Two wallets, same score, different risk

Two addresses come back from a scanner with the same number. One belongs to someone who trades weekly and keeps a small balance. The other holds a long-term position and has three standing approvals from 2023. The score says they carry the same risk, and they do not.

A risk score is a single figure produced by weighting several signals about an address. It is genuinely useful for triage — for deciding what to look at — and it cannot represent risk, because risk depends on what you would lose and that is not on the chain.

What goes into the number

A risk score combines some subset of these signals, weighted by choices the provider makes and rarely publishes.

• Outstanding approvals. How many contracts can move funds, and whether any are unlimited.
• Counterparty history. Whether the address has interacted with contracts or addresses flagged for theft or fraud.
• Contract properties. Age, source verification, upgradeability of things the address deals with.
• Behavioural patterns. Frequency, diversity, whether activity resembles known patterns.
• Holdings composition. Concentration in one asset, exposure to tokens with unusual characteristics.

The score is a summary of signals. It has no idea what your balance means to you, and that is most of what risk actually is.

Why identical scores mean different things

The same risk score can describe very different situations, for four reasons, and each is a real case rather than an edge case.

Exposure differs. An unlimited approval on an address holding a small amount and one holding a life's savings score alike and are not comparable. The score is about the address's configuration; the consequence is about its contents.

Intent differs. A trader granting approvals daily is operating deliberately with known exposure. Someone with the same approvals from two years ago has forgotten them. Same signal, opposite meanings.

Time differs. A score is computed now. An address about to receive a large transfer, or one whose owner is about to sign something, is not described by a number from ten minutes ago.

The threat model differs. An address that never connects to sites faces a different set of risks from one that connects daily, and no score knows which you are.

Reading a score usefully

Four rules turn a risk score into an instrument rather than a verdict.

1. Use it to rank, not to judge. A score's real job is telling you which of twenty addresses to examine first. That is genuinely valuable and it is a different claim from "this is safe".
2. Read the components, not the total. Every scanner that produces a score also lists what fed it. The components are facts; the total is a weighting decision made by someone who does not know your situation. A tool such as Riskira is most useful read this way — the outstanding approvals and counterparty ages answer questions the number only gestures at.
3. Never treat a low score as clearance. Absence of flagged history means nothing has been reported, and reporting lags reality by design.
4. Watch changes rather than levels. A score moving is a signal that something happened. A score sitting still is a description of a configuration, and configurations do not cause losses on their own.

Point four is the one that converts a score into something worth checking regularly. The level tells you little; the delta tells you an approval was granted, a new counterparty appeared, or a holding changed.

Where a score is actively misleading

Three situations where a risk score points the wrong way.

A fresh wallet scores well. No history, no approvals, no flagged counterparties — and no evidence of anything at all. New and safe look identical to a scoring system, which is precisely the condition an attacker's address is in.

A busy legitimate wallet scores badly. Frequent interaction with many contracts is what normal use looks like for an active participant, and it accumulates exactly the signals that lower a score.

A compromised key scores fine. If someone else holds your seed phrase, nothing about the address changes until they act. The score describes permissions granted to contracts, and a key holder needs no permissions.

The third is worth stating plainly because it bounds what any of this can do. Scoring is about what contracts may do with your funds, not about who can sign. Those are separate categories of failure and only one of them is visible.

What to check that no score contains

Five things sit outside any risk score, and none of them can be measured from the chain.

How much you would mind losing it. The only question that converts exposure into risk, and it is yours to answer.

Whether the approvals were intentional. You know which ones you granted deliberately. Nothing else does.

Where the seed phrase lives. The largest single factor in whether funds survive, and entirely off-chain.

What you are about to sign. The decoded transaction in front of you outranks any historical summary.

Whether the wallet is segregated. An address holding only what is in play bounds every failure mode above, and it is a decision rather than a measurement.

Building your own view instead

For anyone holding across several addresses, a simple private assessment beats any published score, because it can contain the thing that matters.

Keep a short list — a note, a spreadsheet — with one row per address and four columns:

• What it holds, in rough terms rather than exact figures.
• What it connects to. Never, occasionally, or daily.
• Standing approvals, with dates and whether each was deliberate.
• Where the key lives. Hardware, phone, or a seed phrase in a drawer.

That table does what no scanner can: it puts exposure beside configuration. An address with three approvals and nothing in it needs no attention; the same three approvals against a long-term holding are the most urgent item you own, and only your own list knows which is which.

Reviewing it takes ten minutes a quarter, and the review usually produces exactly one action — revoke something, move a balance, or write down where a backup is. That is a better outcome than reading a number that moved from 62 to 58 and having no idea what to do about it.

A workable habit

For anyone holding more than a trivial amount, a quarterly pass in fifteen minutes.

Scan each address you use, and read the approvals list rather than the total.

Revoke anything you cannot name, on both the token and NFT tabs.

Confirm the segregation still holds — that the address connecting to sites is still the one holding little.

Check the seed phrase backup exists and is findable, which no scan will ever tell you.

More on how labels and flags are produced in risk analysis, what an approval actually grants in web3 security, and reading a preview in transaction safety.

The short version

A risk score weights on-chain signals into one figure, which makes it good for ranking what to examine and unable to represent risk itself — because risk depends on your balance, your intentions and where your seed phrase is, none of which are on the chain.

Read the components rather than the total, treat a moving score as the signal and a static one as a description, and remember that a fresh wallet scores well precisely because there is nothing to know about it yet.