RU

AML check on Ethereum

How to check an Ethereum address (including USDT and USDC on ERC-20) for AML risk, which checkers cover Ethereum, and the risks that come up most.

Address format0x followed by 40 hexadecimal characters0x71c2a9e0f4d8b3e6c5a1f09d7e2b4c8a6d3e9f10Example for illustration, not a real address.
Note

The same 0x address format is used on BNB Chain, Polygon, Arbitrum and other EVM networks. Make sure the service checks the network the funds actually moved on.

Services that check Ethereum

01ChainalysisEnterprise platformPrice on requestSupportedNot scored
02EllipticEnterprise platformPrice on requestSupportedNot scored
03Crystal IntelligenceEnterprise platformPrice on requestSupportedNot scored
04TRM LabsEnterprise platformPrice on requestSupportedNot scored
05BitOKTelegram botfrom $0.35 per checkSupported8.5
06ShardUse with careWeb app290 ₽ for 10 checks, down to 15 ₽ a check in a 1,000-check packSupported8.1
07MistTrackWeb appAPI from $0.20 per checkSupported7.9
08MetaSleuthWeb appFree web app · paid plans from $30/monthSupported7.6
09Quppy AML BotUse with careTelegram bot5 USDT for 11 checks, down to 0.23 USDT a checkSupported7.5
10Phalcon ComplianceEnterprise platformFree plan (3 checks a month) · credit packs $1.10–$1.90 a checkSupported6.4
11USDTBanListUse with careWeb appFree basic check · paid AML check $1.50Supported6.4
12Cryptomus AML CheckerUse with careWeb app4.4 USDT for 10 checks, down to 0.40 USDT a checkSupported6.3
13PublicAMLUse with careWeb appFreeSupported6.2
14AMLCryptoTelegram bot$0.39–$1.00 per checkSupported6.1
15AnChain.AI Data APIAPI for businessAddress score $0.08–$0.10 in credit packs from $1,000Supported6.1
16GetBlock Crypto AMLWeb appFrom about $0.50 a check, prepaid creditsSupported6.1
17BestChange AML checkAggregator$0.50–$2.00 per checkSupportedNot scored
18Scorechain BotTelegram botPay per use, prices not publishedSupportedNot scored
19BitraceAPI for businessPrice on requestSupportedNot scored
20Merkle ScienceEnterprise platformPrice on requestSupportedNot scored
21Sumsub Crypto MonitoringEnterprise platformPrice on requestSupportedNot scored
22WebacyUse with careAPI for businessPrices shown after sign-inSupportedNot scored
23BitHide AML CheckUse with careTelegram botFirst check free, prices not publishedSupportedNot scored
24CoinKYTTelegram botNot published (resold on BestChange at $0.50)SupportedNot scored
25Scorechain AIWeb app€75 for 35 credits, down to €1.00 a checkNot verifiedNot scored
26AMLBotTelegram botPrices shown after sign-upNot verifiedNot scored
27Match SystemsUse with careAPI for businessAPI from $0.08 per check (volume)Not verifiedNot scored

For companies: screening tools that list Ethereum

Enterprise KYT and wallet-screening platforms for exchanges, payment firms and other businesses. Prices are on request and they are not part of our score. “Screening” means the provider’s own page lists Ethereum for screening or monitoring; “Not verified” means it is listed only for investigations or without detail. Compare business tools →

01Global Ledger[1]KYT (Know Your Transaction: transaction screening / real-time risk scoring); also KYB and Vision (investigations platform)Quote on requestScreening

How to check an Ethereum address

  1. Get the public addressAsk your counterparty for the address they will send from — or copy it from the incoming transaction.
  2. Pick a service that covers EthereumChoose one marked “Supported” in the list above. Choose Ethereum, not another EVM network, if the funds moved on Ethereum mainnet.
  3. Run the check and read itFor USDT or USDC, the address check covers the token history too — the token contract is not what you paste.
A real AML check needs only a public address. Never share a seed phrase or private key.

Ethereum specifics

  • An Ethereum address is 0x plus 40 hexadecimal characters. Mixed upper and lower case is an optional checksum (EIP-55): an all-lowercase address is still valid but carries no typo protection.[2]
  • TRM Labs attributed 24% of illicit crypto volume in 2024 to Ethereum.[3]

Who can freeze funds on Ethereum

  • The USDT contract on Ethereum (TetherToken) includes owner-only functions to blacklist an address and to destroy the USDT balance held by a blacklisted address.[4]
  • Tether's terms list blacklisting an address that holds Tether tokens among the actions it may take, alongside freezing tokens and reporting to authorities without notice.[5]
  • Circle's USDC terms say Circle can block USDC transfers to and from an address on-chain under its blocklisting policy. Circle may also freeze USDC sent to or from a blocked address.[6]
  • In Circle's open-source USDC contract design, a blacklisted address cannot transfer, mint or burn tokens, and only the 'blacklister' role can add addresses to the blacklist.[7]
  • Ethereum itself has no undo button. ethereum.org says a transaction sent on Ethereum is irreversible.[8]

Scams seen on Ethereum

  • Address poisoning: attackers create addresses that match the first and last characters of one you use, then send tiny or zero-value transfers so the fake address appears in your history, hoping you copy it next time.[9]
  • Chainalysis reports that in May 2024 one Ethereum user sent about $68 million in WBTC to a lookalike address in an address poisoning scam. The funds were later returned.[10]
  • Approval phishing tricks you into signing a token approval that lets a scammer's contract move your tokens. Chainalysis notes that dApps on Ethereum routinely ask for such approvals, which is what the scam abuses.[11]
  • Chainalysis reports that most crypto drainers, phishing kits that empty a wallet once you sign, operate in the Ethereum ecosystem.[12]
  • Fake airdrops are common: a scam project sends a token or NFT to your wallet to lure you to a malicious site. There is also no 'ETH2' token; offers to swap into one are scams.[8]

Check the history yourself

  • You can review and cancel token approvals yourself. ethereum.org lists Etherscan and Blockscout for Ethereum, and Revoke, Unrekt and EverRevoke for several networks. Revoking is an on-chain transaction, so it costs a network fee.[13]
  • ethereum.org recommends never giving a project unlimited access to your tokens and revoking allowances regularly.[13]
  • Etherscan's Address Highlight feature marks matching addresses in a transaction list, which helps you spot a lookalike address planted by address poisoning.[9]

Sanctions and enforcement cases

  • On 2022-08-08 OFAC sanctioned Tornado Cash, a mixer running on Ethereum, saying it had been used to launder more than $7 billion since 2019, including over $455 million stolen by the Lazarus Group.[14]
  • On 2024-11-26 the U.S. Court of Appeals for the Fifth Circuit ruled in Van Loon v. Department of the Treasury that Tornado Cash's immutable smart contracts are not property that OFAC could block. It reversed the lower court and sent the case back.[15]
  • On 2025-03-21 Treasury announced it had removed the sanctions on Tornado Cash. Older reports may still show Tornado Cash addresses as sanctioned.[16]
  • On 2022-04-14 OFAC added an Ethereum address to the Lazarus Group's entry on the SDN sanctions list.[17]
  • The FBI attributed the theft of about $1.5 billion from the exchange Bybit (around 2025-02-21) to North Korean 'TraderTraitor' actors. It published Ethereum addresses used to launder the funds and asked exchanges, bridges and node operators to block transactions linked to them.[18]

In numbers

  • Chainalysis reports that, measured per 100,000 active personal wallets, Ethereum and TRON had the highest rates of theft in 2025.[19]
  • Etherscan, citing a 2025 USENIX Security study, reports about 17 million address-poisoning attempts against about 1.3 million Ethereum users between July 2022 and June 2024, with losses of at least $79.3 million.[9]

Common risks on Ethereum

ScamHighMoney taken through fake investments, phishing, impersonation and similar deception.Stolen fundsHighCoins taken in hacks of exchanges, protocols or personal wallets.MixerHighServices that pool and reshuffle coins to break the link between sender and receiver.SanctionsHighAddresses on government sanctions lists or owned by listed entities.High-risk exchangeMediumExchanges with weak or no customer checks.DeFi protocolLowEstablished on-chain lending, swaps and liquidity pools.

FAQ

Is an Ethereum address the same on BNB Chain or Polygon?

The format is the same, so one 0x string can exist on several EVM networks with different histories. Pick the network where the transfer happened.

Can USDT on Ethereum be frozen?

Yes. Tether can restrict USDT at specific addresses, including on Ethereum. See the USDT ERC-20 page for the issuer’s policy.

Is Tornado Cash still sanctioned?

No. Treasury removed the sanctions on Tornado Cash on 21 March 2025. Separately, in November 2024 a federal appeals court ruled that its immutable smart contracts could not be blocked as property. Exchanges may still treat mixer history as a risk factor.

Someone sent me a zero-value token transfer from an address that looks like mine. What is it?

Probably address poisoning. The sender hopes you will copy the lookalike address from your history next time. Always copy the recipient from a trusted source and compare the full address, not just the first and last characters.

How do I remove an old token approval on Ethereum?

Open a token approval tool such as Etherscan's or Revoke, connect your wallet, and revoke the approvals you no longer need. Each revoke is a transaction, so you pay a small network fee.

How do I check a Ethereum address for AML risk?

Copy the public address, open one of the services listed above that supports Ethereum, and run the check. You never need a seed phrase or private key.

What does “Not verified” mean?

The service claims support somewhere — in marketing copy or a third-party page — but its own docs, pricing or FAQ do not list the network. Treat it as unknown.

Sources

  1. Global Ledger — Global Ledger — Ethereum coverage. Checked 4 Oct 2026.
  2. Ethereum EIPs — EIP-55: Mixed-case checksum address encoding. Checked 4 Nov 2026.
  3. TRM Labs — Category deep dive: overall 2024 figures and declining illicit crypto volume on TRON. Checked 4 Nov 2026.
  4. Etherscan — Tether USD (USDT) on Ethereum: verified contract code. Checked 4 Nov 2026.
  5. Tether — Terms of Service (26 Feb 2026). Checked 4 Nov 2026.
  6. Circle Internet Financial (issuer) — USDC Terms, Section 13 'Risk Factors & Disclosures' - 'Blocked Addresses & Forfeited Funds' and 'Blocklisting' (12 Dec 2025). Checked 4 Nov 2026.
  7. Circle (GitHub) — Token design (stablecoin-evm). Checked 4 Nov 2026.
  8. ethereum.org — Ethereum security and scam prevention (6 Jun 2026). Checked 4 Nov 2026.
  9. Etherscan — Address Poisoning Attacks Are Rising on Ethereum (9 Mar 2026). Checked 4 Nov 2026.
  10. Chainalysis — Anatomy of an Address Poisoning Scam (23 Oct 2024). Checked 4 Nov 2026.
  11. Chainalysis (original research) — Crypto Crime: Targeted Approval Phishing Scams On the Rise (14 Dec 2023). Checked 4 Nov 2026.
  12. Chainalysis — Understanding Crypto Drainers (16 May 2024). Checked 4 Nov 2026.
  13. ethereum.org — How to revoke smart contract access to your crypto funds (6 Jun 2026). Checked 4 Nov 2026.
  14. U.S. Department of the Treasury — U.S. Treasury Sanctions Notorious Virtual Currency Mixer Tornado Cash (jy0916) (8 Aug 2022). Checked 4 Nov 2026.
  15. U.S. Court of Appeals for the Fifth Circuit — Van Loon v. Department of the Treasury, No. 23-50669 (26 Nov 2024). Checked 4 Nov 2026.
  16. U.S. Department of the Treasury — Tornado Cash Delisting (sb0057) (21 Mar 2025). Checked 4 Nov 2026.
  17. OFAC, U.S. Department of the Treasury — Cyber-related Designation Update (14 Apr 2022). Checked 4 Nov 2026.
  18. FBI Internet Crime Complaint Center (IC3) — North Korea Responsible for $1.5 Billion Bybit Hack (PSA250226) (26 Feb 2025). Checked 4 Nov 2026.
  19. Chainalysis — 2025 Crypto Theft Reaches $3.4 Billion (18 Dec 2025). Checked 4 Nov 2026.