How do I check if a crypto address is flagged before I send?
Published · Updated
Short answer: Check two things. First, is it the exact address the real recipient gave you? Copy it from the source, compare every character, check your hardware wallet's screen. Second, is it flagged? Search the block explorer, Chainabuse, USDT/USDC freeze lists and OFAC. A flag means stop. "Clean" only means nobody has flagged it yet. (MetaMask; FBI)
What this covers: how to check if a crypto address is flagged before you send: a two-part check (is it the right address, and is it known to be a scam), the four free official places to look (block explorer labels, Chainabuse, the USDT and USDC freeze lists, and OFAC's sanctions search), what a "flagged" or "clean" result really means, whether a crypto scammer list exists, and what to do if the address is flagged. Who it's for: you, if someone gave you an address to pay, you're moving funds between your own wallets, or you're checking for a parent. What it isn't: a scam-checker tool, a risk score or a way to trace who owns an address. We don't link third-party checkers and we have no affiliate links on this page.
Key facts
- Crypto transfers can't be reversed. The FBI says transactions "are irrevocable," and MetaMask says funds sent to the wrong address "will be irretrievable." (FBI IC3; MetaMask)
- Scammers make lookalike addresses that match the first and last characters of one you use. The FBI says to "check the entire cryptocurrency address," because "the middle alphanumeric characters in the address will be different." (FBI, Apr 26, 2024)
- Block explorers label some scam addresses. Etherscan reviews reports and adds a label and public notice to addresses "proven to be involved in a scam or phishing activities." (Etherscan)
- OFAC's sanctions list includes crypto addresses, and you can search one by pasting it into the "ID #" field. Only exact matches come back. (OFAC FAQ 594) On 2026-10-28 the list held 514 unique crypto addresses, all tied to sanctioned people or groups. (OFAC SDN list; our count)
- A clean result isn't proof. On 2026-10-28, the lookalike address that took $305,560 in an October address-poisoning theft had no Etherscan label, no Chainabuse report, no OFAC listing and no USDT or USDC freeze. (Our test)
What does "checking an address" actually check?
When you check a wallet address before you send, you're asking two different questions. The first one stops more losses, and no scam checker can answer it for you.
- Question 1: Is this the exact address the real recipient gave you? This catches lookalikes planted in your history, clipboard malware that swaps what you paste, and fake apps showing the wrong address. (Trezor; Ledger; MetaMask)
- Question 2: Is this address known to be a scam? This catches addresses someone has already reported, labeled, frozen or sanctioned. It can't catch a brand-new one. (Etherscan; Chainabuse)
- And sometimes the request is the answer. If a stranger, "agent," platform or "government office" is telling you to send crypto, you don't need to check the address. The FTC says "only scammers demand payment in cryptocurrency." See when the request is the red flag. (FTC)
Recreated illustration
Your thumb over Send → 1. Right address? (from the source, every character, on your device screen) → 2. Known-bad? (explorer label, Chainabuse, USDT/USDC freeze, OFAC) → Both pass: send a small test first. Either fails: stop and report.
Step 1: Is it the right address?
To verify a crypto address, compare it with the source, not with a list.
- Get the address from the source, every time. Ask the recipient, or open the exchange's deposit screen or your own wallet's receive screen. Never copy it from your transaction history, even for your own address. (MetaMask) That's how address poisoning works.
- Compare the whole address, middle included. Scammers' lookalikes match the start and end. (FBI; Etherscan)
- Confirm it on your hardware wallet's screen. Trezor says malware "can change what you see" on your computer or phone, "but it cannot change what your Trezor shows you." Ledger says that if the address on the device doesn't match, malware may have swapped your clipboard, so abort. (Trezor; Ledger) Device checks are covered on our hardware wallet guide.
- Know what the device can't tell you. Trezor's screen "can't tell you whether an address someone gave you is the right one." That's why step 1 comes first. (Trezor)
- Use a saved address book for people and accounts you pay often, and send from it. (MetaMask)
- Confirm a new or changed address on a second channel. If a seller, relative or business says they "changed wallets," call them on a number you already have. [Our advice.]
- Big amount? Send a small test first, confirm with the recipient that it arrived, then copy the address from the source again for the main send, not from history. [Our recommendation, not from a cited source: scammers react to test transfers.]
- Clipboard malware is current. Microsoft reported a Windows "crypto clipper" affecting users since February 2026 that checks the clipboard roughly every 500 milliseconds and swaps copied wallet addresses for the attacker's. (Microsoft, Jun 17, 2026)
- Got a tiny or zero-value transfer from a lookalike? That's address poisoning. See real lookalike pairs and the 60-second pre-send check. Researchers at Carnegie Mellon University and an independent researcher counted 270 million poisoning attempts against 17 million victims on Ethereum and BNB Chain over two years, with at least $83.8 million lost. (Tsuchiya et al., USENIX Security 2025)
Step 2: How do I check if a crypto address is flagged?
These four checks are free, need no account or wallet connection, and use the source's own data. Paste the public address only. Never your recovery phrase or private key.
| Check | Who runs it | How (as of Oct 2026) | A hit means | "Nothing found" means |
|---|---|---|---|---|
| Block explorer label | The chain's explorer: Etherscan for Ethereum, Tronscan for Tron, others in our explorer table | Paste the full address into the explorer's search. Look for a red warning and a name tag such as "Fake_Phishing…" | Etherscan reviewed reports and labeled it as scam or phishing. Don't send. (Etherscan) | Nobody has reported it, or the explorer hasn't reviewed it yet. Labels vary by explorer. |
| Chainabuse reports | Chainabuse, a free scam-report site (its docs say TRM's investigations team reviews flagged reports) | Search the address at chainabuse.com. Read each report's badge. | Someone reported it. "Checked by Chainabuse" and "Trusted Contributor" badges carry more weight; Chainabuse says to use unverified reports "with caution." (Chainabuse) | "No Reports." Chainabuse's own page says "unreported addresses might still be used in scams." (Chainabuse) |
| USDT / USDC freeze | Tether (USDT) and Circle (USDC) | On Etherscan, open the official USDT or USDC token contract → Contract → Read Contract → isBlackListed (USDT), or Read as Proxy → isBlacklisted (USDC) → paste the address → Query. true = frozen. Reading needs no wallet connection. Tronscan has the same isBlackListed read for USDT on Tron. | The issuer froze it: it's on the USDT blacklist or USDC's. Tether says it freezes addresses on OFAC's sanctions list. Don't send. (Tether, Dec 9, 2023) | Not frozen on that chain right now. Freezes are rare: we counted 51 USDT and 29 USDC freezes on Ethereum in the ~34 days before Oct 28, 2026. (Our test) |
| OFAC sanctions search | US Treasury, Office of Foreign Assets Control | At sanctionssearch.ofac.treas.gov, leave Name blank, paste the full address into "ID #" and search. Exact matches only. (OFAC FAQ 594) | The address is on OFAC's sanctions list, tied to a sanctioned person or group. Don't send. | Not sanctioned. That says nothing about scams: the list held 514 unique crypto addresses on 2026-10-28. (OFAC SDN list) |
"Check the token and address on an open source blockchain explorer to see if the address has been labeled as suspicious."
- Free scam-checker sites run a crypto address blacklist check against some of these lists plus their own data, then give a score. Most warn that a clean score isn't proof of safety, and that's true. We don't link any of them. The four sources above come straight from the explorer, Chainabuse, the stablecoin issuer or the government.
- Exchanges may check too. Some exchanges and wallets warn about or block sends to flagged addresses. Don't count on it: our test below found the biggest loss unflagged everywhere. [Our framing; we don't claim any specific exchange screens.]
Is there a list of crypto scammer addresses?
- No single official one. In the US, we found no government list of scam wallet addresses you can search. What exists: OFAC's sanctions list (about 500 addresses tied to sanctioned parties), explorer labels, Chainabuse's user reports, and stablecoin freeze lists. (OFAC FAQ 563; OFAC SDN list; Etherscan; Chainabuse) ["We found no…" is our finding from our search, not a government statement.]
- "Blacklist directory" sites that come up for "crypto scammer list" or "bitcoin scammer list" publish big totals of "flagged wallets" that mix sanctions, hacks and unverified reports, and can't be checked. Treat them as one more search, not proof. [Our reading of the search results we checked.]
- Scammers rotate addresses. A list is a record of addresses already used. A new address made today isn't on any of them. [Our inference; see our test.]
- Our scam log is a dated record of incidents, not an address list: see the incident log and the scam tracker. The lookalike addresses from our address-poisoning cases are printed in full on that alert, labeled "do not send."
We checked the addresses that took $415,136. Here's what the checks found.
Between Sep 25 and Oct 7, 2026, four people lost $415,136 to address-poisoning lookalikes (our alert). On Oct 28, 2026, we ran each lookalike through the four checks above, plus one older public blocklist.
Checked 2026-10-28, 1:19–1:20 PM CT.
| Loss (UTC date) | Lookalike (do not send) | Etherscan label | Chainabuse | USDT/USDC freeze | OFAC |
|---|---|---|---|---|---|
| $67,572 USDT (Sep 25) | 0xca166632…1e80fd94b | Yes | 0 reports | No | No |
| $305,560 DAI (Oct 3) | 0x085ccc21…47c18f1dd | No | 0 reports | No | No |
| $30,004 USDT (Oct 6) | 0xca07d0bf…14ab7b302 | Yes | 0 reports | No | No |
| $12,000 USDC (Oct 7) | 0xbc3ab786…9b05f4686 | Yes | 0 reports | No | No |
Addresses shortened on purpose and not linked. Full real and fake pairs: our alert.
- What we found: Etherscan now labels 3 of the 4 as phishing, with warnings such as "identified as an address poisoning attacker" and "There are reports that this address was involved in Address Poisoning." The address that took the most, $305,560, had no label on any source we checked, 25 days later. None of the four had a Chainabuse report, a stablecoin freeze or an OFAC listing.
- Why it matters: each victim's real address was also clean. [Our inference: a flag check can't tell a real address from its lookalike if the lookalike hasn't been flagged. Only step 1, comparing to the source, would have caught all four.]
- And it keeps happening: two weeks after the Oct 7 loss, Etherscan shows new transfers into that victim's real address from addresses it labels "Fake_Phishing." [Our reading of Etherscan, Oct 21 and Oct 23, 2026.] If you've been poisoned once, expect more, and keep sending from your address book.
So is an address safe if an address checker says clean? No. A clean result means nobody has flagged the address yet.
How we checked: Etherscan and Chainabuse address pages read in a headless browser; USDT and USDC freeze status read from the official Ethereum token contracts, with a known-frozen address as a control; OFAC's SDN list downloaded and searched; plus an older public blocklist (last updated Feb 2024) from the firm that reported the cases: 0 of 4. Read-only: we sent nothing and connected no wallet. Etherscan doesn't show when a label was added, so we can't say what any check showed on the day of each theft. Four cases one firm chose to post: a sample, not a rate.
When the request is the red flag
Sometimes you can skip the address check, because the reason you're paying is already a scam.
- Someone demands crypto. "Only scammers demand payment in cryptocurrency." (FTC)
- A "government office," "bank" or "utility" gives you a wallet address or QR code "for safe keeping." That's a scam. (FTC; FBI IC3) If they sent you to a kiosk, read about crypto ATM scams.
- A platform says you must deposit more to withdraw (a "fee," "tax" or "unlock" payment). See the pig-butchering warning signs. Task apps that want a "top-up" use the same trick: see task scams that want your USDT.
- A "recovery" service wants a fee sent to a wallet. That's one of the crypto recovery scams.
- Unexpected tokens told you to "claim" at a site. See airdrop claim scams.
- A site wants you to connect a wallet to see if an address is flagged. Checking an address is a lookup. It never needs your wallet connected, a signature or your phrase. That's seed phrase phishing or a trap for token approvals. [Our rule; Etherscan and Chainabuse searches need neither.]
Not sure about the site itself? Here's how to check if a crypto site is legit.
The address is flagged. What now?
- Don't send. Not a "small test," not "just this once."
- Tell the person you meant to pay, on a channel you already trust. If the address came from someone you know, their account may be hacked. [Our advice.]
- Save what you have: the address, where it came from (screenshot the chat, page or QR code), the time and time zone. Use our evidence template. (FBI IC3)
- Report the address, even though you didn't lose money: on Chainabuse (free, public) and with the explorer's report form (on Etherscan: the address page → More → Report/Flag Address). (Etherscan; Chainabuse)
- If someone is pressuring you to pay (a "platform," "agent" or "officer"), report the scam too: how to report a crypto scam in the US. IC3 asks for the "wallet address where funds were sent" and any phone numbers, emails or domains. (FBI IC3)
Already sent to an address that's flagged, or wrong?
- Report it today, in order: your exchange or wallet provider, then IC3, then the FTC. Here's how to report the crypto scam in this order, with the evidence template. Include the transaction hash and both addresses. (FBI IC3)
- Sent USDT or USDC? Contact the issuer quickly; issuers have frozen funds tied to thefts. See what to do after sending to a lookalike.
- Sent to a lookalike from your history? Here's what to do if you sent to a poisoned address.
- Your wallet sent it, not you? That's a drain, not a wrong send. Follow the first 30 minutes after a drain.
- Someone offers to "trace" the address or get it back for a fee? That's the second scam: crypto recovery scams. The FBI says to "be wary of anyone claiming they can recover your funds." (FBI IC3)
Frequently asked questions
How do I check if a crypto address is flagged?
Paste the full address into the block explorer for its chain (Etherscan labels reported scam addresses), search it on Chainabuse, check the USDT or USDC freeze list on the token contract, and search OFAC's sanctions list using the "ID #" field. All four are free and need no wallet connection. A flag means don't send; no flag only means nobody has flagged it yet.
Is there a list of crypto scammer wallet addresses?
We found no single official US list of scam addresses. OFAC's sanctions list includes about 500 crypto addresses tied to sanctioned people and groups, explorers label some reported scam addresses, and Chainabuse collects user reports. Scammers use new addresses constantly, so no list is complete.
Is this crypto address a scam if a checker says it's clean?
It could be. A clean result only means the address isn't on the lists that checker uses yet. On Oct 28, 2026, the lookalike address that took $305,560 in an October address-poisoning theft was still clean on every source we checked. Make sure the address came from the real recipient, and compare every character.
How do I check if a USDT address is blacklisted?
On Etherscan, open the official USDT contract, go to Read Contract, and query isBlackListed with the address; "true" means Tether froze it. Tronscan has the same check for USDT on Tron, and USDC uses isBlacklisted on Circle's contract (under Read as Proxy). A frozen address is a reason not to send.
How do I check a crypto address against the OFAC list?
Go to OFAC's Sanctions List Search, leave the name blank, paste the full address into the "ID #" field and search. The field only returns exact matches, so paste the whole address. A match means the address belongs to a sanctioned person or group.
What does "Fake_Phishing" mean on Etherscan?
It's a public label Etherscan adds to addresses its team has reviewed and tied to scam or phishing activity, with a warning on the address page. Don't send to an address with that label. A missing label doesn't prove the address is safe.
Should I send a small test transaction first?
For a large or first-time send, a small test lets you confirm with the recipient that the address is right before you send the rest. Copy the address from the source again for the main send, not from your history, because scammers watch for test transfers. A test can't tell you whether the recipient is honest.
How do I report a scam wallet address?
Report it on Chainabuse and with the explorer's report form (on Etherscan: the address page, then More, then Report/Flag Address). If you were asked to pay or lost money, also file at ic3.gov with the address, any transaction hash and the scammer's contact details.
Can I get crypto back after sending it to a scam address?
Usually not, because crypto transfers can't be reversed. Report it to your exchange, IC3 and the FTC right away, contact the stablecoin issuer if you sent USDT or USDC, and ignore anyone who offers to recover it for a fee.
Is it safe to paste an address into a checker?
Pasting a public address is a lookup, and anyone can already see that address on the blockchain. Never paste a recovery phrase or private key, and never connect your wallet or sign anything to "check" an address. A site that asks for that is the scam.
What to do next
Before your next crypto send, check the address twice: first that it's the exact address the real recipient gave you (from the source, every character, on your device screen), then that it isn't flagged (block explorer, Chainabuse, USDT/USDC freeze, OFAC). For how lookalike addresses get into your history, read what address poisoning is. Already sent to a scam address? Report it today with our crypto scam reporting checklist, including the transaction hash.
One-minute check now: open your wallet's send screen. Is the address you're about to use in your saved address book? If not, get it from the source and add it now.
Get one crypto scam warning a week from Pause Before Send: join the newsletter.
No affiliate links, exchange referrals, coin calls or scam-checker referrals on this page, by policy.
Sources
- FBI Denver, "FBI Warns of Cryptocurrency Token Impersonation Scam," 2024-04-26. fbi.gov (accessed 2026-10-28)
- MetaMask Help Center, "Address poisoning scams" (undated help article). support.metamask.io (accessed 2026-10-28)
- Etherscan Information Center (Raja Amir), "Report/Flag Address," 2020-03-10. info.etherscan.com (accessed 2026-10-28)
- Etherscan Information Center, "Address Poisoning Attacks," 2024-01-15. info.etherscan.com (accessed 2026-10-28)
- Chainabuse, home page and address search pages (living). chainabuse.com (accessed 2026-10-28)
- Chainabuse Docs, "Spam detection and reports accuracy" (undated). docs.chainabuse.com (accessed 2026-10-28)
- U.S. Treasury, OFAC, FAQ 594, "Is it possible to query a digital currency address using OFAC's Sanctions List Search tool?" 2021-05-18. ofac.treasury.gov (accessed 2026-10-28)
- U.S. Treasury, OFAC, FAQ 563, "What is the structure of a digital currency address on OFAC's SDN List?" 2018-06-06. ofac.treasury.gov (accessed 2026-10-28)
- U.S. Treasury, OFAC, Specially Designated Nationals (SDN) List, CSV export downloaded 2026-10-28; our count of "Digital Currency Address" entries (521 entries, 514 unique). Search: sanctionssearch.ofac.treas.gov (accessed 2026-10-28)
- Tether, "Tether Introduces New Policy to Strengthen Ecosystem Security," 2023-12-09 (company statement). tether.io (accessed 2026-10-28)
- Trezor Guides, "Trezor's Trusted Display: Verify every address on your device" (undated). trezor.io (accessed 2026-10-28)
- Ledger Support, "What's a Clipboard Highjack?" last updated 2026-05-13. support.ledger.com (accessed 2026-10-28)
- Microsoft Threat Intelligence, "Crypto Clipper uses Tor and worm-like propagation for persistence and control," 2026-06-17. microsoft.com (accessed 2026-10-28)
- Taro Tsuchiya, Jin-Dong Dong, Kyle Soska and Nicolas Christin, "Blockchain Address Poisoning," USENIX Security 2025 (arXiv v3, 2025-07-02). usenix.org (accessed 2026-10-28)
- Federal Trade Commission, "What To Know About Cryptocurrency and Scams" (undated consumer article). consumer.ftc.gov (accessed 2026-10-28)
- FBI IC3, "Cryptocurrency" (crime information page, living). ic3.gov (accessed 2026-10-28)
- FBI IC3, "FBI Guidance for Cryptocurrency Scam Victims" (I-082423-PSA), 2023-08-24. ic3.gov (accessed 2026-10-28)
- FBI IC3, "IC3 Cryptocurrency Kiosk Complaint Data By State" (I-051526-PSA), 2026-05-15. ic3.gov (accessed 2026-10-28)
Changelog
- 2026-10-28: First published. Address checks re-run on 2026-10-28, 1:19–1:20 PM CT.
- 2026-10-28: Added links to how to check if a crypto site is legit and to task scams that want your USDT.