoints for periodic re-screening of your existing address base
- Webhooks when a monitored address becomes newly exposed
- Case management integration so flagged transfers route into your existing review queue
- Deployment inside your infrastructure where screening data cannot leave
- Versioned scoring with historical reproduction for audit
Included in every build
- Authentication, scoped API keys and per-customer rate limiting
- Input validation with predictable, documented error responses
- Versioned endpoints so your integration never breaks without notice
- Request and response logging for audit and dispute resolution
- Latency, error-rate and usage monitoring with alerting
- OpenAPI specification, sandbox environment and client examples
- Backups, failover design and a documented recovery procedure
- An agreed support arrangement once the service is live
How we would build it
about 20 weeksDiscovery and feasibility
Weeks 1–3
This one depends heavily on data access, so we start by proving the sources exist, can be licensed for your use, and actually carry the signal the model needs. If they do not, you find out here.
Architecture and baseline model
Weeks 4–6
A written architecture and a baseline model measured against a holdout period, so you know what accuracy you are buying before the full build starts.
Production build
Weeks 7–16
Data pipelines, model training and serving, historical archive, validation harness, API, security, monitoring and documentation.
Validation and integration
Weeks 17–20
Backtesting against held-out history, accuracy reporting your team can audit, integration support and an agreed retraining cadence.
Commercial models
There is no fixed price list, because the cost is driven by data complexity, integration count, model requirements, request volume and the support level you need. Scope is agreed in writing before development starts.
Fixed-scope prototype
A defined slice of the service, built and priced as one piece of work. The usual first step when the business case needs proving internally.
Fixed-price build
An agreed scope against a written architecture, delivered for an agreed price. Best when the requirements are already clear.
Build then retainer
We build the service, then operate and improve it under a monthly agreement covering monitoring, updates and model maintenance.
White-label product
The service runs under your brand, your domain and your pricing, with MLPivot invisible to your customers.
Questions buyers ask
Is this a substitute for a licensed compliance vendor?
That is your compliance and legal team's judgement, not ours. Some regulators and banking partners expect a named commercial provider. This can be the primary screen, a cost-reducing pre-filter ahead of one, or an explainability layer alongside one — and we would want that question settled before the build rather than after.
How current are sanctions lists?
Refreshed from official publications on a schedule measured in hours, and newly designated addresses trigger immediate re-screening of monitored addresses.
What about privacy chains?
Chains designed to prevent traceability cannot be meaningfully traversed, and we would not pretend otherwise. The API returns an explicit limitation rather than a misleading low score.
Can we reproduce a decision from six months ago?
Yes. Scoring logic is versioned and every screening stores its inputs and version, so a historical decision can be reproduced exactly as it was originally made. This is usually the first thing a reviewer asks for.
How do you avoid false positives on exchange addresses?
Exchange-controlled addresses receive enormous volumes including some tainted funds, so naive traversal flags everything. We maintain exchange attribution and apply different exposure logic at custodial boundaries, which is where most naive implementations fail.
Related blueprints
Crypto Market Stress API
Liquidity stress, volatility regime and concentration scoring for digital assets, as a risk layer for exchanges and wallets.
AML Screening API
Sanctions, PEP and adverse media screening with entity resolution and relationship analysis, built so every hit can be explained.
Forex Technical Analysis API
Chart patterns, support and resistance levels and trade setups, delivered as a white-label research module for your trading platform.
Want this built for your platform?
Tell us what your product does today and what you want another system to be able to ask it. We will come back with an approach, a scope and a price.