Every crypto address leaves a trail. We keep the receipts.
ChainWitness finds where a crypto address was published — sanctions lists, exchange disclosures, research, paste sites, victim reports — and preserves the proof: dated, hashed and ready to show an investigator, a compliance officer or a court.
No card, no plan, no black-box score. Every claim links to its source.
Exhibit · Ethereum addressSanctioned
0x098B716B8Aaf21512996dC57EB0615e2383E2f96
Lazarus Group — Ronin Bridge exploiterListed by OFAC SDN · also in public attribution repositories
US Treasury · OFAC SDN14 Apr 2022
GraphSense TagPackspublic repository
captureWARC + screenshot + HTML
manifestSHA-256 of every file ✓
exposuretraced on-chain
An address ChainWitness tracks, as its report shows it.
ChainWitness in numbers
1M+attributed addresses, each with its source and date
100+sources: official lists, exchanges, vendors, research, repositories
5networks — Bitcoin, Ethereum, Tron, Solana, Cardano — plus USDT, USDC and LINK
7paste sites watched for bait wallets and scam drops
Figures of October 2026.
Why ChainWitness
Intelligence you can defend, not a score you have to trust.
Evidence, preserved the day it is seen
Every page where an address appears is captured on the spot: full-page screenshot, web archive (WARC), HTML and a manifest with the SHA-256 of each file. If the source changes or disappears, the original capture stays — and anyone can check the hash.
Confirmation counts origins, not copies
Three datasets repeating one tweet are one source. ChainWitness traces each label back to where it really came from and only calls an attribution corroborated when independent origins agree. When sources disagree, you see both.
Exchange wallets proven, not guessed
Wallets come from the exchanges' own proof-of-reserves — OKX, Binance, Bitfinex, HTX. Where the exchange signs each address, ChainWitness checks the signature. A wallet seen only in third-party lists is shown as a probable exchange, never as fact.
A person reviews what matters
Scam and bait findings from paste sites, and every report from a victim, are read by a person before they go public. Seed phrases and private keys are never shown. Anyone can request a review, and every decision is recorded next to the report.
How a finding is made
From a line on the internet to evidence in five steps.
01Collect
Sanctions lists, exchange reserves, research, public datasets and paste sites, on a schedule.
02Validate
Every address checked by format and checksum, on the network the source declares.
03Preserve
Screenshot, WARC, HTML and SHA-256 manifest, stored and never edited.
04Corroborate
Independent origins counted; conflicts surfaced, not hidden.
05Trace
On-chain exposure to sanctioned and scam wallets, and to the exchanges where funds can be frozen.
Built for
The people who have to be sure.
Compliance & risk
Exchanges, banks and fintechs screening a counterparty before funds move — with a record of what was known, and when.
Investigators & courts
Police, expert witnesses and lawyers who need dated, verifiable evidence — exportable as PDF or JSON with every hash.
Victims & researchers
People tracing where their money went and warning the next person; journalists following scams, hacks and sanctions.
Made by forensic practitioners
Built the way evidence is judged in court.
Built from the demands of real cases involving crypto-assets, where chain of custody is non-negotiable and the ecosystem rarely makes it easy.
A lead, not a verdict
A finding links an address to published content, not to a person. It tells you where to look; you decide what it means. Read the full disclaimer.
Open about every source
Every list is named, dated and linked. Nothing is scored by a model you cannot inspect.
Free to check
Search any address without an account. A free account opens full reports, watched wallets and alerts.
Before you send, before you sign, before you testify — check the address.