Wallet reports
Behaviors
The patterns Iris recognizes in a wallet's activity. Each comes with a confidence, a plain description with the numbers behind it, and example transactions.
Reading a behavior
A behavior has a title (“Wallet drainer”), a confidence, and a description that states what was measured, in the wallet's own numbers: “39 of 84 senders: received the full balance of 39 wallets”. Most link a few example transactions to check on Solscan.
Some behaviors can be the wallet's identity; others are traits that only add to the picture (and sometimes to the risk). The tables below say which.
Threats
| Behavior | Meaning | Identity | Risk |
|---|---|---|---|
| Wallet drainer | Many senders gave it their whole balance or several assets in one go, or it moved tokens out of wallets as a delegate. Senders the wallet funded itself, or swept back with its own fleet, are not counted as victims. | Yes | HIGH |
| Address poisoner | Sends dust to many wallets and does little else. | Yes | HIGH |
| Tries to move frozen funds | Keeps trying to move tokens their issuer froze. The freeze itself shows as a label. | No | HIGH |
| Sent to a look-alike address | Sent real funds to an address made to look like one it trusts: it fell for address poisoning. | No | MEDIUM |
| Burner funding hop | A transit wallet, funded and emptied at once. | Yes | MEDIUM |
Privacy and obfuscation
| Behavior | Meaning | Identity | Risk |
|---|---|---|---|
| Mixer | Pools money from many wallets and pays it out to many others. A known privacy protocol's pool, or the same pattern: one-time counterparties on both sides, round amounts, withdrawals sent by relayers. | Yes | HIGH |
| Uses a privacy pool | Deposited into or withdrew from a privacy pool. Privacy is not wrongdoing, but it breaks the trail, so compliance treats it as exposure. | No | MEDIUM |
| Funded through burner wallets | One-use wallets forwarded everything they had to it, so the funding can't be traced back directly. | No | MEDIUM |
Operators and fleets
| Behavior | Meaning | Identity | Risk |
|---|---|---|---|
| Funder wallet | Pays SOL to many wallets at once, with money from one or a few sources. Says where its money came from and whether it swept the fleet back. | Yes | None |
| Runs multiple wallets | Funds wallets, then collects their whole balance back: one operator behind many addresses. | No | LOW |
Trading and automation
| Behavior | Meaning | Identity | Risk |
|---|---|---|---|
| MEV arbitrage bot | Most of its landed swaps are profitable loops. | Yes | None |
| MEV bot | Priority fees on almost every transaction, many of them failing. | Yes | None |
| Bot | Many transactions in the same second, seconds apart around the clock. | Yes | None |
| Memecoin trader | Buys and sells on launchpad bonding curves. Says which launchpads. | Yes | None |
| Tips Jito | Pays tips to get its transactions landed first, as bots and snipers do. | No | None |
Services and people
| Behavior | Meaning | Identity | Risk |
|---|---|---|---|
| Exchange hot wallet | Deposits from many wallets and payouts to many others, or much of its value moving with a known exchange's wallets. | Yes | None |
| Merchant | Many payers, stablecoins, repeated prices, payment references. | Yes | None |
| Protocol account | No private key; one program does most of its work. | Yes | None |
| Validator | Consensus votes make up most of its activity. | Yes | None |
| Personal wallet | Signs its own transactions at a human pace. | Yes | None |