Risk categories: Mixer/Darknet/Sanctioned/Scam — what each means
A complete taxonomy of crypto address risk categories: Exchange, Mixer, Darknet, Sanctioned, Scam, Gambling, Mining pool, DeFi. What each label means and how to respond.
AML checkers flag addresses with dozens of categories. What they mean and which are actually dangerous — let's break down each one.
Full label taxonomy
Exchange — exchange (safe)
The address belongs to a centralized exchange (CEX: Binance, Coinbase, Kraken) or DEX (Uniswap, SushiSwap). Severity: info (5).
This is a normal counterparty for P2P — exchanges go through KYC and comply with AML. Receiving from an exchange is safe.
Mixer / Tumbler — mixer (dangerous)
A crypto mixer address (Tornado Cash, Blender, ChipMixer) or a wallet that received funds from one. Severity: warning/danger (25-55).
Mixers are used for laundering — funds are mixed, hiding their origin. Exchanges automatically block deposits from mixers.
Darknet market — darknet market (dangerous)
Address of a darknet marketplace (Hydra, Silk Road, Empire). Severity: danger (55).
Association with such addresses is almost guaranteed to result in a block. Goods on darknet markets: drugs, weapons, stolen data.
Sanctioned — sanctions (critical)
Address on OFAC SDN or EU consolidated. Severity: critical (90).
Details: What is OFAC SDN.
Scam / Phishing / Honeypot — fraud (dangerous)
- Phishing — address of a phishing site stealing keys.
- Honeypot — smart contract from which you cannot withdraw funds.
- Drainer — wallet-drainer address (signature attacks).
Severity: warning (25). Sources: eth-labels, GoPlus (coverage — EVM chains; no reliable bulk scam-address lists exist for BTC/TRON yet).
Gambling — gambling (neutral)
Address of a gambling platform (Stake.com, casino). Severity: info (5).
Legal in most jurisdictions, but in some regions may attract bank attention for large volumes.
Mining pool — mining pool (neutral)
Address of a mining pool (Foundry USA, F2Pool). Severity: info (5).
Receiving mining payouts is safe — these are honestly mined coins.
DeFi protocol — DeFi protocol (neutral)
Address of a DeFi smart contract (Uniswap, Aave, Compound). Severity: info (5).
Interacting with DeFi is normal crypto activity.
Token contract — token contract (neutral)
Address of an ERC-20/BEP-20 token (USDT, USDC, UNI). Severity: info (5).
Checking a token contract only makes sense for honeypot/is_blacklisted flags via GoPlus.
P2P exchange — P2P exchange (neutral)
Address linked to a P2P service (Paxful, LocalBitcoins). Severity: info (5).
Ransomware — extortion (dangerous)
Address used in a ransomware attack (WannaCry, Ryuk). Severity: danger (55).
Theft / Hack — hack (dangerous)
Address to which funds were drained after an exchange/DeFi hack. Severity: danger (55).
Severity table
| Category | Severity | Score | Danger |
|---|---|---|---|
| Sanctioned | critical | 90+ | 🚫 Critical |
| Darknet, Theft, Ransomware | danger | 55 | 🔴 High |
| Mixer, Scam | warning | 25 | 🟠 Medium |
| Exchange, DeFi, Mining, Token | info | 5 | 🟢 Low |
Related materials
Categories are labels from open databases. VerifAML aggregates them from many sources, and the database keeps expanding.