How to check a borrower's wallet before you lend

TL;DR. A wallet address is a public record, so before you fund a stranger's loan request you can read it yourself in about ten minutes. Open the address on a block explorer and check five things in order: how old the wallet is and how regularly it is used; what it holds and whether the request fits what it has handled before; whether it has borrowed before, repaid, or been liquidated; whether it is one person's wallet or one of a cluster funded from the same source; and whether it has touched stolen or sanctioned funds. Then read what other people say about it, through vouches and reviews, and what a reputation score adds. None of this proves a borrower will repay. It tells you which requests are not worth the risk, which is most of the work.

What can a wallet address tell you, and what can it not?

An Ethereum address tells you everything it has ever done on-chain and nothing about who controls it. Every transfer in and out, every contract it has called, every token it holds and every loan it has taken on a public lending protocol is recorded and readable by anyone with the address. What is not recorded is a name, a reason for borrowing, or a promise. A wallet with three years of steady history can still belong to someone who will not repay a loan without collateral, and a wallet created last week can belong to a careful person who just moved funds.

That is why reading a wallet is a filter, not a verdict. In a crowd loan on Unlloo you choose which borrower to fund and name your own rate, and nothing is locked as collateral, so the loss on a default is yours. Our post on whether it is safe to lend crypto lists ten checks on the loan's structure, the borrower and the price. This post goes deep on one of them: the borrower's wallet, read with your own eyes.

Where do you look up a wallet?

You look it up on a block explorer, a public website that reads the chain and shows it as pages. On Ethereum the most used one is Etherscan; Blockscout is an open-source alternative that shows the same data and is what our own score reads. Paste the address into the search bar and you land on its address page.

Etherscan's address page is organised in three parts, and each one answers a different question:

• The header shows any public name tag (a label Etherscan attaches to known exchanges, projects and public figures) and a link to report or flag the address. A name tag that says an exchange means you are looking at the exchange's wallet, not a person's.
• The details box shows the ETH balance, the total value of token holdings with a dropdown of each token, and two lines that matter most here: First Txn Sent and Last Txn Sent, the first and most recent outgoing transactions. A link to Multichain Addresses lists other chains where the same address has activity.
• The tabs split the history: Transactions (ETH sent and received), Internal Transactions (transfers made by contract code), Token Transfers (every ERC-20 movement, which is where stablecoins and lending-protocol tokens show up), NFT Transfers, Analytics (balance and activity over time) and Comments.

Two more tools sit under the header. Token Approvals lists which contracts the wallet has allowed to move its tokens, and Check Previous Balance shows what the wallet held at a given date. You will use both below.

One caution before you start. Copy the address from the loan request itself, never from your own transaction history. Attackers create lookalike addresses that match the first and last characters of a real one and plant them in people's histories with zero-value transfers; a Carnegie Mellon study of this address poisoning counted 6,633 successful thefts worth over $83.8 million. Check the whole address, not the ends.

How old is the wallet, and how regularly is it used?

Wallet age is the first thing to read because it is the hardest thing to fake quickly. First Txn Sent gives the date; the Analytics tab shows whether the wallet has been used steadily since or sat empty between two bursts. A wallet that has sent transactions most months for two years is a different proposition from one that was created last month, funded once and used three times.

Our own part of the reputation score treats age as a threshold: a wallet younger than 12 months scores zero on it, whatever else it has done. That is deliberate. Everything else a wallet does can be bought in an afternoon; a year of history cannot. If the borrower's wallet is new, that is not a reason to refuse on its own, but it means the other checks have to carry the whole weight, and the amount should be small. Our post on building credit history with a new wallet describes what a careful new wallet looks like from the inside.

Regularity matters as much as age. Look at the gaps in the Transactions tab. A wallet with 400 transactions in one week in 2024 and nothing since is an airdrop farm or an abandoned wallet, not an active person. Also look at the variety of counterparties: a real wallet talks to exchanges, a few protocols, a few other people. A wallet that only ever moves funds between itself and one other address is a conduit.

What does the wallet hold, and has it held it for long?

The token holdings dropdown shows what the wallet holds now, and Check Previous Balance shows what it held at a date you choose. Two questions matter. Does the request fit what the wallet has handled? A borrower asking for 5,000 USDC from a wallet that has never held or moved more than 200 is asking you for a sum they have no record of managing. Compare the request with the largest transfers in the Token Transfers tab, not with the balance today, which can be moved in or out in the minutes before a request.

And is the balance steady? A wallet that has held a few thousand dollars of stablecoins or ETH through a year of ups and downs tells you the owner is not living transfer to transfer. One that was empty until yesterday and now holds exactly the amount that makes the request look plausible tells you the opposite. Our score reads the same thing under the name financial: what the wallet holds and how steady it is.

The balance also sets a ceiling on what a default costs the borrower. With no collateral, nothing is seized, so the borrower's only on-chain loss from not repaying is their record. A wallet holding ten times the loan has more to protect than one holding nothing. This is also where to check that the wallet is not a smart contract: the address page says so in the header, and a contract borrower can be programmed to refuse incoming tokens, which would block repayment to you.

Has the wallet borrowed before, and did it repay?

You can see this in the Token Transfers tab, because the big lending protocols issue tokens that record a position. On Aave on Ethereum, supplying USDC gives the wallet aEthUSDC, a receipt token that grows with interest; borrowing USDC at a variable rate gives it variableDebtEthUSDC, a debt token whose balance grows with the interest owed, as Cyfrin's course on Aave v3 explains. A debt token being minted is a borrow; the same token being burned is a repayment. If the wallet still holds a debt token today, it still owes that loan.

A liquidation leaves a different mark. When an Aave position's health factor falls below 1, anyone can repay part of the debt and take the collateral at a discount; the Pool contract emits a LiquidationCall event naming the user, the debt asset, the collateral seized and the liquidator, as QuickNode's liquidation tracker guide lays out. From the wallet's side it shows as collateral leaving and debt being repaid by an address that is not the wallet's own. One liquidation in a crash is a lesson; several are a habit.

For loans on Unlloo, open the borrower's earlier loans in the app. Each loan has one of seven statuses, and three of them tell you what you need: Repaid, RepaidLate (repaid in full, but after the deadline) and NotRepaidInTime (past the deadline and still open). Note that our reputation score does not read repayment or liquidation history, on Unlloo or anywhere else, so this is a check you do yourself, and it is the one that most directly predicts what you want to know.

Is this one person, or one of twenty wallets?

The question is whether the wallet asking you for a loan is one of a set controlled by the same person, each with a history built to look independent. The methods that airdrop teams use to catch this are public and work for a lender too. The Arbitrum Foundation's sybil-detection method for its 2023 token distribution first removed known entities such as exchanges and bridges, then built a graph from each wallet's first incoming ETH transfer and last outgoing one, and flagged clusters of more than 20 addresses that were funded from the same source or showed similar activity, with a manual review at the end. The first of those signals, many wallets whose first funds came from one address, is the one a lender can read by hand.

You cannot run a graph over the whole chain, but you can read one wallet's funding. Go to the oldest page of its Transactions tab and find the first incoming transfer. If it came from an address with an exchange name tag, that is how most real wallets start. If it came from an ordinary address, open that one. A funder that sent a near-identical amount to dozens of fresh wallets on the same day, which then did near-identical things, is a wallet farm, and the borrower is one of its hands. The same check runs forward: if the borrower's wallet itself funded a spread of new wallets, you are looking at the farmer.

Proof-of-personhood adds a check from the other side. Human Passport gives a wallet a Unique Humanity Score by adding up the weights of verified "stamps": a government ID is worth about 16 points, a year of ETH activity about 22.5, a GitHub account about 6, a Google account about half a point, according to its stamp weights. Its recommended threshold is 20, above which the wallet is treated as not a sybil. The score is one of the six services in our reputation score, and the app shows it per wallet. A score above 20 means someone verified real documents or accounts for this wallet; it does not stop one person from doing that for two wallets, so it narrows the question rather than closing it.

Has the wallet touched stolen or sanctioned funds?

This is the one check you cannot do well by hand, because it means tracing where every incoming transfer came from, several hops back. Screening services do it. Webacy, one of the six services in our score, returns a risk number from 0 to 100, where higher means riskier, built from signals that its wallet screening guide lists: sanctions exposure, known scam and malicious addresses, hacks and exploits, stolen funds, suspicious transaction patterns, high-risk counterparties, address poisoning and indirect, multi-hop exposure. A sanctions hit is reported separately from the score, as a yes or no.

Two things to keep in mind when you read a risk score. It is a point-in-time view: the response carries the time it was analysed and when it expires, and a wallet that was clean last month can have received funds from a hack since. And exposure is not guilt. A wallet that received a transfer from an address two hops from an exploit may have sold something to a buyer who was paid in stolen funds. What you are looking for is direct flags, sanctioned or hack-related, or a pattern of high-risk counterparties, not a single faint link. On Etherscan, the Report/Flag Address link and the Comments tab sometimes carry earlier reports from other people; read them as claims, not findings.

What do other people say about the wallet?

Two services in our score record what people, rather than the chain, say. Ethos Network gives each profile a credibility score from 0 to 2,800, in which every new profile starts at 1,200, labelled neutral, according to its whitepaper. The score moves with vouches (how many people vouch, whether they vouch for each other, how much they stake behind it and for how long), reviews, the standing of the people vouching and reviewing, the age of linked accounts, and slashing events. A vouch is backed by staked ETH that the voucher can lose, so a wallet with several vouches from established profiles has people with something at risk standing behind it. A wallet at exactly 1,200 has no one.

Talent Protocol's Builder Score reads public on-chain activity and public GitHub work, which tells you whether the wallet belongs to someone who builds things under a name they keep. Outside the score, two simpler signals help: an ENS name that resolves to the address and has been held for a while, and any public name tag or linked social account that lets you find the person off-chain. A borrower you can reach, by any channel, has a reason to repay that an anonymous address does not, which is the point our post on lending to a friend makes from the other direction.

What does a reputation score add, and what does it miss?

A score compresses most of the checks above into one number, which is useful for sorting requests and dangerous as a substitute for reading. Our score runs from 0 to 1,000. When both sides have data, 60% comes from the six services named above (Human Passport, Ethos, Talent Protocol, Webacy, growthepie and Zeru zPass) and 40% from our own reading of the wallet's history on Ethereum, Arbitrum, Base, Avalanche and Optimism over the last 48 months, scored on activity, holdings, reliability (how many of its transactions succeed) and the breadth of DeFi protocols used. The anatomy of on-chain reputation explains why it is built that way. In the app, the loan page shows the borrower's score with the factors, chains, DeFi activity and each service's result underneath it, labelled Excellent from 800, Good from 600 and Fair from 400.

What it misses is what you have to read yourself. It does not read repayments, defaults or liquidations. It does not know whether the request fits the wallet's past sums. It cannot tell one careful wallet from one careful wallet in a cluster of twenty, if each one was aged separately. And it is a snapshot: check when it was last refreshed, because a wallet's position can change in a day. The services themselves rank these limits; Human Passport's own documentation says some sybils will pass its threshold. Treat the score as a reason to look closer or to stop looking, never as the reason to fund.

What should make you pass?

The table lists what we would treat as a reason to pass, where in the wallet you see it, and what the same signal looks like when it is fine. A single row is enough; you do not need three.

Done in that order, the whole read takes about ten minutes for a wallet that passes and about two for one that does not, because the first two rows end most of the bad ones. The last step is not on the chain at all: set the amount you fund to what you would be content to lose if this one wallet, which you now know better than any pool would, turns out to be the one that does not repay.

Sources

1. Etherscan, "Explore an EOA Address on Etherscan". The sections and tabs of an address page, First and Last Txn Sent, name tags, Token Approvals and Check Previous Balance.
2. Taro Tsuchiya et al., "Blockchain Address Poisoning", Carnegie Mellon University, 2025. Lookalike addresses matching the first and last characters, zero-value transfers, and the count and value of successful thefts.
3. Cyfrin Updraft, "aToken and debt token", read on 28 October 2026. Receipt tokens for supplied assets and rebasing debt tokens for borrowed ones on Aave v3.
4. QuickNode, "Ethereum Aave liquidation tracker", read on 28 October 2026. The LiquidationCall event and its fields, and the Aave v3 Pool address on Ethereum.
5. Arbitrum Foundation, "sybil-detection", 2023. Entity removal, the funding and sweep graph, clusters of more than 20 addresses, funding from the same source, similar activity, Louvain clustering and manual review.
6. Human Passport, "Stamp Weights", read on 28 October 2026. Government ID 16.026, ETH activity 22.541, GitHub 6.026 and Google 0.525.
7. Human Passport, "Scoring thresholds", read on 28 October 2026. The score as a sum of stamp weights, the threshold of 20, and the note that some sybils will pass it.
8. Webacy, "Screen a wallet for risk", read on 28 October 2026. The 0 to 100 risk score, the signals it reads, the separate sanctions result and the analysed-at and expiry fields.
9. Ethos Network, "Credibility score", read on 28 October 2026. The 0 to 2,800 range, the 1,200 starting point, and the inputs: vouches, reviews, the standing of vouchers and reviewers, attestation ages and slashing.
10. Unlloo, "Security" and "The Anatomy of On-Chain Reputation". How the 0 to 1,000 score is weighted, the 12-month rule, and what it does not read.