How to Read a KYT Report

This page walks through a real KYT result, section by section: what each field means, how the risk score was built from the numbers you see, and what an analyst is expected to do next. One check produces the same data on three surfaces — the dashboard result page, the downloadable AML PDF, and the API JSON response. Labels differ slightly; the meaning does not. The exact label-to-field mapping is in the Result fields reference.

---

​

Triage in 30 seconds

If you only have half a minute per case, read the report in this order.

1. Read the grade, not the number. Low / Moderate / High / Undefined is the verdict. The percentage refines it.
2. Check the High tier total. Is it above zero? A Low grade with non-zero high-risk exposure still deserves a look — this is the single most common misread of a KYT report.
3. Open the category breakdown. Which high-risk categories are present? Sanctions, stolen assets, and darknet carry very different consequences than unlicensed gambling.
4. Scan Direct transfers. The named counterparties one hop away. This tells you who the address actually deals with, and whether that matches what your customer told you.

Then apply your policy — see the decision matrix below.

---

​

The example used on this page

A real address check: USDT on TRON, indirect analysis enabled.

---

​

1. Header — what exactly was checked

The first line states the asset and network (USDT Address (TRX)), followed by the full address. This makes the report unambiguous on its own, which matters when it is forwarded to a banking partner or attached to a case file. How to read it. An address is screened per network and per asset. The same address string on a different chain, or the same address with a different token selected, is a different check with a different result.

---

​

2. Owner and Type — whose address is this

In the example both are Undefined — the address is not attributed to any known service. How to read it. Undefined is the normal result for an individual, non-service wallet. It is not a risk signal on its own. When these fields are populated, they change the meaning of everything below them: a service address pools funds from thousands of users, so its exposure profile describes the service, not your customer. If a customer gives you an address that resolves to an exchange, you are looking at the exchange’s wallet — ask for an address they actually control.

---

​

3. Balance, Sent, Received — behavior at a glance

How to read it. Compare the three. Here, roughly 469M USDT has flowed in and almost the same amount out, while the standing balance is a small fraction of that. That is pass-through behavior — typical of an exchange, aggregator, or payment processor wallet, not of an end user’s savings. Volume that is wildly inconsistent with a customer’s declared profile is a finding in itself, independent of the risk score.

---

​

4. Risk Score and grade — the verdict

The report prints the score, its grade, a plain-language interpretation, and the band legend:

Risk Score Low — 23%. Low suspicious funds rate. The funds or address is likely safe. 0–25% low suspicious rate • 26–74% moderate • 75%+ high

How to read it. The score is a weighted composite of the exposure shares below it, with high-risk categories weighted more heavily than low-risk ones. It is not the sum of the high-risk percentages: 1.64% high-risk exposure produced a 23% score.

---

​

5. Exposure by tier — where the funds come from

Four totals covering the traced funds, each printed with its own one-line explanation: These four tiers describe 100% of the traced funds. The risk score does not equal any one of them.

---

​

6. Payments — the category breakdown

This is the evidence behind the score, and the section analysts should spend the most time in: every entity category detected in the fund trail, with its share, grouped by tier. It covers both direct (1 hop) and indirect (n-hop) connections. The High tier in our example: And the Low tier, which explains why the overall grade is Low: How to read it.

• Find the driver. One or two categories usually account for most of a tier. Here, licensed exchanges dominate the Low tier, and Illegal service dominates the High tier.
• Ask whether it fits the story. Heavy DEX and bridge exposure is unremarkable for a DeFi trader and odd for a pensioner receiving a one-off payment.
• Read <0.01% as a trace, not as noise. Tiny exposures are printed rather than hidden on purpose. For most categories a trace is background; for sanctions, terrorism financing, CSAM, and stolen assets it is a finding to document.

---

​

7. Direct transfers — the named counterparties

A table of entities that transacted directly with the address (1 hop), with lifetime amounts in the selected token. Excerpt from the example: How to read it.

• A zero means one-directional. Gate and MEXC only received funds from this address; there is no return flow.
• These are names, not categories — which makes this the starting point for counterparty due diligence and for gathering Travel Rule counterparty information.
• Direct vs indirect. Direct transfers are who the address touched. The category breakdown in §6 also includes entities further down the trail (n-hop) — which is how a mixer two hops back shows up even though it never appears in this table. See How KYT works.

An empty Direct transfers table with a populated category breakdown is normal: it means no named entity interacted directly with the address.

---

​

8. Footer — provenance

Every page carries the generation timestamp in UTC, the ID of the account that generated the report, and page numbers — for example GENERATED ON 06-MAR-26 10:34:12 UTC BY OC5AB55F497104667, Page 1 of 3. This is what makes the PDF usable as audit evidence: an auditor can establish when the assessment was made and by whom. Store the check id from the API alongside the file so the result can be re-fetched later.

---

​

Two things called “status”

These are frequently confused, especially between engineering and compliance teams. Two API responses that look like errors but are statuses:

• 404 No data, try again later — the check is still being calculated. Retry in 2–5 seconds with exponential backoff.
• 404 Empty address — the address has no transaction history on the selected network. Not an error in your integration; verify the network and token first.

---

​

Worked example 1 — a Low grade that still needs EDD

Our TRON address: 23%, Low. Two findings survive the headline grade. Finding 1 — this looks like a service wallet, not an end user. ~469M USDT in and out, a balance that is a fraction of the flow, and ten named direct counterparties that are all licensed exchanges. The 95.34% Licensed exchange service share is exactly what an exchange or aggregator wallet looks like. So what: if this was submitted as a customer’s personal wallet, the profile does not match. Request an address the customer controls, or reclassify the relationship as business-to-business and apply the corresponding due diligence. Finding 2 — Low grade, non-zero high-risk exposure. Inside the 23% score sits 1.64% high-risk exposure, including Sanctions 0.42% and Illegal service 0.89%. So what: under the policy of treating any high-risk exposure as an escalation trigger, this address goes to enhanced due diligence despite the Low badge. Document the source of funds, the reason for the decision, and archive the report. Decision: proceed, but with EDD and a documented rationale — not silent auto-approval.

---

​

Worked example 2 — a transaction check

Transaction reports follow the same layout, scoped to a single TxID. A real Bitcoin transaction check: How to read it. Instead of Balance / Sent / Received, a transaction report shows the block, the timestamp, and Sender and Receiver attribution. Here the funds moved from an unattributed address to a licensed exchange. The grade is Low and the composition is dominated by licensed services — but Mixing service 0.03% and Scam 0.46% are present in the trail. If this is an inbound deposit to your platform, that combination is worth a note in the case file; if you are screening an outbound withdrawal to an exchange, it is context for your counterparty record.

---

​

Decision matrix

Regardless of outcome:

• Archive the PDF for every check that supports a business decision and keep it for at least 5 years, or longer where your jurisdiction requires it.
• Log who decided what, and why. The report evidences the assessment; your file evidences the decision.
• Re-screen periodically. Scores change as new transactions appear and as counterparties are newly classified.

Configurable thresholds and risk profiles are on the roadmap — see Feature availability.

---

​

Edge cases and common misreads

---

​

What a KYT report does not tell you

Being explicit about the limits is part of using the tool correctly.

• It does not identify a person. Attribution names services, not individuals. KYT analyzes public on-chain data only and processes no personal data.
• Exposure is association, not proof. A share of funds traced to a high-risk category means the fund trail touched that category — it is a reason to investigate, not a conclusion about your customer’s conduct.
• It is point-in-time. Every result describes the chain as of the moment of the check.
• Coverage is bounded. Bitcoin, Ethereum (ERC-20), and TRON (TRC-20) today — see Supported networks.
• Per-category weights are not exposed field by field. The mechanism is published (weighted exposure, high-risk categories weigh more) and every result ships with the full breakdown that drove it, so results are explainable and reviewable — but the score is not intended to be recomputed by hand.

---

​

Next steps