Findings
A finding is one concrete way the public data ties a wallet to something else: another wallet, an exchange account, a name or a habit. Seven detectors produce them. Each detector has rules, and each rule has a fixed threshold, severity and confidence, published in full on its page.
| Finding | What it looks for | Detector | Cap |
|---|---|---|---|
| ENS and public identity | A primary ENS name, its records, other names the wallet owns, and public labels. | public_identity | 30 |
| Linked wallets | Wallets that probably belong together, each with a confidence and its reasons. | linked_wallets | 25 |
| Funding source reuse | Who paid for the first transaction on each chain, and who else that wallet funded. | funding_reuse | 20 |
| CEX exposure | Funding from an exchange, transfers with exchange wallets, and deposit addresses. | cex_exposure | 20 |
| Cross-chain traceability | One address used on several chains, and bridge transfers that match on both sides. | cross_chain | 12 |
| Behavioral fingerprint | Active hours, round amounts, fixed gas, a fixed rhythm and the wallet app. | behavioral_fingerprint | 12 |
| Recurring counterparties | A few personal wallets that make up most of the transfers. | recurring_counterparties | 10 |
The cap is the most points one detector can take off the Privacy Score, however much it finds.
What every finding contains
Section titled “What every finding contains”| Part | What it is |
|---|---|
| Title and explanation | What was found, in one to three plain sentences |
| Rule id | Which rule fired, for example funding_reuse.shared_funder |
| Severity | How much it would cost if it were certainly true: info, low, medium, high or critical |
| Confidence | From 0 to 1: how sure the engine is that the pattern is real |
| Cost | The points it took off the score, after confidence and the cap |
| Evidence | The transactions, addresses, labels or statistics behind it, with explorer links |
| Linked wallets | For findings that link wallets: each address with its own confidence and reasons |
A finding that links wallets always carries a confidence and never states who owns a wallet. Each link is printed with Likely, Possible or Weak; a finding shows its confidence as a number.
A service is never a link
Section titled “A service is never a link”A service is never a link. A wallet that sends to or funds thousands of people says nothing about who you are. These never count as a shared funder, a back and forth partner, a sender into the same deposit address or a recurring counterparty:
- exchanges: the explorer's tags and the bundled exchange list;
- contracts: bridges, routers, aggregators, airdrop and faucet contracts, tokens, marketplaces and multisigs, as the explorer reports per address;
- 9,532 known service wallets from the open datasetdawsbot/eth-labels (MIT): bots, bundlers, deployers, bridge relayers, operators, market makers, payment processors and payout wallets;
- anything the explorer tags publicly, such as a relayer's name tag;
- busy wallets: a wallet that sent 2,000 or more transactions on the chain where you dealt with it (its own count, read from that chain's RPC) is a service or a bot, even when no list names it. A funder that sent 200 or more transactions in the 6 days around the funding, or funded more than 40 other wallets in that window, is busy too;
- wallets that never send: a back and forth partner, a sender into the same deposit address or another wallet your funder paid must have signed at least one transaction on that chain. One that never did can only appear through a forged token transfer, or it only received (a gift, an address from a tutorial). A fresh wallet you funded that never sent anything is a weak link at most;
- look-alikes: addresses made to look like yours or like a wallet you deal with. They are listed as warnings instead.
Only real transfers count. A token contract can write any transfer it likes into any history, so "you sent 500 USDT to X" may never have happened. A token transfer you did not sign counts only when the token is real: priced on the explorer, held by 10,000 or more addresses, or one of the major tokens the engine lists by contract address. An incoming token also counts when you sent that same token yourself. A symbol proves nothing: anyone can deploy a token called USDT.
The background, with the research it rests on: How wallets get linked.
Warnings are not findings
Section titled “Warnings are not findings”Look-alike addresses, made to trick you into a wrong transfer, are listed separately as warnings. They are never a linked wallet and cost no points.