The test: six addresses, known answers
Each address below is public and its status is documented by OFAC, the FBI or an exploit post-mortem. Scores are from each tool’s own report page on 25 October 2026.
| Address | What it is | Claroscan | PublicAML |
|---|---|---|---|
Houthi (Ansarallah) USDT wallet TQ5mpZPb…siTpFZ | On the US OFAC sanctions list (SDN), TRON | 25 / 100 — “not found in the sanctions databases we check” | CRITICAL — sanctioned (OFAC) |
Chen Zhi / Prince Group Bitcoin bc1qeth6…j0gkhw | On the OFAC SDN list, Bitcoin | 100 / 100 — on the OFAC list | CRITICAL — sanctioned (OFAC) |
Tornado Cash 100 ETH pool 0xA160cd…53f291 | Mixer contract, Ethereum | 0 / 100 — “no links to scams, sanctions or flagged wallets” | CRITICAL — mixer |
Initia exploit attacker (23 Oct 2026) 0xDD922c…f6edFA | Received the stolen AUSD, USDC and ETH | 75 / 100 — labelled “wallet-draining attacks” | CRITICAL — hack (Initia MoveVM exploit) |
Bybit exploiter (21 Feb 2025) 0x47666F…9486E2 | Received the stETH, cmETH and mETH from Bybit’s cold wallet | 100 / 100 — Blockscout scam tag, SlowMist report | CRITICAL — hack (Bybit cold wallet, Feb 2025) |
vitalik.eth 0xd8dA6B…A96045 | Clean personal wallet | 0 / 100 | LOW — individual |
What Claroscan does well
It is free, needs no account for a check, and says plainly that an AML check never needs a wallet connection or a signature — the exact trick fake “AML check” sites use to drain wallets. The report is short, gives a 0–100 score with one line per point, and warns about address-poisoning transfers in the wallet’s history.
Where it falls short
Measured on 25 October 2026:
- Sanctions on TRON: the Houthi USDT wallet on the OFAC list scored 25 and was reported as not found in sanctions databases. TRON is where most USDT moves.
- Mixers: the Tornado Cash 100 ETH pool itself scored 0.
- Look-alike addresses: on the Initia attacker’s report, a look-alike address that only sent fake “ETH” tokens was shown as the “real (paid before)” one. Copying an address from that panel is exactly what address poisoning counts on.
- Solana: a report on a busy wallet read only its last 6 transfers and checked them against the OFAC list; the wallet’s owner was not identified.
- No public API and no published rate limits: the terms forbid working around “rate limits or the human check”.
- Age: the domain claroscan.tech was registered on 17 October 2026 (RDAP), eight days before this test.
Why the results differ
Claroscan says on its About page that it reads public APIs: mempool.space for Bitcoin, Blockscout (including its scam labels) for Ethereum, TronGrid for TRON, GoPlus Security for address and token risk, the OFAC list, and CoinGecko and Binance for prices. It checks an address and its most frequent counterparties. PublicAML indexes Bitcoin, Ethereum, BNB Chain and TRON itself and propagates risk several hops along the money: sanctions and issuer freezes, stolen funds from traced incidents, mixers, darknet services and scams. That is why a sanctioned TRON wallet or a mixer pool shows up for us and not for a checker that only looks one hop out.
Which one to use
For anything that touches USDT on TRON, sanctions, mixers or stolen funds, PublicAML is the more complete check: it covers every source in the table below and follows the money several hops. Whatever you use: never connect a wallet or sign anything to “check” an address, and send a small test amount first.
Data sources side by side
Claroscan’s list is from its own About page; ours is what the PublicAML risk engine reads.
| Source | Claroscan | PublicAML |
|---|---|---|
| OFAC sanctions list | Yes (snapshot 17 Oct 2026) | Yes, plus UK OFSI and EU lists |
| FBI public service announcements | No | Yes |
| Tether and Circle freezes | No | Yes |
| Traced hacks and exploits (own investigations) | No | Yes |
| Mixers (Tornado Cash, Railgun and others) | No | Yes |
| Darknet and scam entities | Through GoPlus | Yes |
| Phishing blocklists | Through GoPlus and Blockscout tags | ScamSniffer and others |
| Multi-hop risk along the money flow | No (top counterparties only) | Yes |
| Own node / index of the chain | No (public APIs) | Yes (BTC, ETH, BNB, TRON) |
| Public API | No | Yes, free, no key needed |
Questions
- Is Claroscan free?
- Yes. A wallet report needs no account. It also offers “Claroscan ID” username cards, free for the first 10,000, and reads exchange API keys (read-only, it says) to verify deposit addresses.
- Does Claroscan have an API?
- Not a public one as of 25 October 2026: /api answers 404, there is no documentation, and its terms forbid scraping. PublicAML has a free REST API that works without a key.
- Which is better for USDT on TRON?
- In this test PublicAML flagged the OFAC-listed Houthi TRON wallet as sanctioned; Claroscan scored it 25 and did not find it in sanctions databases.
Test run on 25 October 2026 by PublicAML. Claroscan results are from its public report pages that day; its data sources, terms and privacy statements are quoted from claroscan.tech; the domain’s registration date is from RDAP. Sanctions status from the OFAC SDN list; the Bybit exploiter from the on-chain transfer out of Bybit’s cold wallet on 21 Feb 2025, the Initia attacker from our trace of 25 Oct 2026. PublicAML is one of the two tools compared — read accordingly. This is not financial or legal advice.