Live data
What the sanction and label feeds brought in over the last 7 days, and what it turned into.
348 refreshed against the source lists
- BTCattributed
- BTCattributed
- ETH
- ETH
- TRON
- BTCattributed
11,047 addresses blocked by the issuer
1,195 addresses blocked by the issuer
Reports are reviewed before they affect a score
Flagged at the source, before propagation
- Solana MEV Bot King Loses $786,000 in AssetsThe Solana MEV bot King was drained of approximately $786,000 in assets. This incident involved the transfer of funds through drainer addresses and cross-chain bridging.
- Mercado Bitcoin Reports $40 Million LossMercado Bitcoin experienced a significant financial loss of $40 million. The details surrounding the incident remain unclear.
- BTCPay Server Reports Unauthorized Access to Hot WalletsBTCPay Server has reported unauthorized attacks on hot wallets across multiple instances. Operators are advised to shut down their instances immediately.
Counts only. Entity names where we have them, never addresses. Updated .
All incidentsLatest investigations
Where stolen money went, traced on-chain, with every transaction linked.
Binance Hot Wallet Exploit
The drain of Binance hot wallets on 29 October 2026: where the money went, which addresses hold it, and what is still open.
Binance hack: a Tornado-funded operator, three test runs the same afternoon, and about 430,737 stolen ETH parked on four wallets
The operator was funded by three Tornado Cash withdrawals, rehearsed EIP-7702 on its own wallets, then hijacked Binance 14 with 50 pre-signed authorizations: 197,540 ETH and 1.87B USDT to one collector in 24 seconds; 1.175B USDT frozen; 700M turned into ETH via UniswapX, Aave and Uniswap; about 430,737 ETH on four wallets that have never sent a transaction.
Initia exploit: the attacker bought its Initia gas with Tornado Cash ETH through Osmosis, tested the bridge it drained, and all 1,135.52 ETH still sit on one address
A forged MoveVM mint pulled 1.4M AUSD, 1.08M USDC and 105 ETH to Ethereum in seven minutes, swapped into 1,135.52 ETH and parked; the Initia signer is the same key as the Ethereum wallet, its gas was INIT bought with Tornado ETH via Axelar and Osmosis, and 29 minutes before the drain it sent a test through the same ETH bridge.
X100 exploit: the attacker’s gas came from FixedFloat, the second raid was run by a Limit Break attacker wallet, and on 26 October 821 ETH went into Tornado Cash
One flash-loaned transaction bought two of three Senate seats and made the treasury sell 400,000 X for 36 USDT; 4,749,726 USDT netted into 2,022.86 ETH, of which 821.1 ETH went into Tornado Cash on 26 Oct; FixedFloat funded the gas five minutes before; a wallet we filed for Limit Break ran the second raid and cashed 40.9 ETH out through ChangeNOW in twenty minutes.
USDD on TRON: $8.4 billion went USDT → USDD → USDT within two days in 2026, and $621 million of it came from wallets Tether froze, darknet guarantors or hacks
Every swap through the USDD stability module in 2026: 12.99B USDT in from 11,971 senders, 64% of redemptions are quick round trips, 7.4% of them tied to Tether-frozen wallets, Xinbi counterparties or hacks — the route the Ledger/CryptoBilis thief used, measured across the whole network.
Tornado Cash in 2026: at least 18% of the ETH that went in was stolen, over 40% of that by one attacker — and almost none of it can be traced out
All 64,860 deposits of 2026 read on chain: 645,194 ETH, at least 117,000 of it from published thefts, 48,805 from the Drift exploiter alone; bridges and DEX swaps are the main on-ramps, exchanges only 3–4%; only 4.7% of withdrawals link to deposits — compared with TRM, Chainalysis, Cambridge and academic studies.
Why PublicAML?
By default—compliance for everyone. Free, fast, anonymous.
The Protection Gap
Traditional AML solutions are designed for banks and large centralized exchanges, leaving the decentralized crypto ecosystem vulnerable.
Wallets, OTC desks, and DeFi platforms remain blind to sanctioned addresses, scam operations, and high-risk transactions.
This creates a massive security gap that bad actors exploit daily, putting millions of users at risk.
Our Mission
PublicAML is the world's first free, real-time AML firewall that protects everyone in the crypto ecosystem.
Works in every wallet
Universal protection across all crypto wallets and platforms
Blocks scams before they happen
Real-time detection and prevention of malicious transactions
Protecting wallets, OTC desks & DeFi platforms across the ecosystem
Trusted by millions across the crypto ecosystem
Easy Integration Options
API
RESTful API for real-time address checking
SDK
Developer-friendly SDKs for multiple languages
Smart Contract
On-chain integration for DeFi protocols
Telegram Bot
Instant address checking via Telegram
Free Forever, Easy to Integrate
We believe AML protection should be accessible to everyone in crypto, not just large institutions. That's why PublicAML is completely free and designed for easy integration into any platform.
Who Uses PublicAML
From individual users to large platforms, everyone in crypto can benefit from AML protection
Wallets
MetaMask, Trust, LedgerProtect users from sending funds to malicious addresses
OTC Desks
Over-the-counter tradingCompliance and risk management for trading platforms
DeFi/NFT
DEXs, NFT marketplacesReal-time protection for decentralized applications
Individual Users
Crypto traders, investorsPersonal protection for individual crypto users
Comprehensive Ecosystem Coverage
Individual Users
- Wallet protection and transaction screening
- Real-time scam and hack prevention
- Free access to AML data
Institutions & Platforms
- Easy API integration and SDKs
- Compliance and regulatory reporting
- Custom risk management solutions
Free, non-profit, no licence fee.
Why Trust PublicAML?
Built on principles of transparency, accessibility, and public good
The score is a stated policy, not a model
Two axes set every number. What is alleged carries its own severity, who alleges it carries one trust rank from 0 to 100, and the score at the point of origin is the lower of the two. The whole derivation travels in the same response as the score, so you can check it instead of trusting it.
Read the methodologyseverity
source rank
A weak source cannot carry a heavy accusation, and a strong one cannot make a soft category heavy.
Our Commitment to Trust
We believe that AML protection should be a public good, not a profit center. Our commitment to transparency and accessibility drives everything we do.
Data Sources
- OFAC sanctions lists
- EU sanctions database
- Verified scam databases
- Community-reported threats
Our Principles
- Free access for everyone
- Open source transparency
- No vendor lock-in
- Community-driven development
Join Our Growing Community
We're building the future of crypto security together. Testimonials and partner logos coming soon.
Journalists: see our press kit.
API & SDK Integration
Drop-in REST & JS SDK for pre-transaction screening. Quick to integrate, secure, and reliable.
REST API
Simple HTTP endpoints for real-time address checking and risk assessment.
// REST API Example — no API key required
const res = await fetch('https://intelapi.publicaml.org/v1/enrich', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({
addresses: [
{
wallet_address: '0x742d35Cc6634C0532925a3b844Bc454e4438f44e',
chain: 'ETH',
},
],
}),
});
const { entities } = await res.json();
console.log(entities[0].aml_score); // 0–100
Webhooks
Real-time notifications when addresses are flagged or risk scores change.
// Webhook Integration
app.post('/webhook/publicaml', (req, res) => {
const { address, risk_score, risk_flags } = req.body;
if (risk_score >= 70) {
// Block transaction or show warning
console.log('High risk detected:', address);
}
res.status(200).json({ received: true });
});
Telegram Bot
Instant address checking via Telegram with inline results and risk alerts.
// Telegram Bot Integration
@bot.message_handler(commands=['check'])
def check(msg):
address = msg.text.split(' ')[1]
// Call PublicAML API
risk = publicaml.check_address(address)
if risk['risk_score'] < 30:
bot.reply_to(msg, '✅ Address looks safe.')
else:
bot.reply_to(msg, '⚠️ Address is risky.')
API Features & Limits
AML screening inside your AI assistant
Our MCP server puts wallet screening, fund tracing and counterparty lookup directly into Claude, Cursor and any other MCP client. Ask about an address in plain language and the assistant checks it against PublicAML.
npx -y @publicaml/mcp-server{
"mcpServers": {
"publicaml": {
"command": "npx",
"args": ["-y", "@publicaml/mcp-server"]
}
}
}Bitcoin, Ethereum, BNB Chain and TRON, and Solana by labels and lists. Works with no account; an optional API key only raises the rate limit. View on npm
No excuse not to check AML.
It's free, fast, and protects your users.