What a wallet risk score actually measures

A risk score compresses a lot of context into one number, which is exactly what makes it useful and exactly what makes it dangerous to rely on alone. The number tells you how concerned to be. It doesn't tell you why.

Scores blend things that shouldn't always be blended

A wallet can score high because it's part of a coordinated cluster, because it interacted with a sanctioned address, or because it's brand new with no history to evaluate. Those are three very different situations that call for three different responses, but a single score often flattens them into the same number.

What's usually underneath

Most useful risk models are built from several independent checks: funding lineage, behavioral fingerprints, known-entity exposure, and cluster membership, among others. Each check produces its own evidence. The score is a summary of that evidence, not a replacement for it.

When a score matters — an exclusion decision, a compliance review, a security escalation — the underlying evidence is what actually needs to be read. The score decides how urgently to look. The evidence decides what to do.

A good sign to look for

A model worth trusting will show its work: which signal families contributed, how strong each one was, and which findings were discounted because they touched known infrastructure rather than something suspicious. If a tool can only give you the number, treat it as a starting point for investigation, not an answer to a decision.