# KYTScore — USDT source-of-funds check > KYTScore is a USDT source-of-funds checker that traces where an address's USDT came from — up to 2 hops back over the last 90 days on TRON, BNB Smart Chain and Ethereum — and flags links to OFAC-sanctioned, Tether / Circle-frozen, hacked or scam addresses, with the evidence path, amounts and dates. Will the USDT you receive get you frozen? Paste the address that paid you at https://kytscore.com/ and KYTScore shows whether the funds are linked to OFAC-sanctioned, Tether / Circle-frozen, hacked or scam addresses. This is a free prototype, not a live service. ## How it works 1. Take the address's USDT inflows over the last 90 days (up to 400 transfers); drop transfers under $1 (dust and address poisoning). 2. Look up every sender: sanctions, issuer freezes, hack / scam lists, and exchange wallets. Exchanges and big hubs are treated as end points. 3. Expand the largest unidentified senders (up to 8, until 80% of the inflow is covered) and repeat one more hop. 4. Exposure = the product of the amount shares along each path; hop 2 counts half. The score follows the table below. | Situation | Score | |---|---| | The address itself is sanctioned, frozen or a known hack address | 100 Severe | | The address itself is a scam or mixer address | 85 High | | Hop 1: ≥ 10% or ≥ $1,000 from sanctioned / frozen / hack addresses | 85 High | | Hop 1: ≥ 1% | 60 Moderate | | Hop 1: any; or hop 2: ≥ 10% | 45–55 Moderate | | Otherwise (small hop-2 exposure raises it within Low) | 5–30 Low | | The address is a known exchange wallet and not listed itself | capped at 30 Low | Inferred labels: very high volume or transfer count (≥ 400 transfers or ≥ $1,000,000 in 90 days) → hub; ≥ $10,000,000 from ≤ 10 senders → likely exchange hot wallet; forwards most funds to one known exchange → likely that exchange's deposit address. ## Key facts - Status: prototype to test demand, free, not a live service. No account needed; no SLA. - Chains and asset: USDT only, on TRON (TRC-20), BNB Smart Chain (BEP-20) and Ethereum (ERC-20). - Window: the last 90 days. Up to 400 incoming transfers of the checked address; transfers under $1 are ignored (dust, address poisoning). - Depth: up to 2 hops. The largest unidentified senders (up to 8, until 80% of the inflow is covered) are expanded one more hop, 200 transfers each. Exchanges and big hubs are end points. - Exposure: the product of the amount shares along each path; hop 2 counts half (× 0.5). Mixer and scam exposure counts half of sanctioned / frozen / hack exposure. - Labels: OFAC SDN list; addresses currently frozen by Tether and Circle; FBI public notices; exchanges' own proof-of-reserves address lists (Binance, OKX, Bitfinex, HTX, Bybit, KuCoin, Crypto.com); inferred labels from flow patterns (marked "inferred"); public tags from TRONSCAN for the top unidentified TRON addresses (attributed, cached 24 hours). - Data freshness: OFAC SDN, Tether / Circle freezes and public labels are looked up live at check time. If the live lookup fails, the check falls back to a local snapshot (freezes and OFAC SDN as of 2026-11-05; public labels as of 2026-11-01). Exchange proof-of-reserves addresses as of 2026-11-05. Every result says whether it used live data or the snapshot, and when the lists were last synced. - Chain data: fetched live at check time from TronGrid (TRON) and Alchemy (BSC, Ethereum). A result is cached for 24 hours (1 hour if the lists came from the snapshot). - Limits: 10 checks per hour per IP address and 200 per day in total; at most 30 upstream data calls per check. Cached results don't count. - Access: The demo endpoint requires a Cloudflare Turnstile check, so it only works from the web page. A key-based API for programmatic use is not open yet; leave an email at https://kytscore.com/#price-h to hear when it opens. - Full description of the check endpoint: https://kytscore.com/openapi.json ## Limitations - USDT only: USDC, native coins (TRX, BNB, ETH) and other tokens are not traced, and neither are bridges or swaps. - 90 days and 2 hops: older history and longer chains of transfers are not seen. - Very busy addresses are sampled: at most 400 transfers for the checked address and 200 for each expanded sender. - Label coverage is incomplete. The share of inflow from addresses we couldn't identify is shown with every result. - Inferred labels (hub, likely hot wallet, likely deposit address) are guesses from flow patterns and can be wrong. - Lists change: an address that is clean today can be frozen tomorrow. Each result says whether its lists were checked live or from the snapshot, and when they were last synced. - A known exchange wallet that is later frozen counts as Severe only for itself; wallets it paid get a note, not a risk score. - Exposure describes fund flows, not ownership or intent. Not legal, compliance or investment advice. ## FAQ ### What is KYTScore? KYTScore is a free prototype that checks the source of funds of a USDT address. It traces the address's USDT inflows up to 2 hops back over the last 90 days and reports how much is linked to OFAC-sanctioned, Tether / Circle-frozen, hacked or scam addresses, with the transactions that prove it. ### Which blockchains and tokens are covered? Only USDT, on TRON (TRC-20), BNB Smart Chain (BEP-20) and Ethereum (ERC-20). Other tokens, other chains and cross-chain bridges are not traced. ### How far back does a check look? 90 days. It reads up to 400 incoming USDT transfers of the checked address, ignores transfers under $1, then expands the largest unidentified senders (up to 8, until 80% of the inflow is covered) by one more hop, reading up to 200 transfers each. ### What do the score and risk levels mean? The score runs from 0 to 100: Low is 0–30, Moderate 31–70, High 71–90 and Severe 91–100. Severe means the address itself is on an official list. High means at least 10% or $1,000 of its inflow came directly from sanctioned, frozen or hacked addresses. Hop-2 exposure counts half. ### Where do the labels come from? OFAC's SDN list, the addresses Tether and Circle currently have frozen, FBI public notices, and the proof-of-reserves address lists that exchanges publish. Some labels are inferred from flow patterns and marked as inferred. For the top unidentified TRON addresses, public tags from TRONSCAN are shown with attribution and cached for 24 hours. Sanctions, freezes and public labels are looked up live when you run a check; if the live lookup fails, a recent snapshot is used and the result says so. ### Does a high score mean the address owner did something wrong? No. The score describes on-chain fund flows only. It does not say who controls an address or that anyone broke a rule, except where an official list names the address itself. Inferred labels can be wrong. ### Why is an exchange wallet not flagged when funds came from a frozen exchange wallet? Exchanges move funds between their own wallets all the time. If a known exchange wallet is later frozen, the freeze counts as Severe only for that wallet. Wallets it paid are treated as receiving from an exchange and get a note instead of a risk score, and a known exchange wallet that is not listed itself is capped at Low. ### Is there an API and what will it cost? The demo endpoint POST /api/kyt/check only works from this page: it requires a Cloudflare Turnstile check and is rate-limited (10 checks per hour per IP address, 200 per day in total). It is described at /openapi.json. A key-based API for programmatic use is not open yet; leave an email to hear when it opens. Preview pricing is 100 checks a month free, then $0.02–0.05 per check, and may change. ## API The demo endpoint behind the page is `POST https://kytscore.com/api/kyt/check` with `{"address": "...", "chain": "tron" | "bsc" | "eth", "turnstile": "..."}`. It is rate-limited and requires a Cloudflare Turnstile token, so it only works from the web page. Full description: https://kytscore.com/openapi.json. A key-based API for programmatic use is not open yet. It is planned as a paid API. Preview pricing, may change: 100 checks a month free, then $0.02–0.05 per check; TRON, BSC and Ethereum USDT; an evidence path with every score; batch checks and alerts when a past sender gets frozen. Leave an email at https://kytscore.com/#price-h to hear when it opens. ## Disclaimer This page is a prototype to test demand, not a live service. Results are for reference only and are not legal, compliance or investment advice. We only describe association / exposure through on-chain USDT flows. We do not say what an address is, who controls it or that anyone did anything wrong — except where an official list names it (OFAC SDN, Tether / Circle freezes). Inferred labels are guesses from flow patterns and can be wrong. To correct a result, use the form at https://kytscore.com/#report.