vike

Example 2 of 32

Label 100 addresses in one call: who are they, and are any flagged or sanctioned?

One call labels up to 100 addresses and screens them for sanctioned, exploit and phishing addresses: POST them to /labels/batch and each row comes back with its entity, wallet type and risk flag.

POST /v1/onchain/labels/batch takes the addresses in the query string, with no request body. It returns one row per input address, in input order: entity, wallet_type, confidence, risk_flag, four 30-day activity fields, the lower-cased wallet and found. Up to 100 addresses go in one call, and a risk_flag filter turns the same call into a screen for flagged wallets. The full parameter list is on Batch wallet labels.

Quick answer

cURL
# entity, type and risk flag for five addresses in one call
curl -X POST -H "X-API-Key: $VIKE_API_KEY" \
  "https://data.vike.io/v1/onchain/labels/batch?addresses=0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045,0xeae7380dd4cef6fbd1144f49e4d1e6964258a4f4,0xbbbbbbbbbb9cc5e90e3b3af64bdaf62c37eeffcb,0x47666Fab8bd0Ac7003bce3f5C3585383F09486E2,0xA160cdAB225685dA1d56aa342Ad8841c3b53f291"

Example response

Captured from the live API on 2026-10-24 at 17:19 UTC, the whole response.

The rows follow the input order and each echoes its wallet, lower-cased, so compare addresses case-insensitively. risk_flag is the empty string on a clean row. The Bybit exploiter reads exploit and the Tornado Cash pool sanctioned.

Example response
[
  {
    "entity": "vitalik buterin",
    "wallet_type": "dex",
    "confidence": "medium",
    "risk_flag": "",
    "net_30d_usd": -70023.25164,
    "volume_30d_usd": 70046.74836,
    "tx_30d": 454,
    "tokens_30d_count": 157,
    "wallet": "0xd8da6bf26964af9d7eed9e03e53415d37aa96045",
    "found": true
  },
  {
    "entity": "wintermute",
    "wallet_type": "market_maker",
    "confidence": "medium",
    "risk_flag": "",
    "net_30d_usd": 2113236.042409,
    "volume_30d_usd": 2508838843.170737,
    "tx_30d": 14678,
    "tokens_30d_count": 100,
    "wallet": "0xeae7380dd4cef6fbd1144f49e4d1e6964258a4f4",
    "found": true
  },
  {
    "entity": "morpho",
    "wallet_type": "vault",
    "confidence": "high",
    "risk_flag": "",
    "net_30d_usd": -357800362.784802,
    "volume_30d_usd": 2359366854024.6597,
    "tx_30d": 409814,
    "tokens_30d_count": 235,
    "wallet": "0xbbbbbbbbbb9cc5e90e3b3af64bdaf62c37eeffcb",
    "found": true
  },
  {
    "entity": "bybit",
    "wallet_type": "cex",
    "confidence": "medium",
    "risk_flag": "exploit",
    "net_30d_usd": null,
    "volume_30d_usd": null,
    "tx_30d": null,
    "tokens_30d_count": null,
    "wallet": "0x47666fab8bd0ac7003bce3f5c3585383f09486e2",
    "found": true
  },
  {
    "entity": "tornadocash",
    "wallet_type": "flagged",
    "confidence": "medium",
    "risk_flag": "sanctioned",
    "net_30d_usd": null,
    "volume_30d_usd": null,
    "tx_30d": null,
    "tokens_30d_count": null,
    "wallet": "0xa160cdab225685da1d56aa342ad8841c3b53f291",
    "found": true
  }
]

Variations

Screen a list for risk flags. Keep only the rows whose risk_flag is set, such as sanctioned or exploit.

cURL — screen
# the flagged addresses of a list, with their flag
curl -s -X POST -H "X-API-Key: $VIKE_API_KEY" \
  "https://data.vike.io/v1/onchain/labels/batch?addresses=0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045,0x47666Fab8bd0Ac7003bce3f5C3585383F09486E2,0xA160cdAB225685dA1d56aa342Ad8841c3b53f291" \
  | jq '[.[] | select((.risk_flag // "") != "") | {wallet, entity, risk_flag}]'

Which source flagged it. For an Ethereum address, /labels/{address}/provenance lists each label source's own claim beside the consensus. On 2026-10-24 four sources named the Tornado Cash router, one of them in a blocked category.

cURL — sources
# every source's claim about one flagged address, plus the consensus
curl -H "X-API-Key: $VIKE_API_KEY" \
  "https://data.vike.io/v1/onchain/labels/0xd90e2f925da726b50c4ed8d0fb90ad053324f31b/provenance"

Another chain. Labels and flags are read from the chain you name only (default ethereum), so the same address can be flagged on one chain and not on another. The 30-day fields are read for that chain too, bsc included.

cURL — Base
# the same lookup against Base's labels
curl -X POST -H "X-API-Key: $VIKE_API_KEY" \
  "https://data.vike.io/v1/onchain/labels/batch?chain=base&addresses=0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045,0xeae7380dd4cef6fbd1144f49e4d1e6964258a4f4"

More than 100 addresses. Split the list. BATCH_2 is the second hundred, joined with commas.

cURL — second batch
# addresses 101 to 200, in a second call
curl -X POST -H "X-API-Key: $VIKE_API_KEY" \
  "https://data.vike.io/v1/onchain/labels/batch?addresses=$BATCH_2"

Before you rely on it

risk_flag is what a label source said

risk_flag comes from our label sources: sanctions lists and mixer labels give sanctioned, hack reports exploit, phishing reports phishing. It is not a live check against an official sanctions list, and a label can outlive the listing behind it. There is no frozen-by-issuer flag: a stablecoin issuer's blacklist is not covered. An empty risk_flag only says no source flagged the address, and found: false says we hold no label at all: neither one clears an address.

A hacker's entity can name the victim

The Bybit exploiter row's entity is bybit: the label names the victim, and the capture shows wallet_type: cex from before 2026-10-25. An address flagged exploit is now typed flagged instead of cex, but the entity can still carry the victim's name until the label rebuild lands, so filter on risk_flag before you treat a row as an exchange.

The captured 30-day fields predate the live ones

net_30d_usd, volume_30d_usd, tx_30d and tokens_30d_count used to come from an offline build that had stopped updating: vitalik.eth and Morpho returned the same four values on 2026-09-03 and on 2026-10-24, and the Bybit and Tornado Cash rows were null. Since 2026-10-25 they are computed live over the last 30 calendar days, the window /wallets/{address} calls 30d, and are null only for an address with no label. The windows beyond 30 days come from /wallets/{address}.

A rejected batch is a 400

More than 100 addresses, or none, is a 400 with a detail message and is not billed. A batch where every address is malformed answers 200 with [], so check the length as well as the status.

Ask your agent

Connected to the Vike MCP server (https://vike.io/mcp) in Claude, ChatGPT or Cursor, ask it in plain words. The wallet_batch_labels tool answers it, at 2 credits a call.

Ask your agent
Label these addresses and flag any that are sanctioned or linked to an exploit: 0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045, 0x47666Fab8bd0Ac7003bce3f5C3585383F09486E2

Whose wallet is this? Labels and entity for any address

Example 1

Are these two wallets related? Shared counterparties and tokens

Example 3

Example response
[  {    "entity": "vitalik buterin",    "wallet_type": "dex",    "confidence": "medium",    "risk_flag": "",    "net_30d_usd": -70023.25164,    "volume_30d_usd": 70046.74836,    "tx_30d": 454,    "tokens_30d_count": 157,    "wallet": "0xd8da6bf26964af9d7eed9e03e53415d37aa96045",    "found": true  },  {    "entity": "wintermute",    "wallet_type": "market_maker",    "confidence": "medium",    "risk_flag": "",    "net_30d_usd": 2113236.042409,    "volume_30d_usd": 2508838843.170737,    "tx_30d": 14678,    "tokens_30d_count": 100,    "wallet": "0xeae7380dd4cef6fbd1144f49e4d1e6964258a4f4",    "found": true  },  {    "entity": "morpho",    "wallet_type": "vault",    "confidence": "high",    "risk_flag": "",    "net_30d_usd": -357800362.784802,    "volume_30d_usd": 2359366854024.6597,    "tx_30d": 409814,    "tokens_30d_count": 235,    "wallet": "0xbbbbbbbbbb9cc5e90e3b3af64bdaf62c37eeffcb",    "found": true  },  {    "entity": "bybit",    "wallet_type": "cex",    "confidence": "medium",    "risk_flag": "exploit",    "net_30d_usd": null,    "volume_30d_usd": null,    "tx_30d": null,    "tokens_30d_count": null,    "wallet": "0x47666fab8bd0ac7003bce3f5c3585383f09486e2",    "found": true  },  {    "entity": "tornadocash",    "wallet_type": "flagged",    "confidence": "medium",    "risk_flag": "sanctioned",    "net_30d_usd": null,    "volume_30d_usd": null,    "tx_30d": null,    "tokens_30d_count": null,    "wallet": "0xa160cdab225685da1d56aa342ad8841c3b53f291",    "found": true  }]