# How to spot an exchange wallet without a label list *ZeruAI has mapped 185 million connections between wallets. Chasing stolen money through them, the hard part is knowing where to stop.* By [ZeruAI - zScore, Zaps and Zapperboard News](https://blog.zeruai.org) · 2026-10-18 --- When crypto gets stolen, you follow it. Wallet to wallet, hop by hop. Sooner or later it lands at an exchange, and that’s where you have to stop, because the next hop out isn’t the thief any more. It’s some guy in Manila buying $40 of ether. Go one step too far and your investigation turns into a list of an exchange’s entire customer base. Millions of people, none of them the person you’re looking for. So the job hangs on recognising an exchange when you see one. The normal way is a list. Somebody, somewhere, labelled an address as belonging to Binance or Coinbase, and you check against it. ZeruAI ran that list against a much simpler idea on the same trace. Addresses caught by the curated list 53 Caught by one measured number 120 Same investigation, same set of counterparties. ### The number Every wallet on Ethereum keeps a public counter of how many transactions it has ever sent. It’s called a nonce and it sits on any block explorer. That’s the whole signal. What makes it useful is how the numbers fall. They don’t spread out evenly. They clump into two groups with a canyon in between. A typical busy wallet about 4,200 Almost nothing lives here 20k to 5M A large exchange 9.9M to 17.7M No person sends five million transactions. No business sends four thousand. The empty stretch runs from 20,000 to 5 million, a factor of 250, so you don’t have to pick a clever cutoff. Put the line anywhere in the canyon and you get the same answer. It confirms the big exchanges everyone already knows about. Then it keeps going and flags wallets doing 3.3 million transactions that aren’t on any public list we could find. Nobody had gotten around to labelling them. The counter didn’t care. ### Why we still keep the list Some exchange deposit addresses are smart contracts, and contracts don’t tick that counter the same way. A contract can move billions of dollars while its number reads zero or one. There are two physical kinds of exchange address, and the counter only sees one of them. So lists still matter, but they cover less than you’d think. The public label set we work from holds around 87,000 Ethereum addresses. Against the trail we were following, that came to 2.1%. ### The 2.1% has traps in it Three we hit for real, all of them still live in that data. “Blocked” doesn’t mean criminal. Nearly two thousand addresses carry that label, and one of them is a major stablecoin contract, because the company behind it can freeze accounts. Read the label as a red flag and you’ve just flagged one of the biggest tokens in crypto. Addresses carry several labels at once. That same contract has four. Any tool that takes the first one it sees will happily file a token contract as an exchange. Criminals get infrastructure labels too. One well-known bridge hacker is tagged as both sanctioned and blocked. A tool that reads the second tag skips the address as boring plumbing, and that address was the entire point of the investigation. ### A free extra signal: vanity addresses Addresses that start with a long run of zeros don’t happen by accident. You have to grind through millions of guesses to find one. On this trail we found 123 of them, where pure chance predicts 0.137. Nobody burns that much computing power on a good-looking address they’ll use twice. Those are businesses, every time. And they behave like it: pulling their history took ten times the work of a normal wallet. ### Why ZeruAI reads behavior instead of labels Hand-maintained lists describe the part of the world somebody already wrote down. At 2.1% coverage, that’s a small part. A number the wallet publishes about itself works on the address nobody has heard of yet, which is almost every address that ends up mattering. That’s the idea behind ZeruAI. A label is one person’s opinion about an address, recorded once. Behavior is what the wallet actually did, and it keeps updating. zScore is built on the second kind of evidence. zScreen, ZeruAI’s wallet screening API, takes the same approach to counterparty risk, source-of-funds context and pre-transaction checks. It supports compliance teams and doesn’t replace their judgment. A person still decides what a trail means once the tracing stops. More on ZeruAI at [zeruai.org](http://zeruai.org). --- *Originally published on [ZeruAI - zScore, Zaps and Zapperboard News](https://blog.zeruai.org/how-to-spot-an-exchange-wallet-without-a-label-list)*