Tainted crypto: what a flag actually means.

The short version

• Taint is a score, not a property. No blockchain marks a coin as dirty. A private vendor labels addresses, a tracing rule propagates those labels through the graph, and an institution decides which number is too high.
• The same coins get different scores. Vendors disagree on attribution, tracing rules disagree on arithmetic, and every venue sets its own threshold. A deposit refused at one exchange clears at another the same afternoon.
• Most flags are not criminals. Illicit activity is a fraction of one percent of on-chain volume, and at that base rate even an accurate classifier produces mostly false positives.
• Laundering offences need a mental element; sanctions do not. Receiving unknowingly is generally not the offence — continuing after suspicion is. US sanctions liability is the exception, and it is strict.
• The dangerous moment is consolidation, not receipt. Merging outputs of different provenance in one transaction fuses their histories permanently and is not undoable.
• A swap does not clean anything. It ends the readable trail forward; the deposit remains recorded, and converting known proceeds to disguise them is the offence itself.
• Opaque ledgers cannot be scored, so venues rated the asset instead. The risk moved from the coin to the venue policy, which is why several large exchanges delisted Monero rather than price it.

Taint is a score, not a property of a coin

The most useful thing to understand about tainted crypto is that the phrase describes a claim somebody is making about your coins, not a state your coins are in.

Nothing on any public ledger records that a coin is dirty. Bitcoin has no field for it. Ethereum has no opcode for it. No consensus rule anywhere recognises the concept, no node validates it, and there is no registry a coin can be looked up in to receive a verdict. A satoshi that passed through a ransomware wallet in 2021 is bit-for-bit identical to one that was mined yesterday, and every piece of software that actually moves value treats the two the same way.

What exists instead is an industry. A handful of analytics vendors maintain private databases that attach labels to addresses — this cluster is a darknet market, that one is a sanctioned exchange, this one belongs to a ransomware family. Given a deposit, the vendor walks the transaction graph backwards from your address, finds whatever labelled sources appear within some number of hops, and applies a tracing rule to decide how much of your balance to attribute to each of them. The output is a percentage, or a category, or a colour. An institution then compares that output against a threshold it chose and decides whether to accept your money.

Three consequences follow from that description, and they are the ones people find surprising:

• The score is an opinion, and opinions differ. Vendors do not share attribution databases, and they do not use identical tracing arithmetic. The same coins submitted to two vendors on the same morning can come back materially different.
• The threshold belongs to the institution. A vendor supplies a number; a compliance team decides what to do with it. A bank-adjacent venue with a licence to protect will act on exposure that a higher-risk-tolerance venue ignores entirely.
• Nothing about it is permanent or portable. Labels get added, corrected and retired. Coins refused today can pass in six months because a cluster was reattributed, and coins that passed for years can start failing because a new label landed upstream of them.

This is not a criticism of the vendors, who are mostly solving a genuinely hard problem with the only data available. It is a correction to the mental model most people arrive with, which imagines a permanent stain attached to a specific coin. There is no stain. There is a company with a database, a rule for propagating labels through it, and a customer who pays for the answer.

How a risk score is actually built

Every screening product does the same four things in the same order. Understanding the sequence tells you where the errors enter.

1. Attribution: attaching a name to a cluster

The raw ledger is pseudonymous, so the first job is deciding which real-world entity controls which addresses. Vendors cluster addresses using the same heuristics described in our chain-analysis guide — common-input ownership, change detection, behavioural fingerprints — and then attach labels from law-enforcement co-operation, court filings and seizure notices, undercover purchases at the services themselves, scraped published addresses, and open-source reporting. This stage is where most of the value and most of the error live. A label can be stale, over-broad, or simply wrong, and you have no visibility into any of it.

2. Tracing: propagating the label to you

Once a labelled source exists, the vendor must decide how much of it reaches your address. This is arithmetic on the graph rather than observation, and — as the next section explains — there is more than one defensible way to do it. The choice of rule can change your number by an order of magnitude on identical inputs.

3. Weighting: direct versus indirect exposure

Screening distinguishes direct exposure — the funds came straight from a labelled address — from indirect exposure, where one or more hops sit between. Direct exposure to a serious category is treated as close to dispositive. Indirect exposure is discounted with distance, because at four or five hops from anything, a meaningful share of the entire network is implicated and the signal collapses into noise. Categories are also weighted differently: a sanctioned entity is not treated like an online casino, even though both may appear in the same report.

4. Thresholding: somebody decides

Finally an institution converts the score into an action: accept, review, request source of funds, freeze, report. This step is invisible to you, uses a policy you will never read, and is the only step that has any effect on your day. It is also why the question are my coins tainted? has no answer in the abstract. The only meaningful version is will this venue, with this policy, accept these coins today?

Three tracing rules, three different answers

This is the part that is rarely explained outside the literature, and it is the clearest evidence that a risk score is a construction rather than a measurement. Suppose a transaction takes in one coin from a labelled source and nine ordinary coins, and pays out ten coins to ten people. How much taint does each recipient receive?

• Poison. Any output touched by tainted input is entirely tainted. All ten recipients receive fully tainted coins. The rule is simple and it is catastrophic in practice: a single contaminated input taints an unbounded set of downstream users within a few hops, which is why almost nobody applies it literally.
• Haircut. Taint is spread proportionally. Each of the ten recipients receives ten percent taint. This is intuitive and it degrades badly with distance — after several hops through high-volume services almost everything carries a small non-zero score, and the number stops distinguishing anything.
• First-in-first-out. Coins are treated as an ordered queue: the first satoshi in is the first satoshi out. Exactly one recipient receives the tainted coin and the other nine receive nothing. This rule has an unexpected pedigree — it is the rule from Clayton's Case, a nineteenth-century English decision about mixed bank accounts, and researchers have applied it directly to Bitcoin precisely because courts already reason that way about commingled funds.

All three are defensible. All three are in use. They give different answers about the same transaction, and none of them is the truth, because there is no fact of the matter about which specific satoshi in a mixed output came from where. The ledger records amounts, not identities of individual units. Everything past that point is a convention chosen by whoever is doing the counting.

Keep this in mind when a service tells you your coins are ninety percent clean or forty percent risky. That figure is the output of a chosen convention applied to a private database, not a measurement of anything in the world.

What actually triggers a flag

Not all labels are equal. Roughly in descending order of how seriously they are treated:

• Sanctions designations. The only category with a public, authoritative list and the only one carrying strict liability in the United States. OFAC has published specific crypto addresses on the SDN list since 2018, and the EU, UN and UK maintain their own consolidated lists. Every serious screening product treats a match here as a hard stop.
• Stolen funds and hack proceeds. Increasingly the largest single driver of high-value flags, and dominated by a small number of very large incidents — the 2025 theft from a major centralised exchange, publicly attributed to North Korean state-linked actors, moved well over a billion dollars of labelled funds into the graph in a single day. Coins downstream of an incident like that stay conspicuous for years.
• Ransomware. Well attributed because victims and incident responders report the payment addresses, and treated with near-sanctions seriousness because paying certain groups can itself be a sanctions violation.
• Darknet markets. The historical archetype. Attribution is strong, since investigators buy from the markets themselves and seize their servers.
• Mixers and tumblers. Treated as high risk almost universally, and occasionally sanctioned outright — Blender.io in May 2022, Tornado Cash in August 2022, Sinbad in November 2023. The Tornado Cash designation is also the clearest illustration that these categories are contested rather than settled: a US appeals court held in late 2024 that immutable smart contracts are not property that can be blocked, and the designation was withdrawn in March 2025. Screening policies at individual venues did not all follow.
• Fraud and scam proceeds. Attribution quality varies enormously here, because much of it comes from victim reports rather than verified investigation.
• High-risk venues. A policy category rather than a criminal one, covering gambling sites, exchanges with weak controls, peer-to-peer marketplaces and — stated plainly, because it applies to us — non-KYC and instant-swap services. Nothing improper needs to have happened for a deposit to land in this bucket.

The last two categories are where ordinary users actually get caught. Almost nobody reading this is going to touch a sanctioned address. Very many people have received a payment from a peer-to-peer trader, or cashed out through a service their next venue classifies as high risk.

Why most flags are not criminals

Screening has a base-rate problem, and it is arithmetic rather than opinion.

The most-cited industry estimates put genuinely illicit flows at a fraction of one percent of on-chain transaction volume — the exact figure moves between reports and is routinely revised upward in later editions as attribution improves, but every serious estimate lands well under one percent. Now consider what that does to a classifier. When the thing you are looking for is rare, even a test with excellent accuracy generates far more false alarms than true ones, because the overwhelming majority of cases it examines are negative. This is the base-rate fallacy, it is the same reason mass medical screening for rare diseases produces mostly false positives, and no amount of vendor sophistication makes it go away.

Four mechanisms turn that statistical pressure into real, specific false positives:

• Commingling at ordinary services. Centralised exchanges pool customer funds in omnibus hot wallets. Withdrawals from them are, in tracing terms, a few hops from every deposit that venue ever received — including the bad ones. Perfectly ordinary exchange withdrawals therefore carry indirect exposure by construction.
• Change outputs. Bitcoin returns change to you as a new output. A tracing rule that misidentifies which output was change misallocates taint between you and your payee, and change-detection heuristics are inferential rather than certain.
• Stale and over-broad labels. A cluster may be labelled from a single observation years ago, and clusters merge as new heuristics land. An address can inherit a label because of a co-spend it was never party to.
• Distance. Indirect exposure at four or five hops implicates a large share of the network. Where a venue screens deeply and thresholds tightly, it is not detecting crime, it is detecting participation in the economy.

The honest summary: a flag is weak evidence about you and strong evidence about a policy. It tells you a threshold was crossed. It does not tell you that anything wrong happened, and the people operating the system know this — which is exactly why the usual response is a question about source of funds rather than an accusation.

What "tainted" means legally, which is nothing

No jurisdiction recognises taint as a status. There is no statute under which coins are dirty and no court that issues that finding. What exist are three separate bodies of law that can each be engaged by the same facts, and conflating them is the most common mistake in this subject.

Money laundering: the mental element does the work

Laundering offences are built around what you knew or suspected. The offences in most regimes require knowledge, belief or suspicion that the property represents the proceeds of crime, which is why passively receiving a payment you had no reason to question is generally not the offence. The exposure begins at the moment something makes you suspicious and you carry on anyway — moving the funds, converting them, splitting them, or arranging their transfer after that point is where liability attaches. In the UK the threshold is expressly one of suspicion rather than knowledge, and a separate reporting duty sits on people working in the regulated sector. The practical lesson is unglamorous: if a payment starts to look wrong, stopping is safe and improvising is not.

Sanctions: strict, and the exception to everything above

Sanctions do not care what you knew. US civil sanctions liability is strict, which means a transaction involving a designated person or address can be penalised without intent, knowledge or negligence on your part. Other regimes are less absolute but none of them treat ignorance as a complete answer. This is why the free, public, authoritative sanctions lists are the one check worth performing every single time, and why they are the only category in this entire guide where a mechanical check genuinely protects you.

Property law: the victim can follow the coins

Separately from any criminal question, several common-law jurisdictions now treat crypto-assets as property capable of being traced and recovered — the English courts have granted proprietary injunctions over stolen crypto since 2019, and other jurisdictions have followed. A theft victim may therefore have a civil claim against assets in your hands, subject to the usual defences for a good-faith purchaser for value without notice. This route runs entirely independently of whether anyone accuses you of anything, and it is the one most people never consider.

What none of these produce is a general legal duty on an ordinary individual to screen incoming payments. That duty sits on regulated institutions. What you have instead is exposure to their policies, which is a practical problem rather than a legal one, and which is what the rest of this guide is about.

What actually happens when a deposit is flagged

The consequence depends entirely on whether the party holding your funds can hold them.

At a custodial exchange

The withdrawal is paused, an automated or manual review opens, and you receive a source-of-funds request — sometimes with a document upload attached. If the review does not satisfy the compliance team, outcomes range from a permanent withdrawal restriction to account closure, and in serious cases a suspicious activity report to the national financial intelligence unit. Two features of this process routinely infuriate people and are worth understanding before you are in it:

• Nobody may be able to tell you why. Where a report has been filed, disclosing that fact to the customer is itself an offence in the UK and across much of the EU. An agent giving you a non-answer may be complying with the law rather than stonewalling you.
• Your funds are in their custody, so their policy is the only one that matters. There is no appeal to the ledger. This is the structural cost of custody, and it is the same cost whether the trigger is a screening hit, a court order or a commercial decision.

What helps: answering quickly, answering specifically, supplying documents that actually correspond to what was asked, and never changing the account of what happened. What hurts: vagueness, delay, indignation, and any attempt to move funds elsewhere mid-review.

At a non-custodial swap

The structure is different because nobody in the chain is holding a balance for you. In our case the upstream routing provider screens the deposit and payout addresses against sanctions feeds and analytics risk scores, and when it flags an order the order page enters an explicit state offering a refund to an address you supply at that moment. Identity documents are never a precondition for a refund — that is the whole point of a refund-first flagging policy, and it is written down rather than merely implied. Where the flag concerns a late deposit or rate drift rather than screening, you can alternatively accept the current market rate and let the swap complete. If you think a flag is mistaken, you may volunteer context about the source of funds at your discretion and we forward it upstream for reassessment; the upstream provider keeps final discretion, and we will not pretend otherwise. The mechanics of every order state are in the troubleshooting guide.

The asymmetry is worth naming: a custodian can freeze you, a non-custodial router can only decline you. Declining is a considerably better worst case, and it is one of the few places where the architecture — rather than the promises — does the protecting.

Checking coins before you accept them

You can do a real check for free, and you cannot do the check you probably imagine at all. Both halves matter.

• Sanctions lists: free, public, authoritative, and the one that counts. OFAC publishes designated crypto addresses in its SDN list with a searchable interface; the EU consolidated list, the UN Security Council list and the UK sanctions list are equally public. This covers the strict-liability category, takes a minute, and is the only screening step with a definitive answer.
• Block explorers with entity labels. Several public explorers annotate well-known addresses. Useful for orientation, not remotely comprehensive, and absence of a label means nothing at all.
• Free vendor lookups. Some analytics firms expose a limited single-address check. Treat the result as directional: it is not the database your exchange licenses, it is not scored with your exchange thresholds, and a clear result is not a clearance.
• Anything selling you a clean bill of health. Sites offering an "AML check" for a fee, or offering to clean or wash coins for a percentage, are either harvesting the addresses you submit, taking your money, or soliciting you to commit an offence. There is no legitimate product in that category. A genuine problem is answered with provenance documents, not with a certificate bought online.

One more practical point that people get backwards: the address you most need to check is not yours, it is the one you are about to receive from. Screening your own wallet after the funds land tells you about a decision you already made.

The routine that keeps this from happening

Seven habits, in the order they matter. All of them are free, and none of them can be applied retroactively — which is the entire reason they matter.

1. Ask the provenance question before the money moves. Decide whether you could comfortably explain where a payment came from before you hand out an address, not after it arrives.
2. Fresh receiving address for every counterparty. Costs nothing, supported everywhere, and it is what makes one questionable receipt isolable later rather than fused with everything else.
3. Never merge outputs of different provenance. Spending two coins together publicly asserts common control and permanently joins their histories. Use coin control; treat consolidation as irreversible, because it is.
4. Screen against the sanctions lists, every time. Free, authoritative, one minute, and it is the only category where a mechanical check actually protects you.
5. Write down provenance on the day. Who paid, what for, which transaction. A source-of-funds request can arrive years later and memory will not answer it.
6. Refuse to move money for strangers. A percentage offered for receiving and forwarding funds is money-mule recruitment regardless of the cover story, and willingness rather than knowledge is often enough for liability.
7. Keep the identified leg and the private leg apart. Decide in advance which funds will end at a venue that asks questions. Mixing the two means the strictest policy in the chain governs everything you hold.

Items two and three are the whole game. Nearly every difficult case has the same shape: an unchecked receipt lands in the main wallet, gets consolidated with older coins during an ordinary spend six weeks later, and permanently attaches its score to funds that had nothing to do with it. The receipt was recoverable. The merge was not.

Why opaque ledgers cannot be scored — and what venues did instead

Scoring requires a graph to walk. Monero does not publish one: outputs are not linkable to a sender, amounts are concealed by confidential transactions, and ring signatures mean the true spend among the decoys is not identifiable. There is no path for a tracing rule to follow and no history to price, so the concept of a per-coin risk score simply does not apply. The cryptography behind that is covered in private crypto explained.

Venues did not respond by accepting the coins. They responded by rerating the asset. Between 2023 and 2024 several of the largest regulated exchanges delisted Monero or restricted it in specific jurisdictions, on the stated basis that they could not perform the screening their obligations require. The risk did not disappear — it moved from the individual coin to the question of which venues will deal in the asset at all.

That trade-off is worth stating without spin, because it cuts both ways. An opaque asset cannot be scored against you, and it is also less liquid at regulated venues and more likely to attract attention when it is converted back into something transparent. Which side of that you prefer depends on your threat model, and pretending there is no cost would be dishonest.

A swap does not clean coins

This deserves its own section because it is the single most common misconception in the subject, and because a site that sells swaps has an obvious incentive to leave it fuzzy.

Converting an asset does not remove its history. The deposit is recorded permanently on the chain you left, with its amount and its timestamp; the fact that the far side is unreadable does not unwrite the near side. What conversion does is end the readable trail forward — and that is a genuinely different thing from erasing what came before.

The legal position is unambiguous and worth being blunt about. Converting property in order to disguise its criminal origin is the definition of money laundering in essentially every regime on earth. If the coins are proceeds of crime and the purpose of the conversion is to obscure that, the swap is the offence — the absence of an identity check changes nothing about it, and the transparent-side record is exactly the evidence such a case is built on. Our AML statement prohibits that use in terms, and we are not interested in the business.

What a swap legitimately does is deny future observers a continuous public trail of ordinary activity that was never anybody's business to begin with. That is a real benefit for a person with nothing to hide and a normal preference not to publish their finances — which describes almost everyone. The distinction is intent, the technology cannot see it, and only you know which side you are on. We would rather say that plainly than let an ambiguity do marketing work for us.

What we do, stated plainly

A guide about screening is worthless unless it says how the site publishing it screens. So:

• The screening happens upstream, not here. We are a non-custodial front end to third-party liquidity routers. That upstream provider is the regulated entity in the chain and it performs the address screening against sanctions feeds and analytics risk scores. We relay the outcome; we do not operate the scoring.
• A flag produces a refund offer, never a document request. The order page enters an explicit state and asks for an address you control. Identity verification is never a precondition for getting your funds back — the policy is written out on the AML page rather than left to goodwill.
• We hold nothing that identifies you. No name, no email, no phone number, no account, no document. Order records purge within thirty days; server logs rotate within twenty-four hours. The detail is on the privacy page and the infrastructure claims are itemised on the transparency page.
• Being a no-KYC route can itself raise your score elsewhere. Several attribution databases carry a category for services like ours. If your funds end at a conservative regulated venue afterwards, that classification can surface as a source-of-funds question. It is a real cost of using us and we would rather you plan for it than discover it.
• We co-operate with properly served law-enforcement process and refuse informal fishing. What we can supply is limited to the un-purged order record, because it is all that exists at our layer.

What we cannot do is tell you whether your coins will be accepted somewhere else. Nobody can, because that answer belongs to a policy we do not write and a database we do not see.

Related reading

For the clustering and attribution machinery that produces the labels in the first place, see blockchain analysis explained. For what a swap conceals and what it does not, see is crypto swapping anonymous. The operational counterpart to this guide is wallet hygiene for privacy swaps, which covers coin control and address discipline in depth. For what a flagged order looks like in practice and how refunds work, see the troubleshooting guide. For the regulatory backdrop by country, is no-KYC swap legal where you live, and for why a disposal is taxable regardless of screening, the tax guide. For the identity side of the same coin, what happens to your ID after you upload it. Vocabulary used throughout is defined in the glossary.

Frequently asked questions