USDT source-of-funds check · TRON · BSC · Ethereum
KYTScore is a USDT source-of-funds checker that traces where an address's USDT came from — up to 2 hops back over the last 90 days on TRON, BNB Smart Chain and Ethereum — and flags links to OFAC-sanctioned, Tether / Circle-frozen, hacked or scam addresses, with the evidence path, amounts and dates.
Paste the address that paid you and see whether that USDT could get you frozen or flagged by an exchange.
Prototype. Exposure describes on-chain fund flows only; it does not say who owns an address or that anyone did anything wrong. Not legal advice. Wrong? Tell us →
| Situation | Score |
|---|---|
| The address itself is sanctioned, frozen or a known hack address | 100 Severe |
| Hop 1: ≥ 10% or ≥ $1k from sanctioned / frozen / hack addresses | 85 High |
| Hop 1: ≥ 1% | 60 Moderate |
| Hop 1: any; or hop 2: ≥ 10% | 45–55 Moderate |
| Otherwise (small hop-2 exposure raises it within Low) | 5–30 Low |
| The address is a known exchange wallet and not listed itself | ≤ 30 Low |
Local label OFAC SDN, current Tether / Circle freezes, FBI notices, exchanges' own proof-of-reserves address lists.
Inferred Rules on the address's own flows: very high volume or transfer count → hub; ≥ $10M from ≤ 10 senders → likely exchange hot wallet; forwards most funds to one known exchange → likely that exchange's deposit address.
External API For the top 3 TRON addresses we still can't name, the public tag from TRONSCAN, attributed and linked to its TRONSCAN page. Cached for 24 hours, not stored as our label.
Not live yet. Field names follow the common risk_score shape (score / risk_level / risk_detail), plus an evidence path.
The rate-limited demo endpoint behind this page is described in /openapi.json.
POST /v1/risk/address
Authorization: Bearer <key>
{ "chain": "tron", "address": "TQ4k…9fWm", "asset": "USDT" }
Response
{
"score": 85,
"risk_level": "High",
"risk_detail": [
{
"entity": "Frozen by Tether (USDT_TRC20)",
"risk_type": "frozen_by_issuer",
"exposure_type": "direct",
"hop_num": 1,
"volume": 4200.00,
"percent": 12.4,
"path": [
{ "address": "TQ4k…9fWm" },
{ "address": "TFz8…2kLx", "usd": 4200.00, "ts": 1792310400000,
"tx": "9c1e…a07b", "entity": "Frozen by Tether (USDT_TRC20)" }
]
}
],
"exchanges": [ { "entity": "Binance", "hop": 1, "percent": 61.2, "source": "por-binance" } ],
"coverage": { "inflow_usd": 33870.5, "labeled_pct": 73.6, "traced_pct": 18.1 }
}
KYTScore is a free prototype that checks the source of funds of a USDT address. It traces the address's USDT inflows up to 2 hops back over the last 90 days and reports how much is linked to OFAC-sanctioned, Tether / Circle-frozen, hacked or scam addresses, with the transactions that prove it.
Only USDT, on TRON (TRC-20), BNB Smart Chain (BEP-20) and Ethereum (ERC-20). Other tokens, other chains and cross-chain bridges are not traced.
90 days. It reads up to 400 incoming USDT transfers of the checked address, ignores transfers under $1, then expands the largest unidentified senders (up to 8, until 80% of the inflow is covered) by one more hop, reading up to 200 transfers each.
The score runs from 0 to 100: Low is 0–30, Moderate 31–70, High 71–90 and Severe 91–100. Severe means the address itself is on an official list. High means at least 10% or $1,000 of its inflow came directly from sanctioned, frozen or hacked addresses. Hop-2 exposure counts half.
OFAC's SDN list, the addresses Tether and Circle currently have frozen, FBI public notices, and the proof-of-reserves address lists that exchanges publish. Some labels are inferred from flow patterns and marked as inferred. For the top unidentified TRON addresses, public tags from TRONSCAN are shown with attribution and cached for 24 hours.
No. The score describes on-chain fund flows only. It does not say who controls an address or that anyone broke a rule, except where an official list names the address itself. Inferred labels can be wrong.
Exchanges move funds between their own wallets all the time. If a known exchange wallet is later frozen, the freeze counts as Severe only for that wallet. Wallets it paid are treated as receiving from an exchange and get a note instead of a risk score, and a known exchange wallet that is not listed itself is capped at Low.
The demo endpoint POST /api/kyt/check is public but rate-limited (10 checks per hour per IP address, 200 per day in total) and described at /openapi.json. A paid API is planned; preview pricing is 100 checks a month free, then $0.02–0.05 per check, and may change.
Know who an address belongs to, or think a result is wrong? Tell us. Submissions are reviewed by a person before they affect any result.
This page is a prototype to test demand, not a live service. Results are for reference only and are not legal, compliance or investment advice.
We only describe association / exposure through on-chain USDT flows. We do not say what an address is, who controls it or that anyone did anything wrong — except where an official list names it (OFAC SDN, Tether / Circle freezes). Inferred labels are guesses from flow patterns and can be wrong.
Data: OFAC SDN list; Tether and Circle freeze events from the chain; FBI public notices; exchanges' published proof-of-reserves addresses; external tags are always attributed. Chain data via TronGrid and Alchemy. To correct a result, use the form above.