How to read a crypto address report

What the report is built from

Every transaction on Bitcoin and on EVM chains such as Ethereum is public and permanent. An address report reads that history and summarises it: how much the address has received and sent, when it was first and last active, who it transacted with, and whether any of those counterparties carries a known label: an exchange, a bridge, a sanctioned entity.

What the chain does not record is identity. An address is derived from a key, and nothing on-chain says who holds that key. Everything a report says about ownership is an inference, and a good report tells you where each inference comes from.

Balances, totals and activity

• Balance is what the address can spend now. On Bitcoin it is the sum of its unspent outputs; on EVM chains it is the native coin balance plus token balances.
• Total received and sent show throughput. High throughput with a small balance usually means a service address that forwards funds, such as an exchange deposit address.
• Transaction count, first and last seen show how established the address is. A brand-new address receiving a large sum is not suspicious in itself, but it is context.

Counterparties and flows

The counterparty table lists the addresses that sent funds here and received funds from here, ranked by value. The flow graph draws the same thing: inflows on one side, outflows on the other, sized by amount. Opening a counterparty opens its own report, which is how an investigation moves hop by hop.

Labels

Labels come from sources of very different quality. Sanctions labels come from the US Treasury’s OFAC list and are authoritative for what they cover. Curated labels (well-known exchange wallets, bridges, protocol contracts) are researched but can go out of date. Explorer and community tags vary. A good report shows the source of every label, and ours does.

The absence of a label means nothing. Most addresses belong to ordinary people and carry no label, and sanctioned groups control far more addresses than any list contains.

Clustering and change

On Bitcoin, the common-input-ownership heuristic assumes that inputs spent together in one transaction belong to the same owner, because the spender needed the keys for all of them. Chaining that assumption groups addresses into a likely wallet cluster. It holds well for ordinary wallets and fails for CoinJoin transactions, where many people deliberately combine their inputs; reports should detect and exclude those.

Wallets also send the leftover amount of a payment back to themselves as change. Guessing which output is the change (by address type, round amounts or reuse) helps follow funds, but it is probabilistic.

Risk scores

A risk score condenses the factors a compliance analyst would look at: direct or indirect exposure to sanctioned addresses, mixers, scams or hacks; unusual patterns such as rapid pass-through or peeling chains; and how much of the activity can be attributed at all. Read the factors, not just the number. A high score because an address once received dust from a flagged address is not the same as a high score because it sends everything straight to a mixer.

EVM addresses

• An address is either an externally owned account (a wallet controlled by a key) or a contract. Contracts can hold funds and move them according to their code; the report shows which it is.
• Token movements are events emitted by token contracts, so tokens appear as transfers separate from the native coin. Fake tokens can emit transfers that look real. See address poisoning.
• The same address exists on every EVM chain, but its history on each chain is separate. Check the chains that matter to you.