32,175 crypto addresses are on DeepSea's risk list. Ransomware is the biggest category
DeepSea's database of scam, fraud and sanctioned addresses grew by 1,178 last week. Most new entries were hack-tainted, and Bitcoin holds more flagged addresses than Ethereum.
Key points
- DeepSea's risk database held 32,175 addresses on November 1, 2026, up 1,178 in a week.
- Ransomware is the largest category with 11,186 addresses, ahead of 9,258 hack-tainted and 5,605 phishing addresses.
- Of the week's new entries, 1,127 were hack-tainted, 43 were theft or hack and 8 were on US sanctions lists.
What DeepSea's data shows
DeepSea keeps a database of crypto addresses linked to crime or sanctions. Its weekly report shows 32,175 risk addresses as of November 1, 1,178 more than a week earlier. DeepSea grades 1,103 as critical, 13,548 as high and 8,266 as medium risk.
The biggest category is ransomware (malware that locks files and demands crypto) with 11,186 addresses. Next are hack-tainted addresses (9,258), phishing (5,605), scams (2,613), exploits from public incidents (1,204), theft or hack (1,187) and US sanctioned addresses (1,065). Mixers, which blend coins to hide their trail, account for 48, and UK sanctioned addresses for 9.
Data: DeepSea (desea.io), checked November 4, 2026, 12:37 a.m. ET.
By category
The list is a reminder that crypto crime is not only big exchange hacks. Ransomware and phishing, which target ordinary people and companies, together make up more than half of all flagged addresses.
DeepSea risk addresses by category, November 1, 2026
addresses
Source: DeepSea weekly report, October 26 to November 1, 2026.
What was added this week
Of the 1,178 new entries, 1,127 were hack-tainted, meaning they received funds traced to a hack. Another 43 were tagged theft or hack, and 8 were added as US sanctioned. In the same report, DeepSea logged 680 deposits of tainted funds to exchanges worth $307.64 million.
On October 28, the US Treasury's sanctions office OFAC designated people tied to North Korea's IT worker schemes and listed eight crypto addresses. DeepSea's report does not say whether its eight new US sanctioned entries are the same ones.
By chain
Bitcoin holds the most flagged addresses at 17,129, ahead of Ethereum at 13,987. Tron has 812 and XRP 172. Privacy coins appear too: 23 on Zcash and 11 on Monero. BSC has just 5. Together, Bitcoin and Ethereum account for about 97% of the whole list, so most risky money DeepSea tracks sits on the two largest networks.
Why it matters
Exchanges and wallets use lists like this to block or flag payments. If you receive coins from a flagged address, an exchange may freeze your deposit. Before sending to an unknown address, check it on a risk tool.
LC Insight analysis
This section is our reading of the facts above, not a statement of fact.
- We think the jump in hack-tainted addresses reflects tracing of recent hack money as it spreads into new wallets, not 1,127 new attacks.
- Ransomware's lead suggests that for most victims the danger is an infected computer or a fake link, not a protocol bug.
- Bitcoin's lead on the list likely ties back to ransomware, since ransom demands are often made in bitcoin. DeepSea's report does not break categories down by chain, so this is our reading, not its finding.
What's next
- Whether hack-tainted additions stay high as stolen funds keep moving
- New OFAC crypto designations
- Tainted deposits reaching exchanges next week
Disclaimer. This article is based on public information and the sources listed below as of the update time shown. It is for information only and is not investment, legal or tax advice. Figures may change as companies and authorities publish new data.
