Scorechain - Crypto Risk Screening

The scorechain plugin screens your exchange's crypto deposits and withdrawals with Scorechain before they go through. Deposits are checked by their transaction ID and withdrawals by their destination address. Risky transactions stay on hold for your team; the rest are released automatically. You use and pay for your own Scorechain account.

What you need

• The Enterprise plan on HollaEx Cloud.
• Your own Scorechain account and API key.
• Auto Deposit and Auto Withdrawal turned off. See Turn off Auto Deposit and Auto Withdrawal.
• No other risk-screening plugin. Only one can run at a time (Scorechain, AMLBot or TRM Labs). If another is installed, this one doesn't start and your audit email is told why.

Turn off Auto Deposit and Auto Withdrawal

The plugin only screens transactions that are on hold. With Auto Deposit and Auto Withdrawal on, deposits and withdrawals are processed straight away and never wait on hold, so there is nothing to screen.

1. Go to Operator Controls → Exchange → Configuration → Security.
2. Turn off Auto Deposit. Incoming blockchain deposits now stay pending until they are approved.
3. Turn off Auto Withdrawal. Withdrawal requests now stay pending until they are approved.

The plugin never changes these settings itself. While one of them is on, the plugin doesn't screen that kind of transaction, and it emails your audit address asking you to turn it off. It starts screening on its own within about a minute of the setting being turned off.

Set it up

1. Get your API key. In Scorechain, create an API key on the API keys page.

2. Turn off Auto Deposit and Auto Withdrawal as described above.

3. Install the plugin. Go to Operator Controls → Exchange → Plugins, find scorechain under Available to install and click Install.

4. Configure it. Open the plugin with Configure, fill in the settings and save.

   Setting	What it does
   api_key	Your Scorechain API key. Secret, from Scorechain. Required. Until it is set, nothing is screened and on-hold transactions stay on hold.
   min_usdt	Smallest value, in USDT, that gets screened. Transactions worth less are released without a check. Default 100.
   risk_threshold	Scorechain severity that holds a transaction: CRITICAL (default), HIGH, MEDIUM or LOW. A lower level holds more transactions and means more manual review.
   transaction_analysis_type	How Scorechain analyses deposits: ASSIGNED (default, fastest), INCOMING, OUTGOING or FULL.
   address_analysis_type	How Scorechain analyses withdrawal addresses: ASSIGNED (default, fastest), INCOMING, OUTGOING or FULL.
   cache_ttl_hours	How long a Scorechain result is reused for the same address or transaction. Default 48.
   request_timeout_ms	How long to wait for Scorechain on each request, in milliseconds. Default 8000.
   alert_email	Who gets an email when a transaction is held. Empty (default) uses your exchange's audit email, set in Operator Controls → Exchange → Configuration → Alerts.
   api_url	Scorechain's API address. Leave the default, https://api.scorechain.com/v1.

5. Check it's running. Make a small test deposit above min_usdt. If Scorechain finds no risk, it is released on one of the next runs.

What your users see

Users see their deposit or withdrawal as pending while it is on hold. A transaction the plugin releases then goes through as usual. A held one stays pending until your team releases or rejects it.

How it works

Every 60 seconds, the plugin goes through your on-hold deposits and withdrawals:

1. Blacklist first. If the address is on your exchange's address blacklist, the transaction stays on hold straight away, without asking Scorechain, and your team is emailed.
2. Small amounts. A transaction worth less than min_usdt is released without a check.
3. Screening. Otherwise the plugin asks Scorechain: the transaction ID for a deposit, the destination address for a withdrawal.
4. Decision.
   • Risky (at or above risk_threshold): the transaction stays on hold, an alert with the details goes to alert_email, and the address is added to your exchange's blacklist for all networks. The transaction gets a note starting [scorechain-reviewed], so it isn't screened or charged again.
   • Not risky: the transaction is released and goes through as usual.

The plugin fails closed:

• If Scorechain can't be reached or returns no result, the transaction stays on hold and is tried again on the next run.
• If a transaction's value can't be worked out, it isn't released as a small amount; it is screened.
• Transactions on a network the plugin doesn't recognise are left on hold, untouched, for you to review.
• The plugin only clears its own screening hold. A transaction held for another reason, such as the Travel Rule, stays on hold until that reason is cleared too.

Review held transactions

Open the transaction in Operator Controls → Operations → Deposits or Withdrawals. Its hold reason shows the plugin's note with the severity and score. If you decide the transaction is fine, use Release to clear the hold. Remember that the plugin has also added the address to your blacklist; remove it there if it was a false positive.

Troubleshooting

• You got an email saying the plugin is inactive and to turn off Auto Deposit or Auto Withdrawal. One or both are still on. Turn them off in Operator Controls → Exchange → Configuration → Security.
• You got an email titled "Duplicate KYT Plugin Installation Blocked". Another risk-screening plugin was installed first, so this one didn't start. Only one can run. Remove the one you don't want with Remove plugin. If you keep this one, open it in Operator Controls → Exchange → Plugins and click Restart.
• Nothing is being released. Check that api_key is set and correct. While it is empty, the plugin screens and releases nothing. With a wrong key, Scorechain returns no result, so every transaction above min_usdt stays on hold.

Need help? Open a ticket from your HollaEx dashboard.