Check crypto addresses before the transaction.
Aegis aggregates 120+ sanctions, fraud, exchange and DeFi label feeds into one verdict — so you never wire to a sanctioned, hacked or mixer-tainted address by mistake.
- Live screening across Bitcoin, Litecoin, Ethereum, BNB Chain, Polygon, Avalanche, Arbitrum, Optimism, Base, Plasma, Tron, Solana, TON
- 120+ sources in one consensus, no single-vendor lock-in
- App + API — pick your integration
- No match in OFAC, EU, UK or UN sanctions lists on the check date
- No exposure to mixer, hack or scam-tagged addresses within 2 hops in our data
- Sources, hops and dates listed in the report
- sources
- 120+
- networks
- 13
- labels
- 38M+
A crypto wallet whose users check the address before sending. And a clear visual map of fund flows.
Aegis provides an API for fast recipient-address screening.
One sanctioned hot wallet and its counterparties, risk-coloured. The Risky only filter drops everything below score 40 so the exposure stands out.
Three surfaces, one truth.
Built for VASPs, OTC desks, custodians and compliance officers who need to act on labels, not just see them.
Fast Check
Paste an address — get verdict, sanctions match, risk categories, source-by-source breakdown in under 3 seconds. Pay per check in credits, from $0.10.
Try Fast Check
Graph Lab
Arkham-style on-canvas exploration. Drag in addresses, follow inbound and outbound counterparties, group clusters, save the canvas as a shareable experiment.
Explore the graph
Experiments
Persist suspicious clusters, attach labels and risk overrides, run pattern detectors (smurfing, peeling chain, layering), export the full audit trail.
Build an experimentAML investigations, next level
Follow the money up to four hops in both directions: where an address got its funds and where they went. Exchanges, services, flagged counterparties and the unlabeled tail on one interactive map.
Illustrative demo: the addresses are generated and the attribution is fictional. In a real investigation hop 1 amounts are exact and deeper hops are a proportional estimate, not coin-by-coin tracing.
Investigate an addressWhy it mattersOne bad address can freeze your business.
One bad address can freeze your business.
Centralized exchanges block deposits the moment a counterparty touches OFAC, Tornado Cash, Garantex, Lazarus or any flagged mixer. Banks de-risk VASPs whose reports skip a sanction list. Auditors demand a paper trail every regulator can replay.
Sanctions exposure
OFAC, EU, UK, UN and more — the lists overlap only partly. A single missed list and your CEX freezes the deposit.
Hacked & stolen funds
Lazarus, Bybit hack, Wormhole, Ronin — once tainted USDT lands in your wallet, every downstream counterparty sees it.
Mixer & darknet exposure
Tornado Cash, Sinbad, Garantex, Hydra residue — most providers see only their own taint score. We unify the picture.
Built for everyone whose deposits can be frozen.
VASPs & exchanges
Pre-screen incoming deposits, run periodic re-screens on hot wallets, ship a Travel-Rule-ready report.
OTC desks & PSPs
Verify counterparty wallets before quoting. Avoid the chargeback that started with a hacked deposit two hops away.
Treasury & funds
Continuously monitor every address you control. Get alerted when a counterparty wallet picks up new risk.
Compliance & audit
Reproducible reports with source attribution. Every verdict comes with the evidence trail a regulator can replay.
How it worksVerdict in three steps.
Verdict in three steps.
Any BTC, LTC, EVM, TRON, Solana or TON address — paste directly or upload a CSV of partner wallets.
We query 120+ label feeds in parallel — sanctions, exchange clusters, DeFi, fraud reports, hack attributions — and reconcile them into one consensus.
A risk level with the evidence behind it: severity, source list and the exact taint hops. Apply your own policy and keep the report for the auditor.
120+ feeds, one verdict.
Sanctions
- OFAC SDN
- OFAC Consolidated
- UK FCDO/OFSI
- EU CFSP
- UN Security Council
- Canada SEMA
- Switzerland SECO
- Australia DFAT
- US BIS Entity List
Exchanges & clusters
- Binance
- OKX PoR
- Coinbase
- Bybit
- GraphSense clusters
Fraud & hacks
- Tether blacklist
- Chainabuse
- CryptoScamDB
- Lazarus attributions
DeFi & protocols
- Tornado Cash
- DefiLlama
- Etherscan tags
- Arkham
BridgesCross-chain hops, unpacked
Cross-chain hops, unpacked
A bridge is not a dead end. For each protocol below we read the deposit on the source chain and follow it to the recipient on the other side, so the trail continues across networks.
Stargate (LayerZero)
Wormhole
Across
deBridge DLN
Celer cBridge
Relay
NEAR Intents
Rubic
THORChain
Allbridge Core
Bridgers
CoW Protocol
We use each protocol's own public API or on-chain events. Synapse and Railgun are recognised, but their hops are not resolved yet.
How we unpack Tornado Cash
Tornado pools take one fixed amount per deposit, so every deposit and withdrawal of a pool looks alike. What remains observable is who deposited, who received, how much and when. We index all of it ourselves and correlate on those four facts.
- 1Index both sides
Every deposit into a pool, direct or through the routers, and every withdrawal out of it. A withdrawal is recognised by the pool paying out the denomination minus a relayer fee.
- 2Group into vouchers
Consecutive deposits of one denomination by the same address within 24 hours form a voucher of N deposits.
- 3Match by amount and timing
Within a window after the deposits (30 days by default) we look for recipients that received exactly N withdrawals of that denomination. They are the candidate exit addresses.
Covered: ETH pools of 0.1 / 1 / 10 / 100 ETH; DAI, cDAI, USDC, USDT and WBTC pools; and the Polygon, Optimism, BSC, Avalanche, Arbitrum and Gnosis deployments.
The result is a lead for an analyst, never a verdict: overlapping windows produce false matches, and deposits made through a router hide the depositor.
NetworksWhat we see, across 13 networks
What we see, across 13 networks
Updated once daily. Every number below is rounded — this page is a trust signal, not a data feed.
Aegis and alternatives
What address and transaction screening services can do. Filter by region and capability. The table only shows what public sources confirm.
Showing 19 of 19 alternatives
| Service | Networks | Price | Free | Graph | AI mode | x402 / MCP | Named entities | For customers in Russia / CIS |
|---|---|---|---|---|---|---|---|---|
| Aegis CISEnterprise + retail | 13 networksBTC, LTC, EVM, TRON, SOL, TON | from $0.10x402: $0.10 quick screen, $1 full check | 10 creditson the web; 3 on Telegram | Graph Lab | AI synthesis + AI Trackan LLM reconciles source disagreements into one verdict; AI Track Stolen Funds traces stolen funds | x402pay per call in USDC on Base, no contract | Yesnamed-entity database | Yes |
| Chainalysis GlobalEnterprise | — | — | — | Reactor | AI agentsannounced 03.2026 | — | — | — |
| TRM Labs GlobalEnterprise | 185+ | — | Sanctions screeningfree tool | — | ArdenceAI investigation platform, 10.2026 | — | — | — |
| Elliptic GlobalEnterprise | 65+ | — | Free trial | Investigator | Copilotsince 04.2025 | — | Yesclaims 1B+ labelled addresses | — |
| Crystal Intelligence GlobalEnterprise | 330+ | — | — | Crystal Expert | Ask Crystal07.2026 | — | Yes110K+ entities | — |
| Merkle Science GlobalEnterprise | 15–28sources disagree | — | — | Tracker | — | — | — | — |
| Scorechain GlobalEnterprise | 21–25+sources disagree | — | Sanctions APIand wallet checks | Flux Analysis | Scorechain AI | MCPlicensed customers only | — | — |
| MistTrack GlobalEnterprise + retail | 19 | from $0.03 per callsubscriptions from $229/mo; packs $0.10–0.20 | MistTrack Lightand a 7-day trial | Risk Graph | AI Agent Skills | MCP + x402x402 listed as a payment option; details not published | Address labels | — |
| AMLBot CISRetail / bots | 23AI Tracer: 14 | $0.35–0.45Lite; Pro on request | Demo + AI Tracer trial | AI Tracertraces funds from a transaction hash | AI Traceran investigation tool, not a verdict explainer | — | Exchange labelsin AI Tracer | — |
| BitOK CISEnterprise + retail | 5 in the botblog claims 15+ | ≈ 19–35 RUBbot; Graph from $500/mo | — | Graph Analytics | — | — | Yes40K+ entities | YesRUB pricing in the bot |
| Alpha AML CISRetail / bots | 5 | from $0.20 | Up to 3-month trialbusiness | — | — | — | — | — |
| GetBlock AML CISRetail / bots | 5–9the vendor's two sites disagree | $0.33–1bot; API "from ~$0.20" | 1 + bonuses | — | — | — | — | Yescard or crypto |
| CryptoAML.ai CISRetail / bots | 17 | $1 | 1 check | — | — | — | — | YesUSDT, Telegram Stars |
| Change.PRO CISRetail / bots | — | $1 | 1 + own blocklist | — | — | — | — | — |
| SHARD CISEnterprise | 7BTC, ETH, TRX, LTC, BNB, TON, BCH | from 29 RUBpacks of 10 / 250 / 1,000 | 3 checks | YesPNG/CSV export, bridges marked | — | — | — | YesRUB pricing, Russian software registry |
| CoinKYT CISEnterprise + retail | 3BTC, ETH, TRON | from $0.07with API; Lite from 3.6 RUB | 3 checks | PRO only | — | — | PROclaims 1B+ labelled addresses | YesRUB pricing |
| Btrace (AML Crypto) CISEnterprise + retail | 3ETH, BTC, TRON | $0.08–1 | 1 check | Bholdera separate product | — | — | — | Yescard, crypto |
| Inchain (Innotech) CISEnterprise | 30+ coinsnetwork list not published | — | — | — | — | — | VASPs, criminal addresseslabelling focused on Russia | YesRussian software registry no. 21728 |
| Transparent Blockchain CISState system | 30+ coins | — | — | — | — | — | Yesgrey addresses, VASPs; closed database | Authorities and 5 banks onlyno commercial access |
| Match Systems CISEnterprise + retail | 6BTC, ETH, TRON, BSC, TON, POLYGON | from $0.08depends on volume | Risk snapshot | — | — | — | — | — |
Compiled from public sources: vendors' websites and documentation, and press. Prices and capabilities change, so check current terms with each vendor.
Pay per check. No contract.
Start free in the web app, then call the same engine from your own code. The V2 API and x402 use the same prices.
Web app
Fast Check, Graph Lab and Experiments in the browser. Sign up and run your first checks at no cost.
Open the appx402 pay-per-call
$0.10 quick screen, $1.00 full address check or transaction check. Paid in USDC on Base per call, no account and no contract. Built for agents and scripts.
See x402V2 API
Same two prices over a standard REST API with a single decision field in the response. OpenAPI spec and docs are public.
API docsQuestions buyers ask first
Which sanctions lists does Aegis cover?
OFAC SDN (US), the EU consolidated list (CFSP), the UK sanctions list (OFSI), plus on-chain freeze events from Tether, Circle (USDC), and Paxos.
How is Aegis different from a single-vendor KYT check?
A single-vendor KYT service only sees its own internal label graph. Aegis aggregates independent feeds — sanctions, exchange clusters, GraphSense, issuer on-chain freeze events, hack-attribution research — and produces a consensus verdict so you’re not blind to a list your vendor missed.
How fast is a check?
Paste an address and get a verdict in ~3 seconds — sanctions matches, risk categories, and a breakdown by source.
How much does a check cost?
The web app starts with 10 free credits. For API and agent use, a quick screen costs $0.10 and a full address or transaction check costs $1.00, paid per call in USDC on Base with no contract. The V2 API uses the same prices.
What do the risk levels mean?
Aegis shows six levels: unknown (no data), none/low (no significant risk found in our data), medium, high, critical, and sanctioned (a direct sanctions-list match). Each level maps to a color on the transaction graph, from gray (no data) to black (sanctioned).
Is my check data kept confidential?
Yes — see our Privacy Policy for details.
What is Aegis KYT?
Aegis KYT is a crypto wallet screening (KYT/AML) service. We check an address against dozens of independent sources — sanctions lists, hack attributions, exchange clusters, DeFi protocols — and return a single risk assessment to help you spot sanctioned, hacked, or mixer-tainted addresses before you transact.
Which blockchains does Aegis support?
12 networks today: Bitcoin, Litecoin, Ethereum, BNB Chain, Polygon, Avalanche, Arbitrum, Optimism, Base, Plasma, Tron, and Solana. The list grows as the platform does.
How many data sources does Aegis use, and how do they become one verdict?
120+ sources today: sanctions lists, issuer on-chain freeze events, exchange clusters, DeFi protocols, hack attributions, and open research data. Every label carries a trust weight and a timestamp; we reconcile every match into one consensus verdict rather than trusting a single source.
Where does Aegis get its labels and data from?
From 100+ sources in total. Below, in the Sources section, we publish the sources with open licenses (MIT, public domain, CC-BY) — government sanctions lists, stablecoin-issuer on-chain freeze events, and independent open-source research datasets. Restricted-license commercial sources feed into risk scoring but aren’t published here.
Does Aegis help with Travel Rule compliance?
Aegis doesn’t transmit originator/beneficiary data itself — that’s handled by dedicated travel-rule messaging providers (Notabene, Sygna, and similar). We cover the other half: screening the counterparty address itself, which is the due diligence Travel Rule compliance relies on.
What SLA do you offer?
We don’t publish a formal uptime SLA yet — a check itself typically returns in about 3 seconds, which is the service’s actual speed, not a contractual promise. For partners, the support channel and response-time SLA are set in the contract; everyone else can reach us at hello@aegis-kyt.com.
How do I get help or report an issue?
Email us at hello@aegis-kyt.com or check the documentation — both are linked in Contacts below.
Check your first address in seconds.
Open the app with free credits, or leave an email and we will send access.