WalletGuard AI

Detects crypto wallet addresses in any chat or page and explains, in 2-3 plain-English sentences, how risky they are before you hit send

Comment

Inspiration

Crypto scams work because ordinary people have no way to tell a legitimate wallet address from a scammer's. You get a DM — "send 0.1 ETH here for the airdrop" — and the address means nothing to you. It could be a project that's been running for years, or a wallet created an hour ago specifically to disappear with your money.

The tools that already exist for this (Chainalysis, Elliptic) are built for banks and compliance teams, not for someone about to click "send" on their phone. According to the FBI's 2025 IC3 Report, Americans lost $11.4 billion to crypto scams in a single year — and a huge share of that comes down to exactly this moment: not knowing whether an address is safe.

We wanted something that lives exactly where the danger is — right next to the address, the second before you send — and explains the risk like a knowledgeable friend would, not like a compliance dashboard.

What it does

WalletGuard AI is a browser extension that:

  • Detects crypto wallet addresses automatically — in chat messages, DMs, links, tooltips, and even as you type or paste one into a text box.
  • Analyzes the address's real on-chain transaction history (Ethereum, BSC, and Polygon) against 6 deterministic risk signals.
  • Explains the result in 2-3 plain-English sentences, generated by AI, instead of a bare number or a wall of jargon.
  • To try it yourself: load the extension first (see "Try it out" links → unzip the submission → chrome://extensions → enable Developer mode → "Load unpacked" → select the extension folder), then visit our live demo page — the extension will automatically highlight sample addresses on it with clickable "Check" buttons. Without the extension loaded, the demo page is just a static page; the extension is what makes it interactive.

Click "Check" next to any address, and within seconds you get a verdict — low, medium, or high risk — with a human explanation of why.

How we built it

Risk scoring (the technical core): the score is calculated deterministically, not guessed by an AI model. A Python engine checks 6 signals against the address's transaction history:

  1. A hand-curated list of confirmed exploiters (instant maximum-risk match)
  2. Address age (brand new or no history at all)
  3. "Layering" — funds received and forwarded onward within the hour, a classic laundering pattern
  4. Low counterparty diversity — repeatedly moving funds between the same few addresses
  5. Repeated round-number amounts — a sign of bot/automated activity
  6. Abnormal transaction volume compared to the address's own history

Only after the score is computed does AI enter the picture: Gemini receives the score and which signals fired, and translates that into a short, human explanation. The AI never decides the risk itself — it only narrates a decision that's already been made deterministically, which keeps the whole system auditable.

Data & infrastructure: Etherscan's unified V2 API supplies transaction history across all three chains from a single key. The backend (Flask) is deployed on Render. The extension itself uses a background service worker to handle all network requests — routing through it (instead of fetching directly from the content script) keeps requests in the extension's own privileged context, immune to whatever CSP a given website enforces. The result overlay renders inside a Shadow DOM, so its styling can never collide with or leak into the host page's own CSS.

Challenges we ran into

  • CORS/CSP unpredictability. A content script injected into an arbitrary website inherits that website's own security restrictions, which vary site to site. Fetching directly from the content script worked on some pages and silently failed on others. Routing every request through a background service worker instead fixed this completely, since that context is governed only by the extension's own declared permissions.
  • Chrome's file:// restriction. Our own test pages worked fine when clicked open locally during development, then appeared "broken" (no highlighting at all) once we thought about how a stranger would actually open them — Chrome disables content scripts on local files by default, for every extension, with no manifest setting to override it. We solved it by serving the demo pages directly from our own backend over https instead of relying on local files at all.
  • Keeping the AI honest. It was tempting to let the AI model just "decide" if a wallet looked risky. We deliberately kept that logic out of its hands — the AI only ever narrates a score that deterministic code already computed, so the system stays explainable rather than being a black box.

Accomplishments that we're proud of

  • A scoring system where every single point on the risk score can be traced back to a specific, named, testable rule — not an opaque AI guess.
  • An extension that actually detects addresses in the wild: inside links, tooltips, and live as you type into a message box — not just plain visible text.
  • Full automated test coverage: a dedicated scenario test for each of the 6 risk signals, plus robustness tests confirming the engine never crashes on malformed real-world API data.

What we learned

How much of an extension's real-world reliability comes down to where code runs, not just what it does — the same fetch call behaves completely differently depending on whether it executes in a content script, a background worker, or a popup. We also learned to be honest about scope: our community-sourced exploiter list is currently a proof-of-concept with a handful of seed entries, not a live crowd-sourced database yet — and we'd rather say that plainly than oversell it.

What's next for WalletGuard AI

  • Growing the known-exploiter list from a public feed (e.g. Chainabuse) instead of a hand-picked seed set
  • Support for additional chains (Solana, Base)
  • Extending the same "deterministic score + AI narration" approach to smart-contract approval scams and NFT minting scams
  • Chrome Web Store submission

Built With

Share this project:

Updates

Submission history