Contents

Listed wallets (OFAC, FBI, post-mortems)

Listed wallets: addresses that an official source lists, with the source’s own category, wording, date and a link to the listing.

GET/api/v1/security/walletsEvery keyPaginated

Description

Sources: the OFAC SDN list (every digital currency address, re-read daily; an address OFAC removes is delisted automatically and no longer returned), FBI / IC3 public service announcements that list addresses, and addresses an official incident post-mortem names (reviewed before they are published). listing reads "Listed as <category> by <source>, <date>"; for OFAC the date is the first SDN list in which we saw the address. No person is named and no counterparty is labelled. tracked = we follow its on-chain movements (EVM addresses on Ethereum, Arbitrum and Base, Bitcoin); other networks are listed only. Newest activity first, then newest listing. Paginated.

Who can call it

Available with every key and keyless (X-Blockmetric-Access: public). Keys of Free accounts get free-tier data (real-time feeds, 30 days of history, heatmap over time for every coin over the last 24 hours, liquidation levels now for every coin, the same as the free web plan); Pro and Desk keys the data of their plan; API Dev / API Pro raise the limits.

No key: 24 h
Free: 30 days
Pro: 365 days
Desk: 1095 days
API Dev: 365 days
API Pro: 1095 days

History window per plan. Limits: Authentication & limits.

Parameters

Parameters of /security/wallets
Parameter	Description
`category`string	sanctioned \| stolen_funds \| exploit \| drainer \| phishing \| other (optional).one of sanctioned, stolen_funds, exploit, drainer, phishing, other
`network`string	Address family: evm, bitcoin, tron, litecoin, monero … (optional).one of evm, bitcoin, tron, litecoin, monero, bitcoin_cash, dash, zcash, solana, ripple, dogecoin, bitcoin_gold, bitcoin_sv, verge, ethereum_classic, bnb_beacon, other
`source`string	ofac_sdn \| fbi_ic3 \| incident (optional).one of ofac_sdn, fbi_ic3, incident
`q`string	Address or part of one (optional).
`movedDays`integer	Only addresses with a tracked movement in the last N days (1–400, optional).1–400
`limit`integer	Number of items, default 100, clamped to 1–500.1–500 · default 100
`cursor`string	Next page: the value of meta.nextCursor from the previous response (keep the other parameters unchanged). Cursors are signed: an edited cursor answers 400; paging stops at the plan history.
`fields`string	Comma-separated fields of every item to return, e.g. address,network,category,source (case-insensitive). All other fields are left out, so large lists get much smaller; an unknown name answers 400 with the list of fields. Default: every field.
`format`string	json (default: the { data, meta } envelope) \| csv (the rows with a header line; nested values as JSON text) \| ndjson (one JSON object per row and line). csv and ndjson carry the meta block in headers: Link rel="next" and X-Blockmetric-Next-Cursor (next page), X-Blockmetric-Next-After (forward polling), X-Blockmetric-Updated-At, X-Blockmetric-Warnings, X-Blockmetric-License. Errors stay JSON.one of json, csv, ndjson · default json

Response fields

Every success is { data, meta }; these are the fields of data. meta is the same on every endpoint.

Response fields of /security/wallets
Field	Description
`[].address`string	The address as listed (EVM and bech32 lower case, other formats as the source publishes them).
`[].network`string	Address family: evm (one key on every EVM chain), bitcoin, tron, litecoin, monero …
`[].tracked`boolean	We follow its on-chain movements (EVM on Ethereum, Arbitrum, Base; Bitcoin).
`[].category`"sanctioned" \| "stolen_funds" \| "exploit" \| "drainer" \| "phishing" \| "other"	The source’s classification.
`[].source`"ofac_sdn" \| "fbi_ic3" \| "incident"	ofac_sdn \| fbi_ic3 \| incident.
`[].sourceLabel`string	How the source is named.
`[].sourceUrl`string	Link to the listing at the source.
`[].sourceDate`string · nullable	Date of the listing (YYYY-MM-DD).
`[].listing`string	"Listed as <category> by <source>, <date>".
`[].detail`string · nullable	The source’s own wording. Never a name.
`[].assets`string · nullable	OFAC: currency tickers of the address fields.
`[].incidentId`integer · nullable	Curated incident of the listing.
`[].firstSeen`string (ISO 8601)	When we first imported the listing.
`[].lastMoveTs`string (ISO 8601) · nullable	Newest tracked movement of the address.
`[].movements`integer	Tracked movements of the address.
`[].balanceUsd`number · nullable	Last known balance on the scanned EVM chains at our prices, null when not read or not priced (USD).
`[].balanceAt`string (ISO 8601) · nullable	When the balance was read.

Errors

400invalid_param Invalid parameter
401unauthorized Missing or invalid API key
403plan_required Plan does not include this
403scope_required Key not scoped for this API
403ip_not_allowed Address not on the IP allowlist of the key
403origin_not_allowed Key used from a browser origin it does not allow
403source_restricted Exchange data not redistributed
403https_required https required
429rate_limited Per-minute limit reachedretry
429daily_limit_exceeded Daily limit reachedretry
429stream_limit Too many open streamsretry
500internal_error Internal errorretry

Request

curl -s -H "X-Blockmetric-Access: public" \
  "https://api.blockmetric.io/v1/security/wallets"

Example response

HTTP 200Real data from 2026-11-03 10:36 UTC

{
  "data": [
    {
      "address": "0xe4c9a7f68b1eba4508f54f07f7378847318dd1a3",
      "network": "evm",
      "tracked": true,
      "category": "sanctioned",
      "source": "ofac_sdn",
      "sourceLabel": "OFAC SDN list",
      "sourceUrl": "https://sanctionssearch.ofac.treas.gov/Details.aspx?id=58887",
      "sourceDate": "2026-10-28",
      "listing": "Listed as sanctioned by OFAC SDN list (on the list as of 2026-10-28)",
      "detail": "Program DPRK2",
      "assets": "ETH",
      "incidentId": null,
      "firstSeen": "2026-11-03T10:36:54.671Z",
      "lastMoveTs": null,
      "movements": 0,
      "balanceUsd": null,
      "balanceAt": null
    },
    {
      "address": "0x761edd5e4546229a0bd35ae99b4d3d01cf4a3510",
      "network": "evm",
      "tracked": true,
      "category": "sanctioned",
      "source": "ofac_sdn",
      "sourceLabel": "OFAC SDN list",
      "sourceUrl": "https://sanctionssearch.ofac.treas.gov/Details.aspx?id=58886",
      "sourceDate": "2026-10-28",
      "listing": "Listed as sanctioned by OFAC SDN list (on the list as of 2026-10-28)",
      "detail": "Program DPRK2",
      "assets": "ETH",
      "incidentId": null,
      "firstSeen": "2026-11-03T10:36:54.671Z",
      "lastMoveTs": null,
      "movements": 0,
      "balanceUsd": null,
      "balanceAt": null
    }
  ],
  "meta": {
    "updatedAt": "2026-11-03T10:36:54.671Z",
    "source": "ofac_sdn",
    "sources": [
      "ofac_sdn"
    ],
    "plan": "api_dev",
    "delayMinutes": 0,
    "commercial": false,
    "license": {
      "id": "internal",
      "display": false,
      "attributionRequired": false,
      "attribution": null,
      "redistribution": false,
      "mauCap": null,
      "terms": "https://blockmetric.io/terms#api-license"
    },
    "attribution": {
      "text": "Data by Blockmetric · Source: OFAC SDN list (U.S. Treasury)",
      "url": "https://blockmetric.io/"
    },
    "access": {
      "historyDays": 365,
      "historyFrom": "2025-11-03T10:47:00.000Z"
    },
    "nextCursor": "<cursor>",
    "nextUrl": "https://api.blockmetric.io/v1/security/wallets?cursor=<cursor>"
  }
}

More options: open in the explorer · SDK method securityWallets() / security_wallets()

Code snippets in these docs are licensed under MIT-0: copy them into your own code without attribution. The SDKs, CLI and MCP server will be, once published, Apache-2.0; the name Blockmetric is not licensed (forks must be renamed). Data from the API is governed by the API terms; third-party exchange data by the exchange’s terms.