# Crypto wallet scam check API Bewary's wallet API tells you whether a crypto address is on our scam list, built from reported scams, or on a US sanctions list, before anyone sends money to it. It reads Bitcoin, Ethereum and any EVM address, Tron, Litecoin, Solana, Monero and Dash addresses. It is a list check, not blockchain analytics: it does not follow funds on chain. A call costs 1 credit, a free key gets 1,000 credits a month, no card, and it answers in median 127 ms. Updated 2026-10-30. ## At a glance - Endpoint: GET https://api.bewary.app/v1/wallet/{chain}/{address} - Price: 1 credit - Free key: 1,000 credits a month, no card - Speed: Median 127 ms, measured - Returns: verdict, p_scam, entities with typed facts, reason codes - MCP tool: lookup_wallet ## Used for - Warning before a user sends crypto to an address from a message. - Screening payout addresses. - Investigating a reported scam. ## Call it curl: ```bash curl "https://api.bewary.app/v1/wallet/eth/0xde0B295669a9FD93d5F28D9Ec85E40f4cb697BAe" ``` Python: ```python import requests r = requests.get("https://api.bewary.app/v1/wallet/eth/0xde0B295669a9FD93d5F28D9Ec85E40f4cb697BAe", timeout=10) result = r.json() print(result["verdict"], result["p_scam"], result["reason_codes"]) ``` JavaScript: ```javascript const res = await fetch("https://api.bewary.app/v1/wallet/eth/0xde0B295669a9FD93d5F28D9Ec85E40f4cb697BAe") const result = await res.json() console.log(result.verdict, result.p_scam, result.reason_codes) ``` ## Act on the result Python: ```python import os, requests def wallet_listed(chain, address): key = os.environ["BEWARY_API_KEY"] # a free key: bewary.app/account headers = {"Authorization": f"Bearer {key}"} r = requests.get(f"https://api.bewary.app/v1/wallet/{chain}/{address}", headers=headers, timeout=10) r.raise_for_status() return r.json()["entities"][0]["facts"]["listed"] if wallet_listed("eth", "0xde0B295669a9FD93d5F28D9Ec85E40f4cb697BAe"): print("Do not send: this wallet is reported in scams") ``` TypeScript, with the types from https://bewary.app/types/bewary.d.ts: ```typescript import type { Envelope } from "./bewary" export async function walletListed(chain: "btc" | "eth" | "trx" | "ltc" | "sol" | "xmr" | "dash", address: string): Promise { const key = process.env.BEWARY_API_KEY! // a free key: bewary.app/account const headers: Record = { Authorization: `Bearer ${key}` } const res = await fetch(`https://api.bewary.app/v1/wallet/${chain}/${address}`, { headers, signal: AbortSignal.timeout(10_000) }) if (!res.ok) throw new Error(`Bewary ${res.status}`) const e = (await res.json() as Envelope).entities[0] return e.type === "wallet" && Boolean(e.facts.listed) } ``` ## The fields you will use - `entities[0].facts.listed`: On Bewary's scam list. - `entities[0].facts.sanctioned`: On a US sanctions list (WALLET_SANCTIONED). - `entities[0].facts.chain`: btc, eth (any EVM address), trx, ltc, sol, xmr or dash, read from the address. - `verdict`: scam when listed, suspicious when only sanctioned, otherwise unknown. ## Example response: unknown Request: `GET /v1/wallet/eth/0xde0B295669a9FD93d5F28D9Ec85E40f4cb697BAe`. Captured from the live API on 2026-10-31. ```json { "schema_version": "1.7.0", "request_id": "req_01M69WJ0M1XHQ3CJBJ1QQ1WC78", "checked_at": "2026-10-31T21:06:26Z", "engine": "bewary-engine/3.0.0", "models": { "calibration": "interim-band-v0" }, "input": { "kind": "lookup", "channel": "unknown", "language": null, "region": null }, "verdict": "unknown", "p_scam": 0.2, "risk_score": 20, "confidence": 0, "classification": null, "reason_codes": [], "entities": [ { "id": "e1", "type": "wallet", "value": "0xde0b295669a9fd93d5f28d9ec85e40f4cb697bae", "normalized": "0xde0b295669a9fd93d5f28d9ec85e40f4cb697bae", "role": "payee", "verdict": "unknown", "p_scam": 0.2, "risk_score": 20, "reason_codes": [], "facts": { "chain": "eth", "caip2": null, "listed": false, "sanctioned": false, "reports": null, "list_count": null }, "related": [], "datasets": [ { "dataset": "wallet_reports", "coverage": "WW", "in_coverage": true }, { "dataset": "sanctions", "coverage": "WW", "in_coverage": true }, { "dataset": "community_reports", "coverage": "WW", "in_coverage": true } ] } ], "signals": [], "degraded": false, "degraded_reasons": [], "cached": false, "explanation": null } ``` ## Example response: suspicious Request: `GET /v1/wallet/eth/0x098B716B8Aaf21512996dC57EB0615e2383E2f96`. Captured from the live API on 2026-10-31. ```json { "schema_version": "1.7.0", "request_id": "req_01M69WJKJC0C57D2VXBXZHVQCS", "checked_at": "2026-10-31T21:06:45Z", "engine": "bewary-engine/3.0.0", "models": { "calibration": "interim-band-v0" }, "input": { "kind": "lookup", "channel": "unknown", "language": null, "region": null }, "verdict": "suspicious", "p_scam": 0.7914, "risk_score": 79, "confidence": 1, "classification": null, "reason_codes": [ "WALLET_SANCTIONED" ], "entities": [ { "id": "e1", "type": "wallet", "value": "0x098b716b8aaf21512996dc57eb0615e2383e2f96", "normalized": "0x098b716b8aaf21512996dc57eb0615e2383e2f96", "role": "payee", "verdict": "suspicious", "p_scam": 0.7914, "risk_score": 79, "reason_codes": [ "WALLET_SANCTIONED" ], "facts": { "chain": "eth", "caip2": null, "listed": false, "sanctioned": true, "reports": null, "list_count": 1 }, "related": [], "datasets": [ { "dataset": "wallet_reports", "coverage": "WW", "in_coverage": true }, { "dataset": "sanctions", "coverage": "WW", "in_coverage": true }, { "dataset": "community_reports", "coverage": "WW", "in_coverage": true } ] } ], "signals": [ { "code": "WALLET_SANCTIONED", "entity": "e1", "severity": "high", "weight": 75, "source_class": "confirmed", "p": null, "dataset": "sanctions", "coverage": "WW", "evidence": {} } ], "degraded": false, "degraded_reasons": [], "cached": false, "explanation": null } ``` ## Crypto wallet facts Every key is in every response, null when unknown. Keys marked coming stay null until their source ships. | Key | Type | Meaning | |---|---|---| | `chain` | btc \| eth \| trx \| ltc \| sol \| xmr \| dash or null | The chain, read from the address format. eth is any EVM address. | | `listed` | boolean or null | On Bewary's scam list. | | `sanctioned` | boolean or null | On a US sanctions list. | | `caip2` | string or null | The CAIP-2 chain id where the chain is fixed. | | `list_count` | integer or null | How many lists name it, ours and others'. | | `reports` | integer or null | How many reports name it. Coming: null for now. | ## Parameters | Name | In | Type | Required | Description | |---|---|---|---|---| | `chain` | path | string | yes | btc, eth (any EVM address), trx, ltc, sol, xmr or dash. | | `address` | path | string | yes | The wallet address. | ## Questions ### How do I check if a crypto address is linked to a scam? GET /v1/wallet/{chain}/{address} with btc, eth (any EVM address), trx, ltc, sol, xmr or dash. facts.listed is true when the address is on Bewary's scam list. ### Does it trace transactions or screen sanctions? It screens the US sanctions list: facts.sanctioned is true and the answer carries WALLET_SANCTIONED for an address on it. It does not follow funds on chain. ### Is an unlisted wallet safe? No. Not listed means nobody reported it to us yet, so the verdict is unknown. ## Reason codes it can return `LISTED_BLOCKLIST`, `WALLET_LISTED`, `WALLET_SANCTIONED`, `LISTED_CAUTION`, `PLATFORM_TAKEDOWN`, `PLATFORM_WARNING`