Crypto risk score explained: what a wallet risk score actually measures

A crypto risk score is a signal about an address or a transaction. It is not a verdict about a person, and it was never designed to be used as one.

What goes into a wallet risk score

Every score starts from public chain history: the age of the address, the shape of its funding graph, how many hops separate it from a known sanctioned or exploited cluster, the mix of contracts it interacts with, and how its behaviour compares to addresses that later turned out to be involved in theft or laundering.

None of those inputs is decisive on its own. A new address is not suspicious because it is new — every address was new once, and legitimate users create fresh addresses constantly for perfectly good privacy reasons. Proximity to a bad cluster matters far less at four hops than at one, because in an active network almost everything eventually connects to almost everything. The model's job is to weigh these together and report how confident it is.

Why hop distance dominates

If you take one thing from this post, take this. Exposure is a gradient, not a boolean. Direct receipt from a sanctioned address is a fact about your counterparty. A five-hop path to the same address is a fact about the network's connectivity. Systems that collapse both into "has exposure" generate enormous noise and teach analysts to ignore the output — which we cover in cutting AML false positives.

What a crypto risk score returns

Every response carries three things, and reading only the first is the most common mistake integrators make:

• a score between 0 and 100;
• a confidence band, which widens when the address has thin history;
• the contributing factors, so a human can see why the score moved.

{
  "address": "0x…",
  "score": 72,
  "confidence": "medium",
  "factors": ["proximity:2-hop", "funding-mix:mixer", "age:14d"]
}

A score of 72 with low confidence and a score of 72 with high confidence are not the same finding, and should not trigger the same action.

How to read the bands

Score	Confidence	Reasonable action
High	High	Block or hold. The evidence supports a decision
High	Low	Review, do not auto-block. Thin history inflates volatility
Low	High	Proceed, and record the basis
Low	Low	Proceed with a tighter re-screening interval. Absence of evidence is not evidence of absence

That bottom row is the one firms most often get wrong. A brand-new address with no exposure scores low, and it scores low because there is nothing to see yet — not because it has been examined and cleared.

Why a wallet risk score changes

A score is not a property of an address; it is a property of an address at a point in time. It changes when new flow arrives, when an analytics provider publishes a new attribution on a cluster the address touches, when a counterparty is designated, or when the model itself is retrained. Any of these can move a score without the address doing anything at all.

The operational consequence is that a score you cached last week is not a screening result today. We set out the caching rules that follow from this in integrating a wallet screening API.

What a risk score should not be used for

A score is an input to a policy you own, not a policy in itself. It should not be the sole basis for freezing funds, closing an account, or reporting a person. Set thresholds against your own risk appetite, log the factors alongside the decision, and keep a human review path for anything consequential.

There is a legal dimension here too, not only an ethical one. Where an automated process produces a consequential outcome for an individual, they are frequently entitled to an explanation and to human review — which is why our privacy policy commits to exactly that. A vendor score presented as a determination of wrongdoing is a compliance risk in its own right.

We publish the factor list precisely so that a decision made with our score can be explained after the fact — by you, to your regulator, without us in the room.