Detects cryptocurrency wallet addresses across major networks — Bitcoin (legacy and Bech32), Ethereum, Solana, XRP, Litecoin, Tron, Cardano, Dogecoin, and Monero.
Detects Bitcoin payment address candidates in both Bech32 (bc1…) and legacy Base58 (1…/3…) shapes. Checksums are not validated (Purview custom SITs lack Bech32/Base58Check functions), so matches are structural candidates and require Bitcoin/transfer context at enforce tiers.
Detects Cardano Shelley-era payment addresses: bech32-encoded with the mainnet human-readable prefix "addr1" (CIP-19 / CIP-5). The bech32 body varies with address type — enterprise (payment only) ~53 body chars, base (payment + stake) ~98 body chars, pointer in between — so the total ranges roughly 58-103 characters. The distinctive "addr1" prefix plus a long bech32 body is strong structure, gated at 85. Legacy Byron base58 (Ae2.../DdzFF...) and reward "stake1" addresses are not implemented (see report). Prefix/lengths verified against the CIP-19 test vectors.
Detects Dogecoin mainnet addresses: Base58Check encoded, 34 characters long. Pay-to-Public-Key-Hash (P2PKH) addresses use version byte 0x1E and start with "D"; Pay-to-Script-Hash (P2SH) addresses use version byte 0x16 (22) and start with "A" (leading "9" is also possible for that version byte). A single leading letter is weak structure, so detection is context-gated. Prefix/version/length verified against libdogecoin and Dogecoin address-type docs.
Detects Ethereum Address patterns.
Detects Litecoin addresses in two forms. Native SegWit bech32 addresses use the human-readable part "ltc1" (distinctive, 85-gated). Legacy base58 addresses are P2PKH with version byte 0x30 (leading "L") and P2SH with version byte 0x32 (leading "M"), 26-35 characters (most 34) — a single-letter prefix that is weaker (75-gated). Prefixes/version bytes/lengths verified against the Litecoin address-prefix docs and documented example addresses.
Detects Monero (XMR) public addresses, encoded in Monero-specific base58 (same 58-character alphabet as standard base58, excluding 0 O I l). Standard addresses (mainnet network byte 18) and subaddresses (network byte 42) are 95 characters and begin with "4" or "8"; integrated addresses (network byte 19, standard address + encrypted 64-bit payment ID) are 106 characters and begin with "4". The fixed 95/106-char length is highly distinctive, gated at 85. Prefixes/lengths verified against the Monero standard-address and integrated-address docs.
Detects Solana public wallet/account addresses: the base58 encoding of a 32-byte ed25519 public key, 32-44 characters long, with NO distinctive prefix. Because a prefix-less base58 run of this length collides heavily with random tokens, other base58 identifiers and prose, detection is context-gated: the single tier is AND-gated by cryptocurrency/wallet domain context and a template/sample noise exclusion. Length/charset bounds verified against the Solana account model (32-byte address displayed as a base58 string) and the base58 alphabet (excludes 0 O I l).
Detects TRON (TRX) mainnet addresses: Base58Check encoding of a 21-byte payload (0x41 version byte + 20-byte address hash), always starting with the letter "T" and exactly 34 characters long. The 0x41 prefix byte fixes the leading character as "T" and the length at 34 (58^34 > 66*256^24; 58^33 insufficient). A single leading letter is weak structure, so detection is context-gated. Prefix/length/charset verified against TRON developer docs and the TRON protocol overview.
Detects XRP Ledger classic addresses: base58-encoded, starting with the character "r", 25-35 characters long, encoding a 21-byte buffer (1-byte prefix value 0 + 160-bit account ID) with a 4-byte checksum. The XRP base58 dictionary excludes 0, capital O, capital I and lowercase l — the same 58-character set as standard base58, so a standard base58 class matches the charset. A single leading letter is weak structure, so detection is context-gated. Length/charset/prefix verified against xrpl.org address docs.