Settings

Severity bands and exposure thresholds drive every score and alert. Changes apply to screens run after saving; stored screens keep the settings they were scored with. See Methodology for the formula.

Category severities and thresholds

Category	Severity band	Threshold (% of traced value)	Default
Sanctioned entity or designated address sanctioned			severe / 0.05%
Terrorism financing terrorism_financing			severe / 0.05%
Child sexual abuse material child_abuse_material			severe / 0.05%
Ransomware operator or affiliate ransomware			severe / 0.05%
Darknet marketplace darknet_market			severe / 0.05%
Mixing or anonymising service mixer			high / 1.0%
Proceeds of hacks and exploits stolen_funds			high / 1.0%
Scam, phishing or investment fraud scam			high / 1.0%
Fraud shop / stolen data vendor fraud_shop			high / 1.0%
Exchange with weak or absent KYC high_risk_exchange			medium / 5.0%
Unlicensed peer-to-peer broker unlicensed_p2p			medium / 5.0%
Gambling or betting service gambling			medium / 5.0%
Cross-chain bridge bridge			low / 35.0%
Decentralised finance protocol defi			none / 100.0%
Unattributed address unknown			none / 100.0%
Regulated exchange or VASP exchange			none / 100.0%
Mining pool mining			none / 100.0%
Merchant or payment processor merchant			none / 100.0%
Regulated custodian custodian			none / 100.0%
Token contract token_contract			none / 100.0%

Alert threshold (score)

Alert webhook (https, or http on localhost)