What the sanction and label feeds brought in over the last 24 hours, and what it turned into.
in the last 24 hours. OFAC, UK and EU lists are re-read every day, and every address already listed stays flagged.
1,130 addresses blocked by the issuer
10,740 addresses blocked by the issuer
2 re-checked
across 4 feeds
Counts only. Entity names where we have them, never addresses. Updated .
All incidentsWhere stolen money went, traced on-chain, with every transaction linked.
The press reported one victim and no recovery; on chain the attacker used delegations from 120 wallets, sent sven.eth 9.58 ETH back nine minutes after the sweep, and cashed 3.32 ETH out into a Binance deposit.
The Base exploit of 27 Aug was paid for with ~800 ETH from Tornado; 1.95M USDC bridged in, 8.73M back as unfreezable DAI; the attacker’s own gain is about $6.78M; all 8,728,319 DAI still sit on one Ethereum wallet.
Five projects’ vested tokens drained and dumped into thin pools for 14.93 ETH; 9M ZC stuck on the exploit contract; the gas wallet, funded from Tornado, was repaid 3.5 ETH; 13.72 ETH still on the attacker’s wallet.
Gas from Railgun, the loot back into Railgun 98 minutes later; both drained Safes run by one key, the only two Safes that ever enabled the adapter.
A second 100M mint nobody reported; the sales produced 291.7 ETH; 400 ETH of the reported 700.8 were on the wallet a week before; 93.5M unsold THEO sent to an older wallet funded from Binance and MEXC.
The six Ethereum addresses OFAC listed on 20 May 2026: $4.58M in, $4.39M into one Binance hot wallet within minutes; $989,000 withdrawn from Coinbase, swapped on Uniswap; last deposit 14 months before the listing.
A sanctioned address, a clean one, the same answer from the API — no signup.
By default—compliance for everyone. Free, fast, anonymous.
Traditional AML solutions are designed for banks and large centralized exchanges, leaving the decentralized crypto ecosystem vulnerable.
Wallets, OTC desks, and DeFi platforms remain blind to sanctioned addresses, scam operations, and high-risk transactions.
This creates a massive security gap that bad actors exploit daily, putting millions of users at risk.
PublicAML is the world's first free, real-time AML firewall that protects everyone in the crypto ecosystem.
Universal protection across all crypto wallets and platforms
Real-time detection and prevention of malicious transactions
Trusted by millions across the crypto ecosystem
RESTful API for real-time address checking
Developer-friendly SDKs for multiple languages
On-chain integration for DeFi protocols
Instant address checking via Telegram
We believe AML protection should be accessible to everyone in crypto, not just large institutions. That's why PublicAML is completely free and designed for easy integration into any platform.
From individual users to large platforms, everyone in crypto can benefit from AML protection
Protect users from sending funds to malicious addresses
Compliance and risk management for trading platforms
Real-time protection for decentralized applications
Personal protection for individual crypto users
Free, non-profit, no licence fee.
Built on principles of transparency, accessibility, and public good
Two axes set every number. What is alleged carries its own severity, who alleges it carries one trust rank from 0 to 100, and the score at the point of origin is the lower of the two. The whole derivation travels in the same response as the score, so you can check it instead of trusting it.
Read the methodologyseverity
source rank
A weak source cannot carry a heavy accusation, and a strong one cannot make a soft category heavy.
We believe that AML protection should be a public good, not a profit center. Our commitment to transparency and accessibility drives everything we do.
We're building the future of crypto security together. Testimonials and partner logos coming soon.
Journalists: see our press kit.
Drop-in REST & JS SDK for pre-transaction screening. Quick to integrate, secure, and reliable.
Simple HTTP endpoints for real-time address checking and risk assessment.
// REST API Example — no API key required
const res = await fetch('https://intelapi.publicaml.org/v1/enrich', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({
addresses: [
{
wallet_address: '0x742d35Cc6634C0532925a3b844Bc454e4438f44e',
chain: 'ETH',
},
],
}),
});
const { entities } = await res.json();
console.log(entities[0].aml_score); // 0–100
Real-time notifications when addresses are flagged or risk scores change.
// Webhook Integration
app.post('/webhook/publicaml', (req, res) => {
const { address, risk_score, risk_flags } = req.body;
if (risk_score >= 70) {
// Block transaction or show warning
console.log('High risk detected:', address);
}
res.status(200).json({ received: true });
});
Instant address checking via Telegram with inline results and risk alerts.
// Telegram Bot Integration
@bot.message_handler(commands=['check'])
def check(msg):
address = msg.text.split(' ')[1]
// Call PublicAML API
risk = publicaml.check_address(address)
if risk['risk_score'] < 30:
bot.reply_to(msg, '✅ Address looks safe.')
else:
bot.reply_to(msg, '⚠️ Address is risky.')
Our MCP server puts wallet screening, fund tracing and counterparty lookup directly into Claude, Cursor and any other MCP client. Ask about an address in plain language and the assistant checks it against PublicAML.
npx -y @publicaml/mcp-server{
"mcpServers": {
"publicaml": {
"command": "npx",
"args": ["-y", "@publicaml/mcp-server"]
}
}
}Bitcoin, Ethereum, BNB Chain and TRON. Works with no account; an optional API key only raises the rate limit. View on npm
It's free, fast, and protects your users.