Crypto Address Lookup

Look up any blockchain address to get labels, sanctions status, risk scoring, and address classification across 18 supported chains.

1. What is Crypto Address Lookup?

The Crypto Lookup module lets you query any blockchain address and receive threat intelligence data: known labels, OFAC sanctions status, risk scoring, and address type classification (EOA, contract, etc.).

It combines static intelligence databases, community labels, live enrichment from on-chain data, and sanctions lists to provide a comprehensive risk profile.

• Labels - known identities from community, Arkham, and internal databases
• Sanctions - OFAC SDN list with authority and listing date
• Risk Score - 0–100 composite score with level (low, medium, high, critical)
• Address Type - EOA, contract, or unknown
• Categories - exchange, DeFi, bridge, mixer, scam, sanctioned, etc.

2. How to look up an address

From the search bar

Paste any blockchain address directly into the mlab search bar. EVM (0x...), Bitcoin (1.../3.../bc1...), and Tron (T...) addresses are automatically detected and routed to the crypto lookup page.

From the API

Use GET /api/v1/scan/crypto?address=...&chain=... with your API key. See the API documentation for full details.

From the MCP integration

Use the scan_crypto tool from any connected AI assistant. See the MCP documentation.

How the chain is determined

mlab identifies the address family by decoding the address, not by matching its shape. Bitcoin, Dogecoin and Tron addresses are base58check: they carry a version byte that names the chain outright, behind a checksum that is verified on the way. Bitcoin segwit and taproot carry their own bech32 checksum, TON ends in a CRC16, and Solana is identified by exclusion.

Every response says where the chain came from, in chain_source:

Address checksums

address_info.checksum reports what the checksum told us, in four states rather than a pass/fail:

Neither absent nor unverifiable is a pass.

3. Supported chains

Every chain below is reachable from the search bar, the web module, the REST API and the MCP tool.

Looking up several addresses at once

POST /api/v1/scan/crypto takes up to 100 addresses in one request, for a list pulled out of a ransom note, a dump or a report.

curl -X POST "https://mlab.sh/api/v1/scan/crypto" \
  -H "Authorization: token mlab_..." \
  -H "Content-Type: application/json" \
  -d '{"addresses": ["1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa", "TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t"], "chain": "BSC"}'

chain is optional and applies to the whole batch, which is what you want for a list of EVM addresses. Each address is metered separately; anything the daily quota did not reach comes back under deferred rather than as an error, and an address whose upstream call failed carries error: upstream_unavailable instead of a verdict. Batch lookups require an authenticated caller.

4. Risk scoring

Each address receives a risk score from 0 to 100 based on its categories, labels, and sanctions status. The score is broken down into four levels to help triage decisions.

Category risk weights

Categories directly influence the risk score:

5. Data sources

Intelligence layers

• Static data - curated labels for major exchanges, DeFi protocols, mixers, and bridges
• Community labels - ~83k labeled Ethereum addresses from the community
• Darklist - known phishing and scam addresses
• OFAC SDN - 651 sanctioned crypto addresses, updated daily
• Arkham Intel - live enrichment with on-demand lookups, cached locally

Address type detection

• EVM chains - uses eth_getCode to distinguish EOA from contract
• Bitcoin / Dogecoin - prefix-based detection
• Solana - RPC account lookup
• Tron - API-based detection
• TON - API-based detection

6. Daily quotas

Crypto lookups share your organization's daily quota, which resets every 24 hours.