Blacklisting

Blacklisting is a security control that defines a list of known-bad or high-risk entities—such as wallet addresses, IP addresses, devices, email domains, or users—that are explicitly blocked from interacting with an account or system. Anything on the blacklist is denied or subject to strict restrictions.

For financial and crypto services, blacklisting is used to prevent interactions with addresses or actors associated with fraud, scams, sanctions, money laundering, or other illicit activity. It complements other controls like whitelisting, transaction monitoring, and sanctions screening.

Why blacklisting is used

Blacklisting addresses several key risks.

Blocking known-bad actors and addresses

• Crypto addresses linked to hacks, scams, darknet markets, mixers, or stolen funds can be blacklisted to prevent deposits or withdrawals.
• IP addresses or ranges associated with attacks, botnets, or abuse can be blocked from accessing the platform.
• Devices previously used for fraud or account takeover can be denied access.
• Email domains or senders known for phishing or spam can be filtered or blocked.

Reducing exposure to illicit funds

• By blacklisting addresses tied to illicit activity, platforms reduce the risk of processing tainted funds.
• This helps meet AML/CFT obligations and reduces the likelihood of regulatory issues or reputational damage.
• It also protects legitimate users from inadvertently interacting with high-risk counterparties.

Supporting sanctions and compliance programmes

• Blacklists often include sanctioned entities, designated persons, and prohibited jurisdictions.
• Automated blocking of these entities helps ensure compliance with OFAC, UN, EU, and other sanctions regimes.
• Blacklisting is a key part of sanctions screening and ongoing monitoring.

Limiting fraud and abuse

• Known fraud rings, abusive users, or compromised accounts can be blacklisted to prevent further activity.
• Repeated offenders (for example, chargeback abusers, bonus abusers) can be blocked from creating new accounts or accessing certain features.
• Helps protect both the platform and legitimate users from systematic abuse.

Common types of blacklisting

Blacklisting is applied in several contexts.

Crypto address blacklisting

• Addresses associated with:
  • Hacks, exploits, or stolen funds.
  • Scams, phishing, or fraudulent schemes.
  • Darknet markets, ransomware, or other illicit activity.
  • Sanctioned entities or designated persons.
• When an address is blacklisted:
  • Deposits from that address may be blocked, frozen, or flagged for review.
  • Withdrawals to that address are typically denied.
  • Any interaction may trigger enhanced monitoring or reporting.

IP and network blacklisting

• IP addresses or ranges known for:
  • Automated attacks (credential stuffing, brute force).
  • Botnet activity or DDoS participation.
  • Prior fraud or abuse on the platform.
• Blacklisted IPs may be:
  • Completely blocked from accessing the service.
  • Allowed only with additional verification or manual approval.
• Often integrated with threat intelligence feeds and security operations.

Device and account blacklisting

• Devices previously used for:
  • Account takeover.
  • Fraudulent transactions or withdrawals.
  • Mass account creation or abuse.
• Accounts or users that have:
  • Been confirmed as fraudulent.
  • Repeatedly violated terms of service.
  • Been linked to money laundering or sanctions evasion.
• Blacklisted devices or accounts are denied access or heavily restricted.

Email and domain blacklisting

• Email addresses or domains associated with:
  • Phishing campaigns.
  • Spam or malicious attachments.
  • Social engineering or impersonation attacks.
• Blacklisted senders may have their messages:
  • Blocked entirely.
  • Filtered to spam or quarantine.
  • Flagged for additional scrutiny before delivery.

Sanctions and watchlist blacklisting

• Individuals, entities, or vessels on official sanctions lists (for example, OFAC SDN, UN, EU, UK).
• Parties identified in internal or industry watchlists as high-risk or prohibited.
• Automatic blocking or freezing of assets and transactions involving these parties.
• Mandatory reporting to authorities in many jurisdictions.

How blacklisting works in practice

Implementations vary, but most blacklisting systems follow a similar pattern.

1. Source of blacklist data

Blacklists can come from:

• Internal data – addresses, IPs, devices, or accounts previously linked to fraud, abuse, or policy violations on the platform.
• Threat intelligence feeds – commercial or open-source feeds that provide updated lists of malicious IPs, domains, or crypto addresses.
• Regulatory and sanctions lists – official government or international body lists (for example, OFAC, UN, EU).
• Industry sharing – information shared between platforms, consortia, or law enforcement about known bad actors.

2. Integration into controls

Blacklist data is integrated into various controls:

• Transaction screening – every deposit, withdrawal, or transfer is checked against blacklisted addresses and entities.
• Access control – login attempts and API requests are checked against blacklisted IPs, devices, or accounts.
• Communication filtering – incoming emails or messages are checked against blacklisted senders and domains.
• Onboarding checks – new users, addresses, or counterparties are screened against blacklists during verification.

3. Enforcement and response

When a match is found:

• The action is typically blocked or restricted automatically.
• Additional steps may include:
  • Freezing funds or assets pending review.
  • Flagging the account for enhanced monitoring.
  • Generating an alert for the security or compliance team.
  • Filing a report with relevant authorities (for sanctions or serious fraud cases).
• The user may see a generic error message (for example, “This action cannot be completed”) without revealing detailed security logic.

4. Maintenance and updates

Blacklists must be actively managed:

• Regular updates from threat intelligence and sanctions sources.
• Periodic review of internally blacklisted entries to ensure they remain accurate.
• Processes for removing entries that are no longer relevant (for example, false positives, resolved cases).
• Audit logs to track who added or removed entries and why.

Blacklisting vs whitelisting

Blacklisting and whitelisting are complementary but opposite approaches.

Blacklisting

• Starts from “allow by default” and explicitly blocks known-bad entities.
• Useful when:
  • The set of bad actors is relatively small and identifiable.
  • You want to minimise friction for legitimate users.
• Limitations:
  • Cannot block unknown or new threats that are not yet on the list.
  • Requires constant updates to stay effective.
  • Attackers can rotate addresses, IPs, or identities to evade blacklists.

Whitelisting

• Starts from “deny by default” and explicitly allows only known-good entities.
• Useful when:
  • You want strong control over where funds can go or who can access the system.
  • The set of allowed entities is well-defined and stable.
• Limitations:
  • Less flexible for users who need to interact with new counterparties.
  • Requires active management of the allowed list.

Most platforms use both: blacklisting to block known threats, and whitelisting to restrict high-value actions (like withdrawals) to pre-approved destinations.

Benefits of blacklisting

Blacklisting provides several important security advantages.

Immediate blocking of known threats

• Prevents interactions with addresses, IPs, or actors that are already identified as malicious.
• Reduces the likelihood of processing illicit funds or enabling fraud.
• Helps stop repeat offenders from continuing abusive behaviour.

Regulatory and sanctions compliance

• Automated blocking of sanctioned entities helps meet legal obligations.
• Reduces the risk of penalties, fines, or enforcement actions.
• Demonstrates to regulators that the platform has controls to prevent prohibited dealings.

Protection for legitimate users

• Reduces the chance that users inadvertently interact with scams, hacks, or fraudulent schemes.
• Helps protect users from sending funds to known-bad addresses.
• Contributes to a safer overall ecosystem.

Scalable defence

• Once an entity is blacklisted, it is blocked across all users and contexts (unless exceptions are explicitly made).
• Efficient way to mitigate widespread threats (for example, a known scam address used against many users).
• Can be automated and integrated into real-time controls.

Limitations and trade-offs

Blacklisting is useful but not sufficient on its own.

Cannot catch new or unknown threats

• Only entities that are already identified and added to the blacklist are blocked.
• New scam addresses, fresh IPs, or novel attack patterns may slip through until they are detected and blacklisted.
• Must be combined with behavioural monitoring, risk scoring, and other proactive controls.

Risk of false positives

• Legitimate users or addresses may be incorrectly blacklisted due to:
  • Shared infrastructure (for example, NAT IPs used by many users).
  • Incorrect or outdated threat intelligence.
  • Overly broad internal rules.
• False positives can lead to blocked transactions, frustrated users, and increased support workload.

Evasion and rotation

• Attackers can:
  • Generate new wallet addresses.
  • Rotate IPs or use proxies and VPNs.
  • Create new accounts or identities.
• Blacklisting must be continuously updated and combined with other signals (device fingerprinting, velocity limits, pattern analysis).

Operational overhead

• Maintaining accurate, up-to-date blacklists requires:
  • Dedicated security and compliance resources.
  • Integration with multiple data sources.
  • Regular review and tuning to minimise false positives.
• For large platforms, this can be a significant operational effort.

How blacklisting affects users

From a user’s perspective, blacklisting may be visible in several ways.

Blocked transactions or actions

• You attempt to withdraw to a crypto address or bank account that is blacklisted.
• The transaction is denied, often with a generic message (for example, “This withdrawal cannot be processed”).
• You may be asked to use a different address or contact support if you believe it is an error.

Login or access restrictions

• You try to log in from an IP or device that is blacklisted (for example, due to prior abuse from that network).
• Access is denied or limited, possibly with a suggestion to try a different network or device.
• In some cases, you may need to contact support to resolve the issue.

False positives and appeals

• If you believe a block is incorrect (for example, your address or IP was mistakenly blacklisted):
  • You can usually contact support to request a review.
  • The platform may ask for additional information to verify your situation.
  • If confirmed as a false positive, the entry may be removed or an exception made.

Indirect protection

• Even when you do not directly encounter blacklisting, it protects you by:
  • Reducing the overall level of fraud and scams on the platform.
  • Preventing your funds from interacting with known-bad addresses.
  • Contributing to a safer environment for all users.

Good practices for users

While users do not directly manage blacklists, they can adopt good practices:

• Double-check addresses and counterparties before sending funds; do not rely solely on the platform to catch all risks.
• Be cautious of unsolicited messages, links, or requests, even if they appear to come from known entities.
• If a transaction or action is blocked and you believe it is legitimate, contact support through official channels.
• Keep your own “personal blacklist” of known scams or suspicious addresses, and avoid interacting with them.
• Understand that blacklisting is one layer of protection; continue to use other security measures (2FA, strong passwords, device security).

Good practices for services

For platforms implementing blacklisting:

• Combine blacklisting with other controls (risk scoring, transaction monitoring, sanctions screening, whitelisting) for layered defence.
• Use high-quality, up-to-date threat intelligence and sanctions data from reliable sources.
• Implement clear processes for reviewing and updating blacklist entries, including false positive handling.
• Maintain audit logs of blacklist changes for accountability and compliance.
• Provide user-friendly support paths for users who believe they have been incorrectly blocked.
• Regularly measure the effectiveness of blacklisting (for example, fraud prevented, false positive rates) and tune accordingly.