What the health check covers
Open token permissions. When you use a trading site you often grant its contract a standing permission to spend a token from your wallet — like a direct-debit authorization. These never expire on their own. We list every one still open on Ethereum, Base, Arbitrum, and Polygon, and flag permissions to contracts on public scam blacklists, unlimited permissions to contracts nobody can identify, and old ones with real money exposed today.
Lookalike addresses. Attackers plant addresses in your history that match the first and last characters of your real contacts — the only ones your eye checks. Copy one later and you pay the attacker. Documented losses exceed $83M. We look for strangers mimicking your genuine contacts and for the zero-value transfer trick itself.
Dust and bait. On Bitcoin, tiny payments sent to track you or bait a response. We point them out so you don't touch them.
An A–F grade. Deterministic — fixed, published weights per finding, and the same input always produces the same grade. The full methodology is public.
At rest, not at transaction time
Most wallet security tools protect the moment you click — a browser extension warning you about the site you're on. That guards the front door while you're standing at it. A wallet you rarely touch has a different problem: nobody is looking at all. A years-old permission, a planted lookalike, money quietly leaving — none of it needs you to click anything today.
Canary watches the vault, not the click: the standing state of the wallet itself, checked from public data alone. That's also why it works for hardware wallets — your keys are offline, but your addresses are public, and so is everything that happens to them.
Asked before, answered plainly.
What is a wallet health check?
A read-only review of everything publicly visible about a wallet address: the standing token permissions it has granted, lookalike addresses planted in its history, dust payments, and how much money is exposed today. Canary turns that into a plain-English report with an A–F grade.
Do I need to connect my wallet?
No. You paste a public address — the same thing you'd give someone to receive money. No connection, no signature, no browser extension, no keys, no seed phrase. The check cannot move funds because it never has the ability to.
How long does it take?
About ten seconds for a typical wallet. Bitcoin, Ethereum, Base, Arbitrum, and Polygon are read in one pass and reported together.
Is the wallet health check really free?
Yes — one wallet, one fresh read a day, no account needed. Paid monitoring exists for people who want the watching to continue around the clock, and nothing auto-renews.
One check is a snapshot. Watching is the product.
The free check reads your wallet once. Continuous monitoring reads every block on every chain you hold and writes you — by Telegram or email — the moment something changes. Nothing auto-renews.
See pricing