Important — please read before using Kanshi Guardian
What Kanshi Guardian is, what it is not, and the limits of its protection.
Beta - not every feature is live yet
Kanshi Guardian is in closed beta. This guide describes the product as designed, and not every capability below is available today. Some features are pending completion of an independent security audit, and on-chain features - including the Guardian Vault and its time-lock delay - are not yet deployed. Availability also varies by subscription tier and by blockchain. The app itself is the source of truth for what is live right now; where this guide and the app disagree, the app is correct.
Not investment advice
Nothing Kanshi Guardian displays — including risk scores, threat flags, token ratings, wallet analysis, or any AI-generated response — constitutes financial or investment advice. It helps you verify whether a transaction appears technically safe; it does not evaluate the financial merit, profitability, or suitability of any token, protocol, or investment. Always consult a qualified financial adviser before making investment decisions.
What Kanshi Guardian can do
- Check URLs and domains against known phishing and scam patterns
- Scan wallet addresses for connections to flagged or malicious addresses
- Identify risky token approval patterns such as unlimited allowances and setApprovalForAll
- Simulate smart contract calls and flag dangerous opcodes before you sign
- Flag suspicious airdropped assets and hold them in a separate list, so you can recognise them instead of interacting with them unawares
- Apply a time-lock delay to high-risk actions giving you a window to cancel
- Alert you to unusual transaction patterns that may indicate a compromise
- Verify email sender domains against known scam infrastructure
What Kanshi Guardian cannot do
- Recover funds that have already been stolen or transferred — no tool can reverse confirmed blockchain transactions
- Guarantee that a transaction flagged as safe will not result in financial loss
- Predict the future price, value, or legitimacy of any token or protocol
- Replace your own judgement — Kanshi Guardian provides information, not decisions
- Protect against threats it has not yet encountered — novel attack patterns may not be detected
- Prevent you from signing a transaction if you choose to override a warning
- Access, control, or safeguard funds held on centralised exchanges
- Provide legal, tax, or regulatory advice of any kind
Kanshi Guardian's purpose is to give you the means to verify that a transaction or interaction is technically safe before you sign it, and to protect your funds by detecting threats early enough for you to act. The final decision on every transaction always rests with you.
Getting started
What is Kanshi Guardian?
Kanshi Guardian is an AI-powered blockchain wallet security platform for self-custody wallet protection. It provides a comprehensive suite of security tools across five categories: Verify Before You Click (URL screener, email verifier, scam text scanner, wallet sniffer), Analyze Before You Sign (signature decoder, contract simulator, token risk analyzer, address poisoning guard, auto scan), Manage Access (token auth manager, quarantine vault, Solana assets), Vault Protection (Guardian Vault, timelock alerts, Guardian alerts, emergency safe-haven sweep), and Investigate & Advise (threat reporter, AI security advisor, RF & device security scan). Kanshi Guardian never holds your funds or accesses your private keys - it is a security layer that sits between you and threats.
Which wallets does Kanshi Guardian support?
Kanshi Guardian supports MetaMask, Coinbase Wallet, Trust Wallet, Rabby, Phantom (EVM), OKX Wallet, and any WalletConnect v2 compatible wallet. On mobile, open your wallet app, navigate to its built-in browser or DApps tab, and load the Kanshi Guardian URL from there - the wallet injects its provider automatically.
Does Kanshi Guardian work with hardware wallets like Ledger or Trezor?
Yes. Kanshi doesn't need to support hardware wallets directly - it connects to whatever address your software wallet (MetaMask, Rabby, etc.) exposes, and a hardware wallet plugged into that software wallet works exactly the same way any other connected account does. All of Kanshi's scanning, monitoring, and Guardian Vault protection operate on your public address and request signatures through the standard connection your wallet already provides, regardless of whether the private key lives in your browser, your phone, or a physical device. If anything, a hardware wallet is a genuinely good fit for the two roles in Kanshi that specifically benefit from an isolated key: the guardian address on your Guardian Vault, and especially the safe-haven address for emergency sweeps, which the vault setup flow already recommends using a hardware wallet for.
Is Kanshi Guardian safe to use with my wallet?
Yes. Kanshi Guardian never requests access to your private keys or seed phrase. It works by monitoring transaction patterns and scanning URLs, addresses, and contract bytecode - it does not interact with your funds directly.
Does Kanshi Guardian guarantee my funds are safe?
No. Kanshi Guardian significantly reduces your exposure to common crypto threats, but it cannot guarantee protection against all attacks, novel exploits, or user error. No security tool can make that guarantee. Kanshi Guardian gives you the information and the time to make better decisions - the final call is always yours.
Verify Before You Click
What does the URL Screener check?
The URL Screener runs every URL against multiple threat intelligence databases - Google Safe Browsing, PhishTank, OpenPhish, and URLScan.io - plus Kanshi Guardian's own blocklist. It checks domain age (domains under 30 days old are flagged), HTTPS enforcement, and known phishing patterns in the URL structure. Results are colour-coded: green is safe, yellow needs review, red is blocked. Use it before clicking any link in a Discord DM, Telegram message, email, or social post.
How does the Email Verifier work?
The Email Verifier checks the sender domain against DMARC records, known scam infrastructure databases, and typosquatting patterns (e.g. support@metamask-security.com vs support@metamask.io). It also checks whether the domain was recently registered. Paste the full sender email address - not just the display name - for an accurate result.
What is the Scam Text Scanner?
The Scam Text Scanner uses AI to analyse raw message text - Discord DMs, Telegram messages, emails, or SMS - for social engineering patterns. It detects urgency manipulation ('your wallet will be drained in 24 hours'), impersonation, fake airdrop offers, and credential-harvesting prompts. Paste the full message text. The scanner is available from the Starter tier.
What does the Wallet Sniffer show?
The Wallet Sniffer performs a multi-hop transaction trace (3 hops Free/Starter, 5 hops Pro, 8 hops Trader+) from any EVM address. It cross-references each address against Etherscan transaction data, Chainabuse community scam reports, Honeypot.is simulation results, and an 80+ address blocklist covering Tornado Cash and DPRK-linked sanctioned wallets. XRP Ledger addresses show a dedicated trust line panel with XRPL-specific risk flags. Tron addresses get their own scan: live TRC-20 approval checks, a bounded hop trace, and the same sanctions and blocklist screening. Tron is non-EVM, so it does not share the EVM hop budget above, and funds that bridge off Tron end the trace. Use it before accepting a payment from an unknown address or before sending funds to a new counterparty.
Analyze Before You Sign
What is the Signature Decoder?
The Signature Decoder intercepts wallet signing requests and decodes what you are actually authorising. It supports all six signing methods: eth_sign (dangerous - signs arbitrary data), personal_sign, signTypedData v1/v3/v4, and EIP-712 structured data. For EIP-712 it renders the full typed data tree in readable form. It detects Permit MAX_UINT256 approvals (unlimited spending), suspicious domain mismatches, and shows the exact function being called. Auto-screen mode runs this check automatically on every signing request.
How does the Contract Simulator work?
The Contract Simulator fetches and decodes the ABI of any smart contract, then simulates the call you are about to make using the eth_call RPC method - without broadcasting to the chain. It shows the decoded function name, parameters, expected outcome, estimated gas cost, and an AI-generated plain-English explanation. It also checks whether the contract is verified on Etherscan, flags proxy contracts and upgradeability, and runs a MEV risk assessment.
What does the Token Risk Analyzer detect?
The Token Risk Analyzer runs token contracts through the GoPlus Security API and checks for: honeypot traps (buy-only contracts that prevent selling), hidden mint functions that allow the deployer to print unlimited tokens, ownership not renounced, transfer tax above 10%, blacklist functions that can freeze your balance, and rug pull indicators based on liquidity lock status and deployer wallet history. A 0-100 risk score is produced with a breakdown of each flag.
What is the Address Poisoning Guard?
Address poisoning is an attack where a scammer sends a tiny transaction from a wallet address that looks nearly identical to one in your recent transaction history - hoping you will copy-paste the wrong address next time you send funds. The Address Poisoning Guard monitors your wallet's transaction history for look-alike addresses (differing only in the first or last 4 characters) and flags them before you confirm a new transaction. It also guards your clipboard - if you copy an address and it changes before you paste, Kanshi Guardian alerts you immediately.
What does Auto Scan do?
Auto Scan hooks into your connected wallet's provider and intercepts every outgoing transaction request before it reaches your wallet's signing popup. It runs the destination address against the blocklist, checks the contract for known-bad bytecode patterns, decodes the calldata, and produces a risk score - all in under 2 seconds. If the risk is high, it shows a warning overlay before you see the wallet popup. Auto Scan operates silently in the background once enabled.
Manage Access
What is the Token Auth Manager?
The Token Auth Manager shows every ERC-20 approval your wallet has granted - meaning every contract that currently has permission to spend your tokens. Many approvals are set to unlimited (MAX_UINT256) and persist indefinitely after you stop using a dApp. The manager lets you revoke individual approvals in one click, batch-revoke all approvals from a single contract, and identifies approvals to high-risk or deprecated contracts. It also surfaces Permit2 sub-approvals, which are often missed by other tools.
How does the Quarantine Vault work?
The Quarantine Vault watches for tokens arriving at your wallet from unknown or suspicious sources - airdropped tokens, dust attacks, and tokens from flagged contracts - and lists them separately with the reason each was flagged. Be clear on the boundary: this is a warning and identification layer, not an on-chain lock. Quarantined tokens stay in your wallet on-chain and can still be moved, sold or interacted with; nothing here prevents a malicious contract from running if you choose to touch it. What it does is make sure a dangerous token is clearly labelled rather than sitting unnoticed. From the Quarantine page each flagged item has two actions, and you can also simply leave it alone. Release removes the item from the Quarantine list - use it when you review something and it turns out to be legitimate. Release changes nothing on-chain: it sends no transaction and costs no gas, because the token was never held in the first place. It only stops Kanshi flagging it. Burn attempts to actually remove the token, by sending its full balance to the standard burn address (0x...dEaD). This is the only way to clear a malicious token from a wallet, because nothing can erase a balance from a token contract's own ledger without a signed transaction from the wallet holding it. Burning is an on-chain transaction: it costs gas, it is irreversible, and it needs a connected wallet that can sign. Both actions require biometric confirmation. Leaving a flagged token alone is a perfectly reasonable third choice - it stays listed with the reason it was flagged, and as long as you never swap, send or approve anything involving it, it cannot do anything to you.
What does the Solana Assets scanner show?
The Solana Assets scanner fetches your SOL balance and all SPL token accounts via the Helius RPC, then scans each token through the GoPlus Solana security API and RugCheck.xyz in parallel. Risk flags include honeypot detection, freeze authority (the deployer can freeze your token balance), hidden owner, unverified source code, and a rug score from 0-1000. Available from the Pro tier.
Vault Protection
What is the Guardian Vault?
The Guardian Vault is a personal smart contract you deploy, on whichever supported blockchain your assets are on, that enforces time-delayed withdrawals. When you (or an attacker with your seed) request a withdrawal, a configurable delay of 12 hours to 7 days begins, giving you time to cancel before funds leave the vault - even if your seed phrase has been compromised. This on-chain protection works identically on every chain the vault is deployed on. How you're alerted to a withdrawal depends on the chain: on Kanshi's 10 actively-monitored chains, Kanshi watches the vault and fires a critical push alert the moment a withdrawal is queued; on other supported chains, monitoring is user-determined - the app checks your vault when you open it and can remind you to check (see the monitoring question below). Either way, the delay itself always protects your assets.
Which blockchains can I deploy a Guardian Vault on?
The Guardian Vault can be deployed on all 18 supported chains - the on-chain time-delay protection works identically everywhere it's deployed, because that protection is enforced by the vault contract itself, not by Kanshi watching the chain. What differs between chains is how the vault is monitored for alerts, and there are three levels. Real-time monitoring (7 chains: Ethereum, Polygon, Arbitrum, Optimism, Base, zkSync Era, Linea) - Kanshi's servers watch these in real time via Alchemy Notify and push you a critical alert the moment a withdrawal is queued. Real-time monitoring, newly enabled (4 chains: BNB Chain, Avalanche, Gnosis, Scroll) - the same real-time alerting, switched on in August 2026. We have confirmed the alert subscription is accepted on each of these, but we have not yet watched a live alert arrive on them, so the minimum delay you can set is 24 hours instead of 12 until we have. User-determined monitoring (the remaining chains) - Kanshi does not run active server-side monitoring on these, so you decide how the vault gets checked: the app checks your vault whenever you open it, and you can set a reminder (once or twice daily) that prompts you to open the app and check. On these chains the vault still fully protects your assets on-chain - the delay, the guardian's ability to cancel, and the lockdown all work exactly the same - but Kanshi will not automatically detect and alert you to a withdrawal; you are responsible for checking. This is disclosed clearly when you deploy on such a chain. Solana and XRP Ledger use fundamentally different technology that does not support this kind of smart contract today, so a Guardian Vault cannot be deployed there yet. This list expands as our alert infrastructure grows.
What does "user-determined monitoring" mean?
It means you choose how your vault is checked on chains where Kanshi doesn't run active, automatic monitoring. The vault's on-chain protection is always active everywhere - an attacker cannot move funds faster than your chosen delay, regardless of chain. But on a user-determined chain, Kanshi will not watch the chain for you and won't automatically send an alert if a withdrawal is requested. Instead, two things keep you in the loop: the app checks your vault's status every time you open it (reliable on any device, including iOS), and you can turn on a reminder - once or twice a day - that nudges you to open the app and check. The reminder is a scheduled prompt to check; it is not Kanshi monitoring the chain on your behalf. This gives you a real, honest way to stay protected on chains we don't yet actively monitor, as long as you check within your vault's delay window. We deliberately don't overstate this: deployable everywhere, actively monitored on 11 chains, user-checked on the rest.
Why is the minimum delay 24 hours on BNB Chain, Avalanche, Gnosis, and Scroll instead of 12?
Because alerting on these four is new and we have not yet seen it work end to end. Kanshi added real-time vault alerting on them in August 2026, and confirmed with Alchemy that the alert subscription is accepted on each. What has not happened yet is watching a real vault event travel all the way through - from the chain, to Kanshi's servers, to a push on your phone. Until we have observed that, we hold the shortest selectable delay at 24 hours rather than 12, so that even if the first alert on one of these chains is slower than expected, you still have a meaningful window to review and cancel. Your vault's actual protection — the delay itself, the guardian's ability to cancel, the lockdown circuit-breaker — works exactly the same as on any other chain, and once we have confirmed delivery we will drop the minimum to 12 hours like everywhere else.
Can I deploy more than one Guardian Vault per wallet, or does a new one replace the old?
Neither — you deploy one vault per wallet address per chain, permanently. The contract enforces this directly: a second deployment attempt is rejected outright, so there's no way to accidentally overwrite or lose your existing vault. If you want different settings later — a different delay, a different guardian, a different threshold — you update your existing vault's rules directly rather than deploying a new one. That update goes through the same delay your vault is already configured with, so even a compromised owner key can't instantly weaken your own protection. Once deployed, every subsequent withdrawal attempt from that vault — however many, however soon after the last one — goes through the same delay, guardian review, and lockdown protection. There's no limit to how many attempts it will catch, and no scenario where it only protects you once.
What is a safe-haven wallet and how do I register one?
A safe-haven wallet is a clean wallet address - ideally a hardware wallet whose seed has never been exposed - that you register in advance as the emergency sweep destination. You register it via the Guardian Vault page, which triggers a 48-hour on-chain timelock before the address activates. This timelock means even an attacker who already has your seed cannot change the safe-haven destination to their own address. Once active, the safe haven is fixed. Set it up before any compromise is suspected.
How does the emergency vault sweep work?
When a critical Guardian Alert fires (or you manually trigger it), the emergency sweep calls emergencySweep() on the vault contract. This moves all ETH and specified ERC-20 tokens instantly to your pre-registered safe-haven wallet with zero delay - because the destination is fixed and timelocked, it is safe to execute without waiting. emergencyCancelAll() simultaneously voids every pending withdrawal, neutralising any delayed withdrawal the attacker may have queued. Triggerable by either the vault owner or the designated guardian wallet.
My wallet was compromised (or an emergency sweep fired) - can I move my subscription to a new wallet?
Yes. If an emergency sweep fired or you've confirmed your wallet is compromised, the remaining time on your subscription can be transferred to a new, clean wallet rather than lost. This requires a support request - it isn't self-service, since it moves real subscription value and needs a human to verify it. Contact support with: (1) the event or incident number from the alert that fired (visible in Timelock Alerts or your email notification), or a screenshot of the alert if no log number is available, and (2) the new wallet address you want the subscription moved to. Critically, the new wallet's account must use the exact same email address as the old one - support cannot move a subscription to a new email, even with a valid incident number, since that's the same pattern a compromised-email account-takeover attempt would take. If your email may also be compromised, secure that first through normal account recovery before requesting a wallet migration. Once verified, support grants the exact remaining time from your old subscription (same tier, same days left) to the new wallet - nothing is lost, and nothing extra is added.
What are Timelock Alerts?
Timelock Alerts is a log of every high-risk event Kanshi detects, so you have one place to review and respond quickly. It's genuinely two different things wearing one page. Guardian Vault actions - a withdrawal or rule change requested from a deployed vault, including a rapid-withdrawal pattern consistent with a bot sweep, which the vault's own circuit-breaker detects and locks against automatically - really are still pending: they show a live countdown against a real on-chain delay, and Cancel actually stops them before they execute. Everything else (large transfers from your regular wallet, new approvals, unusual activity) is detected once Kanshi sees it confirmed on-chain, which is after it already happened - reviewing one of these reports it as unauthorized or acknowledges it as legitimate, it doesn't undo anything. The difference comes down to whether the assets involved were actually deposited in your vault: a bot sweep against vaulted assets is genuinely caught and stopped; the same attack against assets sitting in your regular wallet is only ever detected afterward. Each entry is labeled clearly as one or the other so you always know which you're looking at.
Investigate & Advise
What is the Threat Reporter?
The Threat Reporter lets you submit newly discovered scam addresses, phishing URLs, malicious contracts, and rug-pull tokens directly to global threat intelligence databases - Chainabuse, ScamAlert, and Kanshi Guardian's own blocklist. Reports are reviewed and, if verified, propagated to all Kanshi Guardian users within 4 hours. You can also browse recent community reports and see which threats have been verified. Reporting threats protects not just your own wallet but the broader community.
How does the AI Security Advisor work?
The Security Advisor is an AI security analyst trained on blockchain threat patterns, smart contract vulnerabilities, DeFi exploit history, and wallet security best practices. You can ask it to explain a transaction you don't understand, evaluate a DeFi protocol's risk profile, decode a suspicious message, or give a second opinion on any Kanshi Guardian alert. It has access to Kanshi Guardian's live threat intelligence feed. Available from the Starter tier with monthly usage limits by tier.
What does the RF & Device Security scan check?
The RF & Device Security scan runs 10 checks across four categories before any signing event - and is also available on demand from the Security Tools menu. Device Integrity: root/jailbreak signatures (Frida, Magisk, Cydia), screen overlay timing attacks, developer mode flags. Network: TLS integrity via a probe to a known endpoint, evil-twin access point indicators, VPN/proxy detection. RF/Wireless: NFC active state without user intent (NFC is the short-range wireless tech phones use for tap-to-pay - leaving it switched on at all times, rather than only when actually paying, gives a nearby attacker a continuously open channel to attempt proximity-based skimming or relay attacks against payment cards or hardware wallets in your pocket), BLE hardware wallet pairing anomalies. Identity/Auth: SIM-swap flags, accessibility permission abuse. Each scan generates a 16-character SHA-256 session hash that can be attached to transaction metadata as an audit record.
Blocked Addresses
What is the Blocked Addresses panel?
The Blocked Addresses panel is your personal threat blocklist. Any wallet address, smart contract, token, or domain you add here is flagged as dangerous across the entire app. When Kanshi Guardian detects an interaction with a blocked entry - in a transaction, URL scan, or wallet analysis - it immediately raises an alert and prevents the interaction from proceeding silently.
What types of entries can I block?
You can block four types of entry. Wallet - a specific 0x or Tron wallet address known to be associated with scams, phishing, or theft. Contract - a smart contract address that has been identified as malicious, a drain contract, or an approval trap. Token - a token contract address for known scam tokens, phishing airdrops, or rug-pull assets. Domain - a website domain used for phishing, fake DApps, or social engineering attacks.
How do I add an entry to the blocklist?
Go to the Dashboard and scroll to the Blocked Addresses panel. Select the entry type (wallet, contract, token, or domain) from the dropdown, paste or type the address or domain into the input field, then press Enter or click Add. Kanshi Guardian validates the format before accepting the entry - Ethereum and Tron addresses must match the correct format, and domains must be valid hostnames.
Where does Kanshi Guardian get its built-in blocklist?
Kanshi Guardian's threat intelligence feed is refreshed every 4 hours using published security research and community-reported scam data. Entries from this feed are automatically merged with your personal blocklist. Your manual additions sit on top of the shared feed and are never overwritten by updates.
Can I remove an entry from the blocklist?
Yes. Hover over any entry in the Blocked Addresses panel and click the trash icon that appears on the right. The entry is removed immediately. You can also clear your entire personal blocklist from Profile → Biometric Settings using the credential removal option, which clears all locally stored Kanshi Guardian data.
Does blocking an address prevent a transaction on-chain?
No. Kanshi Guardian operates as a warning layer in your browser - it cannot intercept or reverse a transaction once you have signed and broadcast it. What it does is alert you before you sign, giving you the chance to cancel. You must act on the warning; Kanshi Guardian cannot act on your behalf.
AI Security Advisor
What is the AI Security Advisor?
The Security Advisor is an AI assistant trained on blockchain security knowledge. You can ask it questions in plain English about wallet threats, token approvals, smart contract risks, phishing tactics, DeFi attack patterns, and how to recover from or prevent specific security incidents. It responds conversationally and explains concepts without requiring technical knowledge.
What can I ask the Security Advisor?
You can ask anything related to crypto security. Examples: 'What is a rug pull and how do I spot one?', 'Is it safe to approve this contract?', 'What does setApprovalForAll actually do?', 'My wallet was phished - what should I do first?', 'Explain the difference between a hot wallet and a cold wallet', 'What is a honeypot token?', 'How do I check if a token contract is verified?'. The quick-prompt chips at the top of the page offer common starting questions.
How do I use the Security Advisor?
Navigate to Security Tools → Security Advisor. Type your question in the input field at the bottom and press Enter or tap the send button. You can also tap any of the quick-prompt chips above the chat to pre-fill a common question. The advisor responds within a few seconds. You can continue the conversation - it maintains context across the messages in your current session.
Does the AI have access to my wallet or transaction data?
No. The Security Advisor has no access to your wallet, private keys, transaction history, or any personal data. Every message you send is processed independently. Do not share your seed phrase, private keys, or passwords with the advisor - or with any AI tool.
Which AI model powers the Security Advisor?
Free and Starter plan users receive responses from Claude Haiku - a fast, capable model well-suited to security Q&A. Pro, Business, and Enterprise plan users receive responses from Claude Sonnet, which provides deeper reasoning for complex threat analysis. The active model is shown as a small badge next to each response.
Is there a limit on how many questions I can ask?
Free tier users are limited to 10 AI Advisor uses per month, and each session is capped at 50 messages to prevent excessive API costs that would make the free tier unsustainable. Paid plans have higher limits. If you reach the session cap, reload the page to start a new session.
Can the AI Advisor tell me whether a specific token is a good investment?
No. The Security Advisor is a security tool, not a financial adviser. It can tell you whether a token contract has been verified, whether its approval pattern is risky, or whether its domain appears in known scam databases. It cannot and will not assess financial merit, predict price movements, or recommend investments.
Wallet Sniffer
What does 3-hop transaction tracing mean?
When you scan a wallet address, Kanshi Guardian traces the flow of funds up to 3 hops on the free tier (5 hops Pro, 8 hops Trader+) — following where assets came from and where they went across multiple layers of transactions. Along the way, each address is cross-checked against Etherscan transaction records, Chainabuse community reports, Honeypot.is simulation results, and a blocklist of 80+ mixer and sanctioned addresses including Tornado Cash and Lazarus Group wallets. Wallet age is also checked — newly created wallets are flagged as elevated risk.
Can I scan my own wallet?
Yes. Scanning your own wallet is a good way to check if any of your past transaction counterparties appear in Kanshi Guardian's threat database or have unusual risk patterns.
Does a low risk score mean I should trust or invest in a project?
No. A low risk score means Kanshi Guardian has not detected security red flags based on its current threat database. It says nothing about the financial legitimacy, regulatory status, or investment merit of any project or token associated with that wallet.
Does Wallet Sniffer support XRP Ledger addresses?
Yes. Paste any XRP Ledger address (r-prefix or X-prefix) and Kanshi Guardian automatically routes it to XRPL-specific analysis: account info, trust line inventory, transaction history, and seven XRPL risk flags including frozen trust lines, trust line spam, rippling enabled, reserve drain, rapid forwarding patterns, and wallet age. Results include a dedicated Trust Lines panel alongside the standard risk score.
Quarantine & Timelock
What is the Quarantine Vault?
The Quarantine Vault lists assets that Kanshi Guardian has flagged as high-risk - primarily phishing airdrops, approval trap tokens, and dust attack amounts. It is a warning layer, not an on-chain barrier: flagged assets remain in your wallet and can still be interacted with. Its job is to label the risk clearly so you do not touch a dangerous token by accident. For each item you can release it - removing it from the list, with no transaction and no gas, for something you have reviewed and found legitimate - or burn it, which sends its full balance to the burn address in a signed, irreversible on-chain transaction that costs gas. You can also just leave it listed. Both actions require biometric confirmation.
What if a quarantined token cannot be burned?
Some tokens cannot be burned, and that is often the point. A honeypot token's contract deliberately blocks transfers out - it is built so you can buy but never sell or move. Kanshi tries the transfer as a free simulation first, before your wallet is ever asked to sign, so a token that was always going to fail is caught without you paying gas for a transaction that would only revert. If that simulation fails, the burn stops there and the item is marked as unremovable. A burn can also fail for a reason that has nothing to do with the token: some smart-contract wallets (Coinbase Wallet on mobile is the common one) cannot complete an automated burn, and occasionally a transaction is broadcast but not confirmed - in that case check the transaction hash on a block explorer before trying again, so you do not send a second transaction and waste gas. When a token cannot be removed, the safe outcome is the same as if you had never tried: hide it in your wallet's own interface so it stops cluttering your balances, and never swap, send, or approve anything involving it. A token you do not interact with cannot do anything to you, burned or not.
Should I burn every flagged token?
No. Burning costs gas, and most flagged items are worthless dust or scam airdrops sent to thousands of addresses at once - paying a real transaction fee to delete something with no value is usually not worth it. Burning is most useful when a token is cluttering your wallet enough to risk a mistake, or when you want it gone for your own peace of mind. The protection does not come from burning; it comes from not interacting. Leaving a token in the Quarantine list, clearly labelled with why it was flagged, is a legitimate end state.
What is a time-lock vault?
A time-lock vault places a mandatory delay on withdrawals - a delay you choose, from 12 hours up to 7 days (24 hours minimum on BNB Chain, Avalanche, Gnosis, and Scroll). If your seed phrase is compromised, this gives you a window to detect the attack and cancel the withdrawal before funds are moved. Guardian or safe-haven address changes specifically use a separate, fixed 48-hour lock - deliberately not configurable, so an attacker who already has your seed can't quickly redirect either of those to their own address.
How do I approve or reject a timelocked action?
Go to Timelock Alerts and click Review. The review panel shows you the full transaction detail, risk score, and reason for the flag. You can approve it (if you initiated it) or reject it (if you did not). All critical actions require biometric confirmation.
How many timelocks do I get on the free tier?
The free tier includes 2 timelock events per month. This covers the most common threat scenarios but may not be sufficient if your wallet is actively targeted. Starter and above plans include unlimited timelocks. If you use both free-tier timelocks, Kanshi Guardian will prompt you to upgrade to ensure continuous protection.
Subscription, billing & cancellation
What subscription plans does Kanshi Guardian offer?
Kanshi Guardian offers six plans. Kanshi is free while in beta - there is no permanent free tier; during beta the Free plan ($0) includes the core security tools with limited monthly uses and 5 timelock events. At launch, every account starts with a 60-day free trial, then continues on Basic ($1/month or $11/year). Starter ($8/month or $81.60/year) increases tool uses to 50 and includes unlimited timelocks. Pro ($14/month or $142.80/year) adds the browser extension, Guardian wallet alerts, and Claude Sonnet AI. Trader ($24/month or $244.80/year) is designed for active on-chain traders with 250 uses per tool, mobile guardian alerts, and priority contract simulation. Business ($49/month or $499.80/year) supports multiple users with 500 uses per tool and full API access. Enterprise ($149/month or $1,519.80/year) provides unlimited users and uses and custom webhook support. Annual plans save 15% versus monthly billing, except Basic ($11/year, about 8% off).
Can I add secondary wallets to my subscription?
Yes, and the terms depend on your tier. During beta you can link a second wallet at no cost; at launch, Free and Basic include your primary wallet only (no secondary wallets). On Starter and Pro, additional wallets are $7/month each, up to 4 secondary wallets — unchanged from before. On Trader, additional wallets are $10/month each, up to 4 secondary wallets (5 total including your primary) — the higher rate reflects Trader's higher tool-use limits, which do carry more backend cost per wallet. On Business, additional wallets are also $10/month each, but with no fixed maximum — larger organizations can add as many as they need, weighing the cost against their own requirements. On Enterprise, wallet arrangements are discussed directly rather than priced per-wallet, since Enterprise plans (starting at $149/month) are built around each organization's specific scale. Every secondary wallet, on any tier, carries your full subscription benefits — independent signing guards, Guardian Vault, and alerts. Manage secondary wallets from Profile → Wallet & Plan.
How are payments processed?
All paid subscriptions are settled on-chain using the exact canonical 6-decimal USDT token configured for the deployed Kanshi Guardian contract. You must have a compatible wallet and sufficient USDT. Kanshi never holds your signing keys or initiates charges; you approve each payment directly. The smart contract does hold the refundable reserve until it is earned, refunded, or swept under the contract rules.
Can I cancel my subscription at any time?
Yes. You can cancel at any time from Profile → Subscription → Cancel. Cancellation requires a refund disclosure, an email one-time code (OTP), and a wallet signature. Once the on-chain cancellation confirms, your plan reverts to Free and the refund is queued. The app then prompts a second transaction to claim it; if that transaction fails or is rejected, the refund remains claimable in the contract.
What is the refund policy?
The creator royalty and maintenance allocation are routed when you pay and are non-refundable. The remainder is held on-chain as your refundable reserve. When you cancel, the refund is: refundable reserve x (seconds remaining / covered seconds). The contract queues that amount for you to claim in a separate transaction, so the refund is not an automatic transfer during cancellation.
What is non-refundable?
The creator royalty (initially 10%, reducing to 7.5% once the contract has processed $10M in cumulative gross subscription revenue) and maintenance allocation (initially 5%, reducible once to 2.5% only by the nonprofit board — the owner cannot change it) are non-refundable because they are routed at payment time. The remaining reserve is refundable only for unused coverage time.
How do tier upgrades work?
You can upgrade to a higher tier at any time from Profile → Subscription. You pay only the prorated price difference for the remaining days in your current billing cycle. Your billing cycle end date does not change - future renewals charge the full new tier price.
What happens at the end of a billing cycle?
Subscriptions do not auto-renew automatically. At the end of your billing cycle, your plan reverts to Free unless you manually renew from the Subscription page. Every renewal requires a new transaction you sign - you cannot be charged unexpectedly.
Are annual plans refundable?
Yes, on the same reserve-based prorated basis as monthly plans. The unused-time fraction is applied to the refundable reserve, not the full payment. Annual plans offer a 15% discount versus monthly billing.
What personal data does Kanshi store, and how is it protected?
Two pieces of account data matter here, and they're protected differently because they serve genuinely different purposes. Your email is never stored - only a one-way cryptographic hash of it, which cannot be reversed back into your actual address, by Kanshi or anyone else. It exists purely to confirm a match (e.g., verifying an OTP code), never to be read back. Your wallet address is different: it's encrypted, not hashed, because Kanshi genuinely needs the real address back for things a one-way hash could never support - checking your actual on-chain subscription status, monitoring a deployed Guardian Vault and routing real-time alerts to you, and helping support verify your account if you ever need help recovering access. Encryption is the honest tradeoff for a piece of data that has to be reversible by design; it means a raw database breach doesn't expose a plain, searchable list of which wallet belongs to which account, even though the server itself can still decrypt it when a legitimate feature needs to. Your account itself is identified internally by a random ID, not by your email or wallet directly - you can find this ID in the Profile tab, and it's the reference support will ask for if you ever contact them, so an agent can look up your account without needing your email or wallet address repeated back to them.
What happens to my data if I cancel?
Cancelling your subscription reverts your plan to Free immediately. Your local security data (blocked addresses, quarantine state, timelock history) stored in your browser is not deleted by cancellation - logging out clears all locally stored data. Your referral credit balance and account record are tracked server-side, not in your browser, so they're unaffected by clearing local data either way. See the previous question for exactly what's stored server-side and how it's protected.
What if a transaction fails or I am charged but my plan does not activate?
If you approve a payment transaction and it confirms on-chain but your subscription does not reflect the new tier, contact support with your wallet address and the transaction hash. Because payments are on-chain, the transaction is publicly verifiable and any discrepancy can be resolved by inspecting the contract state.
Billing disclaimers
Is Kanshi Guardian a regulated financial service?
No. Kanshi Guardian is a software security tool, not a financial service, investment platform, exchange, or payment processor. Subscription payments are made directly from your wallet to a smart contract - Kanshi Guardian is not a custodian of your funds at any point.
Are subscription fees guaranteed to remain fixed?
No. Kanshi Guardian reserves the right to change subscription pricing at any time. Any price changes will be communicated with reasonable advance notice and will only apply to future billing cycles - your current active subscription period is always honoured at the price you paid.
What currency are prices shown in?
All prices are shown in US Dollars (USD) and charged in canonical USDT. Stablecoin market value is not guaranteed by Kanshi. You are responsible for gas fees required to approve and execute subscription transactions; gas is not included in the subscription price.
Is my subscription transferable?
No. Subscriptions are non-transferable and bound to the wallet address that made the payment. You cannot transfer a subscription to a different wallet, gift it to another user, or sell unused subscription time. You can change your primary wallet once per billing period via Profile → Wallet & Plan.
What if the smart contract is paused or deprecated?
The Kanshi Guardian subscription contract includes a Pausable mechanism that allows Kanshi Guardian to pause new subscriptions in an emergency. Existing active subscriptions are not affected by a pause. If the contract is permanently deprecated, subscribers will be notified and unused subscription time honoured through alternative means.
Does Kanshi Guardian offer refunds for dissatisfaction?
Kanshi Guardian does not offer discretionary refunds for dissatisfaction beyond the prorated cancellation refund described in the refund policy. If you experience a technical failure that prevents you from using Kanshi Guardian, contact support.
Referral programme
How does the referral programme work?
When you share your unique invite link and someone creates an account using it, that counts as a referral. You earn rewards two ways: every free signup earns you a 30-day free trial at the next subscription tier - once per tier level in order from Starter to Enterprise. When a referred user purchases a paid subscription, you earn credit equal to 15% of their first month's price - but that credit isn't awarded immediately. It becomes available 30 days after the referred subscription begins, and only if that subscription is still active at that point. If the referred user cancels within those 30 days, the credit simply never gets issued. This also means the referral doesn't count toward quarterly leaderboard rankings until it clears that same 30-day check. Credits can be applied to your own subscription once per quarter.
Where do I find my invite link?
Go to Referral Programme in the sidebar. Your unique link is displayed at the top of the page. Click Copy to copy it to your clipboard.
How much credit can I earn from paid referrals?
You earn 15% of the first month's price for each paid plan a referred user subscribes to. For example: Starter ($8/mo) = $1.20 credit, Pro ($14/mo) = $2.10 credit, Trader ($24/mo) = $3.60 credit, Business ($49/mo) = $7.35 credit, Enterprise ($149/mo) = $22.35 credit. Credits stack up to a maximum balance of $50.
What is the free month reward?
Every time 3 people create any kind of Kanshi Guardian account using your invite link, you earn a 30-day free trial at the next subscription tier. Rewards are issued in order: Starter → Pro → Business → Enterprise. Each tier can only be rewarded once.
How do I apply my credits?
Go to Referral Programme and click 'Apply to next billing cycle'. Credits are deducted from your next subscription payment. You must have an active paid subscription to apply credits, and applications are limited to once per quarter.
When do credits expire?
Each credit expires exactly 1 year from the date it was issued. Credits expiring within 30 days are flagged with a warning. Expired credits cannot be reinstated.
Can I use credits on any plan?
Credits can only be applied to your own personal Kanshi Guardian subscription. They have no cash value, cannot be transferred to another account, and cannot be used to pay for a plan on someone else's behalf.
Limitations & important notices
Can Kanshi Guardian recover stolen funds?
No. Blockchain transactions are irreversible once confirmed. Kanshi Guardian is designed to prevent theft before it happens - not to recover funds after the fact. If you believe your wallet has been compromised, immediately transfer remaining assets to a new wallet and revoke all token approvals using the Token Auth Manager.
What should I do if Kanshi Guardian flags something I initiated?
Review the flag details carefully. If you are certain the transaction is legitimate and you initiated it, you can approve it through the Timelock review panel after biometric confirmation. If you are unsure, reject it - you can always initiate the transaction again once you have verified it is safe.
Is Kanshi Guardian's AI security advisor a financial adviser?
No. The Security Advisor is an AI tool that answers questions about wallet security, threat patterns, and protective measures. It is not a licensed financial adviser, does not provide investment recommendations, and its responses should not be relied upon for financial decisions.
Does Kanshi Guardian store my wallet data or transaction history?
Kanshi Guardian does not transmit your private keys, seed phrase, or full wallet balance to any server. Threat intelligence, blocklist data, and session preferences are stored locally in your browser. When wallet addresses are scanned, only the public address is used - never private key material.
Does Guardian Vault protect assets on every chain Kanshi supports?
No, and the protection level also differs by chain. On Ethereum, Polygon, Arbitrum, Optimism, Base, zkSync Era, and Linea, alerts are real-time and we have seen them working. On BNB Chain, Avalanche, Gnosis, and Scroll, alerting is also real-time but was only switched on in August 2026 and has not yet been observed delivering a live alert, so the minimum delay is set to 24 hours instead of 12 to preserve a real safety margin until it has. Kanshi cannot currently deploy a Guardian Vault at all on Solana or XRP Ledger — both use fundamentally different underlying technology that does not support this kind of smart contract today — so assets held natively on those two chains are not covered by this protection, even though Kanshi's scanning and monitoring tools do cover them. This compatibility list will be updated as new chains and alert infrastructure become available.