Riskira: what a 0–100 wallet score is actually reading

You are about to send funds to an address you were given in a chat. The address is 42 characters long, it is correct as far as you can tell, and you know nothing else about it. That gap — between a valid address and a known one — is where most avoidable losses happen.

Riskira is our iPhone and Android app that reads what the chain already says about an address and returns it in plain language, with a score from 0 to 100. This article is about what that number is made of, because a score you cannot interpret is worse than no score at all.

What the report actually contains

The listing screenshots show a completed scan, and the structure is worth walking through because each part answers a different question.

At the top, a score badge — 15, labelled low risk — with two tags beside it: "whale" and "8 mo old". Below that, the balance and its recent change. Then a written summary, then the risk breakdown with its own labels, then two buttons: delete the local report, or export it as a PDF.

The summary in the screenshot reads like this: the wallet has been active for roughly 254 days, has conducted 1,000 transactions all of which are outgoing, holds a native balance of about 10.1 ETH and a portfolio of 16 tokens with significant holdings in two stablecoins, and has spent around 0.006 ETH on gas.

Every one of those figures is public. Balances, transaction counts, token holdings and gas spend are all readable from a node through the standard JSON-RPC interface, and token balances follow the ERC-20 interface. Nothing here is privileged information, and that is the point — the data was always there, and reading it by hand is the tedious part.

What goes into a score?

Broadly, four families of signal, and they are not equally reliable.

That last row matters more than people expect, and we have written about it separately: an address does not consent to what is sent to it. Unsolicited tokens arrive in wallets constantly, which is why a scoring model that punishes holdings alone will mislabel ordinary users.

The screenshot's example is a good illustration of nuance. A score of 15 with a "whale" tag and 1,000 outgoing transactions is not a suspicious profile; it reads as an active operational wallet. The same shape at eight days old rather than eight months would read very differently.

What can a scanner never tell you?

Four things, and knowing them is most of what makes the tool useful rather than reassuring.

• Who owns the address. Chain data has no names. An address is a pseudonym, and linking it to a person is a separate discipline.
• What was agreed off-chain. The chain records a transfer, not a promise. A scam with a clean on-chain record is still a scam.
• What happens next. A score reads history. An address with a spotless record can behave badly for the first time on your transaction.
• Whether a contract is safe to approve. That is a question about code and permissions, not about an address's past — and it is the subject of our transaction safety work.

A clean score is the absence of a known bad signal. It is not the presence of a good one.

This is also why Riskira is deliberately read-only. It never holds funds or private keys, and the listing states plainly that it is not an exchange, a custodial wallet or a financial adviser. A tool that reads public data needs no custody, so it does not ask for any — which removes the largest risk a wallet-adjacent app can carry.

What it costs you to use it

Two things, and only one of them is money.

The first is that your query is a signal. Asking a service about an address tells that service you are interested in it, and the scan screen shows an account and an eight-network scope, so the analysis runs remotely rather than on the phone. The screenshots also carry a "powered by GPT" tag, meaning the written summary is produced by a language model — which is why the summary reads as prose and why it should be treated as a summary of the data rather than an authority above it.

The second is the usual model caveat. A generated summary can restate a number incorrectly. The figures in the report are checkable against any block explorer, and for a decision that matters, checking two of them is a minute well spent.

Reports are saved locally with a delete button, and can be exported to PDF. Local storage is the right default for something that reveals what you were curious about.

How to use it well

Scan before the first transfer to a new counterparty, not after a problem. Read the summary, then check the two figures that would change your decision — usually age and whether the activity shape matches the story you were told. Treat a high score as a reason to stop and a low score as a reason to continue carefully, never as permission.

And keep the limits in view. Riskira is informational, not financial advice, and it says so. It compresses public history into a number so you can ask better questions, which is a genuinely useful thing and a much smaller claim than safety. The habits that actually prevent losses — verifying addresses out of band, reviewing approvals, keeping value off hot wallets — are the subject of our wallet security writing, and no scanner replaces them.

Reading the tags, not just the number

The badges beside the score do more work than the score itself, and they are the part worth learning to read.

"8 mo old" is an age claim, and age is the single most useful signal in the set. Fraud infrastructure is disposable by necessity — an address that has been active for months has survived a period in which complaints would have accumulated.

"Whale" is a size claim, and it is neutral rather than good. It tells you the balance is large, which changes what a mistake costs but says nothing about intent. A large balance is equally consistent with a treasury, an exchange hot wallet and a successful thief.

Labels in the risk breakdown, like the "very active contract usage" tag in the screenshot, describe behaviour patterns. These are the most interpretable part of the report and the least conclusive: heavy contract interaction is what an active DeFi user looks like, and also what an automated drainer looks like.

• Age is the strongest single signal, and the easiest to reason about.
• Size changes the stakes, not the verdict.
• Behaviour labels describe shape, and shapes are shared by very different actors.

Read all three together, against the story you were told about the address. A "payroll wallet" that is four days old is worth a second conversation; the mismatch between claim and history is the finding, not the score.

Version 1.0.2 is current, updated in June 2026, with no ratings yet on either store. Whatever tool you use, the discipline it supports matters more than the tool — and that discipline is the subject of most of our suspicious address work.