{"id":1310,"date":"2026-07-20T18:42:41","date_gmt":"2026-07-20T15:12:41","guid":{"rendered":"https:\/\/safeon.ir\/mag\/direct-vs-indirect-risk-onchain-analysis\/"},"modified":"2026-07-20T18:42:41","modified_gmt":"2026-07-20T15:12:41","slug":"direct-vs-indirect-risk-onchain-analysis","status":"publish","type":"post","link":"https:\/\/safeon.ir\/mag\/en\/direct-vs-indirect-risk-onchain-analysis\/","title":{"rendered":"Direct vs. indirect risk in on-chain analysis"},"content":{"rendered":"

When you open a wallet’s risk report, you probably look straight at the final score. But behind that number sits an important question: how far away from this address is the contamination, exactly? The difference between direct vs indirect risk answers that question. In this article you will learn what each type of risk means, why they don’t carry the same weight, and how taking them into account helps you read a risk score more accurately.<\/p>\n

How does on-chain analysis follow the money?<\/h2>\n

Blockchains such as TRON, BNB Smart Chain and Ethereum run on a public ledger. Every transaction, along with its sender, recipient and amount, is recorded permanently. On-chain analysis uses this public data to measure how one address is connected to others. Once an address is known to belong to a sanctioned entity, a mixer, a hack or a frozen wallet, you can see where the money went from that point and which addresses it eventually reached.<\/p>\n

Think of this path as a chain. Each link in the chain is a “hop”, meaning one transfer. If your wallet sits in the first link right next to a high-risk source, the situation is very different from one where it is five links away. That distance is exactly what splits risk into two categories: direct and indirect.<\/p>\n

What do direct and indirect risk actually mean?<\/h2>\n

Direct risk<\/h3>\n

Direct risk means the address you are checking has transacted with a high-risk address without any intermediary. For example, if a wallet received funds straight from a sanctioned address, or sent funds straight to a mixer, its exposure is direct. In some cases the address itself is the source of risk, for instance when it has been added to the USDT blacklist or has already been frozen.<\/p>\n

Indirect risk<\/h3>\n

Indirect risk means the high-risk source sits one or more intermediaries further back. Say money moved from a hacked address to address A, then to address B, and finally landed in the wallet you are checking. In that case your wallet never interacted with the tainted source directly, yet part of its funds originated there.<\/p>\n

If you want to see how a mixer deliberately stretches this distance to make tracing harder, read crypto mixers and source-of-funds tracing<\/a>.<\/p>\n

Why does direct risk weigh more?<\/h2>\n

In general, the closer an address is to a high-risk source, the more likely it is to have a real connection with that source. The main reasons for the difference in weight are:<\/p>\n