ScoreGuard Know Your VASP report · KYV-f16a3bd3fd8f · generated 2026-09-13T20:53:09+00:00

Data source: live:alchemy,live:mempool.space · desk + on-chain review · scale 1–100, lower is riskier · 2 of 2 clustered address(es) screened

Re-run now VASP directory

91of 100

Know Your VASP report Low risk

iFinex Inc. (Bitfinex)

Exchange · incorporated in British Virgin Islands · founded 2012 · attribution: public

Desk review84

On-chain review96

Cluster volume 9,385,571,517

iFinex Inc. (Bitfinex) is a exchange incorporated in British Virgin Islands, assessed at 91/100 (low risk) from a desk review of 84/100 and an on-chain review of 96/100. Licence status is licensed with claimed evidence (British Virgin Islands financial supervisory authority), MiCA transitional, KYC rigour strict, Travel Rule ready. The largest single deduction is 5 points for licence evidence: licence evidence is claimed. 2 clustered wallet(s) moved $9,385,571,517 in the reviewed window, of which $0 (0.00%) touched categories of severity 5 or above and 0.00% touched severity 8 or above. Attribution covers too little of the traced value to treat this as a clear result. Review required; a low-risk score here means little was identified, not that little is there. Original: Licensed, supervised and Travel Rule capable; standard measures apply.

Combined score weights the desk review at 45% and the on-chain review at 55%, because chain evidence is observed while the regulatory file is asserted.

What this assessment rests on

45% of the score is a desk review of the regulatory file. Licence status, controls and monitoring maturity are asserted in the directory record rather than observed on chain, and no attribution measurement grades them.

55% of the score is the on-chain review of 2 of 2 clustered address(es). 0.0% of the value those wallets moved resolves to an identified counterparty (insufficient attribution), and the risk composition and illicit-share figures are computed over the same traffic.

The attribution figure covers the on-chain review only. There is no single coverage percentage for this score, because the desk review half is not measured over counterparty value.

Regulatory file

Legal name	iFinex Inc. (Bitfinex)
Trading name	Bitfinex Hot Wallet
Licence status	licensed (claimed evidence)
Regulator	British Virgin Islands financial supervisory authority
Licence reference	VG-7BDA5A50
MiCA status	transitional
Jurisdiction	British Virgin Islands (VG), risk 5/10 · offshore secrecy
Operational hubs	VG, SV

Controls

KYC rigour	strict · Identity verification before first withdrawal, no anonymous tier.
Withdrawal KYC threshold	$0
Travel Rule	ready · Originator and beneficiary data exchanged for VASP-to-VASP transfers.
Transaction monitoring	mature
Sanctions screening	in place
Source of funds checks	performed
Custody model	custodial

Desk review deductions

16.0 points deducted from 100.

Licence evidence -5.0 pts

licence evidence is claimed

Jurisdiction -5.0 pts

British Virgin Islands is an offshore secrecy jurisdiction

MiCA status -3.0 pts

MiCA transitional

Jurisdiction risk -3.0 pts

British Virgin Islands carries jurisdiction risk 5/10

On-chain review of the provider's clusters

Clustered addresses 2

Wallets screened 2

Inbound 73,747,973

Outbound 9,311,823,544

Illicit share 0.0%

Insufficient attribution · 0.0% of traced value

Only 0% of traced value resolves to an identified counterparty, so this score is not a reliable summary of the wallet. A low-risk result here means little was identified, not that little is there.

Measured over the counterparties of the screened clustered wallets. It grades the on-chain half of the score only, not the desk review.

11 of 135 counterparties (8.1%) resolve to an identified entity. This screen cannot auto-clear: attribution is below the sufficient floor (70% of traced value). Unattributed exposure is penalised: the 'unknown' category carries a 4.0-point penalty at full exposure, reached at a 60% share. A wallet with mostly unidentified counterparties loses points for that. A clean-looking score still cannot auto-clear below the sufficient attribution floor.

Risk composition of managed wallets

Unattributed address · sev 2 100.0% · 9,385,571,517

Screened wallets

Address	Chain	Score	Risk	Inbound	Outbound	Transfers	Source
0x77134cbC06cB00b66F4c7e623D5fdBF6777635EC	Ethereum	96	Low	73,746,833	6,997,419	300	live:alchemy
1P5ZEDWTKTFGxQjZphgWPQUpe554WKDfHQ	Bitcoin	96	Low	1,140	9,304,826,125	124	live:mempool.space

Compliance and provenance

Travel Rule	counterparty ready · Originator and beneficiary data exchanged for VASP-to-VASP transfers.
Data source	live:alchemy,live:mempool.space · 2 of 2 clustered address(es) screened
Directory	41 VASP profiles, 2463 labelled entities

Label sources

Sanctions: 943 designated addresses from the US Treasury OFAC SDN list, published 08/28/2026.
Token contracts: 927 identified from public token lists.
Cited public labels: 519 addresses from 34 source(s), each with a URL.
- Aave address book: V3 Ethereum (98 addresses) — https://aave-dao.github.io/aave-address-book/api/v1/modules/AaveV3Ethereum.json
- FBI/IC3 PSA: North Korea responsible for $1.5 billion Bybit hack (51 addresses) — https://www.ic3.gov/PSA/2025/PSA250226
- Aave address book: AaveV3Polygon (45 addresses) — https://aave-dao.github.io/aave-address-book/api/v1/modules/AaveV3Polygon.json
- Aave address book: V2 Ethereum (40 addresses) — https://aave-dao.github.io/aave-address-book/api/v1/modules/AaveV2Ethereum.json
- Aave address book: AaveV3Arbitrum (39 addresses) — https://aave-dao.github.io/aave-address-book/api/v1/modules/AaveV3Arbitrum.json
- Aave address book: AaveV3Optimism (31 addresses) — https://aave-dao.github.io/aave-address-book/api/v1/modules/AaveV3Optimism.json
- Aave address book: AaveV3Base (25 addresses) — https://aave-dao.github.io/aave-address-book/api/v1/modules/AaveV3Base.json
- Tornado Cash smart contracts (24 addresses) — https://docs.tornado.cash/general/tornado-cash-smart-contracts
- Bybit: wallet addresses ownership explained (21 addresses) — https://www.bybit.com/en/help-center/article/Bybit-Wallet-Addresses-Ownership-Explained
- Circle CCTP EVM contract addresses (20 addresses) — https://developers.circle.com/cctp/evm-smart-contracts
- Aave address book: AaveV3BNB (18 addresses) — https://aave-dao.github.io/aave-address-book/api/v1/modules/AaveV3BNB.json
- Bitfinex: published public wallets (16 addresses) — https://github.com/bitfinexcom/pub/blob/main/wallets.txt
- Aave address book: AaveV2Polygon (16 addresses) — https://aave-dao.github.io/aave-address-book/api/v1/modules/AaveV2Polygon.json
- Aave address book: AaveV3EthereumLido (12 addresses) — https://aave-dao.github.io/aave-address-book/api/v1/modules/AaveV3EthereumLido.json
- Crypto.com: Transparency First cold-wallet list (10 addresses) — https://crypto.com/en/company-news/transparency-first
- Uniswap v3 Arbitrum deployments (7 addresses) — https://docs.uniswap.org/contracts/v3/reference/deployments/arbitrum-deployments
- Uniswap v3 Optimism deployments (7 addresses) — https://docs.uniswap.org/contracts/v3/reference/deployments/optimism-deployments
- Uniswap v3 Polygon deployments (7 addresses) — https://docs.uniswap.org/contracts/v3/reference/deployments/polygon-deployments
- Lido deployed contracts (6 addresses) — https://docs.lido.fi/deployed-contracts/
- Uniswap v3 Base deployments (6 addresses) — https://docs.uniswap.org/contracts/v3/reference/deployments/base-deployments
- Uniswap v3 Ethereum deployments (3 addresses) — https://docs.uniswap.org/contracts/v3/reference/deployments/ethereum-deployments
- Chainalysis: Euler Finance flash loan attack (2 addresses) — https://www.chainalysis.com/blog/euler-finance-flash-loan-attack/
- Morpho deployed contracts (2 addresses) — https://docs.morpho.org/get-started/resources/addresses
- Compound III USDC Ethereum roots (2 addresses) — https://github.com/compound-finance/comet/blob/main/deployments/mainnet/usdc/roots.json
- Aave address book: GhoEthereum (2 addresses) — https://aave-dao.github.io/aave-address-book/api/v1/modules/GhoEthereum.json
- Railgun privacy system contracts (1 address) — https://docs.railgun.org/wiki/learn/helpful-links
- Linea network contracts (1 address) — https://docs.linea.build/network/build/contracts
- Starknet L1-L2 messaging (1 address) — https://docs.starknet.io/documentation/architecture_and_concepts/Network_Architecture/l1-l2-messaging/
- Chainalysis: Wormhole hack February 2022 (1 address) — https://www.chainalysis.com/blog/wormhole-hack-february-2022/
- Compound III USDS Ethereum roots (1 address) — https://github.com/compound-finance/comet/blob/main/deployments/mainnet/usds/roots.json
- Compound III USDT Ethereum roots (1 address) — https://github.com/compound-finance/comet/blob/main/deployments/mainnet/usdt/roots.json
- Compound III WBTC Ethereum roots (1 address) — https://github.com/compound-finance/comet/blob/main/deployments/mainnet/wbtc/roots.json
- Compound III WETH Ethereum roots (1 address) — https://github.com/compound-finance/comet/blob/main/deployments/mainnet/weth/roots.json
- Compound III WSTETH Ethereum roots (1 address) — https://github.com/compound-finance/comet/blob/main/deployments/mainnet/wsteth/roots.json
Demonstration data: excluded — 118 synthetic entities were not scored.

Screen window

Up to 500 transfers across 3 indexer page(s) · default 3 hops · hop-2 budget 16 · hop-3 budget 12.

Artefact integrity

sha256+hmac · SHA-256 0ad637332c4bf99d612671fdf49fc2573a7c1134711d1382923cdcdb7014b3ef · sealed 2026-09-13T20:53:09+00:00 · HMAC present.

Frameworks covered

FATF Recommendation 15 / 16 — Counterparty attribution and originator/beneficiary context.
EU MiCA (Regulation 2023/1114) — Risk assessment record for crypto-asset service providers.
EU AMLD / Transfer of Funds Regulation — Source and destination of funds with jurisdictional exposure.
OFAC sanctions programmes — Direct and cluster-level exposure to designated addresses.
FinCEN SAR / STR filing — Evidence pack: indicators, counterparties and transfer sample.

Informative

Notice / Disclaimer

Limits that apply to this artefact as a whole. Sources and hashes stay in provenance; this section is how to read them.

ScoreGuard reports are a point-in-time assessment produced from public blockchain data and a seeded label set. Unlabelled counterparties are left unknown; they are not assigned a guessed risk category. Labels marked 'synthetic' in the seed are demonstration entities and must not be used as the sole basis for a compliance decision.
Token-contract labels name contracts, not wallet owners.
Demonstration data was excluded — 118 synthetic entities were not scored.
Activity beyond the stated screen window is not in the score.
Recompute the sha256+hmac digest against the JSON export to confirm this copy matches what was stored.