Forensics
The Forensics tab says what a wallet is and runs its funding history against Wallet Sleuth's threat corpus: its tag and inferred location, counterparty safety flags, where its funds trace back to, and how close it sits to anything labelled.
What you'll see
Tags & location
The first card shows what Allium's identity data says about the wallet, with the date it was checked:
- Tag: what kind of address it is, such as an exchange, a protocol, a known service or an exchange deposit address, or Untagged when Allium has nothing on it.
- Location: the country the wallet's activity most resembles, its conviction tier and Allium's reasoning, with a note that it describes the wallet's activity, not where a person is. No location from Allium means Allium has none, which is common and means nothing.
- Cashes out to: deposit addresses the wallet sent funds to, each with its service, the number of deposits, the value where it is known, the last date, and the country the service is registered in when Allium's registry lists one.
When the lookup could not run, the card says Couldn't check tags and location, or Lookup limit reached for today. It never shows that as untagged. See Tags and inferred location for every signal and what a location does not mean.
Counterparty Safety
A severity badge (Critical, High, Elevated, Unknown, or Clear) sums up what was found, followed by any individual flags, each with a detail line, a link to its evidence when there is one, and the path of addresses the taint travelled through to reach this wallet. A coverage line at the bottom lists which signals were actually available to check.
Fund Provenance
A bar breaks down where the wallet's funds trace back to: clean, insider-funded, unknown, or tainted, each as a share of the total. An Insider-funded badge appears when the wallet was seeded by an address already known to be an insider, and a line beneath the bar names when and from where the wallet was first funded, when that's known.
Below it, By Allium category splits the wallets that funded this one by what Allium says they are, such as exchanges or DeFi protocols. Funders that could not be checked are left out rather than counted as untagged.
Going deeper
Trace deeper re-runs the safety and provenance checks over a wider funding history, spending from your trace allowance. A wallet with no graph data yet shows a note asking you to run a trace from the Token tab first.
For what counts as a label, how it can reach a wallet, and how taint proximity is scored, see Threat intelligence and taint.
Common questions
Forensics shows a lock instead of any results. Forensics is available on plans that include it; see pricing.
Coverage looks thin for this wallet. Blocklist coverage differs by chain; see the coverage caveats in Threat intelligence and taint.
Does the location mean the owner lives there? No. It is inferred from exchange deposits, withdrawals and activity timing, and it describes the wallet's activity. Nothing on this tab uses it: it never changes Counterparty Safety, Fund Provenance, a grade or a risk score.
Why does a Solana wallet show no illicit flag? Allium has no illicit flags on Solana, so a Solana wallet without one is not a clean result. See the coverage by chain in Tags and inferred location.