Risk score and grade
How to use it. See Reading the report in the user guide for where the grade, findings, and per-wallet severity appear in an audit report.
A wallet audit produces two layers of risk information: a score and severity for every submitted wallet, and a single grade for the whole list. This page explains both, and the review tools that sit on top of them.
Per-wallet risk factors
Every wallet is checked against a fixed set of risk factors. Each factor that applies is attached to the wallet with a severity, a one-line explanation, and the evidence behind it.
| Factor | What it means |
|---|---|
| Direct label | The wallet itself appears on a blocklist: sanctions, hack, drainer, mixer or scam. Always critical. |
| Restricted asset | The wallet holds, or once held, an asset the audit was told to watch for. Holding it now is worse than having held it in the past. |
| Outbound exposure | The wallet has sent funds to a labelled address. |
| Taint proximity | Funds reached the wallet within a few hops of a labelled address. See Threat intelligence and taint. |
| Shared funding source, coordinated buys, uniform trade sizes, circular flow | The cross-wallet patterns described under Wallet relationships. |
| Bot cadence | Runs of transactions fired faster than a person could plausibly act. |
| Concentration | A single token makes up most of the wallet's value. |
| Illiquid holdings | Meaningful value in tokens with no confirmed exit liquidity. |
| Dormant value | A large balance with no activity for a long time. |
| Fresh high value | A wallet that is new but already holds a lot. Low severity, since it can be entirely innocent. |
| Hub-heavy activity | Most counterparty volume goes through exchanges. Informational only. |
| Institutional custody | The wallet is a multisig or smart account, or a public source names it as a business. Informational only. |
Severities run info, low, elevated, high, critical. Informational factors are shown for context but excluded from every calculation that follows.
Wallet severity and score
A wallet's severity is simply its worst non-informational factor. A wallet with no factors is marked clear when coverage was full, and unknown when coverage was limited.
The score starts at 100 and loses a fixed penalty for every factor, larger for more severe ones. A single critical factor is enough to reach zero. The score is a quick way to compare wallets; the severity and the factor list are what the grade and findings use.
Coverage is reported as full or limited per wallet. Coverage is limited when the chain has fewer blocklist sources, when the history window did not reach the wallet's earliest activity, or when the taint check could not run. A limited wallet with no factors reads as unknown, never as clear.
The grade
The audit grade is driven by one ratio: the share of the holdings value of the risk-assessed wallets that sits in wallets rated elevated or worse. Five bands map that percentage to A through F. Three rules sit on top:
- Any critical wallet in the list caps the grade at D, however small its share of value.
- The value used is holdings value, not realizable value, so an illiquid position still counts fully toward risk exposure.
- Only wallets that were risk-assessed count. Discovered wallets (funders and sub-wallets found by tracing) are valued and shown in the report, but they are not risk-assessed, so their value is left out of the ratio. A large exchange or protocol wallet that funded the list therefore cannot make the list look safer than it is.
The report shows the percentage, the dollar value at risk, and the count of wallets in each severity, so the grade is always traceable to its inputs.
Findings
Findings are the report's narrative layer. Each is either a risk finding, which points at wallets whose factors already contributed to the grade, or an interesting finding, which is descriptive and has no grade effect. Token checks, holder reconciliation results, a dominant wallet, or dense connectivity between submitted wallets are all interesting findings.
Each risk finding also carries an impact: the grade the audit would have received if the factor behind that finding did not exist. This is a true counterfactual computed at finalize, so a finding that says "removing this would move the grade from D to B" is reporting the recomputed grade, not an estimate.
Review and the adjusted grade
Auditors can resolve or hide findings and attach notes. That review never changes the engine's grade. Instead the report shows an adjusted grade: the grade recomputed as if the factors behind reviewed findings were absent, replayed over the review history so the trend chart shows both the engine's line and the adjusted line. A hidden finding also disappears from shared reports and exports, but the underlying wallet risk is preserved so nothing is silently lost.
Identities
When an auditor declares the person or business behind several wallets, the report can assess that identity as a whole. It combines three views: on-chain exposure, which weighs each flagged wallet by the share of the identity's value it holds, so a few flagged wallets holding most of the funds read far worse than a few holding dust; operational security, which looks at how the funds are held and at signs of compromise; and public exposure, which looks at how prominent the identity is in public sources. The worst of the three sets the identity's band. Identity results sit beside the audit grade and never change it.
Two more signals come from Allium's identity data, and neither moves a score. The operational security view carries an info-level note when the declared wallets sent funds to known phishing addresses. When the auditor declares a country, the assessment compares it with the wallets' inferred locations and shows the auditor a neutral line only when a different country holds a majority of the value of the wallets located at High conviction or above; that comparison is never shared, and it describes the wallets' activity, not where a person is (see Tags and inferred location).
See Data sources for what is read and how.
Realizable value
Alongside holdings value, every wallet shows a realizable value: native tokens, stablecoins and tokens with confirmed exit liquidity. Tokens whose liquidity could not be confirmed are excluded from realizable value, and tokens with no liquidity at all also raise the illiquid factor. The two numbers together tell you what a wallet is worth on paper versus what could plausibly be sold.
Revisions
Every completed run is recorded as a numbered revision. Re-running an audit, or editing its wallet list, produces a new revision, and the History tab shows how the grade moved between them and why. Auditors can attach a declaration to a revision to record context that the engine cannot know.