How to Read an Address on Etherscan and Tronscan

An explorer page tells you what an address did: who funded it, what it sent and received, and whether the explorer has tagged it. It does not tell you where those coins came from several hops back, and that is what exchanges check. Read the page first, then run an AML check on the same address before you accept funds.

Wallet or contract

Start with what kind of address it is. On Ethereum there are two account types. An externally-owned account is controlled by whoever holds its private key and can start transactions. A contract account is controlled by its code, not by a key, and cannot start a transaction on its own.^[1]

TRON works the same way. Contract accounts are controlled by deployed bytecode and access rules rather than a private key, and they can hold TRX and tokens like any other address.^[2]

Why it matters: if a P2P counterparty says "send to my wallet" and the address is a contract, ask why. It may be a legitimate service, or it may be something you do not understand.

History: the first and the last transactions

Look at how old the address is and how it was funded.

• First funding. Etherscan has a "Funded By" record. Its documentation says it returns the address and transaction that first funded an externally-owned account, and that it is not available for contracts.^[3] If the first ETH came from a known exchange, that is one picture. If it came from an unlabelled address that itself appeared yesterday, that is another.
• Activation on TRON. A new TRON address is not visible to explorers until it is activated. Someone has to send it TRX or a TRC-10 token, or a contract has to do so.^[2] The activating transfer is the TRON equivalent of "funded by".
• Last activity. A wallet that was empty for months and suddenly moves large amounts is not proof of anything. It is a reason to look closer.

Three tabs, not one

On Etherscan the main list shows only ordinary transactions. Two other kinds of movement live on separate tabs.

• Token transfers. ERC-20 and ERC-721 movements appear under their own token tabs.^[4] USDT and USDC are ERC-20 tokens: a token contract keeps the balances, so a USDT payment is a token transfer, not an ETH transaction.^[5]
• Internal transactions. These are ETH transfers that pass through a smart contract. Etherscan lists them under "Internal Txns".^[4] MetaMask says it does not show them in your activity, although they count toward your balance.^[6]

If you only read the first tab, you can miss most of what an address does. A wallet that "never received anything" may have received millions in USDT on the token tab.

Name tags, labels and warnings

Etherscan uses public name tags to show who owns an address or what a contract is for. Its curators assign them. For a personal wallet, a tag appears only after the owner has publicly declared the address. Labels group addresses into categories, and public notes can carry warnings. Anyone can suggest a tag, and owners can ask for a wrong one to be removed.^[7]

Tronscan says it can mark scam and phishing addresses based on reports from users, to warn others.^[8]

Treat both as useful but incomplete. A warning tag is a strong signal. The absence of a tag means only that nobody tagged that address. A new scam wallet may have no label at all.

Token approvals

An approval lets another address spend your tokens later. On ERC-20, approve sets an amount a third party may spend, and allowance shows how much is left.^[5] Etherscan's approval checker lists the contracts approved to spend an address's tokens.^[9] Tronscan has a list of approvals on the account page, with a change history and a way to cancel them.^[10]

You should check approvals on your own wallet, not the sender's. A payer never needs an approval from you to send you funds. For more, see our post on token approvals and wallet drainers.

TRON resources: energy and bandwidth

On TRON a Tronscan page also shows resources. Bandwidth pays for the size of a transaction. Energy pays for running smart contracts, and a USDT TRC-20 transfer is a contract call. Every activated account gets 600 free bandwidth that refills over 24 hours. Energy has no free quota: you stake TRX, receive delegated energy, or the network burns TRX to cover the cost.^[11]

Resources say nothing about the source of funds. They explain fees. A sender who insists you must "buy energy" from a specific person before a payment can arrive is a warning sign, not a technical requirement. Even cancelling an approval costs bandwidth and energy.^[10]

What an explorer cannot tell you

An explorer shows one address and its direct counterparties on one chain. An AML check does a different job:

• Indirect exposure. Coins can reach a clean-looking address two, five or ten hops after a hack, a scam or a sanctioned wallet. An explorer shows only the last hop. A checker scores the path. See what an AML risk score means.
• Clustering. AML tools can group many addresses that belong to one service. An explorer tag covers a single address.
• Cross-chain history. Funds bridged or swapped from another network have no history on the new chain in the explorer.
• Freeze risk. An explorer does not tell you whether a stablecoin issuer is likely to freeze an address. Our freeze tracker lists known cases.

An explorer is the right tool for "did this payment arrive and from where". It is the wrong tool for "will my exchange accept these coins".

What to do

1. Identify the address type. Wallet or contract. If it is a contract and you were told it is a wallet, stop and ask.
2. Check age and first funding. Look at the "Funded By" record on Etherscan or the activating transfer on Tronscan.
3. Open every tab. Transactions, token transfers and internal transactions.
4. Read tags and notes. Take any warning seriously. Do not read "no tag" as "clean".
5. Run an AML check on the same address before you accept the funds. Our guide on checking USDT before you receive it walks through it.
6. Ignore pressure about energy or "activation fees". You do not have to pay a stranger for a payment to reach you.
7. Keep the transaction hash and screenshots. They help if an exchange later asks where the coins came from.

This is not legal advice. To compare tools that score indirect exposure, see the service comparison.