5-tier confidence model

Every source is graded on these 5 tiers. Each tier represents a different evidence strength for "the wallet was compromised" and decides how we render the match in the UI.

Confirmed stolen

Wallets verified compromised through public incident reports — exchange hacks, DeFi exploits, SIM-swap attacks, etc.

Sanctioned

Addresses on the OFAC sanctions list or equivalent regulator-published indexes. A hit may indicate prior interaction with sanctioned activity.

Academic dataset

Weak-key and vulnerable-address collections curated by security researchers in published papers and public repositories — each entry traces back to its original study.

Community curated

Phishing, scam, and drainer wallet lists continuously maintained by community trackers (ScamSniffer, MEW darklist, etc.).

Dictionary derived (theoretical)

Brain-wallet addresses derived from common-password dictionaries. A hit does not mean you were stolen from — it means any attacker running the same dictionary will land on your address.

Synthetic baseline

Cross-chain projections from known passphrases — added for coverage completeness, not as independent evidence on its own.