Recipe 26 of 32
Does a wallet's inbound trail touch a flagged or exchange entity?
Trace the wallet's senders two hops back with /wallets/{address}/trace?direction=in, read each node's label and wallet_type, then send the node list to /labels/batch for its risk_flag.
GET /v1/onchain/wallets/{address}/trace?direction=in follows the money backwards: the wallet's biggest senders, then their
biggest senders, up to depth hops. Every node carries the label and wallet_type we hold for it, so an
exchange (cex) or a flagged wallet (flagged) shows on the node. /labels/batch on the same addresses adds the
risk_flag. The parameters are on Trace a wallet's funds and Batch wallet labels.
Quick answer
# who sent money to this wallet over 90 days, and who sent money to them
curl -H "X-API-Key: $VIKE_API_KEY" \
"https://data.vike.io/v1/onchain/wallets/0x556e9d5d9e64638edde632bbd4810c9fd0d88397/trace?direction=in&depth=2&width=3&window=90d"Example response
Captured from the live API on 2026-10-24 at 17:18 UTC, the whole response.
One sender cleared the default 10,000 USD floor in 90 days: a Binance wallet. It received from Binance 14, from a
BtcTurk wallet (both cex) and from one unlabelled address. Under direction=in every edge is in_usd: money that moved from to into
from. The root and 0x09f6…7e47 carry no label or wallet_type key at all, because we hold no label for them.
{
"root": "0x556e9d5d9e64638edde632bbd4810c9fd0d88397",
"depth": 2,
"width": 3,
"window": "90d",
"min_usd": 10000.0,
"direction": "in",
"nodes": [
{
"address": "0x556e9d5d9e64638edde632bbd4810c9fd0d88397",
"depth": 0,
"total_volume_usd": 49999.7
},
{
"address": "0x9696f59e4d72e237be84ffd425dcad154bf96976",
"depth": 1,
"total_volume_usd": 11057528619.754766,
"label": "binance",
"wallet_type": "cex"
},
{
"address": "0x28c6c06298d514db089934071355e5743bf21d60",
"depth": 2,
"total_volume_usd": 11057405625.354765,
"label": "binance",
"wallet_type": "cex"
},
{
"address": "0xb334a61a6209f14b5fa5f1684a4ed7621f66e1ef",
"depth": 2,
"total_volume_usd": 50000.0,
"label": "btcturk",
"wallet_type": "cex"
},
{
"address": "0x09f644c6516eba7256cffa665d543f27a3d77e47",
"depth": 2,
"total_volume_usd": 22994.7
}
],
"edges": [
{
"from": "0x556e9d5d9e64638edde632bbd4810c9fd0d88397",
"to": "0x9696f59e4d72e237be84ffd425dcad154bf96976",
"volume_usd": 49999.7,
"out_usd": 0.0,
"in_usd": 49999.7,
"tx_count": 1
},
{
"from": "0x9696f59e4d72e237be84ffd425dcad154bf96976",
"to": "0x28c6c06298d514db089934071355e5743bf21d60",
"volume_usd": 11057405625.35,
"out_usd": 0.0,
"in_usd": 11057405625.35,
"tx_count": 290
},
{
"from": "0x9696f59e4d72e237be84ffd425dcad154bf96976",
"to": "0xb334a61a6209f14b5fa5f1684a4ed7621f66e1ef",
"volume_usd": 50000.0,
"out_usd": 0.0,
"in_usd": 50000.0,
"tx_count": 1
},
{
"from": "0x9696f59e4d72e237be84ffd425dcad154bf96976",
"to": "0x09f644c6516eba7256cffa665d543f27a3d77e47",
"volume_usd": 22994.7,
"out_usd": 0.0,
"in_usd": 22994.7,
"tx_count": 1
}
],
"stats": {
"node_count": 5,
"edge_count": 4,
"max_depth_reached": 2
}
}Variations
The risk flag of every node. Send the node addresses to the batch route. NODES is the comma-separated address list from the trace.
# entity, wallet_type and risk_flag for every wallet in the trail
curl -X POST -H "X-API-Key: $VIKE_API_KEY" \
"https://data.vike.io/v1/onchain/labels/batch?addresses=$NODES"Captured from the live API on 2026-10-24 at 17:18 UTC, trimmed to 3 of 5 rows.
[
{
"entity": "binance",
"wallet_type": "cex",
"confidence": "medium",
"risk_flag": "",
"net_30d_usd": 5973179.599346,
"volume_30d_usd": 4131741608.369042,
"tx_30d": 155322,
"tokens_30d_count": 40,
"wallet": "0x9696f59e4d72e237be84ffd425dcad154bf96976",
"found": true
},
{
"entity": "btcturk",
"wallet_type": "cex",
"confidence": "medium",
"risk_flag": "",
"net_30d_usd": 688651.777206,
"volume_30d_usd": 401897927.825102,
"tx_30d": 73958,
"tokens_30d_count": 132,
"wallet": "0xb334a61a6209f14b5fa5f1684a4ed7621f66e1ef",
"found": true
},
{
"wallet": "0x09f644c6516eba7256cffa665d543f27a3d77e47",
"entity": null,
"wallet_type": null,
"confidence": null,
"risk_flag": null,
"net_30d_usd": null,
"volume_30d_usd": null,
"tx_30d": null,
"tokens_30d_count": null,
"found": false
}
]Only the node list. Print each node with its distance from the root and its type.
# address, depth, label and wallet_type of every node
curl -s -H "X-API-Key: $VIKE_API_KEY" \
"https://data.vike.io/v1/onchain/wallets/0x556e9d5d9e64638edde632bbd4810c9fd0d88397/trace?direction=in&depth=2&width=3&window=90d" \
| jq '[.nodes[] | {address, depth, label, wallet_type}]'Smaller transfers, one more hop. Lower the floor to follow senders below 10,000 USD and go three hops back.
# three hops back, transfers of 1,000 USD and up
curl -H "X-API-Key: $VIKE_API_KEY" \
"https://data.vike.io/v1/onchain/wallets/0x556e9d5d9e64638edde632bbd4810c9fd0d88397/trace?direction=in&depth=3&width=3&window=90d&min_usd=1000"Before you rely on it
Read risk_flag, not only wallet_type
Trace nodes carry no risk_flag. The Bybit exploiter address is labelled entity: bybit, wallet_type: cex and
risk_flag: exploit, so a wallet_type check alone reads it as an exchange. Send the nodes to /labels/batch
and test risk_flag for a non-empty string; it is null for an address we hold no label for.
The trail is the biggest branches only
Only transfers of at least min_usd (10,000 USD when omitted) count, and only the top width senders of each
wallet are followed, so a small flagged sender can sit outside the graph. Coin moved inside a contract call is not
in the data. A clean trail says the largest branches are clean, not that every sender is.
Ask your agent
Connected to the Vike MCP server (https://vike.io/mcp) in Claude, ChatGPT or Cursor, ask it in plain words.
The wallet_trace tool (4 credits) answers it, and wallet_batch_labels (2 credits) adds the risk flags.
Did any of the wallets that funded 0x556e9d5d9e64638edde632bbd4810c9fd0d88397 in the last 90 days belong to an exchange or a flagged entity?