Crypto Wallet Risk Score: How It's Calculated
A crypto wallet risk score is a number, usually on a 0–100 scale, that summarizes how much of a wallet's activity is linked to illicit or high-risk sources such as sanctioned entities, mixers, darknet markets and scams. It is calculated from exposure: which risky entities the wallet transacted with, how directly, how much of its flow they represent and how recently it happened. The score is only useful for compliance if every point in it can be traced back to a specific transaction and source.
This article breaks down the inputs, explains why two wallets with the same score can need very different handling, and shows how to turn scores into internal thresholds and actions.
Exposure categories
Every scoring method starts by attributing counterparties to categories. Addresses are labeled using blockchain analytics data, sanctions lists, clustering and open-source intelligence. The main categories and why they matter:
| Category | What it covers | Why it matters |
|---|---|---|
| Sanctions | Addresses on OFAC and other sanctions lists, and entities controlled by sanctioned parties | Legal prohibition in many jurisdictions; usually the highest severity |
| Mixers | Services that pool and redistribute funds to break the on-chain trail | Common layering tool; some mixers are themselves sanctioned |
| Darknet markets | Marketplaces selling drugs, stolen data and other illegal goods | Direct proceeds of crime |
| Scams and fraud | Phishing, investment scams, fake platforms | Funds belong to victims; frequent cause of exchange and issuer freezes |
| Stolen funds | Proceeds of hacks and exploits | Actively traced by investigators, often frozen downstream |
| Gambling | Online casinos and betting services | Legal in some jurisdictions and not in others; risk depends on your policy and licensing |
Category alone does not decide the score. A wallet that touched a gambling site is not the same as a wallet funded by a darknet market, but a wallet that once received a few dollars from a darknet market is also not the same as one that receives its whole income from it.
The four factors that shape a score
Direct vs indirect exposure
Direct exposure means the wallet sent funds to, or received funds from, a risky address with no intermediaries. Indirect exposure means the risky funds arrived through one or more hops. Direct contact weighs more. Indirect exposure weakens with each hop, because at some point nearly every wallet is connected to something bad if you go back far enough.
Share of flow vs single touch
The share of a wallet's total volume that comes from or goes to risky sources matters more than the fact that a touch happened. This is especially important for exchanges and payment processors. A large exchange hot wallet will always have some contact with risky addresses because thousands of users deposit into it. Rating it as high risk for one tainted deposit would make the score useless. For these entities, the level should depend on what share of the flow is risky.
Dust
Attackers and spammers send tiny amounts, called dust, to large numbers of addresses. Sometimes this is address poisoning, sometimes just noise. Receiving dust is not something the wallet owner chose, so it should not drive the score up as if it were real business with a risky party.
Recency
Exposure from last week tells you more about the current owner and current activity than exposure from four years ago. Recent direct contact with a sanctioned entity is a much stronger signal than an old, small, indirect link.
Why a bare percentage is not enough
Many screening results look like this: "Risk: 67%. Exposure: scam 12%, gambling 4%." That is a starting point, not a compliance record. When a regulator, auditor or a bank partner asks why you accepted or rejected a customer, you need to show:
- which addresses carried the risk and how they were attributed;
- the specific transactions that connect the wallet to them, with hashes and timestamps;
- how many hops separate the wallet from the risky source;
- which data source produced each label, and whether other sources agree;
- how the score was calculated from those facts.
Without that, an analyst cannot challenge the result, and you cannot defend the decision. A score you cannot explain also cannot be checked for errors. Attribution data is sometimes wrong, and different providers can disagree on the same address. Cross-checking several sources and keeping the evidence is the only way to catch that.
Deterministic scoring vs model-generated opinions
AI is useful for investigation. It can follow funds across hops, decide which tools to call next and spot patterns a fixed rule set would miss. It is not a good place to produce the final number. A language model can give a different answer to the same question on a different day, and it can produce a confident explanation that is not backed by data.
For compliance, the score should be deterministic: the same input data always gives the same score, and the score can be broken down into components. That is how Cryptic AI handles it. An AI agent investigates the wallet, choosing tools and cross-checking data from Chainalysis, Global Ledger, Breadcrumbs, its own attribution database, BTC clustering, OFAC sanctions data and OSINT. Every risk factor it reports must carry evidence: a transaction, a source and a timestamp. Factors without evidence are rejected. The final 0–100 score is then calculated by a rules engine, not by the model.
Some of the rules in that engine:
- A sanctioned address itself scores no lower than 90.
- Direct contact with a sanctioned entity of $1,000 or more within the last 30 days sets the score to no lower than 90.
- Dust under $10 does not inflate the score: it takes minus 20 points and drops one level.
- For exchanges, the level depends on the share of risky flow, not on a single touch.
Behavioral signals sit next to exposure. Evenly spaced transfers, amounts just under $10,000, $5,000, $3,000 or $1,000 (a sign of structuring), a high share of round amounts and unusual activity hours are all things an analyst should see, alongside the counterparties.
Setting internal thresholds
A score only becomes a control when you decide in advance what each band means. A workable starting point, based on how Cryptic AI maps scores to suspicious transaction report (STR) recommendations:
| Band | Conditions | Recommended action |
|---|---|---|
| Low | Score below 40, no sanctions exposure, no direct darknet contact | Accept; no report. Keep the screening record. |
| Review | Score 40–69 without sanctions or direct darknet/ransomware contact | Manual review by an analyst; request source-of-funds information if needed |
| High | Score 70 or higher, or any sanctions exposure, or direct darknet or ransomware contact | Hold funds, escalate to the MLRO, prepare a report |
Note that the high band is not only a number. Any sanctions exposure or direct darknet or ransomware contact sends the case to the high band regardless of the score. That protects you against a scoring edge case hiding a hard rule.
When you set your own thresholds, consider:
- Your risk appetite and licensing. A licensed exchange in a strict jurisdiction may push the review band lower. A gambling-friendly platform may treat gambling exposure differently.
- Customer type. Retail users, OTC clients and other VASPs warrant different thresholds.
- Direction. Incoming funds and outgoing payments carry different risks. Sending to a sanctioned address is a different problem from receiving from one.
- Review capacity. If your review band produces more cases than your team can handle, analysts start clicking "approve". Tune it so reviews stay real.
- Documentation. Write the thresholds and the reasoning into your AML policy, and review them on a schedule.
FAQ
How is a crypto risk score calculated?
From exposure to risky categories (sanctions, mixers, darknet, scams, stolen funds, gambling), weighted by how direct the link is, what share of flow it represents, whether it is dust and how recent it is. In a deterministic engine, fixed rules turn those facts into a 0–100 score.
Is a high risk score proof of money laundering?
No. It is a signal that needs review. The evidence behind the score, not the number itself, is what an analyst uses to decide.
Why do different tools give the same wallet different scores?
They use different attribution data, count hops differently and weigh factors differently. That is why a score should come with the transactions and sources behind it.
Should a score ever be overridden?
Yes, by an analyst with a documented reason. The override and the reason belong in the case file.
Scores you can defend
A crypto wallet risk score is worth something when you can show where every point came from. If you want scores that come with a transaction, source and timestamp for each factor, and that export to PDF with a link graph, fund flows and a transaction appendix, see Cryptic AI KYT. For filing the reports that high-band cases lead to, see reporting.