Tainted crypto is cryptocurrency whose transfer history links it to risky sources: fraud, theft, darknet markets, sanctioned addresses. The coins themselves look exactly like any other USDT or BTC. What differs is the path they took, and on a public blockchain that path is visible to everyone. Here’s where tainted coins come from, how the taint travels, and why AML tools express it as a percentage.
What is tainted crypto?
It’s funds with risky addresses somewhere in their history. “Tainted” or “dirty” is everyday shorthand. AML reports talk about risk and sources of funds instead.
A blockchain records every transaction: sender, recipient, amount and time. If an address once received money from a scam, that link stays in the public record for good. Nobody can reverse or edit it.
Individual coins have no serial numbers. One USDT on TRC-20 is interchangeable with any other. So the thing being assessed is the address or the transaction: where its funds came from, and what share of them traces back to problem sources.
Where does tainted crypto come from?
From activity that exchanges and analytics providers classify as high risk. The mexm AML report tracks more than 20 risk sources in three groups, and “tainted” in the everyday sense means the first group.
| Group | Risk level | Example categories |
|---|---|---|
| Dangerous | High | Scams, stolen funds, darknet markets, mixers, sanctions, ransomware |
| Suspicious | Medium | Unlicensed exchangers, unlicensed P2P, DEXs, low-KYC crypto ATMs |
| Trusted | Low | Licensed exchanges (CEX), licensed P2P, payment systems, miners |
The full dangerous list covers darknet marketplaces and darknet services, illegal services, scams, fraudulent exchangers, illegal gambling, stolen funds, mixers, malware, sanctions, terrorist financing and ransomware. Think of USDT a victim sent to a scammer’s address, or BTC pulled out of a hacked platform.
Mixers are a slightly different case. A mixer doesn’t steal anything; it blends coins from many users to blur the trail. That’s exactly why people with something to hide use them, so funds coming out of a mixer are treated as high risk.
The suspicious group is a gray zone. Money from an unlicensed exchanger or a DEX isn’t necessarily dirty, but those venues check their users lightly or not at all, so the origin of funds is harder to trace. The trusted group (licensed exchanges, custodial wallets, payment systems, miner rewards) runs its own customer checks, which is why funds from there count as clean.
How does taint spread through transfers?
It moves with the money. When an address with a risky history sends funds onward, the recipient becomes linked to that source through a single transaction.
Picture a chain. A scammer collects USDT from victims on one address, splits it across a few wallets, and some of it ends up at an unlicensed exchanger, which sells it to a random buyer. The buyer did nothing wrong. Still, their new USDT traces back to a scam, and if they deposit it on an exchange, the exchange’s monitoring will see that link.
That’s the defining property of tainted coins: a few hops don’t clean them. The whole history is public, so the chain can be followed back as far as needed. Running coins through a mixer to hide the trail just adds another high-risk line to the report.
What does happen is dilution. The same buyer’s address also receives money from elsewhere: a licensed exchange, friends, a salary paid in USDT. The risky transfer becomes one share of the total flow, and that share is what the percentage captures.
It works the other way too. An address that’s clean today can receive a transfer from a risky counterparty tomorrow, and its picture will change. That’s why reports on regular partners are worth refreshing from time to time.
Why is risk a percentage?
Because almost every active address receives funds from several sources, so a simple yes or no doesn’t fit. In mexm AML, the percentage reflects the combined weight of clean and dirty funds that passed through the address.
Alongside the total, the report lists source categories and the share from each. The mexm sample report (an illustration, not a real client) shows: licensed exchange 51%, unlicensed P2P 31%, scam 12%, mixer 6%. Over half came from a licensed platform, a third from the gray zone, and 18% from the dangerous group. That address is neither fully clean nor fully dirty.
| Total risk | Level | In practice |
|---|---|---|
| Below 40% | Low | Fine to work with |
| 40 to 50% | Medium | Look closely at the sources |
| 50% and above | High | Better to decline the deal |
Read the number and the breakdown together. A medium score driven by DEXs and unlicensed exchangers is one thing. The same score with a visible share of stolen funds or sanctions is another, and exchanges watch those categories especially closely.
Common myths about dirty crypto
- “Five wallets later, the coins are clean.” They aren’t. A long run of quick transfers between fresh addresses tends to draw attention rather than deflect it.
- “Only criminals end up with tainted coins.” An ordinary buyer dealing with a private seller or an exchanger can receive coins that touched a scam a few hops earlier.
- “A high score means the owner is a scammer.” The report doesn’t say that. It says what share of the funds is linked to risky sources.
- “A clean address means a safe deal.” AML screening covers the money’s origin, not the person’s honesty.
Why tainted coins are a problem for the recipient
Whoever holds the coins now deals with the consequences. The sender may be long gone.
Major exchanges screen incoming deposits and may hold a deposit linked to dangerous sources while they ask where it came from. With USDT there’s a second scenario: Tether can freeze tokens on blacklisted addresses, and the coins simply stop moving. Our article on why exchanges freeze USDT explains the difference and what helps in each case.
How to avoid receiving tainted crypto
Screen the sender’s address before the deal and the transaction hash after it. There’s no other reliable way to see the coins’ history.
mexm AML is a Telegram bot, @AMLmexmBot, that checks wallet addresses and transaction hashes on Bitcoin, Ethereum and Tron; the first check is free. Open @AMLmexmBot, pick the network (Tron for USDT TRC-20, Ethereum for USDT ERC-20), send the address or hash, and read the score and sources. Save the report: if funds get frozen anyway, it shows the exchange you checked where the money came from. Packages start from $0.30 per check as of November 2026; details are on the AML check page.
The limits are real. No service knows who owns every address, and a scammer’s fresh address may not be labeled anywhere yet. A low score sharply reduces the chance of trouble but can’t guarantee anything.
The takeaway
Tainted crypto differs from clean crypto only in its history, and transfers don’t erase that history. They dilute it, which is why risk comes as a share rather than a verdict. A couple of minutes screening an unfamiliar address is far easier than explaining a scam trail to an exchange later.