Six APIs that check crypto transactions before signing

Five of six transaction security APIs reviewed can simulate a proposed transaction before it is signed. Scam Sniffer checks addresses and domains against reputation data but does not simulate transactions.

The comparison followed the Feb. 21, 2025, theft of about $1.5 billion from Bybit. Malicious JavaScript in Safe’s web interface changed a transfer after it was created but before signers approved it. The code targeted Bybit’s contract and one other address, then was replaced with clean files about two minutes later. The signers’ screens did not show the transfer’s actual effects.

Transaction simulation runs a proposed transaction against the current blockchain state without broadcasting it. The result can show balance changes, token approvals and contract calls. Reputation systems check whether an address, token, decentralized application or website appears in a database of known threats.

Blockaid offers transaction, address, token and decentralized application scanning. Its interface provides human-readable results, and the company claims response times below 300 milliseconds. Its website names Coinbase Wallet, MetaMask, Zerion, Rainbow, Backpack and Core among its customers or users. Blockaid does not publish pricing. Its website claims coverage of more than 50 blockchains and reports accuracy and false-positive figures that were not independently verified.

Hypernative combines transaction simulation with threat monitoring in one API call. Its service returns a simulation, risk score and recommendation to approve or deny a transaction. It checks for phishing, drainers, address poisoning, pig-butchering infrastructure, honeypots, impersonation and malicious airdrops. Hypernative claims coverage of more than 300 threat vectors across at least 75 blockchains. Reown is the only named customer in the source material, and pricing is available by request.

GoPlus Security provides token, nonfungible token, approval, malicious-address, phishing-site and transaction-simulation APIs. It lists prices from a free plan to $3,499 a month. Its pricing page gives conflicting information about when batch calls become available. No customers are named on the API page.

Chainalysis Hexagate GateSigner simulates transactions as an additional signer or through an API. It supports Safe multisignature setups and can reject hidden approvals or changes to contract roles. The product is designed for treasuries and blockchain protocols rather than high-volume retail wallet scanning. Chainalysis does not publish GateSigner’s pricing. A Chainalysis security incident in late October 2026 took several products offline for about a week, according to the source material.

Webacy’s Risk Score API covers addresses, transactions, contracts, tokens and URLs. Its transaction module scans and simulates proposed activity. Other tools provide sanctions checks, token analysis and stablecoin risk information. Webacy supports more than a dozen networks, including Ethereum, Solana and Hedera. Its documentation tells customers to treat missing, outdated or failed responses as unknown and to block transactions when a check cannot be completed.

Scam Sniffer checks domains, URLs and addresses against a database containing more than 420,000 malicious domains and 61,000 malicious addresses. Its Standard plan starts at $999 a month. Part of its domain blacklist is available as an open-source feed updated daily. The service cannot identify a new malicious address through transaction simulation because it does not offer that function.

A reputation list can identify previously reported scams, but it cannot assess a new address based on its history. Simulation can show the result of a new contract interaction if it runs outside the wallet interface that creates or displays the transaction. A check inside a compromised interface could be changed or concealed.

The comparison recommends testing APIs with transactions involving newly deployed contracts and measuring false-positive rates and response times on a company’s own traffic. For large transfers, businesses can connect an API to a co-signer or policy engine that blocks a transaction instead of displaying a warning.

Wallet Guard was excluded because it shut down on March 31, 2025. Harpie was excluded because its former domain no longer hosts the product. The review was last checked against vendor websites in November 2026. Vendor claims about accuracy and detection rates were not independently verified, and most providers do not publish pricing.