Dirty Crypto: What It Means and How to Check Your Coins

What people mean by “dirty”

Every transfer on a public blockchain stays visible. So when coins come from a crime, the trail leads from that source to every wallet the coins pass through. “Dirty” (sometimes misspelled “durty”) is the everyday word for coins whose trail leads back to one of these sources:

Source	What it is
Sanctions	Addresses of people, companies or services on a government sanctions list, such as the US SDN list.
Scam	Investment scams, fake platforms, phishing.
Stolen funds	Coins taken in hacks and thefts.
Darknet market	Payments to and from illegal online markets.
Mixer	Services that pool and reshuffle coins to hide where they came from.
Ransomware	Ransom payments and the wallets that collect them.

The full list, with what each label means, is on our risk categories page.

The sums are real. Chainalysis estimates that illicit addresses received at least $154 billion in 2025, and that stablecoins made up 84% of illicit transaction volume. It also puts the illicit share of attributed on-chain volume below 1%.^[1] Most coins are not dirty — but the dirty ones end up in ordinary wallets.

Why it matters to you

You did nothing wrong by receiving coins, but their history becomes your problem in three ways.

• Exchange holds. Exchanges screen deposits. OKX says deposits can be suspended for a compliance check,^[2] and Kraken may ask for Source of Funds documents such as bank or exchange statements.^[3]
• Issuer freezes. Tether says it follows the US sanctions list and can restrict USDT in wallets linked to illicit activity.^[4] Circle’s USDC terms let it block addresses, and USDC sent to or received from a blocked address may be frozen and lose its redemption rights.^[5] See why USDT gets frozen.
• Legal risk. For US persons, OFAC says sanctions obligations are the same whether a payment is in crypto or in dollars.^[6] Dealing with a sanctioned party can be illegal whatever the amount.

“Taint”: how far dirt travels

Checkers do not only look at who sent you the coins. They follow the money back through earlier transfers. TRM Labs, for example, describes indirect exposure as a way to find wallets that may not have received illicit funds directly but are connected to them through multi-hop transfers.^[7] This is the idea people call “taint”: a wallet two or three steps away from a hack can still carry part of its history.

That is also why two checkers can give the same address different results:

• Different data. Each vendor labels addresses itself. One may already know an address belongs to a scam; another may not.
• Different maths. Vendors decide how many hops to follow and how much each category weighs. GetBlock’s docs warn that a category’s share of exposure is not the same as its contribution to the score.^[8]
• Different scales. At most services a high number means high risk; at Scorechain’s business API it means low risk.^[9]

Read the category breakdown, not just the number. More in what an AML risk score means.

How to check before you receive

1. Get the sender’s address — the exact one they will pay from — and the network (TRON, Ethereum, BNB Chain and so on).
2. Run an AML check on that address. If the coins are already on their way, you can check the transaction hash at services that support it. Compare checkers on our services page.
3. Read the breakdown. Some exposure to P2P or high-risk exchanges is common. Any share of sanctions, stolen funds or terrorism financing is a reason to decline.
4. Save the report with your chat and trade records.

Step-by-step for stablecoins: how to check USDT before receiving it.

If you already received dirty coins

1. Don’t move them around to “clean” them. Sending coins through new wallets or a mixer does not erase the trail, and it can look like you are trying to hide it. That makes an explanation harder later.
2. Don’t accept more from the same sender.
3. Keep records: the order, chat, payment receipt, the sender’s address and your AML report.
4. If an exchange holds your deposit, answer through its official support with those documents. See exchange froze your crypto.
5. If sanctions are involved or the amount is large, talk to a lawyer in your country.

Ignore anyone who contacts you offering to “clean” or “unfreeze” coins for a fee. The FBI warns that fake recovery firms take an upfront fee and disappear.^[10]

Myths

Myth	Reality
A mixer makes coins clean.	Mixer exposure is a risk category of its own. FinCEN has called international crypto mixing “a class of transactions of primary money laundering concern” and named ransomware actors and North Korea among its users.[11] When OFAC sanctioned the mixer Tornado Cash in 2022, it said the service had been used to launder more than $7 billion since 2019.[12]
A low score means the coins are safe.	A score reflects what one vendor knows today. A new address can score low because nothing is known yet; TRM, for example, marks new, unprofiled addresses as “Unknown”.[7] Labels are added over time, so an address can look worse later.
Only criminals get dirty coins.	Coins change hands many times. An ordinary P2P seller can pass on coins that were stolen several transfers earlier.
A new wallet fixes a freeze.	An issuer’s blacklist is on the address; frozen USDT cannot be moved out of it to a new wallet.[13]