Every bankroll settles on chain. Addresses come straight from the API; check them yourself before you send anything.