Why Does My Crypto Wallet Show High Risk When I Did Nothing Wrong?
A flagged wallet does not mean a guilty owner. The risk can sit several transfers upstream, in money you received from someone else. Here is how that happens, how to tell a real warning from background noise, and what to do next.
October 16, 20269 min readAML Check Hub editorial team
Contents
- Short answer: exposure is not guilt
- How a wallet gets flagged without doing anything
- A real example from our own checks
- How to read the report
- Real warning or background noise?
- What to do if your wallet shows high risk
- How exchanges and counterparties treat it
- How to lower the chance of a high score
- Questions and answers
IN SHORT
A wallet can show high AML risk without any wrong action by its owner, because the score counts indirect exposure: funds that passed through a risky entity several transfers before they reached you. Read the report in this order — the category, then direct or indirect, then the number of hops, then the share of funds. A large share with few hops is a real warning. A small share many hops away is often background noise.
01Short answer: exposure is not guilt
An AML score describes where the money in a wallet came from and who it passed through, not what its owner did. Crypto moves openly and quickly between addresses, so funds that once touched a sanctioned service, a scam or a mixer keep travelling and end up in ordinary wallets. If you received such funds — from an exchange, a P2P counterparty or a payment — the trace can lead back to them even though you never met the original sender.
That is why the same report can be a serious warning for one wallet and almost irrelevant for another. The score is a signal to look closer, not a verdict. The full logic is described in the methodology.
02How a wallet gets flagged without doing anything
- You received funds that were already “touched”
- Money you got from a P2P buyer, an exchange withdrawal or a payment may have passed through a risky entity earlier. The trace follows it upstream, hop by hop.
- A counterparty's history rubs off
- If the address that paid you also served scams, hacks or sanctioned services, a share of its funds — and so of yours — is linked to them.
- A shared service has a messy past
- Exchange hot wallets and payment processors serve millions of people. Some of their flows come from risky sources, and that shows up as small exposure on everyone downstream.
- Your address is a payout or collection address
- An address that pays many people or collects from many people sees a very wide mix of sources, so some exposure is almost certain.
Risky entity
e.g. a sanctioned or high-risk platform
Intermediate address
hop 1
Exchange or service
hop 2 — mixes funds of many users
Your wallet
indirect exposure, 3 hops
03A real example from our own checks
While testing, we checked a TRON address used to pay out referral commissions for a popular Telegram service (anonymised here). Its direct transfers looked clean: the counterparties were reputable exchanges and payment processors. The report still showed exposure — roughly 9.1% of traced funds via sanctioned or high-risk platforms and about 0.5% via illicit activity (theft, and an address blacklisted by Tether).
This is the typical shape of indirect exposure: nothing suspicious in the first hop, a real but modest share further up the chain. The owner of that address did nothing wrong, and the signal is still genuine — it describes the funds, not the person.
04How to read the report
Do not stop at the number. Four details decide whether the result matters:
Direct exposure to sanctions or illicit activity
A strong signal: the address itself dealt with the risky entity. Treat it seriously, whatever the share.
Indirect, 1–3 hops, share above ~10%
Worth a close look: open the path and ask the counterparty where the funds came from.
Indirect, 4+ hops, share under ~5%
Usually background noise: distance and mixing dilute the link. Note it, do not panic.
Gambling, bridge or high-risk exchange only
Lower-severity categories: often legitimate use, but some jurisdictions' compliance rules care.
“Data unavailable” for a category
Not the same as clean: the provider had no data. Re-check later.
The thresholds in the table are our reading of how risk behaves, not rules from the data provider. What does hold: more traced value, a shorter distance and a more serious category all push the score up. How the score is built is explained in how the Risk Score is formed.
05Real warning or background noise?
- Looks like a real warning
- A large share, only a few hops, a severe category (sanctions, illicit activity), or a tie to a known hack. Several of these together.
- Looks like background noise
- A small share, many hops, a mild category, and an intermediary that is a large exchange or service serving many people.
- Needs a closer look
- A moderate share at a medium distance, or a result that jumps between two checks. Open the transfers that brought the funds in.
06What to do if your wallet shows high risk
- 01Open the full report and read the categories, not just the score. Find which category triggers the result.
- 02Check whether the exposure is direct or indirect, and how many hops away it is.
- 03Look at the share: a few percent is very different from half of the traced funds.
- 04Find the incoming transfers that brought that risk in — usually one or two senders.
- 05Do not move funds in a panic through new addresses: it can look like evasion and does not remove history.
- 06If an exchange or P2P platform asks, prepare a plain explanation of the source of funds and keep the report and transaction hashes.
- 07Re-check before the next large transfer; the result is a snapshot and changes as new transfers arrive.
See what your own report shows
Paste an address and get the score, level and category breakdown in seconds. Your first check is free.
07How exchanges and counterparties treat it
There is no universal rule. Platforms set their own thresholds and weigh categories differently: some accept a low-risk result and move on, some ask for the source of funds above a certain level, some decline transfers with direct exposure to sanctions or illicit activity. A report that clearly shows a small indirect share through a large exchange is usually easy to explain; a large direct exposure is not.
If a platform has restricted your funds, the first step is to find out what actually froze them — see USDT frozen: why Tether blocks addresses and what to do.
08How to lower the chance of a high score
- Check before you receive
- Run an AML check on the counterparty's address before accepting a P2P payment. The steps are in how to do an AML check on a wallet.
- Keep addresses separate
- Use one address for P2P and another for savings, so a problem with incoming funds does not spread to everything you own.
- Prefer regulated platforms for the main flow
- Funds that come from large, compliant exchanges tend to carry a cleaner trace than anonymous peer-to-peer chains.
- Avoid mixers and unknown bridges
- They add exactly the exposure that high scores are made of.
- Keep your records
- Reports, transaction hashes and deal chats are your proof of due diligence if anyone asks.
A check costs far less than a blocked account — see what an AML check costs. Which categories the report covers is explained in what a crypto wallet AML check is.
Know the risk before the money moves
Check an address first: score, level, categories and a PDF report for your records.
Questions and answers
- Why does my wallet show high risk when I did nothing wrong?
- Because the score counts where the funds came from, not what you did. Money that passed through a risky entity several transfers earlier can reach your wallet through an exchange or a P2P counterparty. The signal describes the funds, not the owner.
- What is indirect exposure in an AML check?
- Exposure is indirect when funds reached the address through one or more intermediate addresses instead of a direct transfer from the risky entity. The report counts the hops between the two. See direct vs indirect exposure.
- Is a high risk score always a real problem?
- No. A large share with few hops and a severe category is a real warning. A small share many hops away, through a large service, is often background noise. Read the category, directness, hops and share before drawing a conclusion.
- Can an AML score be a false positive?
- The data can be incomplete or the link thin, so a result is a signal rather than proof. The score describes funds that were really traced, but it may not mean anything for you in practice — which is why the breakdown matters more than the number.
- Will moving my funds to a new address lower the risk?
- No. Risk follows the funds through the transaction graph, so a new address inherits the same history, and moving money in a hurry can look like evasion. Check, document the source and explain, rather than hide.
- How often does the score change?
- It is a snapshot of the data available at the time of the check. New incoming transfers and updated address labels can change it, so repeat the check before a significant transfer.
This article is general information, not legal or compliance advice. AML Check Hub screens addresses against third-party blockchain intelligence and reports the result as-is: a high-risk result is a warning sign, not a final determination about any person, and a clean one is information, not a guarantee. The threshold figures in the table are a rule of thumb, not values set by the data provider.
