Post a sentry on every wallet before you pay it.

Wallet Sentry AML screens TRON wallets. You give it a TRC20, TRX or USDT TRC20 address, it works through the wallet's on-chain history for sanctions, mixer, darknet, theft and scam connections, and it answers Pass, Review or Block with a 0–100 score. Screening once is free; each further one is $1.

Pass: the history that was analyzed showed nothing worrying. Review: some exposure deserves a human look, for example an indirect mixer link. Block: the exposure is serious, such as a sanctioned party or stolen funds, and the safest default is to stop.

Each finding adds to a 0–100 score according to how severe it is and how many transfers away it sits. The verdict is that score read against set bands, so a close sanctions link can send a wallet straight to Block while a faint, distant one may only earn Review.

Yes, if you use the API. It returns the numeric score and the individual factors alongside the verdict, so you can draw a stricter or looser line to match your own policy.

TRC20 is the token standard on the TRON blockchain, the counterpart of ERC-20 on Ethereum. USDT TRC20 is Tether issued as a TRC20 token, and any wallet that holds or moves it is a TRON address that can be screened.

Transfers are fast and cheap, so TRON became a favorite rail for moving USDT between exchanges, traders and businesses. That same convenience attracts fraudsters and launderers, which is why looking at a counterparty before a large transfer is worth a few seconds.

A standard TRON address is 34 characters long, begins with the letter T and uses Base58 characters, which exclude 0, O, I and l. Some tools show the same address in a hex form beginning with 41, and that has to be converted back to the T format before you paste it.

Yes. Paste it like any other address. Expect a lot of pooled activity, because deposit addresses often sweep funds into larger wallets, so the verdict tells you about the address and not about the person who gave it to you.

Yes, and it is a good habit. If your wallet comes back as Review or Block, you will know why before an exchange's own screening holds the deposit, and you can prepare an explanation of where the funds came from.

Review usually reflects indirect exposure rather than anything you did. Common causes are receiving funds from a P2P buyer whose wallet had a risky history, or from a service that mixes funds. Open the report, read the listed factors and the number of hops, and judge how relevant each link is.

No. Review is a prompt to look closer, not an order. Many teams accept a Review wallet after finding the cause, asking the counterparty to explain, or lowering the amount, and keep Block for the cases they would not touch.

Large exchanges and payment services touch enormous numbers of wallets, so a link through one is normal and counts for little on its own. What matters is a direct or near link to a cluster that is clearly risky.

A hop is one transfer between two wallets. A link at one hop means the wallets dealt with each other directly, and at four hops there are three wallets in between. The further away a risky source is, the less weight it carries.

It lists the main wallets that funded the address and the main ones it paid, with a label where one is known and the share of value involved. Start with the biggest counterparties and any that carry a risk label.

Wallets that behave like one operator, for example by funding each other or sweeping into the same destination, can be treated as one cluster so exposure is attributed to the whole group. Grouping is a probabilistic judgment, which is one reason reports show how a link was reached.

In address poisoning a scammer sends a tiny or zero-value transfer from a lookalike address, hoping you later copy it from your history by mistake. A screening can show that a lookalike is a new wallet with scam links, but the real defense is comparing the entire address and not just the first and last characters.

A dust attack sends tiny amounts of TRX or tokens to many wallets. On TRON the usual aim is spam or tempting you to interact with a scam token. Dust itself cannot take your funds, so the sensible response is to ignore tokens you do not recognize.

Scammers issue counterfeit TRC20 tokens that carry the name and symbol USDT. The genuine USDT TRC20 contract is TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t; confirm it against the issuer's official page before relying on it. A wallet screening does not authenticate a token, so check the contract address in your wallet.

No. The screening only reads public blockchain data and never sends anything to the address, so the owner has no way of knowing it was checked.

No. Energy and bandwidth are the resources spent when you send transactions on TRON. Screening reads public data and never touches your wallet, so it costs none of either.

AML duties fall mainly on businesses such as exchanges and payment firms, but anyone can screen a counterparty. For individuals it is practical self-protection: it helps you avoid receiving funds that an exchange may later hold or question.

Whether the law requires it depends on your country and what your business does, and a checker can't settle that for you. In practice, screening the wallet that pays you before a large USDT receipt leaves a record that you looked. Confirm your obligations with a compliance professional.

Ask for their TRON address, paste it into the checker and read the verdict before you send anything. For a first payment, send a small test amount to the address you screened and pay the rest once it arrives.

Yes. Screen each payee's wallet once before the first payout and keep the report with your payment records. For recurring payouts, use monitoring or the API to be told if a payee's wallet later picks up risky activity.

Yes. Screening large donation wallets and the sources of big gifts helps an organization avoid taking funds tied to sanctioned or criminal sources. It works from public data, so donors do not need to do anything.

The US Treasury's OFAC publishes digital currency addresses, including TRON ones, on its sanctions lists. Other authorities such as the EU, the UK and the UN also keep lists, and which apply to you depends on where you operate. See the documentation for the exact sources used in screening.

Public TRON blockchain data, combined with sanctions lists and address sets labeled for mixers, darknet markets, thefts and scams. Each report carries a timestamp so you know when the data was read.

Chain data is read at the time of your screening and the report is stamped with it. Label sets and sanctions lists are refreshed on an ongoing basis, but a very recent designation may not yet be reflected, so treat a result as a snapshot.

Yes. Switch on monitoring for a wallet and it is re-screened as new transfers appear, so you hear about changes without repeating manual checks.

An alert fires when a watched wallet sends to or receives from an address that is sanctioned, tied to a mixer, darknet or scam cluster, or otherwise flagged, or when its verdict moves into a worse band.

Alerts can go to email or to a webhook URL you provide, which lets you push them into chat tools, a ticketing system or your own back office.

For each address, a JSON object with the verdict, the 0–100 score, the list of risk factors with their category and distance, the sanctions result and a timestamp.

Yes. Upload a CSV or send the list through the API and you get a verdict and score for each row. Volume pricing applies to large batches, so get in touch with the size you expect.

One address or one transaction hash is one screening. Your first is free. Running the same address again later, or any other address, is another $1, because the data is read again and a fresh report is generated.

Never. A screening needs only a public address or transaction hash. Any site, message or person asking for a seed phrase or private key is a scam, including one that claims to be us.