Wallet reports
Labels
What Iris knows about an address before reading a single transaction, and how to tell who said so.
What a label is
A label is a fact about an address: it belongs to Binance, it is on a sanctions list, it drained wallets in a known campaign. Iris's knowledge base holds more than 100,000 of them, refreshed continuously.
Every label carries:
- A name: what the address is (the table below).
- An entity when known:
Kraken,Kamino, the sanctioned person's name. - Its source, and a link to it when it is public, so you can check it yourself.
- A confidence. Several independent sources agreeing raise it.
Label names
| Label | Meaning | Risk |
|---|---|---|
| Sanctioned | On an official sanctions list. Dealing with it can be illegal. | HIGH |
| Frozen by Circle | Circle froze the USDC it holds. | HIGH |
| Frozen by Tether | Tether froze the USDT it holds. | HIGH |
| Wallet drainer | Linked to a wallet-draining campaign. | HIGH |
| Exploit | Linked to a protocol exploit. | HIGH |
| Scam | Linked to a scam. | HIGH |
| Phishing | Linked to phishing. | HIGH |
| Malicious contract | A program that steals from its users. | HIGH |
| Mixer | A privacy protocol's pool. | Behavior |
| Exchange | A centralized exchange's wallet, with its role when known. | None |
| DEX | A decentralized exchange. | None |
| Protocol | A DeFi protocol. | None |
| Merchant | A business taking payments. | None |
| KOL | A publicly attributed influencer. | None |
Exchange wallet roles
An exchange runs many wallets, and they mean different things for an investigation. Iris names them by role when it knows it:
- Hot wallet
- Pays out customers' withdrawals. Money coming from it went to one of the exchange's users.
- Deposit address
- Belongs to one customer. Money sent to it is that customer's deposit: the exchange knows who they are.
- Collector
- Gathers deposits from many deposit addresses into the exchange's reserves.
- Cold wallet
- Reserves, rarely moving.
- Vault, treasury
- The exchange's own holdings, not its customers' flows.
Where the trail usually ends
A deposit address is often where stolen funds are cashed out. The exchange can identify its owner: that is the address to put in a report to them or to law enforcement.Flagged and known counterparties
A report lists the labeled wallets the analyzed one dealt with, in two groups. Flagged: threats and sanctions, with how many times money moved each way. Known: exchanges, protocols and DEXes. Each is a link to its own report.