Wallet reports
Identities
Every identity Iris can give a wallet, what it means, and what to do when you meet one.
How the identity is chosen
A wallet gets one identity, with a confidence. It comes from two places, in this order:
- What is known. A label from the knowledge base that says what the address is: an exchange, a drainer, a protocol. Threats outrank everything else.
- What it does. When no label settles it, the behavior that best describes what the wallet is, if Iris is at least 50% sure of it. When several apply, the most specific wins: a drainer before a bot, an MEV bot before a trader.
When neither is sure enough, the identity is UNKNOWN. That is an honest answer, not a failure: it means the wallet did nothing distinctive in the transactions read. Analyzing deeper can change it.
Threats
| Identity | What it is |
|---|---|
| Wallet drainer | Receives the full balance of wallets that did not mean to send it, or pulls their tokens through a signed approval. The end of a phishing or wallet-drainer kit. |
| Exploiter | Known to have exploited a protocol: hacks, oracle manipulation, bridge thefts. |
| Scammer | Known to run a scam: fake projects, rug pulls, fraud. |
| Phisher | Known to run phishing: fake sites and messages that trick people into signing. |
| Malicious contract | A program known to steal from those who interact with it. |
| Address poisoner | Sends dust from look-alike addresses to many wallets, hoping one copies the wrong address from its history. |
| Burner funding hop | A throwaway wallet that exists only to pass money along, funded and emptied at once, so the trail is harder to follow. |
Privacy
| Identity | What it is |
|---|---|
| Mixer | A pool that takes money from many wallets and pays it out to many others, so deposits and withdrawals cannot be matched by eye. Named after its protocol when known: Privacy Cash mixer. |
Wallets that use a mixer get the Uses a privacy pool behavior, not this identity. To follow money through a pool, see Tracing.
Exchanges and services
| Identity | What it is |
|---|---|
| Exchange | A wallet run by a centralized exchange. Named with its role when known: Kraken hot wallet pays out withdrawals, a deposit address collects one customer's deposits. (dormant) is added when it has been inactive for months. |
| Merchant | Takes payments: many payers, mostly stablecoins, repeated prices, payment references or memos. |
| DEX | A decentralized exchange program or pool. |
| Protocol | A known DeFi protocol: lending, staking, perps, bridges. |
| Protocol account | An account a program controls, with no private key behind it: a vault, a market, a pool authority. Named after its program: Kamino protocol account. No person signs for it. |
| Validator | Runs a Solana validator: most of its activity is consensus votes. |
Bots and traders
| Identity | What it is |
|---|---|
| MEV arbitrage bot | Runs swap loops that end with more than they started with, buying on one venue and selling on another within the same transaction. |
| MEV bot | Floods the network with transactions carrying priority fees, most of them failing because another bot got there first. Searching for the same opportunities, landing few. |
| Bot | Signs transactions faster than a person can, around the clock. Trading, sniping or automation. |
| Memecoin trader | Trades freshly launched tokens on launchpads. Never given to an MEV bot, even one that works memecoin pools. |
| Funder wallet | Pays out to a fleet of wallets at once, from its own money: the wallet behind a sniper, bundler or airdrop farm. Often sweeps them back later. |
| KOL | A known influencer's wallet, publicly attributed. |
People
| Identity | What it is |
|---|---|
| Personal wallet | A person: signs its own transactions at a human pace, with a modest history and a handful of counterparties. |
A personal wallet can still be risky
The identity says what a wallet is; the risk says whether to worry. A personal wallet that received from a drainer or deposited into a mixer is a personal wallet with medium or high risk.