CredScore verdict
0xea9f…10c7eth-mainnetScore
35
0 = max risk · 100 = clean
High riskEscalateConfidence:84%
Escalate for deeper review
CredScore sees a 5.1-year-old wallet with 182 transfers. Hack / exploit proceeds attribution and DEX-routed pass-through pattern are severe enough to require escalation before any further interaction.
Wallet snapshot
Wallet age
5.1 years
Transfers observed
182
Native balance
0.0000 ETH
Last activity
2 months ago
Counterparties
84
Primary risk drivers
Hack / exploit proceeds attribution
This wallet is labeled as proceeds from a documented hack or exploit.
The wallet is labeled as proceeds from a documented hack or exploit, which is a hard escalation signal for compliance review.
DEX-routed pass-through pattern
Single inbound source supplied 75% of inbound value · DEX + aggregator routing share: 53% of activity · Flow directionality: heavily one-sided (balance score 0.01)
A dominant share of the wallet's inbound value came from a single source, was routed through DEX or aggregator swap activity, and was drained from the wallet rather than retained. This is the laundering fingerprint observed on documented social-engineering theft cases: a large victim transfer arrives, gets fragmented into many DEX swaps to convert and obscure the asset trail, and the wallet is emptied. It is also consistent with one-shot legitimate behavior (an ICO recipient or grant payee cashing out via DEX), so it warrants review until the funding-source provenance is established.
Rapid outflow pattern
Rapid outbound events observed: 90
Rapid outflow behavior can indicate routing, distribution, or non-routine operational flow that deserves review.
Observed entity context
Labels
ZachXBT-Named Pig-Butchering WalletMetamask SwapsUniswap V3 RouterWETH Tokenapproveuniswap
Protocols
Uniswap V3 Positions NFTmetamaskuniswapwrapped-ethUniswap UNI Token
Offsetting factors
Established history
Wallet age: 5.1y (observed)
Observable activity present
Transfers observed: 182
Moderately distributed counterparties
Unique counterparties observed: 84
Analyst briefing
Executive Risk Verdict
This address presents elevated counterparty risk. Hack / exploit proceeds attribution and DEX-routed pass-through pattern compose adverse signal severe enough to justify escalation under current coverage.
Decision Posture
Escalate for deeper review. This case should not be treated as routine. Sensitive exposure or materially adverse signal composition is strong enough to justify deeper investigation before proceeding.
Primary Risk Drivers
Hack / exploit proceeds attribution This wallet is labeled as proceeds from a documented hack or exploit. The wallet is labeled as proceeds from a documented hack or exploit, which is a hard escalation signal for compliance review.
DEX-routed pass-through pattern
Single inbound source supplied 75% of inbound value
DEX + aggregator routing share: 53% of activity
Flow directionality: heavily one-sided (balance score 0.01)
A dominant share of the wallet's inbound value came from a single source, was routed through DEX or aggregator swap activity, and was drained from the wallet rather than retained. This is the laundering fingerprint observed on documented social-engineering theft cases: a large victim transfer arrives, gets fragmented into many DEX swaps to convert and obscure the asset trail, and the wallet is emptied. It is also consistent with one-shot legitimate behavior (an ICO recipient or grant payee cashing out via DEX), so it warrants review until the funding-source provenance is established.
Rapid outflow pattern
Rapid outbound events observed: 90
Rapid outflow behavior can indicate routing, distribution, or non-routine operational flow that deserves review.
Offsetting Factors
Established history Wallet age: 5.1y (observed)
Observable activity present
Transfers observed: 182
Moderately distributed counterparties
Unique counterparties observed: 84
Structural Pattern Observations
Fan-out distribution (medium confidence) The observed flow pattern is consistent with organized distribution behavior, but recognizable exchange or protocol context partially normalizes the structure and makes a benign operational explanation more plausible.
Behavior Distribution
Exchange-related interactions: 6% of observed activity. DEX-related interactions: 39% of observed activity. Router / aggregator interactions: 14% of observed activity. Attributed interactions: 100% of observed activity. High-confidence attributed interactions: 21% of observed activity.
Observed Entity / Protocol Context
ZachXBT-Named Pig-Butchering Wallet Metamask Swaps Uniswap V3 Router WETH Token approve
Observed Protocol Attribution
Uniswap V3 Positions NFT metamask uniswap wrapped-eth Uniswap UNI Token
Confidence Statement
Overall assessment confidence is high (84%), reflecting stronger sample depth, better coverage, and more stable observable behavior.
Sensitivity notes
No immediate sensitivity drivers were identified from generalized metrics. Larger changes would likely come from stronger exposure and attribution intelligence.
For analysts
Generate a Defensible Verdict Report — engine version + timestamp baked in, exportable as PDF or copy-pasted as Markdown into a SAR narrative or case file.
Run your own wallet through CredScore
Deterministic Ethereum wallet risk scoring with a full audit trail. Every signal has an explicit numeric weight, output is reproducible. Paste any wallet to see your own verdict.
First analysis is free, no credit card. Or see pricing.
Shared Aug 23, 2026