Risk Score (Address Risk Score)
Risk score is a 0-100 rating that analytics platforms (Chainalysis, TRM Labs, Elliptic, Amler) assign to a crypto address based on its transaction history. The higher the score, the higher the likelihood of a link to mixers, darknet markets, sanctions lists, or hacked exchanges. Most exchanges auto-block around 60-70; some stricter platforms block as low as 30-40.
How a Risk Score Is Calculated
A risk score isn't calculated from a single transaction — it's built from the address's entire available history and its on-chain connections, sometimes traced hundreds of "hops" back. The algorithm checks whether the address interacted, directly or indirectly, with known undesirable sources: darknet markets, mixers, sanctioned addresses from the OFAC SDN list, addresses tied to known exchange hacks, scam platforms.
What feeds into the score
Direct interaction (receiving funds straight from a darknet market or sanctioned wallet) contributes the most to the score. Indirect interaction through several intermediate addresses also raises it, but with less weight — the more hops between your address and the flagged source, the lighter that connection's contribution. Behavioural patterns matter too: rapid transfers through a chain of addresses (typical of laundering), mixer use, and interaction with platforms lacking VASP status all count.
Why honest users end up with a high score
The core paradox of risk score is that it doesn't distinguish intent — only connections. Buying USDT from a random P2P seller, you have no way to verify where their funds came from a few transactions earlier. If the seller previously received part of those coins from a compromised source, some of that taint technically carries over to you through the on-chain link, even though your own transaction was entirely legitimate.
Why Risk Score Matters for Your Crypto Security
Understanding how risk score works is the first step toward not panicking or acting blind when a freeze hits. A high score doesn't mean you're accused of a crime — it means an automated system flagged a statistical connection that needs explaining. That's why the free AML check on this site shows more than just a number: it surfaces the specific risk tags behind the result, so you can tell in advance whether a transfer to a given exchange is likely to run into trouble.
A Worked Example: When a Normal Deposit Gets Held
Consider a user who buys stablecoins from a private seller, waits a few days, and deposits them to an exchange. The deposit does not credit. Support says the transfer is under review by the compliance team. The user's own history is clean, so it is baffling. A check of the incoming address shows that the seller's wallet received funds some steps earlier from a source flagged by analytics providers, and that link pushed the transaction's score above the exchange's threshold.
From the exchange's side, an automated rule did what it was configured to do. A person then reviews the case and usually asks the user to explain where the funds came from and to provide supporting documents. The outcome depends on the evidence and on the exchange's own policy.
What a Score Does Not Tell You, and How to Respond
A common misconception is that every provider shows the same number. They do not. Each analytics company uses its own data, labels and weighting, and each exchange chooses its own thresholds and which checks to run on deposits, withdrawals or both. The same address can look fine in one tool and elevated in another, so a single reading should be treated as an indicator, not a verdict.
If a transfer is held, stay calm and respond to the compliance request promptly. Prepare proof of the purchase or the original source of funds, such as exchange statements, payment confirmations, chat history with the counterparty, and the transaction hashes involved. Avoid trying to hide the origin by sending funds through extra wallets or mixing services, because that adds suspicious patterns and usually makes a review harder. Checking an address before sending is cheaper than explaining it afterwards. If a freeze does happen, a structured source-of-funds package is the normal way to approach it, and there is no guarantee how the platform will decide.
Frequently Asked Questions
What risk score is considered safe?
Generally a score under 30 doesn't raise questions on most exchanges. The 30-60 range is a grey zone, where the outcome depends on the specific platform's threshold. Above 60-70 almost always triggers an automatic block or a request for additional documents.
Can an address's risk score be lowered?
The address's historical risk score itself can't be changed — it's based on immutable blockchain history. But you can move funds to a new, "clean" address and avoid future interaction with high-risk sources so the new address doesn't inherit a flagged history.
Why do different platforms give the same address a different score?
Chainalysis, TRM Labs, Elliptic, and other providers run their own databases and algorithms, which aren't identical. The same address can score differently across systems depending on which data sources each provider draws on for flagged activity.
Can a risk score be lowered?
The score reflects past on-chain history, so the history itself cannot be erased. What can change is how a platform treats it. A clear explanation and documents proving the legitimate origin of the funds can lead a compliance team to release a held transaction even when the automated score stays high.
Is a high risk score the same as being accused of a crime?
No. It is an automated statistical signal about an address's connections, not a legal finding about its owner. It prompts a review, and many cases end with the funds released once the source is explained.