Data sources
How to use it. See Audits in the user guide for where audits draw on these sources.
Wallet Sleuth does not maintain its own blocklist. It combines open datasets and public APIs, records where every label came from, and shows that provenance on the label itself. This page lists each source.
Threat intelligence
These sources produce the risk labels described under Threat intelligence and taint.
| Source | What it provides | Chains | Refresh | Access |
|---|---|---|---|---|
| OFAC Specially Designated Nationals list, via the 0xB10C GitHub mirror | Addresses named in United States sanctions designations | EVM | Daily | Public, government data |
| AllenHark blacklist | Community-maintained list of pump.fun scammers and launchers | Solana | Daily | Public |
| Lazarus and DPRK research by tayvano | Incident write-ups for hacks, thefts and laundering attributed to North Korean groups and others. Only addresses whose role is explicitly adversarial are used; victims, signers and exchange deposit addresses are never labelled. | EVM and Solana | Daily | Public, CC0 |
| GoPlus Labs address security | Address flags including sanctions, mixers, phishing, drainers, honeypots and fake tokens, aggregating SlowMist and GoPlus data | Ethereum, Base | On demand per audited wallet | Public API |
| Chainalysis sanctions screening | Sanctioned-entity identification | All | On demand, when enabled for the deployment | Licensed API |
| Allium address labels | Phishing, hack, exploit, heist, sanctioned and mixer addresses from Allium's labelled datasets. Mixer users are not labelled. | EVM | Daily | Licensed API |
Daily sources are merged at a fixed time each day. An address a source no longer lists is removed for that source on the next run, with a safeguard that skips the removal pass when a download looks truncated.
Entity labels
These name an address as a business or service. They are shown for context and never raise risk.
| Source | What it provides | Chains |
|---|---|---|
| Blockscout address metadata | Public tags for exchanges, bridges, routers, custodians and similar | Ethereum, Base |
| Helius wallet identity | Named wallets and categories | Solana |
| Solscan labels | Account labels and tags, used as a fallback when enabled | Solana |
| Curated lists | Hand-maintained exchange hot wallets and infrastructure addresses, including the tradezon cex-list on GitHub for EVM | All |
| Allium entities | Exchanges, market makers, funds, bridges and on-ramps. A counterparty with one of these labels is treated like a known exchange, so it never counts as a shared funder. | Solana, Ethereum, Base |
Chain data
| Provider | Used for | Chains |
|---|---|---|
| Helius | Transaction history, enhanced transaction parsing, digital asset data, real-time webhooks | Solana |
| Alchemy | Transfer history, portfolio balances, real-time address activity, historical prices | Ethereum, Base |
| Blockscout | Token holder lists, contract detection, created-contract history | Ethereum, Base |
| Public RPC endpoints | Balances and contract reads with fallbacks | All |
Prices and liquidity
| Provider | Used for | Chains |
|---|---|---|
| Alchemy Prices | Current and historical token prices | All |
| Jupiter | Token prices | Solana |
| DexScreener | Pool liquidity, prices, launch pair detection | All |
| GeckoTerminal | Price fallback | All |
| CoinGecko | Price fallback | All |
Liquidity figures decide what counts as realizable value and whether a position is flagged illiquid. A price is only accepted from a pool with meaningful depth, so a token's toy pool cannot inflate a wallet's valuation.
Token checks
| Provider | Used for | Chains |
|---|---|---|
| GoPlus token security | Token contract flags such as mintability, ownership, trading restrictions and honeypot risk | Ethereum, Base |
| RugCheck | Token risk signals | Solana |
| On-chain reads | Mint and freeze authorities, proxy and owner slots, supply, bytecode function scans | All |
Funding and cash-out tracing
Allium's indexed chain data lets an audit look further back than the history it reads for each wallet. The audit sends Allium the audited wallet addresses, never the client's name or any other report content.
| Source | Used for | Chains |
|---|---|---|
| Allium wallet funding | Who funded each submitted wallet: the first funder across all history on EVM, and the earliest funders inside the analysis window on Solana | All |
| Allium transfers | Exchange deposit addresses each submitted wallet paid into, which shows where funds left the chain and which wallets share an exchange account | Ethereum, Base |
| Allium DEX trades | A Solana target token's first buyers, insiders and launch-window snipers, and whether those early buyers share funders | Solana for the launch, all chains for the shared-funder check |
Wallet tags and inferred location
These sources produce the tags and locations described under Tags and inferred location. Only wallet addresses are sent to Allium.
| Source | What it provides | Chains | Access |
|---|---|---|---|
| Allium address labels | Entity, service and deposit-address tags, plus illicit and high-risk flags | Solana, Ethereum, Base | Licensed API |
| Allium address geography | An inferred country per wallet, with a conviction tier and the reasoning | Solana, Ethereum, Base | Licensed API |
| Allium exchange registry | The country each exchange operates from | All | Licensed API |
Optional user-connected data
A user can also connect their own Allium key, to import wallet lists from saved queries and to supply historical holder data for reconciliation. Those two features only ever use the user's own key.
Identity assessments
An auditor can declare the person or business behind some of an audit's wallets and, after stating why they are authorised to review it, ask for an identity assessment. Only declared identities are ever assessed. The public sources below are each read once per assessment, with a user agent that names Wallet Sleuth and a contact address, at no more than one request per second, and only where the site's robots.txt allows it. Nothing is read behind a login, and a CAPTCHA or block simply ends that source for the run.
| Source | What it provides | Access |
|---|---|---|
| DuckDuckGo web search | Result titles and links, used to find profiles, press and an encyclopedia entry | Public search page |
| GDELT news | Recent news headlines naming the identity, and whether any mention an incident | Public API |
| GitHub | Public repositories and recent activity for a declared or discovered account | Public API |
| The identity's own website | Its title, and whether it names the declared person | Public page |
| Professional and social networks | Whether a profile exists. Most of these sites disallow automated reads in robots.txt, so a profile is usually recognised from search results alone | Public pages, where allowed |
| OpenCorporates | Company register entries for a declared business | Public search page |
Only links, page titles and short excerpts are kept, never page contents, photos or profile details, and they are deleted 180 days after the assessment unless it is run again. Anyone who believes they have been assessed can ask to be removed at admin@wisteriatechnologies.com; the assessment is deleted from every audit and the name cannot be assessed again.
Disputes and corrections
A label is evidence with a source and a date, not a verdict. If you believe an address is labelled in error, check the source shown on the label first, since most corrections belong with the upstream list. To raise a concern about how Wallet Sleuth applies a label, contact admin@wisteriatechnologies.com.