Contents

Listed wallet detail

One listed wallet: every active listing of the address (category, source, wording, date, link), its last known balances on the scanned EVM chains (native ETH and the curated tokens, at our own prices) and its tracked movements, newest first (every token on Ethereum, Arbitrum and Base, native ETH on Ethereum, Bitcoin; within the plan history).

GET/api/v1/security/wallets/{address}Every key

Description

A token outside our curated list is marked unverifiedToken and never priced. The other side of a movement keeps only its own sourced label (exchange proof of reserves, protocol docs) or none. 404 when the address has no active listing.

Who can call it

Available with every key and keyless (X-Blockmetric-Access: public). Keys of Free accounts get free-tier data (real-time feeds, 30 days of history, heatmap over time for every coin over the last 24 hours, liquidation levels now for every coin, the same as the free web plan); Pro and Desk keys the data of their plan; API Dev / API Pro raise the limits.

No key: 24 h
Free: 30 days
Pro: 365 days
Desk: 1095 days
API Dev: 365 days
API Pro: 1095 days

History window per plan. Limits: Authentication & limits.

Parameters

Parameters of /security/wallets/{address}
Parameter	Description
`address`string · pathrequired	The address as the source lists it (EVM 0x + 40 hex in any case, Bitcoin, Tron …).
`limit`integer	Number of movements, default 25, clamped to 1–100.1–100 · default 25

Response fields

Every success is { data, meta }; these are the fields of data. meta is the same on every endpoint.

Response fields of /security/wallets/{address}
Field	Description
`address`string	The address as listed.
`network`string	Address family (evm, bitcoin, tron …).
`tracked`boolean	We follow its on-chain movements.
`listings[]`array of objects	Every active listing of the address, oldest first.
`listings[].category`"sanctioned" \| "stolen_funds" \| "exploit" \| "drainer" \| "phishing" \| "other"	The source’s classification: sanctioned (OFAC), stolen_funds, exploit, drainer, phishing, other.
`listings[].source`"ofac_sdn" \| "fbi_ic3" \| "incident"	ofac_sdn (OFAC SDN list), fbi_ic3 (FBI / IC3 announcement) or incident (official post-mortem).
`listings[].sourceLabel`string	How the source is named, e.g. "OFAC SDN list", "FBI (IC3 PSA I-022625-PSA)".
`listings[].sourceUrl`string	Link to the listing at the source.
`listings[].sourceDate`string · nullable	Date of the listing (YYYY-MM-DD): the publication for FBI and post-mortems, the first SDN list that contained the address for OFAC.
`listings[].listing`string	The one claim, in the source’s terms: "Listed as <category> by <source>, <date>".
`listings[].detail`string · nullable	The source’s own wording (FBI quote, OFAC sanctions programs, role in the post-mortem). Never a name.
`listings[].assets`string · nullable	OFAC: the currency tickers of the address fields, e.g. "ETH, USDT".
`listings[].incidentId`integer · nullable	Curated incident the listing belongs to (/security/incidents/<id>).
`listings[].firstSeen`string (ISO 8601)	When we first imported the listing.
`balances[]`array of objects	Last known balances per scanned EVM chain and the Hyperliquid account of the same key.
`balances[].chain`string	ethereum \| arbitrum \| base \| hyperliquid.
`balances[].checkedAt`string (ISO 8601)	When the balances were read.
`balances[].balances`object	Units per asset (native ETH and the curated tokens with a balance; on hyperliquid the account value in USD as accountValue).
`balances[].usd`number · nullable	Their value at our prices (USD).
`movements[]`array of objects	Tracked movements, newest first, within the plan history.
`movements[].id`integer	Movement id.
`movements[].ts`string (ISO 8601)	Block time.
`movements[].chain`string	ethereum \| arbitrum \| base \| bitcoin.
`movements[].type`string	transfer \| exchange_in \| exchange_out \| exchange_exchange \| mint \| burn \| bridge \| dex_buy \| dex_sell.
`movements[].asset`string	Asset symbol; "(unverified)" after a symbol outside our curated token list (the token’s own claim).
`movements[].amount`number	Units of the asset.
`movements[].usd`number · nullable	Value at our price; null = price unavailable (always for unverified tokens) (USD).
`movements[].priceSource`string · nullable	Basis of usd, as in /movements.
`movements[].title`string	Factual one-liner with the short source, e.g. "Listed wallet (OFAC) moved 10 ETH ($30K) to Binance on Ethereum".
`movements[].listedAddress`string	The listed address of the movement.
`movements[].listedSide`"from" \| "to"	Which side of the movement is the listed address.
`movements[].from`object	Start of the window (ISO 8601 UTC) or the sending side of a movement.
`movements[].from.address`string · nullable	Wallet or contract address (EVM lowercase 0x…, or Bitcoin).
`movements[].from.label`string · nullable	Label with a cited source (exchange proof of reserves, protocol docs), else null. Never a risk label.
`movements[].from.url`string · nullable	Explorer page.
`movements[].to`object	End of the window (ISO 8601 UTC) or the receiving side of a movement.
`movements[].to.address`string · nullable	Wallet or contract address (EVM lowercase 0x…, or Bitcoin).
`movements[].to.label`string · nullable	Label with a cited source, else null. Never a risk label.
`movements[].to.url`string · nullable	Explorer page.
`movements[].unverifiedToken`boolean	Token outside our curated list: never priced.
`movements[].block`integer	Block height.
`movements[].tx`string	Transaction hash.
`movements[].txUrl`string · nullable	Transaction on the official explorer.

Errors

400invalid_param Invalid parameter
401unauthorized Missing or invalid API key
403plan_required Plan does not include this
403scope_required Key not scoped for this API
403ip_not_allowed Address not on the IP allowlist of the key
403origin_not_allowed Key used from a browser origin it does not allow
403source_restricted Exchange data not redistributed
403https_required https required
404not_found Not found
429rate_limited Per-minute limit reachedretry
429daily_limit_exceeded Daily limit reachedretry
429stream_limit Too many open streamsretry
500internal_error Internal errorretry

Request

curl -s -H "X-Blockmetric-Access: public" \
  "https://api.blockmetric.io/v1/security/wallets/0x51e9d833ecae4e8d9d8be17300aee6d3398c135d"

Example response

HTTP 200Real data from 2026-11-03 10:36 UTC

{
  "data": {
    "address": "0x51e9d833ecae4e8d9d8be17300aee6d3398c135d",
    "network": "evm",
    "tracked": true,
    "listings": [
      {
        "category": "stolen_funds",
        "source": "fbi_ic3",
        "sourceLabel": "FBI (IC3 PSA I-022625-PSA)",
        "sourceUrl": "https://www.ic3.gov/PSA/2025/PSA250226",
        "sourceDate": "2025-02-26",
        "listing": "Listed as holding stolen funds by FBI (IC3 PSA I-022625-PSA), 2025-02-26",
        "detail": "The following Ethereum addresses are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors",
        "assets": null,
        "incidentId": null,
        "firstSeen": "2026-11-03T10:36:54.590Z"
      }
    ],
    "balances": [],
    "movements": []
  },
  "meta": {
    "updatedAt": "2026-11-03T10:36:54.590Z",
    "source": "fbi_ic3",
    "sources": [
      "fbi_ic3"
    ],
    "plan": "api_dev",
    "delayMinutes": 0,
    "commercial": false,
    "license": {
      "id": "internal",
      "display": false,
      "attributionRequired": false,
      "attribution": null,
      "redistribution": false,
      "mauCap": null,
      "terms": "https://blockmetric.io/terms#api-license"
    },
    "attribution": {
      "text": "Data by Blockmetric · Source: FBI / IC3 public service announcements",
      "url": "https://blockmetric.io/"
    },
    "access": {
      "historyDays": 365,
      "historyFrom": "2025-11-03T10:47:00.000Z"
    }
  }
}

More options: open in the explorer · SDK method securityWallet() / security_wallet()

Code snippets in these docs are licensed under MIT-0: copy them into your own code without attribution. The SDKs, CLI and MCP server will be, once published, Apache-2.0; the name Blockmetric is not licensed (forks must be renamed). Data from the API is governed by the API terms; third-party exchange data by the exchange’s terms.