ChainAnalyzer detection features and risk classification
ChainAnalyzer performs 76+ rule-based detection checks plus a 3-model ML anomaly ensemble (Isolation Forest + AutoEncoder + GraphSAGE) across 9 chains (Bitcoin, Ethereum, Polygon, BNB Smart Chain, Base, Arbitrum, Optimism, Avalanche, Solana), plus cross-chain checks via OSINT and contract-level risk feeds. Detection results are classified into 4 severity levels: CRITICAL / HIGH / MEDIUM / LOW, and calculated as a risk score out of 100.
The score starts at 100 and is reduced based on the severity of each detection.
| Severity | Deduction | Example |
|---|---|---|
| CRITICAL | -30 pts / each | 1 detection = 70, 2 = 40 |
| HIGH | -15 pts / each | 2 detections = 70 |
| MEDIUM | -5 pts / each | 4 detections = 80 |
| LOW | -2 pts / each | 5 detections = 90 |
| Score | Risk Level | Verdict |
|---|---|---|
| 90 - 100 | LOW | Safe |
| 70 - 89 | MEDIUM | Caution |
| 40 - 69 | HIGH | Danger |
| 0 - 39 | CRITICAL | Extremely Dangerous |
AI-powered complement to rule-based detection
An ensemble of ML models analyzes structural features from the transaction graph to detect anomalous wallet behavior patterns that rule-based checks may miss.
| ID | Name | Severity | Description |
|---|---|---|---|
| ML1 | ML_HIGH_ANOMALY | MEDIUM | Very high ML ensemble score — Highly anomalous graph structure |
| ML2 | ML_ANOMALY_DETECTED | MEDIUM | High ML ensemble score — Anomalous graph structure detected |
Detects that the token's Mint Authority has not been revoked. When Mint Authority is active, the authority holder can increase the token supply at any time, diluting existing holders' positions.
Detects tokens registered as "danger" in a community risk database. These tokens have already been identified as scams by the community or automated detection.
Detects that the token cannot be sold (swapped) or is extremely restricted. "Honeypot" tokens that can be purchased but not sold are a common scam technique.
Detects that the token's Freeze Authority has not been revoked. When Freeze Authority is active, the authority holder can freeze token transfers for any wallet.
Detects that the top 10 holders collectively own more than 50% of the total supply. When supply is concentrated in a few wallets, there is a risk of price crash from large sell-offs.
Detects that liquidity pool (LP) tokens are neither locked nor burned. When LP is unlocked, the creator can withdraw liquidity (rug pull) at any time.
Detects that a single address holds 20% or more of the total supply. When excessively concentrated in one wallet, a sell-off from that wallet can cause a significant price drop.
Detects extremely low liquidity relative to Market Cap. When the MC/LP ratio is high, large sell orders can cause significant price drops.
Detects that a token was created less than 7 days ago. New tokens have no track record and are statistically more likely to be scams.
Detects that the token has fewer than 50 holders. Extremely low holder counts increase liquidity and price manipulation risks.
Detects patterns suggesting top holders may be the same entity (person or organization). Cluster analysis identifies holding structures that appear distributed but are effectively concentrated.
Detects inconsistencies or missing fields in token metadata. Legitimate projects typically set proper name, symbol, and image in their token metadata.
Detects that there is only one liquidity provider for the pool. When dependent on a single provider, there is a risk of that provider withdrawing all liquidity.
Detects that no Twitter account or website link is set in the token metadata. Missing social links suggest low project transparency.
Detects that the top 10 holders collectively own more than 30% (but less than 50%) of the supply. Not immediately dangerous, but concentration is somewhat high.
Detects that 24-hour trading volume is below $100. Tokens with extremely low trading activity may not have sufficient liquidity when selling.
Detects that the token is not included in a major DEX verified token list. Listing on verified lists requires passing a review process, making it a reference indicator of credibility.
Basic detections work without an API key (Free tier). Some detections gain improved accuracy with additional API keys.
| No API Key | Enhanced with API Key | Market Data API Key |
|---|---|---|
C1 Mint Authority C2 Known Scam C3 Honeypot H1 Freeze Authority H3 LP Not Locked M1 New Token M4 Metadata Mismatch M5 Single LP Provider L1 Social Missing L4 Not Verified | H2 Top Holder >50% H4 Single Whale >20% M2 Low Holder Count M3 Suspicious Distribution L2 Moderate Concentration | H5 Low Liquidity L3 Low Volume |
API keys can be added in Settings > BYOK (Bring Your Own Key).
© 2026 ChainAnalyzer. All rights reserved.