Handle a high-risk crypto deposit

1Score the depositing address

Request the risk score on the sender. A high risk_level or direct high-risk exposure is the trigger to hold. This is a C3 call.

curl https://api.1st-node.com/v1/aml/eth/0xbadf.../risk \
  -H "Authorization: Bearer sk_live_..."
> { "score": 88, "risk_level": "high", "confidence": 0.91, "exposure": [{ "category": "mixer", "hops": 1 }] }

2Trace the inbound flow

Confirm where the funds came from with an inbound fund-flow trace. This C4 call resolves the path over the requested hops.

curl "https://api.1st-node.com/v1/intel/eth/0xbadf.../flow?dir=in&hops=3" \
  -H "Authorization: Bearer sk_live_..."

3Hold the funds pending review

Do not credit the account until review clears. Move the deposit to a hold state so the balance is not spendable while under investigation.

4Store the evidence

Persist the risk response and the trace against the deposit id. Whether funds are released or frozen, the stored evidence justifies the decision.