Risk tags for crypto.
Account takeover, withdrawal holds, mule clusters and airdrop abuse in one event stream, with a decision you can delegate. Built for CEX, DEX and crypto-native fintech.
Crypto attackers operate at the speed of on-chain finality: once funds leave, they're gone. That forces risk decisions into the seconds before a withdrawal, with higher stakes than traditional fintech. At the same time every exchange pays for verification on users who never needed it, because there was no way to tell them apart at signup.
The attack surface, broken down.
Account takeover & withdrawal fraud
New device, impossible travel, credential reuse, then a withdrawal to a new address. The hold goes in before the funds go out.
device.newlogin.impossible_travelwithdrawal.destination_new- withdrawal.destination_new + device.new → hold + step_up
Mule clusters
Accounts operating as part of a laundering network share devices, instruments and timing. The cluster is visible even when each account looks clean.
cluster.size_5pluscluster.shares_device_with_bannednetwork.banned_elsewhere- cluster.shares_device_with_banned → review
- network.banned_elsewhere → kyc
Airdrop, bonus & referral abuse
One person, many wallets, one device. Promo claims and referral loops are tagged at the cluster level, with a quiet window for the launch hour.
promo.multi_claimreferral.self_loopdevice.shared_with_banned- promo.multi_claim → block promo
- referral.self_loop → void referral
Who actually needs verification
Most signups never need a document check. The ones that do are tagged and routed to your partner; the rest trade the same minute.
kyc.recommendedemail.no_footprintip.tor- kyc.recommended → kyc (partner: sumsub)
Three reasons it fits.
Holds, not just scores.
Autopilot places the withdrawal hold via your webhook and lifts it when the user confirms on a known channel. Reversible, logged, capped.
Graph-native mule detection.
Clusters surface coordinated networks that rule-based tools miss, and labels from one exchange protect the next.
Verification only where it counts.
Route to Sumsub or your partner from a tag. Pay for the users who need it, skip the rest.
We don't verify identities. We tell you who needs it.
kyc.recommended routes to Sumsub or the partner you choose, at their price, and keeps the audit trail on our side, next to the tags that sent the user there. Everyone else goes straight through.
Presets tuned on high-velocity exchange traffic: local phone footprint, UPI and local bank rails for deposits alongside cards, a data region you choose, and policy notes for the frameworks that apply in your jurisdiction.
Your risk team starts here.
$99 a month, 10,000 events, sandbox before you pay, money back in 14 days if it doesn't fit.