vike

Recipe 2 of 32

Label 100 addresses in one call: who are they, and are any flagged or sanctioned?

POST up to 100 addresses to /labels/batch and each row comes back with its entity, wallet type and risk flag, so one call both labels a list and screens it for sanctioned, exploit and phishing addresses.

POST /v1/onchain/labels/batch takes the addresses in the query string, with no request body. It returns one row per input address, in input order: entity, wallet_type, confidence, risk_flag, four 30-day activity fields, the lower-cased wallet and found. Up to 100 addresses go in one call, and a risk_flag filter turns the same call into a screen for flagged wallets. The full parameter list is on Batch wallet labels.

Quick answer

cURL
# entity, type and risk flag for five addresses in one call
curl -X POST -H "X-API-Key: $VIKE_API_KEY" \
  "https://data.vike.io/v1/onchain/labels/batch?addresses=0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045,0xeae7380dd4cef6fbd1144f49e4d1e6964258a4f4,0xbbbbbbbbbb9cc5e90e3b3af64bdaf62c37eeffcb,0x47666Fab8bd0Ac7003bce3f5C3585383F09486E2,0xA160cdAB225685dA1d56aa342Ad8841c3b53f291"

Example response

Captured from the live API on 2026-10-24 at 17:19 UTC, the whole response.

The rows follow the input order and each echoes its wallet, lower-cased, so compare addresses case-insensitively. risk_flag is the empty string on a clean row. The Bybit exploiter reads exploit and the Tornado Cash pool sanctioned.

Example response
[
  {
    "entity": "vitalik buterin",
    "wallet_type": "dex",
    "confidence": "medium",
    "risk_flag": "",
    "net_30d_usd": -70023.25164,
    "volume_30d_usd": 70046.74836,
    "tx_30d": 454,
    "tokens_30d_count": 157,
    "wallet": "0xd8da6bf26964af9d7eed9e03e53415d37aa96045",
    "found": true
  },
  {
    "entity": "wintermute",
    "wallet_type": "market_maker",
    "confidence": "medium",
    "risk_flag": "",
    "net_30d_usd": 2113236.042409,
    "volume_30d_usd": 2508838843.170737,
    "tx_30d": 14678,
    "tokens_30d_count": 100,
    "wallet": "0xeae7380dd4cef6fbd1144f49e4d1e6964258a4f4",
    "found": true
  },
  {
    "entity": "morpho",
    "wallet_type": "vault",
    "confidence": "high",
    "risk_flag": "",
    "net_30d_usd": -357800362.784802,
    "volume_30d_usd": 2359366854024.6597,
    "tx_30d": 409814,
    "tokens_30d_count": 235,
    "wallet": "0xbbbbbbbbbb9cc5e90e3b3af64bdaf62c37eeffcb",
    "found": true
  },
  {
    "entity": "bybit",
    "wallet_type": "cex",
    "confidence": "medium",
    "risk_flag": "exploit",
    "net_30d_usd": null,
    "volume_30d_usd": null,
    "tx_30d": null,
    "tokens_30d_count": null,
    "wallet": "0x47666fab8bd0ac7003bce3f5c3585383f09486e2",
    "found": true
  },
  {
    "entity": "tornadocash",
    "wallet_type": "flagged",
    "confidence": "medium",
    "risk_flag": "sanctioned",
    "net_30d_usd": null,
    "volume_30d_usd": null,
    "tx_30d": null,
    "tokens_30d_count": null,
    "wallet": "0xa160cdab225685da1d56aa342ad8841c3b53f291",
    "found": true
  }
]

Variations

Screen a list for risk flags. Keep only the rows whose risk_flag is set, such as sanctioned or exploit.

cURL — screen
# the flagged addresses of a list, with their flag
curl -s -X POST -H "X-API-Key: $VIKE_API_KEY" \
  "https://data.vike.io/v1/onchain/labels/batch?addresses=0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045,0x47666Fab8bd0Ac7003bce3f5C3585383F09486E2,0xA160cdAB225685dA1d56aa342Ad8841c3b53f291" \
  | jq '[.[] | select((.risk_flag // "") != "") | {wallet, entity, risk_flag}]'

Which source flagged it. For an Ethereum address, /labels/{address}/provenance lists each label source's own claim beside the consensus. On 2026-10-24 four sources named the Tornado Cash router, one of them in a blocked category.

cURL — sources
# every source's claim about one flagged address, plus the consensus
curl -H "X-API-Key: $VIKE_API_KEY" \
  "https://data.vike.io/v1/onchain/labels/0xd90e2f925da726b50c4ed8d0fb90ad053324f31b/provenance"

Another chain. Labels and flags are read from the chain you name only (default ethereum), so the same address can be flagged on one chain and not on another. bsc has no 30-day flow data.

cURL — Base
# the same lookup against Base's labels
curl -X POST -H "X-API-Key: $VIKE_API_KEY" \
  "https://data.vike.io/v1/onchain/labels/batch?chain=base&addresses=0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045,0xeae7380dd4cef6fbd1144f49e4d1e6964258a4f4"

More than 100 addresses. Split the list. BATCH_2 is the second hundred, joined with commas.

cURL — second batch
# addresses 101 to 200, in a second call
curl -X POST -H "X-API-Key: $VIKE_API_KEY" \
  "https://data.vike.io/v1/onchain/labels/batch?addresses=$BATCH_2"

Before you rely on it

risk_flag is what a label source said

risk_flag comes from our label sources: sanctions lists and mixer labels give sanctioned, hack reports exploit, phishing reports phishing. It is not a live check against an official sanctions list, and a label can outlive the listing behind it. There is no frozen-by-issuer flag: a stablecoin issuer's blacklist is not covered. An empty risk_flag only says no source flagged the address, and found: false says we hold no label at all: neither one clears an address.

wallet_type alone misreads a hacker

The Bybit exploiter row reads entity: bybit and wallet_type: cex: the label names the victim. Filter on risk_flag, not on wallet_type, before you treat a row as an exchange.

The 30-day fields are not a rolling window

net_30d_usd, volume_30d_usd, tx_30d and tokens_30d_count are not a rolling window: vitalik.eth and Morpho returned the same four values on 2026-09-03 and on 2026-10-24. They are null for every bsc address and for an address with no flow data, as for the Bybit and Tornado Cash rows. Take current windows from /wallets/{address}.

A rejected batch is a 400

More than 100 addresses, or none, is a 400 with a detail message and is not billed. A batch where every address is malformed answers 200 with [], so check the length as well as the status.

Ask your agent

Connected to the Vike MCP server (https://vike.io/mcp) in Claude, ChatGPT or Cursor, ask it in plain words. The wallet_batch_labels tool answers it, at 2 credits a call.

Ask your agent
Label these addresses and flag any that are sanctioned or linked to an exploit: 0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045, 0x47666Fab8bd0Ac7003bce3f5C3585383F09486E2

Whose wallet is this? Labels and entity for any address

Recipe 1

Are these two wallets related? Shared counterparties and tokens

Recipe 3

Example response
[  {    "entity": "vitalik buterin",    "wallet_type": "dex",    "confidence": "medium",    "risk_flag": "",    "net_30d_usd": -70023.25164,    "volume_30d_usd": 70046.74836,    "tx_30d": 454,    "tokens_30d_count": 157,    "wallet": "0xd8da6bf26964af9d7eed9e03e53415d37aa96045",    "found": true  },  {    "entity": "wintermute",    "wallet_type": "market_maker",    "confidence": "medium",    "risk_flag": "",    "net_30d_usd": 2113236.042409,    "volume_30d_usd": 2508838843.170737,    "tx_30d": 14678,    "tokens_30d_count": 100,    "wallet": "0xeae7380dd4cef6fbd1144f49e4d1e6964258a4f4",    "found": true  },  {    "entity": "morpho",    "wallet_type": "vault",    "confidence": "high",    "risk_flag": "",    "net_30d_usd": -357800362.784802,    "volume_30d_usd": 2359366854024.6597,    "tx_30d": 409814,    "tokens_30d_count": 235,    "wallet": "0xbbbbbbbbbb9cc5e90e3b3af64bdaf62c37eeffcb",    "found": true  },  {    "entity": "bybit",    "wallet_type": "cex",    "confidence": "medium",    "risk_flag": "exploit",    "net_30d_usd": null,    "volume_30d_usd": null,    "tx_30d": null,    "tokens_30d_count": null,    "wallet": "0x47666fab8bd0ac7003bce3f5c3585383f09486e2",    "found": true  },  {    "entity": "tornadocash",    "wallet_type": "flagged",    "confidence": "medium",    "risk_flag": "sanctioned",    "net_30d_usd": null,    "volume_30d_usd": null,    "tx_30d": null,    "tokens_30d_count": null,    "wallet": "0xa160cdab225685da1d56aa342ad8841c3b53f291",    "found": true  }]