AML

What Is "Dirty" Crypto, and Why Is It Not a Verdict?

Transaction diagram and a laptop showing analytics on a desk, representing the risk source behind so-called dirty crypto
In brief

Dirty crypto is an informal label for assets with risky blockchain history, such as exposure to a mixer, scam, ransomware, stolen funds, or sanctioned addresses. It is a source-of-risk assessment used by KYT and AML systems, not a legal verdict or a different kind of USDT or BTC. The risk may originate with a counterparty several hops back, especially after a P2P or OTC transaction. Do not combine such incoming funds with assets from clearly documented sources at one address; first screen the address. For a transaction-chain review, see blockchain analytics.

What "dirty" crypto means

In practice, this does not mean physical "dirty money" or a separate token. Exchanges and analytics vendors examine the history of addresses and transfers: where a balance came from and whether it interacted with high-risk entities. If the chain contains a source of risk, such as a mixer, scam cluster, stolen funds, or a sanctioned wallet, a deposit or the entire account may receive an elevated risk score.

Risk labels can propagate across transaction hops. A direct transfer from a mixer and indirect exposure several addresses away present different facts to a reviewer, but either may trigger an alert. Sanctions lists such as those maintained by OFAC publish known digital-currency addresses; a direct match is generally more significant than indirect exposure to a scam cluster. Platform policies differ: one may accept three hops of separation while another pauses the transaction sooner.

The word "dirty" is a shorthand used by users and support chats, not a court finding. The asset itself is not technically different; what changes is the attribution of its transaction path. For guidance on interpreting indicators without treating them as a verdict, see how to check a wallet for AML risk. For a pre-deposit process, see how to check crypto for AML risk.

Why a label is a risk assessment, not a verdict

A high-risk address or incoming TxID does not automatically mean confiscation or prove that you participated in a scheme. Alerts may involve a shared hot wallet used by an exchange or bridge, an outdated label, a small amount near a risk cluster while most funds came from documented sources, or a P2P transaction where the recipient could not see the counterparty's history.

A reviewer considers the proximity of the exposure, the proportion of risky funds, the date, and evidence that you received the assets in good faith: transaction correspondence, fiat payment records, and Source of Funds evidence for the original capital. Indirect exposure to a mixer and a direct transfer from a sanctioned address are different cases. The outcome depends on platform policy and the quality of the evidence package; neither a deadline nor removal of the restriction is guaranteed.

If a hold is already in place, do not send a new deposit as a "test" or try to "clean" the history through a mixer; AML systems may treat that as obfuscation. Assemble the facts for the specific amount and, for a complex chain, request a review through blockchain analytics. For common reasons behind restrictions, see the top exchange-freeze reasons.

Separate incoming funds and screen the address

A common practical mistake is to send an unverified P2P payment to the same address that also receives salary withdrawals from an exchange or other well-documented assets. A mixed balance can raise the risk assessment for the whole wallet: an exchange sees the sending address as a whole, not your internal distinction between separate batches.

Use one address for unverified incoming funds and another for sources you have already checked. Before an exchange transfer, screen the public address and the TxIDs that will actually fund the deposit, never a seed phrase or private key. The practical screening process is set out in checking crypto for AML risk.

Do not pay a "cleaning service" or enter a seed phrase into an "AML bot." Using a mixer to make funds appear green will usually make the risk picture worse. If you need a transaction graph rather than the color shown by a free checker, that is a task for blockchain analytics.

First steps if an asset already has a risk label

  1. Record where the disputed amount came from: TxID, network, counterparty, and date, with screenshots and a text list.
  2. Run the sender's address through AML or address screening and save a dated PDF or screenshot.
  3. Do not combine the risky incoming funds with a well-documented balance at one address.
  4. If the category involves sanctions or stolen funds, do not make a large deposit at random; investigate the source first.
  5. If an exchange hold is already in place, reply through the official channel with one coherent evidence package. Never provide a seed phrase or send repeated emotional tickets.

If the exchange asks about the origin of a specific amount, the chain from source to TxID to balance matters more than a long explanation. Source of Funds documents are distinct from blockchain transaction analysis; see Source of Funds requirements.

  • Do not pay to "clean" assets through a mixer or an opaque intermediary.
  • Do not mix an unverified P2P transfer with salary or exchange-derived funds at one address.
  • Never enter a seed phrase into an "AML bot" or treat a free checker's color as a verdict.
  • Do not send a new deposit as a "test" before identifying the source of risk.
Limitations

Risks and limitations

  • "Dirty crypto" is an informal label; an exchange assesses sources of risk under its own KYT policy, not from chat claims or a screenshot from a free checker.
  • Indirect exposure and direct contact with a sanctioned address represent different levels of risk and should not be generalized.
  • Combining risky and well-documented incoming funds at one address may worsen the assessment of the entire balance.
  • Attempts to "clean" transaction history through mixers or opaque intermediaries often increase AML flags.
  • A complete document package and analytics report do not guarantee removal of a restriction or a specific review time.
Sources

Sources used

Next

Related resources

ServiceBlockchain analyticsBack to the blog
Next step

Need an assessment of your situation?

Briefly describe what happened — without seed phrases or private keys. We will outline possible routes and assess their feasibility.

Request a free assessment
Free initial assessment

Describe what happened

Answer a few questions so we can assess the situation and suggest the next steps.

Do not send seed phrases, private keys, passwords, or 2FA codes. They are not needed for an initial assessment.

Do not send seed phrases, private keys, passwords, or 2FA codes.