Crypto Address Lookup

Look up any blockchain address to get labels, sanctions status, risk scoring, and address classification across 18 supported chains.

1. What is Crypto Address Lookup?

The Crypto Lookup module lets you query any blockchain address and receive threat intelligence data: known labels, OFAC sanctions status, risk scoring, and address type classification (EOA, contract, etc.).

It combines static intelligence databases, community labels, live enrichment from on-chain data, and sanctions lists to provide a comprehensive risk profile.

• Labels - known identities from community, Arkham, and internal databases
• Sanctions - OFAC SDN list with authority and listing date
• Risk Score - 0–100 score with a band (clean, suspect, high, critical) and every reason behind it
• Address Type - EOA, contract, or unknown
• Categories - exchange, DeFi, bridge, mixer, scam, sanctioned, etc.

2. How to look up an address

From the search bar

Paste any blockchain address directly into the mlab search bar. EVM (0x...), Bitcoin (1.../3.../bc1...), and Tron (T...) addresses are automatically detected and routed to the crypto lookup page.

From the API

Use GET /api/v1/scan/crypto?address=...&chain=... with your API key. See the API documentation for full details.

From the MCP integration

Use the scan_crypto tool from any connected AI assistant. See the MCP documentation.

How the chain is determined

mlab identifies the address family by decoding the address, not by matching its shape. Bitcoin, Dogecoin and Tron addresses are base58check: they carry a version byte that names the chain outright, behind a checksum that is verified on the way. Bitcoin segwit and taproot carry their own bech32 checksum, TON ends in a CRC16, and Solana is identified by exclusion.

Every response says where the chain came from, in chain_source:

Address checksums

address_info.checksum reports what the checksum told us, in four states rather than a pass/fail:

Neither absent nor unverifiable is a pass.

3. Supported chains

Every chain below is reachable from the search bar, the web module, the REST API and the MCP tool.

Looking up several addresses at once

POST /api/v1/scan/crypto takes up to 100 addresses in one request, for a list pulled out of a ransom note, a dump or a report.

curl -X POST "https://mlab.sh/api/v1/scan/crypto" \
  -H "Authorization: token mlab_..." \
  -H "Content-Type: application/json" \
  -d '{"addresses": ["1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa", "TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t"], "chain": "BSC"}'

chain is optional and applies to the whole batch, which is what you want for a list of EVM addresses. Each address is metered separately; anything the daily quota did not reach comes back under deferred rather than as an error, and an address whose upstream call failed carries error: upstream_unavailable instead of a verdict. Batch lookups require an authenticated caller.

4. Risk scoring

Each address gets a score from 0 to 100, with the reasons that produced it. The bands are the same as for the email and URL lookups.

How the score is built

The heaviest signal wins; signals are not added up. An address that is both a mixer and sanctioned scores as sanctioned.

Exchanges, DeFi protocols, NFT marketplaces, multisigs and plain wallets or contracts carry no weight.

Not enough data is not clean

conclusive is false when the address is on none of our sanctions or label lists. The score is then 0, but it means unknown, never safe: the page reads Not enough data instead of a green 0. Alert on band only when conclusive is true.

When the chain had to be guessed (chain_source: default), the page says so next to the score, since a wrong chain returns no labels.

In the API

The REST API, the MCP integration and exports return the same block:

"score": {
  "value": 100,
  "band": "critical",
  "conclusive": true,
  "reasons": [
    { "code": "crypto.sanctioned", "weight": 100, "label": "Sanctioned by OFAC" }
  ]
}

Reason codes are stable and safe to alert on; labels are for display and may change. The upstream intel.risk_score is still returned unchanged, beside it.

5. Data sources

Intelligence layers

• Static data - curated labels for major exchanges, DeFi protocols, mixers, and bridges
• Community labels - ~83k labeled Ethereum addresses from the community
• Darklist - known phishing and scam addresses
• OFAC SDN - 651 sanctioned crypto addresses, updated daily
• Arkham Intel - live enrichment with on-demand lookups, cached locally

Address type detection

• EVM chains - uses eth_getCode to distinguish EOA from contract
• Bitcoin / Dogecoin - prefix-based detection
• Solana - RPC account lookup
• Tron - API-based detection
• TON - API-based detection

6. Daily quotas

Crypto lookups share your organization's daily quota, which resets every 24 hours.