FREE · PRIVATE · NO SIGN-UP

Check before you send.

Paste a wallet address, payment link, website link or suspicious message, or scan a crypto QR code with your phone. We check for typos, the wrong network, sanctions and stablecoin blacklists, lookalike addresses, hidden spending approvals, fake websites and common scam signs. Everything runs on your device.

Private: everything is checked on your device. What you paste or scan, camera images and screenshots are not sent to ChainWatch or anyone else. How this works.

Disclaimer. This tool is free and provided for general information only, "as is", without warranties of any kind. Its checks are automated. They compare what you enter against third-party public lists (the U.S. Treasury OFAC sanctions list and stablecoin issuer blacklists) that may be incomplete, out of date or wrong, and apply pattern rules (address and network formats, known website names, common scam wording) that can miss scams and can raise false alarms. A warning is not a finding that any address, website, person or business is involved in wrongdoing, and the absence of a warning does not mean anything is safe. Company names are used only to recognise imitations of their websites; ChainWatch is not affiliated with or endorsed by them. Results are not a sanctions or compliance clearance and not legal, financial or investment advice; businesses with sanctions obligations must use official screening tools and their own procedures. You are solely responsible for checking every address and transaction before you send, sign or pay. To the fullest extent permitted by law, ChainWatch is not liable for any loss or damage arising from use of, or reliance on, this tool.

How to use it

Pick what you have, then follow the steps. Everything stays on your phone or computer.

A QR code someone sent you (a text, email, chat or photo)

  1. Take a screenshot of the QR code, or save the photo.
  2. Tap Check a screenshot.
  3. Choose the screenshot from your photos.
  4. Read the result. Nothing is paid or sent.

A QR code on paper, a poster or another screen

  1. Tap Scan QR code.
  2. If your phone asks, tap Allow for the camera.
  3. Point the camera at the code and hold still. The check starts by itself.
  4. Read the result.

A letter, flyer, text message or email

  1. Tap the big box at the top of the page.
  2. Type a few words from it: what it says you must pay, and how. For example: pay your bail at the bitcoin kiosk.
  3. Tap Check.
  4. If it also has a QR code, check the code too (see above). The QR buttons read the code only, not the words.

Shortcut for a text or email: press and hold on the message, tap Copy, then press and hold in the box and tap Paste. Words in a photo can be copied the same way on most phones (iPhone: press and hold on the words in the photo; Android: open the photo in Google Photos and tap Lens).

A wallet address or website link

  1. Copy it, then paste it into the big box.
  2. Optional: under “I’m sending on”, choose the network, so we can warn you if the address is for a different one.
  3. Tap Check.

Reading the result

  • Red: stop. Don’t pay or send anything. Tap Get help if you have already paid.
  • Amber: warning signs. Something here is a known warning sign. Read each warning before you do anything.
  • Grey: nothing found. These checks found nothing, but it may still be dangerous. Most scams use addresses and messages these checks can’t recognise.
  • Not sure? Don’t pay. Show it to someone you trust, or ask us. No court, police force, government agency or bank ever takes payment at a Bitcoin ATM or kiosk.

Optional: your address whitelist

If you often send to the same addresses (your own wallets, your exchange deposit address), add them to your whitelist after checking one. Later checks will then warn you about lookalikes used in address poisoning.

Put it on your phone’s home screen

  • iPhone (Safari): tap the Share button, then “Add to Home Screen”.
  • Android (Chrome): tap the ⋮ menu, then “Add to Home screen”.

If the camera doesn’t open

  • Allow the camera for chainwatch.us: tap the page-settings button beside the address bar (“aA” in Safari, the icon left of the address in Chrome) and allow Camera.
  • If you opened the link inside Instagram, Facebook or another app, open it in Safari or Chrome instead.
  • Or take a screenshot of the code and use Check a screenshot.

What it checks

AddressesTypos (the built-in check characters in Bitcoin, TRON and Ethereum-style addresses), the wrong network, test-network and burn addresses, the U.S. sanctions list and the USDT and USDC blacklists, and lookalikes of addresses on your whitelist (address poisoning).
Payment QR codesBitcoin, Ethereum-style, TRON, Solana and Lightning codes: the amount, network and recipient, hidden spending approvals, payments to a token’s own contract, expired invoices, amounts already filled in, extra text and hidden or look-alike characters, and scam wording in notes.
Wallet connection codesWalletConnect and Solana transaction codes: what scanning one allows a website to ask of your wallet, and a red warning when someone sent you one.
Website linksWhere a link really goes, imitations of exchange, wallet and government websites, look-alike characters, disguised and shortened links, wallet links that open websites, and common wallet-drainer words.
Messages, letters and flyersCommon scam phrases from texts, emails and scam flyers: Bitcoin ATM or kiosk payments, bail, warrants and other government threats, withdrawal fees, guaranteed returns, recovery offers, blackmail and more, plus the addresses and links inside the message. How to check a letter or flyer.
Recovery phrases and keysIf you paste one, a clear warning never to share it. We clear the box and never store or send it.

What a match means

A match means the address is on an official list. For the OFAC sanctions list, the U.S. Treasury has designated the person or group behind it, and U.S. persons are generally prohibited from dealing with it. For a stablecoin blacklist, the issuer has frozen the address, usually after reports of theft, fraud or a law-enforcement request. Either way: do not send funds to it.

What a grey “nothing found” result means

Only that these particular checks found nothing. It may still be dangerous. Most scam and theft addresses are never sanctioned or frozen, and many scam websites look normal, so a result with no warnings is not a sign that something is safe. If someone is pressuring you to send crypto, read the warning signs in our guidance library first.

Already sent funds?

Stop sending more, keep every record (transaction hashes, screenshots, messages), and report it to the FBI at ic3.gov. Our guide to the first 72 hours after a theft walks through each step, and a case review can tell you what a forensic trace could show.

Your privacy

  • Checked on your device. What you paste, type or scan is checked by code running in your browser. It is not sent to ChainWatch or anyone else.
  • Camera. Used only while the scanner is open, only to read a QR code. Video is not recorded, saved or uploaded, and the camera turns off as soon as a code is read or you close it. Your browser asks your permission first.
  • Screenshots. The image is read on your device and never uploaded.
  • Address whitelist. Saved only in this browser on this device; we can’t see it. Remove addresses any time under “Your address whitelist”, or by clearing this site’s data in your browser.
  • Downloaded to you, not uploaded by you. The sanctions and blacklist data, the QR reader and the recovery-phrase word list are downloaded from chainwatch.us, the same files for everyone, so the checks can run on your device.
  • Recovery phrases and private keys. If you paste one, we warn you and clear the box. It is never stored or sent.
  • Statistics. We use Plausible, a cookieless analytics service, to count how often the tool is used and the type of result (for example “link, warning” or “address, not listed”). It never receives the address, link, message or image you checked.

Questions

Does a clean result mean an address or link is safe?

No. The checks look for known problems and common warning signs. Most scam addresses are on no list, and many scam websites look normal. A result with no warnings only means these particular checks found nothing.

Is what I check sent to ChainWatch?

No. Addresses, links, messages, camera images and screenshots are checked by code running in your browser and are not sent to ChainWatch or anyone else. We only count, anonymously, the type of check and its outcome. See Your privacy.

Is the camera recording or uploading anything?

No. The camera is used only while the scanner is open, only to read a QR code on your device. Nothing is recorded, saved or uploaded, and the camera turns off as soon as a code is read.

Why can a QR code be dangerous?

A crypto QR code can hold more than an address: a payment request, a spending approval that lets someone take your tokens, or a wallet connection to a website. The checker shows what the code actually asks your wallet to do.

Does a warning mean it is definitely a scam?

No. The checks are automated and can raise false alarms. A warning is a reason to stop and verify through a channel you trust, not a finding that anyone did anything wrong.

How current are the lists?

They’re refreshed every two days from the official sources. The date of the last update appears with each result.

Can I rely on this check for compliance or legal decisions?

No. It is an informational tool. It is not a sanctions or compliance clearance and not legal advice. See the disclaimer.

What should I do if an address I paid is listed?

Stop sending funds, preserve your records, report to IC3, and consider a case assessment. Frozen stablecoins can sometimes be returned through legal process, which starts with documentation.

Checks are automated and informational only, can miss scams or raise false alarms, and are not a clearance, a legal determination or advice. Full disclaimer.