Wallets API

Wallet risk flags

Whether a wallet is flagged malicious — sanctions, phishing, stealing attacks and similar — where an absent answer means no record, never a clean bill of health.

GET/api/external/wallet-analysis/wallet-risk/{chain}/{address}

Get a free API key Try it in the API reference

Chains

Solana SOL
BNB Chain BNB
Ethereum ETH
Stable STABLE
Base BASE
Robinhood Chain RHC

Request

Send your key in the x-dex-data-key header. Replace each <placeholder> with a real value.

curl -H "x-dex-data-key: $DEXDATA_API_KEY" \
  "https://api.dexdata.io/api/external/wallet-analysis/wallet-risk/SOL/<address>"

Parameters
Parameter	Description
`chain` path · string · required	The chain the wallet address belongs to. Every trading chain but ARC is served. CELO, ARB, OP and SCROLL return 400 here.
`address` path · string · required	The wallet address.

Response fields

A JSON response. Every field is always present; null means the value could not be established, never zero.

Response fields of Wallet risk flags
Field	Type	Description
`flagged`	boolean \| null	Whether the wallet has at least one risk signal on record. Never `false`: the underlying database holds rows only for addresses it has something on, so an absence of signal does not mean "checked and clean" — a well-known, entirely legitimate address and the OFAC-sanctioned Tornado Cash router read identically (every flag unset) in the sample this shipped against. `null` means "not asserted", never "confirmed clean" — that covers both "no record on file" and "the source could not be reached when asked" (for example a rate limit); the two are indistinguishable in this response, and there is no retry hint. Read `riskFlags` alongside it for what fired, and see its description for how flags vary in confidence.
`maliciousContractsCreated`	integer \| null	How many malicious contracts this wallet is known to have deployed. `null` means no count is on record — including the case where the wallet has no record at all, which is what an address that was never used answers; it is never a checked zero. A real `0` is published only when the record holds something else about the wallet (a fired flag, or a named attribution): a wallet measured live with two independent risk signals set (`sanctioned`, `stealing_attack`) still carried an explicit `0` here, and that zero is a real answer — the two fields answer different questions.
`riskFlags`	string[]	The risk-signal names the source reports as fired for this wallet. Flags vary in confidence: most name a confirmed finding (e.g. `sanctioned`, `stealing_attack`, `phishing_activities`), but the source names `blacklist_doubt` explicitly as a suspicion, not a confirmed finding — weigh it accordingly, especially when it is the only flag present. Always an array, possibly empty; never `null`.

Price per call

Solana, BNB Chain, Ethereum, Stable, Base, Robinhood Chain: 67 credits

Charged only when the call succeeds. Prices as of 2026-10-30; the current ones are always in the API reference.

Deployer wallet
Run it on the deployer a token reports.
Holder count and trend
Run it on the top holders a token reports.
A wallet's outstanding token approvals
Check the wallet itself alongside the approvals it has granted.
Wallet approvals brief: counts, spenders and the riskiest approvals
Check the wallet itself alongside the approvals it has granted.
Who a wallet is
Identify the wallet first, then check whether it is flagged.
Recurring orders a wallet holds
The whole recurring-order book for one wallet across every status — running, paused, completed and pending — so a paused order's remaining balance is a frozen figure, not a live schedule.

Start building with DexData today

Sign in, create a key and make your first call in a minute. Free credits every month, and you only pay for calls that succeed.

Get a free API key