How to Check if a Crypto Wallet Is Clean Before a Deal

This is an add-on module. In your dashboard open Modules and press Install module on the AML check card, and it shows up in the menu. Free with any plan.

You have agreed on a deal, and your counterparty sends a crypto wallet address. Blockchain transfers cannot be reversed, and a "dirty" address can end in frozen funds or awkward questions from an exchange. So the time to check a wallet is before the transfer. Here is what a clean wallet means, what you can see by hand and how to do it in a minute.

What "clean" really means

A perfectly clean address does not exist: every one has a history. When people call a wallet clean, they mean that neither the address nor the people it dealt with are linked to things that cause trouble:

• sanctions lists, such as OFAC: a direct match makes the deal dangerous at once;
• stablecoin blacklists: an issuer like Tether can freeze an address and the money on it gets stuck (more in Why Tether freezes addresses);
• theft, phishing and fraud: the address is flagged as a recipient of stolen funds;
• mixers and obfuscation services: not a crime in themselves, but a reason for exchanges and banks to ask questions.

Indirect exposure counts too. An address can be clean itself and still do half its volume through flagged wallets.

What to check by hand

A blockchain explorer (Tronscan, Etherscan, mempool.space and similar) shows a lot, and it makes a good first look.

1. Address age. A wallet created yesterday is suspicious for a large deal. New does not mean bad, but ask why a regular address was not used.
2. Activity pattern. One incoming transfer followed by the whole balance leaving to another address points to a pass-through wallet.
3. Main counterparties. Where the money comes from and where it goes. Well-known exchanges are usually fine. Dozens of tiny one-day addresses are a warning sign.
4. Explorer labels. Some explorers show tags such as "Phishing" or "Blacklisted". A missing tag guarantees nothing: an explorer does not know everything.
5. Balances and tokens. Odd tokens with unknown names are sometimes airdropped by scammers. You can see them, but you should not interact with them.

By hand this takes 10 to 15 minutes per address, and sanctions and stablecoin blacklists still have to be looked up separately. For regular work that is too slow.

A one-minute check

Zion Tools has the "AML check" module for this (module page). It is free on any plan and covers wallets on Tron, Bitcoin, Solana and 17 EVM networks.

1. Sign up and open Modules. On the "AML check" card press Install module.
2. Open AML check, paste the address and press Check. The network is detected automatically.
3. You get a risk score from 0 to 100 and an explanation of where each signal comes from.

The service looks at OFAC lists, Tether's blacklist and the GoPlus Security label database, and it screens the wallet's largest counterparties, showing their share of volume. Without an account you can run a few free checks in the Telegram bot. Every report also comes as a PDF, handy to attach to a deal or send to compliance.

Reading the result

• 0–34, low risk. No signals found. Normal caution; decide by the size of the deal.
• 35–64, medium risk. Indirect links, for example part of the volume with flagged addresses. Read the report details and ask the counterparty where the money comes from.
• 65–84, high risk. Serious signals. Without explanations from the counterparty, better not to go ahead.
• 85–100, severe risk. A direct match: sanctions, a Tether freeze, theft. Do not send or accept the money.

The report is built from open data and is not a legal opinion. A low score means no known problems, not a promise that none will appear later.

If you were sent a token address

Sometimes the address you get is a contract, with a pitch like "buy our token". The module recognises a token and runs a contract audit instead. The report shows whether the token can be sold after you buy it (if it can't, it is a trap for buyers known as a honeypot), the buy and sell tax, whether the owner can mint new coins or change other people's balances, whether the contract code is open, and how much of the supply sits with the ten largest holders. A tax of 10% or more is flagged as a warning, 30% or more as a danger. A token that cannot be sold gets a critical score straight away.

When to check

• Before sending money to an address a new counterparty gave you.
• Before accepting a payment from a new client, especially a large one.
• Before a P2P trade, if you sell crypto to an unfamiliar buyer.
• From time to time for regular partners: an address can change over time.

Common mistakes

• Checking after paying. Once the money has gone, a report can only confirm the problem. Check before you send money, and before you hand over goods for a payment you received.
• Checking the wrong address. Scammers send a tiny transfer from an address whose first and last characters match your partner's, hoping you will copy it from your transaction history. Take the address from your conversation with the counterparty and compare every character, the middle included.
• Mixing up networks. A Tron address starts with T, Ethereum and other EVM addresses with 0x, Bitcoin with 1, 3 or bc1. The module detects the network itself. If an address has no transactions and no balance, it says so and suggests checking whether the address belongs to another network. That attempt does not count toward the daily limit.
• Trusting someone else's report. A screenshot of a check sent by the counterparty proves nothing: it is easy to fake or to make for a different address. Run the check yourself, it costs nothing.
• Looking only at the number. The score is the summary, and the reasons are in the report details. A medium score caused by one old transfer and a medium score caused by regular mixer use mean different things, so open the list of signals and the share of volume by counterparty.

FAQ

Can I check a wallet without signing up? Yes, the Telegram bot gives a few free checks without an account. In the dashboard, checks are saved to your history.

How much does a check cost? Nothing. The module is free, with a dashboard limit of 200 checks a day.

What if the risk is high but the deal is already agreed? Ask the counterparty for another address and say the reason is the check result. An honest partner usually agrees.

Does a check guarantee safety? No. It lowers risk, but the data is open and incomplete. For very large sums, involve a lawyer or a specialist compliance service.

Check the address before your next deal

A step-by-step guide to the module itself is in How to run an AML check on a crypto wallet and audit a token. To keep checking addresses with no extra effort, sign up and install the "AML check" module. It takes a minute.