crypttrace 0.10.0__tar.gz → 0.12.0__tar.gz

{crypttrace-0.10.0/src/crypttrace.egg-info → crypttrace-0.12.0}/PKG-INFO

@@ -1,13 +1,13 @@
 Metadata-Version: 2.4
 Name: crypttrace
-Version: 0.10.0
-Summary: OSINT toolkit for crypto investigations: trace stolen funds across Ethereum, Bitcoin, Tron and Solana
+Version: 0.12.0
+Summary: OSINT toolkit for crypto investigations: trace stolen funds across Ethereum, Bitcoin, Tron, Solana and TON
 Author: bobslayerX
 License-Expression: MIT
 Project-URL: Homepage, https://github.com/bobslayerX/crypttrace
 Project-URL: Issues, https://github.com/bobslayerX/crypttrace/issues
 Project-URL: Changelog, https://github.com/bobslayerX/crypttrace/blob/main/CHANGELOG.md
-Keywords: osint,blockchain,forensics,cryptocurrency,bitcoin,ethereum,tron,solana,investigation
+Keywords: osint,blockchain,forensics,cryptocurrency,bitcoin,ethereum,tron,solana,ton,investigation
 Classifier: Development Status :: 4 - Beta
 Classifier: Environment :: Console
 Classifier: Environment :: Web Environment
@@ -42,7 +42,7 @@ Dynamic: license-file
 Open-source OSINT toolkit for crypto investigations. Give it a suspicious
 address; it pulls the public on-chain history, labels known entities (exchanges,
 mixers, sanctioned wallets), scores risk, and maps where the funds moved —
-across Ethereum, Bitcoin, Tron, Solana and more.
+across Ethereum, Bitcoin, Tron, Solana, TON and more.
 
 Built for the investigation that actually happens: *someone's crypto was stolen,
 here's the wallet — where did the money go, and where can it still be stopped?*
@@ -80,7 +80,7 @@ python selftest.py                 # offline checks, no API keys needed
 | | Needed? | How to get it |
 |---|---|---|
 | **EVM chains** (Ethereum, BSC, Polygon, Arbitrum, Optimism, Base) | **Required** | Free key at [etherscan.io/myapikey](https://etherscan.io/myapikey). One v2 key covers all EVM chains. |
-| **Bitcoin, Tron, Solana** | **Not required** | Work out of the box via public endpoints. |
+| **Bitcoin, Tron, Solana, TON** | **Not required** | Work out of the box via public endpoints. |
 
 ```bash
 export ETHERSCAN_API_KEY=xxxx           # required for EVM chains only
@@ -93,7 +93,7 @@ $env:ETHERSCAN_API_KEY = "xxxx"                            # this window only
 [Environment]::SetEnvironmentVariable("ETHERSCAN_API_KEY", "xxxx", "User")   # permanently
 ```
 
-**About the keyless chains:** Bitcoin, Tron and Solana work with no signup at
+**About the keyless chains:** Bitcoin, Tron, Solana and TON work with no signup at
 all, but their free public endpoints are **rate-limited**. crypttrace handles
 this for you — it caches every response, spaces requests out, and retries with
 backoff when a limit is hit. For deep traces you can raise the ceiling with your
@@ -102,6 +102,7 @@ own credentials (all optional):
 ```bash
 export TRONGRID_API_KEY=xxxx            # optional: higher TronGrid quota
 export CRYPTTRACE_SOLANA_RPC=https://…  # optional: your own (faster) Solana RPC
+export TONCENTER_API_KEY=xxxx          # optional: toncenter allows ~1 request/s without it
 ```
 
 (In PowerShell: `$env:TRONGRID_API_KEY = "xxxx"` and so on.)
@@ -114,11 +115,16 @@ export CRYPTTRACE_SOLANA_RPC=https://…  # optional: your own (faster) Solana R
 | Bitcoin | `btc` | mempool.space | UTXO |
 | Tron (TRX + USDT-TRC20) | `tron` | TronGrid | account |
 | Solana (SOL + SPL) | `sol` | public JSON-RPC | account |
+| TON (TON + jettons, e.g. USDT) | `ton` | toncenter v3 | account |
 
 Every network is normalized to the same transfer shape, so `profile`, `trace`,
 `funder`, `report` and the web graph behave identically everywhere. Bitcoin
 additionally unlocks `cluster`. Tron matters for everyday victim cases — most
 romance / "pig butchering" scams move USDT-TRC20 because fees are near zero.
+TON matters for the same reason: USDT on TON is built into Telegram's wallet,
+so scams that start in a Telegram chat often end there. TON addresses are
+accepted in any form (`UQ…`, `EQ…` or raw `0:…`) and shown as wallets show
+them (`UQ…`); jetton transfers are reported between the owners' wallets.
 
 ---
 
@@ -433,13 +439,14 @@ want:
 ```bash
 crypttrace trace 0xADDRESS --asset usdt                   # USDT on Ethereum
 crypttrace trace TADDRESS  --chain tron --asset usdt      # USDT-TRC20 on Tron
+crypttrace trace UQADDRESS --chain ton  --asset usdt      # USDT on TON
 crypttrace tokens TADDRESS --chain tron
 ```
 
 Token contracts differ per chain, so the registry is chain-aware: `usdt` on Tron
 resolves to `TR7NHqje…jLj6t`, on Ethereum to `0xdac17f95…31ec7`. Known symbols
-are `usdt`, `usdc`, `dai`, `weth`, `wbtc` on EVM and `usdt`, `usdc` on
-Tron/Solana; you can also pass any contract address directly.
+are `usdt`, `usdc`, `dai`, `weth`, `wbtc` on EVM, `usdt`, `usdc` on
+Tron/Solana and `usdt` on TON; you can also pass any contract address directly.
 
 Matching is by **exact contract**, which matters: attackers routinely airdrop
 fake tokens named "USDT" to poison wallets, and those are ignored rather than
@@ -459,8 +466,8 @@ Add sources in `labels/labels.py` → `SOURCES`.
 
 On Bitcoin, Tron and Solana the labels cover the reserve wallets of Binance,
 OKX and HTX, plus Bybit's older 2022 list — each taken from the address list the
-exchange publishes itself for proof-of-reserves. That is what lets `offramp`
-flag deposit addresses on those chains. Funds sent to an exchange not on that
+exchange publishes itself for proof-of-reserves; on TON, Binance's reserve
+wallets. That is what lets `offramp` flag deposit addresses on those chains. Funds sent to an exchange not on that
 list still show as `unknown`. Every label records where it came from — see
 `crypttrace labels audit`.
 
@@ -561,6 +568,7 @@ src/crypttrace/
     bitcoin.py     # Bitcoin UTXO (mempool.space) + clustering
     tron.py        # Tron / TRC20 (TronGrid) + base58 conversion
     solana.py      # Solana JSON-RPC
+    ton.py         # TON + jettons (toncenter v3)
     http.py        # shared cache, throttling, 429 backoff
   labels/
     known.json     # curated label DB, one source per claim
@@ -589,10 +597,10 @@ cases/             # worked investigations with their data
 
 ## Roadmap
 
-- More exchanges on Bitcoin, Tron and Solana (now: Binance, OKX, HTX, Bybit),
+- More exchanges on Bitcoin, Tron, Solana (now: Binance, OKX, HTX, Bybit) and
+  TON (now: Binance),
   and refreshing these lists as the exchanges republish them
 - Internal transactions (completes `funder` and contract-mediated transfers)
-- Per-mint filtering for Solana SPL tokens
 - More label sources: Chainabuse, CryptoScamDB, exchange deposit-address sets
 - Spam/dust token filtering in `tokens`
 - Entity clustering on EVM via the gas-funding heuristic

{crypttrace-0.10.0 → crypttrace-0.12.0}/README.md

@@ -8,7 +8,7 @@
 Open-source OSINT toolkit for crypto investigations. Give it a suspicious
 address; it pulls the public on-chain history, labels known entities (exchanges,
 mixers, sanctioned wallets), scores risk, and maps where the funds moved —
-across Ethereum, Bitcoin, Tron, Solana and more.
+across Ethereum, Bitcoin, Tron, Solana, TON and more.
 
 Built for the investigation that actually happens: *someone's crypto was stolen,
 here's the wallet — where did the money go, and where can it still be stopped?*
@@ -46,7 +46,7 @@ python selftest.py                 # offline checks, no API keys needed
 | | Needed? | How to get it |
 |---|---|---|
 | **EVM chains** (Ethereum, BSC, Polygon, Arbitrum, Optimism, Base) | **Required** | Free key at [etherscan.io/myapikey](https://etherscan.io/myapikey). One v2 key covers all EVM chains. |
-| **Bitcoin, Tron, Solana** | **Not required** | Work out of the box via public endpoints. |
+| **Bitcoin, Tron, Solana, TON** | **Not required** | Work out of the box via public endpoints. |
 
 ```bash
 export ETHERSCAN_API_KEY=xxxx           # required for EVM chains only
@@ -59,7 +59,7 @@ $env:ETHERSCAN_API_KEY = "xxxx"                            # this window only
 [Environment]::SetEnvironmentVariable("ETHERSCAN_API_KEY", "xxxx", "User")   # permanently
 ```
 
-**About the keyless chains:** Bitcoin, Tron and Solana work with no signup at
+**About the keyless chains:** Bitcoin, Tron, Solana and TON work with no signup at
 all, but their free public endpoints are **rate-limited**. crypttrace handles
 this for you — it caches every response, spaces requests out, and retries with
 backoff when a limit is hit. For deep traces you can raise the ceiling with your
@@ -68,6 +68,7 @@ own credentials (all optional):
 ```bash
 export TRONGRID_API_KEY=xxxx            # optional: higher TronGrid quota
 export CRYPTTRACE_SOLANA_RPC=https://…  # optional: your own (faster) Solana RPC
+export TONCENTER_API_KEY=xxxx          # optional: toncenter allows ~1 request/s without it
 ```
 
 (In PowerShell: `$env:TRONGRID_API_KEY = "xxxx"` and so on.)
@@ -80,11 +81,16 @@ export CRYPTTRACE_SOLANA_RPC=https://…  # optional: your own (faster) Solana R
 | Bitcoin | `btc` | mempool.space | UTXO |
 | Tron (TRX + USDT-TRC20) | `tron` | TronGrid | account |
 | Solana (SOL + SPL) | `sol` | public JSON-RPC | account |
+| TON (TON + jettons, e.g. USDT) | `ton` | toncenter v3 | account |
 
 Every network is normalized to the same transfer shape, so `profile`, `trace`,
 `funder`, `report` and the web graph behave identically everywhere. Bitcoin
 additionally unlocks `cluster`. Tron matters for everyday victim cases — most
 romance / "pig butchering" scams move USDT-TRC20 because fees are near zero.
+TON matters for the same reason: USDT on TON is built into Telegram's wallet,
+so scams that start in a Telegram chat often end there. TON addresses are
+accepted in any form (`UQ…`, `EQ…` or raw `0:…`) and shown as wallets show
+them (`UQ…`); jetton transfers are reported between the owners' wallets.
 
 ---
 
@@ -399,13 +405,14 @@ want:
 ```bash
 crypttrace trace 0xADDRESS --asset usdt                   # USDT on Ethereum
 crypttrace trace TADDRESS  --chain tron --asset usdt      # USDT-TRC20 on Tron
+crypttrace trace UQADDRESS --chain ton  --asset usdt      # USDT on TON
 crypttrace tokens TADDRESS --chain tron
 ```
 
 Token contracts differ per chain, so the registry is chain-aware: `usdt` on Tron
 resolves to `TR7NHqje…jLj6t`, on Ethereum to `0xdac17f95…31ec7`. Known symbols
-are `usdt`, `usdc`, `dai`, `weth`, `wbtc` on EVM and `usdt`, `usdc` on
-Tron/Solana; you can also pass any contract address directly.
+are `usdt`, `usdc`, `dai`, `weth`, `wbtc` on EVM, `usdt`, `usdc` on
+Tron/Solana and `usdt` on TON; you can also pass any contract address directly.
 
 Matching is by **exact contract**, which matters: attackers routinely airdrop
 fake tokens named "USDT" to poison wallets, and those are ignored rather than
@@ -425,8 +432,8 @@ Add sources in `labels/labels.py` → `SOURCES`.
 
 On Bitcoin, Tron and Solana the labels cover the reserve wallets of Binance,
 OKX and HTX, plus Bybit's older 2022 list — each taken from the address list the
-exchange publishes itself for proof-of-reserves. That is what lets `offramp`
-flag deposit addresses on those chains. Funds sent to an exchange not on that
+exchange publishes itself for proof-of-reserves; on TON, Binance's reserve
+wallets. That is what lets `offramp` flag deposit addresses on those chains. Funds sent to an exchange not on that
 list still show as `unknown`. Every label records where it came from — see
 `crypttrace labels audit`.
 
@@ -527,6 +534,7 @@ src/crypttrace/
     bitcoin.py     # Bitcoin UTXO (mempool.space) + clustering
     tron.py        # Tron / TRC20 (TronGrid) + base58 conversion
     solana.py      # Solana JSON-RPC
+    ton.py         # TON + jettons (toncenter v3)
     http.py        # shared cache, throttling, 429 backoff
   labels/
     known.json     # curated label DB, one source per claim
@@ -555,10 +563,10 @@ cases/             # worked investigations with their data
 
 ## Roadmap
 
-- More exchanges on Bitcoin, Tron and Solana (now: Binance, OKX, HTX, Bybit),
+- More exchanges on Bitcoin, Tron, Solana (now: Binance, OKX, HTX, Bybit) and
+  TON (now: Binance),
   and refreshing these lists as the exchanges republish them
 - Internal transactions (completes `funder` and contract-mediated transfers)
-- Per-mint filtering for Solana SPL tokens
 - More label sources: Chainabuse, CryptoScamDB, exchange deposit-address sets
 - Spam/dust token filtering in `tokens`
 - Entity clustering on EVM via the gas-funding heuristic

{crypttrace-0.10.0 → crypttrace-0.12.0}/pyproject.toml

@@ -1,13 +1,13 @@
 [project]
 name = "crypttrace"
 dynamic = ["version"]
-description = "OSINT toolkit for crypto investigations: trace stolen funds across Ethereum, Bitcoin, Tron and Solana"
+description = "OSINT toolkit for crypto investigations: trace stolen funds across Ethereum, Bitcoin, Tron, Solana and TON"
 readme = "README.md"
 license = "MIT"
 license-files = ["LICENSE"]
 authors = [{ name = "bobslayerX" }]
 requires-python = ">=3.9"
-keywords = ["osint", "blockchain", "forensics", "cryptocurrency", "bitcoin", "ethereum", "tron", "solana", "investigation"]
+keywords = ["osint", "blockchain", "forensics", "cryptocurrency", "bitcoin", "ethereum", "tron", "solana", "ton", "investigation"]
 classifiers = [
     "Development Status :: 4 - Beta",
     "Environment :: Console",

{crypttrace-0.10.0 → crypttrace-0.12.0}/src/crypttrace/__init__.py

@@ -1,2 +1,2 @@
 """crypttrace — OSINT crypto investigation CLI."""
-__version__ = "0.10.0"
+__version__ = "0.12.0"

{crypttrace-0.10.0 → crypttrace-0.12.0}/src/crypttrace/addresses.py

@@ -123,9 +123,67 @@ def validate(address: str, chain: str) -> Tuple[bool, str]:
             return False, "does not decode to a 32-byte public key"
         return True, "valid 32-byte key (Solana addresses carry no checksum)"
 
+    if chain == "ton":
+        if ":" in a:
+            return (True, "valid raw TON address (the raw form carries no checksum)") \
+                if ton_parse(a) else (False, "raw TON addresses are workchain:64 hex characters")
+        if len(a) != 48:
+            return False, "TON addresses are 48 characters (EQ…/UQ…) or workchain:hex"
+        return (True, "TON checksum valid") if ton_parse(a) else \
+            (False, "checksum does not match — the address is mistyped or invented")
+
     return False, f"unknown chain '{chain}'"
 
 
+# ---------------------------------------------------------------- TON
+# One account, several spellings: raw "0:<64 hex>", and 48-character base64 forms
+# that are bounceable ("EQ…") or not ("UQ…"), each ending in a CRC16 of the rest.
+# Everything is compared in one canonical spelling: non-bounceable, url-safe —
+# the form wallets show, and so the one a poisoner imitates.
+
+def _crc16_xmodem(data: bytes) -> int:
+    crc = 0
+    for byte in data:
+        crc ^= byte << 8
+        for _ in range(8):
+            crc = ((crc << 1) ^ 0x1021) if crc & 0x8000 else crc << 1
+            crc &= 0xFFFF
+    return crc
+
+
+def ton_parse(address: str) -> Optional[Tuple[int, bytes]]:
+    """(workchain, 32-byte account id) from any TON spelling, or None."""
+    import base64
+    import re
+    a = (address or "").strip()
+    m = re.fullmatch(r"(-?\d+):([0-9a-fA-F]{64})", a)
+    if m:
+        return int(m.group(1)), bytes.fromhex(m.group(2))
+    if len(a) != 48:
+        return None
+    try:
+        raw = base64.b64decode(a.replace("-", "+").replace("_", "/"), validate=True)
+    except (ValueError, TypeError):
+        return None
+    if len(raw) != 36 or (raw[0] & 0x7F) not in (0x11, 0x51):
+        return None
+    if _crc16_xmodem(raw[:34]) != int.from_bytes(raw[34:], "big"):
+        return None
+    wc = raw[1] - 256 if raw[1] > 127 else raw[1]
+    return wc, raw[2:34]
+
+
+def ton_friendly(address: str, bounceable: bool = False) -> Optional[str]:
+    """The canonical 48-character spelling (non-bounceable "UQ…" by default)."""
+    import base64
+    p = ton_parse(address)
+    if not p:
+        return None
+    wc, account = p
+    body = bytes([0x11 if bounceable else 0x51, wc & 0xFF]) + account
+    return base64.urlsafe_b64encode(body + _crc16_xmodem(body).to_bytes(2, "big")).decode()
+
+
 def looks_like_txid(value: str) -> bool:
     """64 hex characters — a transaction id, which people paste in by mistake."""
     v = (value or "").strip()

{crypttrace-0.10.0 → crypttrace-0.12.0}/src/crypttrace/analysis.py

@@ -24,7 +24,7 @@ from crypttrace.labels import labels
 # drowns out the transfers an investigation is actually about.
 DUST = {"btc": 0.0005, "eth": 0.002, "bsc": 0.005, "polygon": 5.0,
         "arbitrum": 0.002, "optimism": 0.002, "base": 0.002,
-        "tron": 5.0, "sol": 0.01}
+        "tron": 5.0, "sol": 0.01, "ton": 0.01}
 
 
 def dust_threshold(chain: str, asset: Optional[dict] = None) -> float:

{crypttrace-0.10.0 → crypttrace-0.12.0}/src/crypttrace/assets.py

@@ -23,6 +23,10 @@ TOKENS: Dict[str, Dict[str, dict]] = {
         "usdt": {"contract": "TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t", "symbol": "USDT", "stable": True},
         "usdc": {"contract": "TEkxiTehnzSmSe2XqrBj4w32RUN966rdz8", "symbol": "USDC", "stable": True},
     },
+    "ton": {
+        "usdt": {"contract": "0:b113a994b5024a16719f69139328eb759596c38a25f59028b146fecdc3621dfe",
+                 "symbol": "USDT", "stable": True, "decimals": 6},
+    },
     "sol": {
         "usdc": {"contract": "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v", "symbol": "USDC", "stable": True},
         "usdt": {"contract": "Es9vMFrzaCERmJfrF4H2FYD4KCoNkY11McCe8BenwNYB", "symbol": "USDT", "stable": True},
@@ -45,7 +49,7 @@ def resolve_asset(asset: Optional[str], chain: str = "eth") -> Optional[dict]:
     Accepts 'eth'/'native'/None, a known symbol on that chain, or a raw contract
     address (0x… on EVM, base58 on Tron/Solana).
     """
-    if asset is None or asset.lower() in ("eth", "native", "btc", "trx", "sol", "bnb", "matic"):
+    if asset is None or asset.lower() in ("eth", "native", "btc", "trx", "sol", "bnb", "matic", "ton"):
         return None
 
     a = asset.lower()
@@ -54,7 +58,12 @@ def resolve_asset(asset: Optional[str], chain: str = "eth") -> Optional[dict]:
         return dict(known[a])
 
     # raw contract address
-    if chain in ("tron", "sol"):
+    if chain == "ton":                      # a jetton master, in any spelling -> raw
+        from crypttrace import addresses
+        p = addresses.ton_parse(asset)
+        if p:
+            return {"contract": f"{p[0]}:{p[1].hex()}", "symbol": "JETTON", "stable": False}
+    elif chain in ("tron", "sol"):
         if len(asset) >= 32 and not asset.startswith("0x"):
             return {"contract": asset, "symbol": asset[:6].upper(), "stable": False}
     elif a.startswith("0x") and len(a) == 42:

{crypttrace-0.10.0 → crypttrace-0.12.0}/src/crypttrace/chains.py

@@ -13,21 +13,22 @@ would be meaningless, so a caller always asks for one asset at a time.
 from typing import List, Dict, Optional
 
 from crypttrace import config
-from crypttrace.fetchers import etherscan, bitcoin, tron, solana
+from crypttrace import addresses as _addresses
+from crypttrace.fetchers import etherscan, bitcoin, http as _http, tron, solana, ton
 
 EVM_CHAINS = set(config.CHAINS)
-NON_EVM = {"btc", "tron", "sol"}
+NON_EVM = {"btc", "tron", "sol", "ton"}
 ALL_CHAINS = sorted(EVM_CHAINS | NON_EVM)
 
 SYMBOL = {"eth": "ETH", "bsc": "BNB", "polygon": "MATIC", "arbitrum": "ETH",
-          "optimism": "ETH", "base": "ETH", "btc": "BTC", "tron": "TRX", "sol": "SOL"}
+          "optimism": "ETH", "base": "ETH", "btc": "BTC", "tron": "TRX", "sol": "SOL", "ton": "TON"}
 
 EXPLORER = {
     "eth": "https://etherscan.io/address/{}", "bsc": "https://bscscan.com/address/{}",
     "polygon": "https://polygonscan.com/address/{}", "arbitrum": "https://arbiscan.io/address/{}",
     "optimism": "https://optimistic.etherscan.io/address/{}", "base": "https://basescan.org/address/{}",
     "btc": "https://mempool.space/address/{}", "tron": "https://tronscan.org/#/address/{}",
-    "sol": "https://solscan.io/account/{}",
+    "sol": "https://solscan.io/account/{}", "ton": "https://tonviewer.com/{}",
 }
 
 TX_EXPLORER = {
@@ -35,11 +36,11 @@ TX_EXPLORER = {
     "polygon": "https://polygonscan.com/tx/{}", "arbitrum": "https://arbiscan.io/tx/{}",
     "optimism": "https://optimistic.etherscan.io/tx/{}", "base": "https://basescan.org/tx/{}",
     "btc": "https://mempool.space/tx/{}", "tron": "https://tronscan.org/#/transaction/{}",
-    "sol": "https://solscan.io/tx/{}",
+    "sol": "https://solscan.io/tx/{}", "ton": "https://tonviewer.com/transaction/{}",
 }
 
 _UPSTREAM_ERRORS = (etherscan.EtherscanError, bitcoin.BitcoinError,
-                    tron.TronError, solana.SolanaError)
+                    tron.TronError, solana.SolanaError, ton.TonError)
 
 
 class ChainError(RuntimeError):
@@ -56,6 +57,8 @@ def case_sensitive(chain: str) -> bool:
 
 
 def norm_addr(address: str, chain: str) -> str:
+    if chain == "ton":        # one account, several spellings: compare the one wallets show
+        return _addresses.ton_friendly(address) or address
     return address if case_sensitive(chain) else address.lower()
 
 
@@ -87,6 +90,8 @@ def balance(address: str, chain: str = "eth") -> float:
             return tron.balance(address)
         if chain == "sol":
             return solana.balance(address)
+        if chain == "ton":
+            return ton.balance(address)
     except _UPSTREAM_ERRORS as e:
         raise ChainError(str(e))
     return 0.0
@@ -138,9 +143,8 @@ def _sol_rows(address: str, limit: int, token: bool, contract: Optional[str]) ->
     rows = solana.transfers(address, limit)
     if token:
         rows = [r for r in rows if r.get("symbol") != "SOL"]
-        if contract:
-            rows = [r for r in rows if r.get("mint") in (None, contract)
-                    or (r.get("contract") or "") == contract]
+        if contract:                      # SPL rows carry their mint as the contract
+            rows = [r for r in rows if (r.get("contract") or "") == contract]
     else:
         rows = [r for r in rows if r.get("symbol") == "SOL"]
     return rows
@@ -160,15 +164,15 @@ def transfers(address: str, chain: str = "eth", limit: int = 1000,
     repeat analysis costs nothing and works offline.
     """
     check(chain)
+    if chain == "ton":
+        address = norm_addr(address, chain)   # one spelling for store keys and matching
     contract = asset.get("contract") if asset else None
 
     from crypttrace import store
     # What the stored rows are filed under: "" native, a contract, "*" every
-    # token, or "spl" on Solana, whose token rows carry no mint to tell apart.
+    # token (Solana token rows carry their mint as the contract).
     if not asset:
         asset_key = ""
-    elif chain == "sol":
-        asset_key = "spl"
     else:
         asset_key = (contract or "*").lower()
     skip_read = fresh or FORCE_FRESH
@@ -184,6 +188,9 @@ def transfers(address: str, chain: str = "eth", limit: int = 1000,
         # nothing stored for this address and we're not allowed to fetch
         return []
 
+    # asked for fresh data: skip the HTTP-level caches too, not just the store
+    was_fresh = _http.FRESH
+    _http.FRESH = was_fresh or fresh or FORCE_FRESH
     try:
         if is_evm(chain):
             rows = _evm_token(address, chain, contract, limit) if asset \
@@ -198,10 +205,16 @@ def transfers(address: str, chain: str = "eth", limit: int = 1000,
                 else tron.transfers(address, limit)
         elif chain == "sol":
             rows = _sol_rows(address, limit, bool(asset), contract)
+        elif chain == "ton":
+            rows = ton.transfers(address, limit) if not asset else [
+                r for r in ton.jetton_transfers(address, limit)
+                if not contract or r["contract"] == contract.lower()]
         else:
             rows = []
     except _UPSTREAM_ERRORS as e:
         raise ChainError(str(e))
+    finally:
+        _http.FRESH = was_fresh
 
     if USE_STORE:
         try:
@@ -255,6 +268,8 @@ def token_holdings(address: str, chain: str = "eth", limit: int = 1000) -> List[
             rows = _evm_token(address, chain, None, limit)
         elif chain == "tron":
             rows = _tron_token(address, None, limit)
+        elif chain == "ton":
+            rows = ton.jetton_transfers(address, limit)
         else:
             rows = _sol_rows(address, limit, True, None)
     except _UPSTREAM_ERRORS as e:

{crypttrace-0.10.0 → crypttrace-0.12.0}/src/crypttrace/cli.py

@@ -390,7 +390,7 @@ def funder(
     except etherscan.EtherscanError as e:
         console.print(f"[red]Error:[/red] {e}")
         raise typer.Exit(1)
-    console.print(render.funding_tree(address, chain_hops))
+    console.print(render.funding_tree(address, chain_hops, chains_mod.symbol(chain)))
     if chain_hops and chain_hops[-1]["terminal"] and chain_hops[-1]["funder_type"] == "exchange":
         console.print("\n[green]➜ Funding chain reaches an exchange — a KYC identification "
                       "point. A legal request to that exchange can reveal the owner.[/green]")
@@ -804,6 +804,7 @@ def chains():
     console.print("  btc        Bitcoin — mempool.space (UTXO)")
     console.print("  tron       Tron — TronGrid (TRX + USDT-TRC20)")
     console.print("  sol        Solana — public JSON-RPC")
+    console.print("  ton        TON — toncenter (TON + jettons such as USDT)")
 
 
 @app.command()

{crypttrace-0.10.0 → crypttrace-0.12.0}/src/crypttrace/fetchers/etherscan.py

@@ -64,7 +64,8 @@ def _call(chain: str, params: Dict[str, str], cache_age: int = 3600) -> dict:
         **params,
     }
     key = f"{chain}:" + "&".join(f"{k}={v}" for k, v in sorted(q.items()) if k != "apikey")
-    cached = _cache_get(key, cache_age)
+    from crypttrace.fetchers import http
+    cached = None if http.FRESH else _cache_get(key, cache_age)
     if cached is not None:
         return cached
 

{crypttrace-0.10.0 → crypttrace-0.12.0}/src/crypttrace/fetchers/http.py

@@ -31,6 +31,10 @@ DEFAULT_INTERVAL = 0.25
 _last_call = {}
 _lock = threading.Lock()
 
+# Set while a caller needs what the chain says *now* (watch, --fresh): cached
+# responses are skipped, though fresh ones are still stored.
+FRESH = False
+
 
 class RateLimited(RuntimeError):
     pass
@@ -86,7 +90,7 @@ def request_json(url: str, params: dict = None, *, body: dict = None,
                  timeout: int = 30, headers: dict = None):
     """GET (or POST when `body` is given) returning JSON, cached and rate-limited."""
     key = cache_key or (url + ("?" + urlencode(sorted(params.items())) if params else ""))
-    hit = cache_get(key, ttl)
+    hit = None if FRESH else cache_get(key, ttl)
     if hit is not None:
         return hit
 

{crypttrace-0.10.0 → crypttrace-0.12.0}/src/crypttrace/fetchers/solana.py

@@ -10,10 +10,15 @@ from typing import List, Dict
 
 import requests
 
+from crypttrace import assets
+
 RPC = os.environ.get("CRYPTTRACE_SOLANA_RPC", "https://api.mainnet-beta.solana.com")
 LAMPORTS = 1_000_000_000
 MAX_TXS = 25  # keep the number of RPC round-trips sane
 
+# mint -> symbol for the tokens crypttrace knows; others show as "SPL"
+_KNOWN_MINTS = {t["contract"]: t["symbol"] for t in assets.tokens_for("sol").values()}
+
 
 class SolanaError(RuntimeError):
     pass
@@ -59,10 +64,26 @@ def _parse_tx(sig: str) -> List[Dict]:
         return []
     ts = int(tx.get("blockTime") or 0)
     rows = []
+    meta = tx.get("meta") or {}
     msg = (tx.get("transaction") or {}).get("message") or {}
     instrs = list(msg.get("instructions") or [])
-    for inner in (tx.get("meta") or {}).get("innerInstructions") or []:
+    for inner in meta.get("innerInstructions") or []:
         instrs.extend(inner.get("instructions") or [])
+
+    # An SPL transfer names token *accounts*, not wallets. The token balances in
+    # the transaction's metadata say which wallet owns each account, which mint
+    # it holds and how many decimals that mint has.
+    keys = [k.get("pubkey") if isinstance(k, dict) else k for k in msg.get("accountKeys") or []]
+    loaded = meta.get("loadedAddresses") or {}
+    if not any(isinstance(k, dict) and k.get("source") == "lookupTable"
+               for k in msg.get("accountKeys") or []):
+        keys += list(loaded.get("writable") or []) + list(loaded.get("readonly") or [])
+    accounts = {}
+    for b in (meta.get("preTokenBalances") or []) + (meta.get("postTokenBalances") or []):
+        i = b.get("accountIndex")
+        if isinstance(i, int) and i < len(keys):
+            accounts[keys[i]] = {"owner": b.get("owner") or "", "mint": b.get("mint") or "",
+                                 "decimals": (b.get("uiTokenAmount") or {}).get("decimals")}
     for ins in instrs:
         parsed = ins.get("parsed")
         if not isinstance(parsed, dict):
@@ -75,15 +96,27 @@ def _parse_tx(sig: str) -> List[Dict]:
                          "value": (info.get("lamports") or 0) / LAMPORTS,
                          "timestamp": ts, "hash": sig, "symbol": "SOL"})
         elif prog == "spl-token" and ptype in ("transfer", "transferChecked"):
+            src = accounts.get(info.get("source", ""), {})
+            dst = accounts.get(info.get("destination", ""), {})
+            mint = info.get("mint") or src.get("mint") or dst.get("mint") or ""
+            decimals = src.get("decimals") if src.get("decimals") is not None else dst.get("decimals")
             amt = info.get("tokenAmount") or {}
             try:
-                val = float(amt.get("uiAmountString") or amt.get("uiAmount") or info.get("amount") or 0)
+                if amt.get("uiAmountString") or amt.get("uiAmount") is not None:
+                    val = float(amt.get("uiAmountString") or amt.get("uiAmount") or 0)
+                elif decimals is not None:        # plain "transfer" gives raw base units
+                    val = int(info.get("amount") or 0) / (10 ** int(decimals))
+                else:
+                    continue                      # no way to know the unit: don't guess
             except (TypeError, ValueError):
-                val = 0.0
-            rows.append({"from": info.get("source", "") or info.get("authority", ""),
-                         "to": info.get("destination", ""), "value": val,
-                         "timestamp": ts, "hash": sig, "symbol": "SPL",
-                         "contract": "spl"})   # keeps token rows apart from SOL in the store
+                continue
+            rows.append({
+                # the wallets behind the token accounts; the account itself if unknown
+                "from": src.get("owner") or info.get("authority") or info.get("source", ""),
+                "to": dst.get("owner") or info.get("destination", ""),
+                "value": val, "timestamp": ts, "hash": sig,
+                "symbol": _KNOWN_MINTS.get(mint, "SPL"),
+                "contract": mint or "spl"})       # the mint; keeps token rows apart from SOL
     return rows
 
 

crypttrace-0.12.0/src/crypttrace/fetchers/ton.py

@@ -0,0 +1,136 @@
+"""TON fetcher via toncenter's v3 indexer — no API key required for basic use.
+
+TON matters for the same reason Tron does: USDT on TON is cheap to move and is
+built into Telegram's wallet, so scams that start in a Telegram chat end here.
+
+Every address comes back from the indexer in the raw "0:<hex>" form and is
+rewritten into the canonical "UQ…" spelling (see addresses.ton_friendly), so it
+matches what wallets show, the labels, and what a victim pastes. Jetton
+transfers (USDT and friends) are reported between the owners' wallets, not the
+per-owner jetton-wallet contracts that actually hold the tokens.
+
+The keyless endpoint allows about one request per second; set TONCENTER_API_KEY
+for more.
+"""
+import base64
+import os
+from typing import Dict, List, Optional
+
+import requests
+
+from crypttrace import addresses, assets
+from crypttrace.fetchers import http
+
+BASE = "https://toncenter.com/api/v3"
+NANO = 1_000_000_000
+# page sizes toncenter accepts (checked live): fewer pages matter at ~1 request/second
+TX_PAGE, JETTON_PAGE = 500, 1000
+_KEY = os.environ.get("TONCENTER_API_KEY")
+http.MIN_INTERVAL["toncenter.com"] = 0.12 if _KEY else 1.1
+
+# jetton master (raw, lower-case) -> decimals, starting with the ones we know
+_DECIMALS: Dict[str, int] = {t["contract"]: t.get("decimals", 9)
+                             for t in assets.tokens_for("ton").values()}
+_SYMBOLS: Dict[str, str] = {t["contract"]: t["symbol"] for t in assets.tokens_for("ton").values()}
+
+
+class TonError(RuntimeError):
+    pass
+
+
+def _get(path: str, params: Optional[dict] = None, timeout: int = 30) -> dict:
+    headers = {"X-API-Key": _KEY} if _KEY else None
+    try:
+        data = http.request_json(f"{BASE}{path}", params or {}, timeout=timeout, headers=headers)
+    except http.RateLimited as e:
+        raise TonError(str(e) + " (tip: set TONCENTER_API_KEY for a higher limit)")
+    except requests.RequestException as e:
+        raise TonError(f"toncenter request failed: {e}")
+    except ValueError as e:
+        raise TonError(f"bad response from toncenter: {e}")
+    if isinstance(data, dict) and "__status__" in data:
+        raise TonError(f"toncenter answered HTTP {data['__status__']}")
+    return data if isinstance(data, dict) else {}
+
+
+def _pages(path: str, key: str, params: dict, limit: int, page: int) -> List[dict]:
+    items: List[dict] = []
+    offset = 0
+    while len(items) < limit:
+        n = min(page, limit - len(items))
+        batch = _get(path, dict(params, limit=n, offset=offset, sort="desc")).get(key) or []
+        items += batch
+        if len(batch) < n:
+            break
+        offset += n
+    return items
+
+
+def _addr(raw: Optional[str]) -> str:
+    return addresses.ton_friendly(raw or "") or (raw or "")
+
+
+def _hex(tx_hash: str) -> str:
+    """toncenter gives base64 hashes; explorers link by hex."""
+    try:
+        return base64.b64decode(tx_hash).hex()
+    except (ValueError, TypeError):
+        return tx_hash or ""
+
+
+def balance(address: str) -> float:
+    d = _get("/account", {"address": address})
+    return int(d.get("balance") or 0) / NANO
+
+
+def transfers(address: str, limit: int = 1000) -> List[Dict]:
+    """TON moved in and out of `address`: its incoming message and outgoing ones."""
+    me = _addr(address)
+    rows = []
+    for tx in _pages("/transactions", "transactions", {"account": address}, limit, TX_PAGE):
+        ts, h = int(tx.get("now") or 0), _hex(tx.get("hash", ""))
+        msgs = [tx.get("in_msg") or {}] + list(tx.get("out_msgs") or [])
+        for m in msgs:
+            src, dst = m.get("source"), m.get("destination")
+            value = int(m.get("value") or 0) / NANO
+            if not src or not dst or value <= 0:    # external messages carry no value
+                continue
+            src, dst = _addr(src), _addr(dst)
+            if me not in (src, dst):
+                continue
+            rows.append({"from": src, "to": dst, "value": value, "timestamp": ts,
+                         "hash": h, "symbol": "TON"})
+    return rows
+
+
+def _decimals(master: str) -> Optional[int]:
+    if master not in _DECIMALS:
+        try:
+            m = (_get("/jetton/masters", {"address": master, "limit": 1}).get("jetton_masters")
+                 or [{}])[0]
+            content = m.get("jetton_content") or {}
+            _DECIMALS[master] = int(content.get("decimals") or 9)   # TEP-64 default is 9
+        except (TonError, ValueError, TypeError):
+            return None
+    return _DECIMALS[master]
+
+
+def jetton_transfers(address: str, limit: int = 1000) -> List[Dict]:
+    """Jetton (token) transfers to and from `address`, between owner wallets."""
+    rows = []
+    for t in _pages("/jetton/transfers", "jetton_transfers", {"owner_address": address}, limit, JETTON_PAGE):
+        if t.get("aborted"):
+            continue
+        master = (t.get("jetton_master") or "").lower()
+        dec = _decimals(master)
+        if dec is None:
+            continue                                # unknown unit: don't guess
+        try:
+            value = int(t.get("amount") or 0) / (10 ** dec)
+        except (ValueError, TypeError):
+            continue
+        rows.append({"from": _addr(t.get("source")), "to": _addr(t.get("destination")),
+                     "value": value, "timestamp": int(t.get("transaction_now") or 0),
+                     "hash": _hex(t.get("transaction_hash", "")),
+                     "symbol": _SYMBOLS.get(master, "JETTON"), "contract": master})
+    return rows

{crypttrace-0.10.0 → crypttrace-0.12.0}/src/crypttrace/funder.py

@@ -24,10 +24,13 @@ def first_funder(address: str, chain: str = "eth") -> Optional[dict]:
     Works on every supported chain. {funder, value, timestamp, hash} or None.
     """
     from crypttrace import chains
-    me = address if chain in ("btc", "tron", "sol") else address.lower()
+    me = chains.norm_addr(address, chain)
     rows = chains.transfers(address, chain, limit=200, oldest_first=True)
+    from crypttrace import analysis
+    dust = analysis.dust_threshold(chain)
     for r in rows:  # ascending => first match is the earliest funding
-        if r.get("to") != me or r.get("value", 0) <= 0:
+        # dust is not funding: it is what poisoners and spammers send everyone
+        if r.get("to") != me or r.get("value", 0) < max(dust, 1e-18):
             continue
         return {
             "funder": r.get("from", ""),
@@ -49,9 +52,11 @@ def funding_chain(address: str, chain: str = "eth", max_hops: int = 6) -> List[D
     Returns a list of hops, each {address, funder, value, timestamp, funder_type,
     funder_label, terminal}. Stops at a labelled entity, a dead end, or a cycle.
     """
+    from crypttrace import chains
     chain_hops: List[Dict] = []
-    seen = {address.lower()}
-    current = address.lower()
+    # lower-casing here broke every Bitcoin, Tron and Solana address
+    current = chains.norm_addr(address, chain)
+    seen = {current}
 
     for _ in range(max_hops):
         info = first_funder(current, chain)

{crypttrace-0.10.0 → crypttrace-0.12.0}/src/crypttrace/labels/audit.py

@@ -39,6 +39,8 @@ def _chain_of(address: str) -> str:
         return "btc"
     if a.startswith("T") and len(a) == 34:
         return "tron"
+    if len(a) == 48 or ":" in a:
+        return "ton"
     return "sol"
 
 

{crypttrace-0.10.0 → crypttrace-0.12.0}/src/crypttrace/labels/bulk.py

@@ -32,7 +32,7 @@ _OKX_FILE = re.compile(r"https://static\.okx\.com/cdn/okx/por/chain/por_csv_(\d{
 # OKX network name -> crypttrace chain (only the chains crypttrace can trace)
 OKX_NETWORKS = {"BTC": "btc", "TRON": "tron", "SOL": "sol", "ETH": "eth", "BSC": "bsc",
                 "POLYGON": "polygon", "ARBITRUM": "arbitrum", "OPTIMISM": "optimism",
-                "BASE": "base"}
+                "BASE": "base", "TON": "ton"}
 
 _conn: Optional[sqlite3.Connection] = None
 
@@ -148,6 +148,8 @@ def import_okx(source: Optional[str] = None,
             chain = OKX_NETWORKS.get(network)
             if not chain:
                 continue
+            if chain == "ton":          # one spelling per account, the one wallets show
+                addr = addresses.ton_friendly(addr) or addr
             key = addr.lower()
             if key in rows:
                 continue

{crypttrace-0.10.0 → crypttrace-0.12.0}/src/crypttrace/labels/known.json

@@ -280,5 +280,9 @@
   "bc1q9w4g79ndel72lygvwtqzem67z6uqv4yncvqjz3yn8my9swnwflxsutg4cx": {"name": "Bybit (2022 reserve list)", "type": "exchange", "chain": "btc", "source": "Bybit proof-of-reserves address list, Dec 2022 (static.bycustody.com/download/app/bybit_por_202212.csv, linked from Bybit's help center); may since be retired", "source_kind": "self-published", "added": "2026-09-23"},
   "bc1qjysjfd9t9aspttpjqzv68k0ydpe7pvyd5vlyn37868473lell5tqkz456m": {"name": "Bybit (2022 reserve list)", "type": "exchange", "chain": "btc", "source": "Bybit proof-of-reserves address list, Dec 2022 (static.bycustody.com/download/app/bybit_por_202212.csv, linked from Bybit's help center); may since be retired", "source_kind": "self-published", "added": "2026-09-23"},
   "1GrwDkr33gT6LuumniYjKEGjTLhsL5kmqC": {"name": "Bybit (2022 reserve list)", "type": "exchange", "chain": "btc", "source": "Bybit proof-of-reserves address list, Dec 2022 (static.bycustody.com/download/app/bybit_por_202212.csv, linked from Bybit's help center); may since be retired", "source_kind": "self-published", "added": "2026-09-23"},
-  "bc1q2qqqt87kh33s0er58akh7v9cwjgd83z5smh9rp": {"name": "Bybit (2022 reserve list)", "type": "exchange", "chain": "btc", "source": "Bybit proof-of-reserves address list, Dec 2022 (static.bycustody.com/download/app/bybit_por_202212.csv, linked from Bybit's help center); may since be retired", "source_kind": "self-published", "added": "2026-09-23"}
+  "bc1q2qqqt87kh33s0er58akh7v9cwjgd83z5smh9rp": {"name": "Bybit (2022 reserve list)", "type": "exchange", "chain": "btc", "source": "Bybit proof-of-reserves address list, Dec 2022 (static.bycustody.com/download/app/bybit_por_202212.csv, linked from Bybit's help center); may since be retired", "source_kind": "self-published", "added": "2026-09-23"},
+
+  "UQAdCl0uTEHMLzvmsD6o69FXjxbNavwaP7pPAGMLCRf9aEbe": {"name": "Binance reserve wallet (custodied by Ceffu)", "type": "exchange", "chain": "ton", "source": "Binance proof-of-reserves address list (binance.com/bapi/apex/v1/public/apex/market/por/address), fetched 2026-09-23; listed since 2026-08-24", "source_kind": "self-published", "added": "2026-09-29"},
+  "UQD4uGNdB4a3f52mYOZf0x1nCmdd1DAvrLppL0a1cetTYCQx": {"name": "Binance reserve wallet", "type": "exchange", "chain": "ton", "source": "Binance proof-of-reserves address list (binance.com/bapi/apex/v1/public/apex/market/por/address), fetched 2026-09-23; listed since 2025-10-15", "source_kind": "self-published", "added": "2026-09-29"},
+  "UQDKHZ7e70CzqdvZCC83Z4WVR8POC_ZB0J1Y4zo88G-zCSRH": {"name": "Binance reserve wallet", "type": "exchange", "chain": "ton", "source": "Binance proof-of-reserves address list (binance.com/bapi/apex/v1/public/apex/market/por/address), fetched 2026-09-23; listed since 2025-10-15", "source_kind": "self-published", "added": "2026-09-29"}
 }

{crypttrace-0.10.0 → crypttrace-0.12.0}/src/crypttrace/labels/labels.py

@@ -177,6 +177,8 @@ TYPE_ICON = {
 
 def lookup(address: str) -> Optional[dict]:
     _load()
+    if len(address) == 48 or ":" in address:          # TON, in whatever spelling
+        address = addresses.ton_friendly(address) or address
     hit = _KNOWN.get(address.lower())
     if hit:
         return hit

{crypttrace-0.10.0 → crypttrace-0.12.0}/src/crypttrace/offramp.py

@@ -18,7 +18,7 @@ from crypttrace.labels import labels
 
 # Where thefts mostly move as stablecoins, a deposit address sweeps those rather
 # than the native coin (on Tron it may never send TRX at all).
-STABLECOIN_CHAINS = {"tron": ("usdt", "usdc"), "sol": ("usdc", "usdt")}
+STABLECOIN_CHAINS = {"tron": ("usdt", "usdc"), "sol": ("usdc", "usdt"), "ton": ("usdt",)}
 
 
 def _one(address: str, chain: str, threshold: float, asset: Optional[dict]) -> Optional[dict]:
@@ -66,6 +66,10 @@ def detect(address: str, chain: str = "eth", threshold: float = 0.6,
     exchange wallets, otherwise None. Checks `asset` if given; otherwise the
     native coin and, on Tron and Solana, their stablecoins.
     """
+    # an exchange's own labelled wallet moving funds between its wallets is not
+    # a customer's deposit address
+    if labels.type_of(address) == "exchange" and not labels.is_deposit(address):
+        return None
     tries: List[Optional[dict]] = [asset]
     if asset is None and stablecoins:
         tries += [assets.resolve_asset(s, chain) for s in STABLECOIN_CHAINS.get(chain, ())]

{crypttrace-0.10.0 → crypttrace-0.12.0}/src/crypttrace/poisoning.py

@@ -24,6 +24,7 @@ from collections import defaultdict
 from typing import Dict, List, Optional, Tuple
 
 from crypttrace import analysis, assets, chains
+from crypttrace.labels import labels
 
 # How closely two addresses must match at the ends (after "0x", "T", "bc1q"…).
 # Strong: rare by chance, flagged on resemblance alone. Weak: the cheap
@@ -40,6 +41,8 @@ SUFFIX_BITS = 32
 def _suffix_chars(address: str, chain: str) -> int:
     if chains.is_evm(chain):
         bits = 4.0                                  # hex
+    elif chain == "ton":
+        bits = 6.0                                  # base64
     elif address.lower().startswith(("bc1", "tb1")):
         bits = 5.0                                  # bech32
     else:
@@ -53,6 +56,8 @@ _ALL_TOKENS = {"contract": None, "symbol": "*"}
 
 def _body(address: str, chain: str) -> str:
     """The part of an address that varies — what a shortened display shows."""
+    if chain == "ton":
+        return chains.norm_addr(address, chain)[2:]     # drop the "UQ" flag bytes
     a = address if chains.case_sensitive(chain) else address.lower()
     for p in ("0x", "bc1q", "bc1p", "bc1", "tb1q", "T"):
         if a.startswith(p) and (p != "T" or chain == "tron"):
@@ -216,6 +221,8 @@ def baited_payments(address: str, chain: str, limit: int = 1000,
     pattern into a specific claim.
     """
     me = chains.norm_addr(address, chain)
+    if labels.type_of(me) == "exchange" and not labels.is_deposit(me):
+        return []                         # an exchange paying its own wallets lures no one
     rows = _history(address, chain, limit)
     first_active = min((int(r.get("timestamp") or 0) for r in rows if r.get("timestamp")), default=0)
     lure: Dict[str, dict] = {}           # counterparty -> earliest lure

{crypttrace-0.10.0 → crypttrace-0.12.0}/src/crypttrace/prices.py

@@ -14,10 +14,10 @@ _STABLE = {"usdt", "usdc", "dai", "busd", "tusd", "usdp", "gusd", "frax", "lusd"
 # CoinGecko platform id per chain
 _PLATFORM = {"eth": "ethereum", "bsc": "binance-smart-chain", "polygon": "polygon-pos",
              "arbitrum": "arbitrum-one", "optimism": "optimistic-ethereum", "base": "base",
-             "tron": "tron", "sol": "solana"}
+             "tron": "tron", "sol": "solana", "ton": "the-open-network"}
 _COINGECKO_NATIVE = {"eth": "ethereum", "bsc": "binancecoin", "polygon": "matic-network",
                      "arbitrum": "ethereum", "optimism": "ethereum", "base": "ethereum",
-                     "btc": "bitcoin", "tron": "tron", "sol": "solana"}
+                     "btc": "bitcoin", "tron": "tron", "sol": "solana", "ton": "the-open-network"}
 
 _cache: Dict[str, Optional[float]] = {}
 

{crypttrace-0.10.0 → crypttrace-0.12.0}/src/crypttrace/render.py

@@ -105,7 +105,8 @@ def profile_rows_table(address: str, chain: str, balance: float, rows: list,
 
 def counterparties_rows_table(address: str, chain: str, rows: list, top: int = 10) -> Table:
     """Counterparties from normalized rows (works on every chain)."""
-    me = address if chain in ("btc", "tron", "sol") else address.lower()
+    from crypttrace import chains
+    me = chains.norm_addr(address, chain)
     agg = {}
     for r in rows:
         frm, to = r.get("from", ""), r.get("to", "")
@@ -200,7 +201,7 @@ def crosschain_tree(address: str, chain: str, results: list) -> Tree:
     return root
 
 
-def funding_tree(address: str, hops: list) -> Tree:
+def funding_tree(address: str, hops: list, symbol: str = "ETH") -> Tree:
     """Render a backward funding chain: target ← funder ← funder …"""
     root = Tree(addr_label(address))
     if not hops:
@@ -210,7 +211,7 @@ def funding_tree(address: str, hops: list) -> Tree:
     node = root
     for h in hops:
         when = _ts(h["timestamp"])
-        edge = Text(f"◀── funded by {h['value']:.4f} ETH  ({when})  ")
+        edge = Text(f"◀── funded by {h['value']:.4f} {symbol}  ({when})  ")
         node = node.add(Text.assemble(edge, addr_label(h["funder"])))
         if h["terminal"]:
             kind = h["funder_type"]

{crypttrace-0.10.0 → crypttrace-0.12.0}/src/crypttrace/report.py

@@ -29,7 +29,8 @@ from crypttrace import freeze as freeze_mod
 from crypttrace import trace as trace_mod
 from crypttrace.labels import labels
 
-SOURCES = {"btc": "mempool.space", "tron": "TronGrid", "sol": "Solana JSON-RPC"}
+SOURCES = {"btc": "mempool.space", "tron": "TronGrid", "sol": "Solana JSON-RPC",
+           "ton": "toncenter"}
 
 
 def _now() -> str:

{crypttrace-0.10.0 → crypttrace-0.12.0}/src/crypttrace/store.py

@@ -118,8 +118,10 @@ def load(chain: str, address: str, contract: str = "", native_symbol: str = "")
     try:
         if contract == "*":
             # every token, whatever its contract (address-poisoning checks need fakes too)
+            # (Solana rows filed as "spl" by 0.5-0.10 name token accounts, not wallets)
             q = (f"{cols} WHERE chain=? AND (from_addr=? OR to_addr=?)"
-                 " AND contract IS NOT NULL AND contract!='' ORDER BY ts DESC")
+                 " AND contract IS NOT NULL AND contract!='' AND contract!='spl'"
+                 " ORDER BY ts DESC")
             args = (chain, address, address)
         elif contract:
             q = (f"{cols} WHERE chain=? AND (from_addr=? OR to_addr=?)"

{crypttrace-0.10.0 → crypttrace-0.12.0}/src/crypttrace/trace.py

@@ -119,7 +119,7 @@ def build_graph(address, chain, depth, branching, asset=None, direction="out"):
     # Bitcoin / Tron / Solana addresses are case-sensitive (base58); only EVM
     # addresses may be normalized to lowercase.
     from crypttrace import chains as _c
-    _norm = (lambda a: a.lower()) if _c.is_evm(chain) else (lambda a: a)
+    _norm = lambda a: _c.norm_addr(a, chain)
 
     nodes = {}
     edges = []

{crypttrace-0.10.0 → crypttrace-0.12.0}/src/crypttrace/watch.py

@@ -43,7 +43,6 @@ def _save(d: Dict[str, dict]) -> None:
 
 
 _ALL_TOKENS = {"contract": None, "symbol": "*"}
-_SPL = {"contract": "spl", "symbol": "SPL"}
 
 
 def _key(row: dict) -> str:
@@ -62,8 +61,6 @@ def _rows(address: str, chain: str, limit: int) -> List[dict]:
         tokens = chains.transfers(address, chain, limit, asset=_ALL_TOKENS, fresh=True)
     except chains.ChainError:
         return rows              # the native history alone still gets watched
-    if chain == "sol":           # Solana token rows carry no mint to tell tokens apart
-        return rows + [{**r, "_asset": _SPL} for r in tokens]
     stables = {t["contract"].lower(): dict(t) for t in assets.tokens_for(chain).values()
                if t.get("stable")}
     return rows + [{**r, "_asset": stables[(r.get("contract") or "").lower()]}

{crypttrace-0.10.0 → crypttrace-0.12.0}/src/crypttrace/web/index.html

@@ -216,7 +216,7 @@
     <option value="eth">eth</option><option value="bsc">bsc</option>
     <option value="polygon">polygon</option><option value="arbitrum">arbitrum</option>
     <option value="optimism">optimism</option><option value="base">base</option>
-    <option value="btc">btc</option><option value="tron">tron</option><option value="sol">sol</option>
+    <option value="btc">btc</option><option value="tron">tron</option><option value="sol">sol</option><option value="ton">ton</option>
   </select>
   <select id="asset" title="Asset to trace">
     <option value="native">ETH (native)</option>
@@ -281,7 +281,8 @@ const EXPLORER={eth:'https://etherscan.io',bsc:'https://bscscan.com',polygon:'ht
   arbitrum:'https://arbiscan.io',optimism:'https://optimistic.etherscan.io',base:'https://basescan.org'};
 const NON_EVM={btc:a=>`https://mempool.space/address/${a}`,
                tron:a=>`https://tronscan.org/#/address/${a}`,
-               sol:a=>`https://solscan.io/account/${a}`};
+               sol:a=>`https://solscan.io/account/${a}`,
+               ton:a=>`https://tonviewer.com/${a}`};
 const $=s=>document.querySelector(s);
 let network=null, lastGraph=null, rootId=null;
 const MIN_SCALE=0.42;   // below this, nodes/labels become unreadable dots
@@ -483,7 +484,7 @@ async function run(){
     const g=await api(`/api/trace?address=${q(a)}&chain=${chain()}&depth=${$('#depth').value}&asset=${q($('#asset').value)}&direction=${dir}`);
     loader(80); renderGraph(g);
     setStatus(`${g.nodes.length} addresses · ${g.edges.length} transfers`);
-    // BTC/Tron/Solana addresses are case-sensitive — never lowercase them
+    // BTC/Tron/Solana/TON addresses are case-sensitive — never lowercase them
     inspect(NON_EVM[chain()] ? a : a.toLowerCase()); loader(100);
     if(!g.edges.length){                     // explain an empty graph instead of showing nothing
       const other=dir==='out'?'← where funds came from':'→ where funds went';
@@ -504,6 +505,7 @@ async function syncAssets(){
   $('#addr').placeholder = c==='btc' ? 'bc1… / 1… / 3…  Bitcoin address'
     : c==='tron' ? 'T…  Tron address'
     : c==='sol'  ? 'Solana account address'
+    : c==='ton'  ? 'UQ… / EQ…  TON address'
     : '0x…  paste an address to investigate';
   try{
     const r=await api(`/api/assets?chain=${c}`);

{crypttrace-0.10.0 → crypttrace-0.12.0}/src/crypttrace/webapp.py

@@ -40,6 +40,10 @@ def validate(address: str, chain: str):
     elif chain == "tron":
         if not (a.startswith("T") and len(a) == 34):
             return f"'{a[:14]}…' is not a Tron address (expected T…, 34 chars)."
+    elif chain == "ton":
+        from crypttrace import addresses as _a
+        if not _a.validate(a, "ton")[0]:
+            return f"'{a[:14]}…' is not a TON address (expected UQ…/EQ…, 48 chars)."
     return None
 
 

{crypttrace-0.10.0 → crypttrace-0.12.0/src/crypttrace.egg-info}/PKG-INFO

@@ -1,13 +1,13 @@
 Metadata-Version: 2.4
 Name: crypttrace
-Version: 0.10.0
-Summary: OSINT toolkit for crypto investigations: trace stolen funds across Ethereum, Bitcoin, Tron and Solana
+Version: 0.12.0
+Summary: OSINT toolkit for crypto investigations: trace stolen funds across Ethereum, Bitcoin, Tron, Solana and TON
 Author: bobslayerX
 License-Expression: MIT
 Project-URL: Homepage, https://github.com/bobslayerX/crypttrace
 Project-URL: Issues, https://github.com/bobslayerX/crypttrace/issues
 Project-URL: Changelog, https://github.com/bobslayerX/crypttrace/blob/main/CHANGELOG.md
-Keywords: osint,blockchain,forensics,cryptocurrency,bitcoin,ethereum,tron,solana,investigation
+Keywords: osint,blockchain,forensics,cryptocurrency,bitcoin,ethereum,tron,solana,ton,investigation
 Classifier: Development Status :: 4 - Beta
 Classifier: Environment :: Console
 Classifier: Environment :: Web Environment
@@ -42,7 +42,7 @@ Dynamic: license-file
 Open-source OSINT toolkit for crypto investigations. Give it a suspicious
 address; it pulls the public on-chain history, labels known entities (exchanges,
 mixers, sanctioned wallets), scores risk, and maps where the funds moved —
-across Ethereum, Bitcoin, Tron, Solana and more.
+across Ethereum, Bitcoin, Tron, Solana, TON and more.
 
 Built for the investigation that actually happens: *someone's crypto was stolen,
 here's the wallet — where did the money go, and where can it still be stopped?*
@@ -80,7 +80,7 @@ python selftest.py                 # offline checks, no API keys needed
 | | Needed? | How to get it |
 |---|---|---|
 | **EVM chains** (Ethereum, BSC, Polygon, Arbitrum, Optimism, Base) | **Required** | Free key at [etherscan.io/myapikey](https://etherscan.io/myapikey). One v2 key covers all EVM chains. |
-| **Bitcoin, Tron, Solana** | **Not required** | Work out of the box via public endpoints. |
+| **Bitcoin, Tron, Solana, TON** | **Not required** | Work out of the box via public endpoints. |
 
 ```bash
 export ETHERSCAN_API_KEY=xxxx           # required for EVM chains only
@@ -93,7 +93,7 @@ $env:ETHERSCAN_API_KEY = "xxxx"                            # this window only
 [Environment]::SetEnvironmentVariable("ETHERSCAN_API_KEY", "xxxx", "User")   # permanently
 ```
 
-**About the keyless chains:** Bitcoin, Tron and Solana work with no signup at
+**About the keyless chains:** Bitcoin, Tron, Solana and TON work with no signup at
 all, but their free public endpoints are **rate-limited**. crypttrace handles
 this for you — it caches every response, spaces requests out, and retries with
 backoff when a limit is hit. For deep traces you can raise the ceiling with your
@@ -102,6 +102,7 @@ own credentials (all optional):
 ```bash
 export TRONGRID_API_KEY=xxxx            # optional: higher TronGrid quota
 export CRYPTTRACE_SOLANA_RPC=https://…  # optional: your own (faster) Solana RPC
+export TONCENTER_API_KEY=xxxx          # optional: toncenter allows ~1 request/s without it
 ```
 
 (In PowerShell: `$env:TRONGRID_API_KEY = "xxxx"` and so on.)
@@ -114,11 +115,16 @@ export CRYPTTRACE_SOLANA_RPC=https://…  # optional: your own (faster) Solana R
 | Bitcoin | `btc` | mempool.space | UTXO |
 | Tron (TRX + USDT-TRC20) | `tron` | TronGrid | account |
 | Solana (SOL + SPL) | `sol` | public JSON-RPC | account |
+| TON (TON + jettons, e.g. USDT) | `ton` | toncenter v3 | account |
 
 Every network is normalized to the same transfer shape, so `profile`, `trace`,
 `funder`, `report` and the web graph behave identically everywhere. Bitcoin
 additionally unlocks `cluster`. Tron matters for everyday victim cases — most
 romance / "pig butchering" scams move USDT-TRC20 because fees are near zero.
+TON matters for the same reason: USDT on TON is built into Telegram's wallet,
+so scams that start in a Telegram chat often end there. TON addresses are
+accepted in any form (`UQ…`, `EQ…` or raw `0:…`) and shown as wallets show
+them (`UQ…`); jetton transfers are reported between the owners' wallets.
 
 ---
 
@@ -433,13 +439,14 @@ want:
 ```bash
 crypttrace trace 0xADDRESS --asset usdt                   # USDT on Ethereum
 crypttrace trace TADDRESS  --chain tron --asset usdt      # USDT-TRC20 on Tron
+crypttrace trace UQADDRESS --chain ton  --asset usdt      # USDT on TON
 crypttrace tokens TADDRESS --chain tron
 ```
 
 Token contracts differ per chain, so the registry is chain-aware: `usdt` on Tron
 resolves to `TR7NHqje…jLj6t`, on Ethereum to `0xdac17f95…31ec7`. Known symbols
-are `usdt`, `usdc`, `dai`, `weth`, `wbtc` on EVM and `usdt`, `usdc` on
-Tron/Solana; you can also pass any contract address directly.
+are `usdt`, `usdc`, `dai`, `weth`, `wbtc` on EVM, `usdt`, `usdc` on
+Tron/Solana and `usdt` on TON; you can also pass any contract address directly.
 
 Matching is by **exact contract**, which matters: attackers routinely airdrop
 fake tokens named "USDT" to poison wallets, and those are ignored rather than
@@ -459,8 +466,8 @@ Add sources in `labels/labels.py` → `SOURCES`.
 
 On Bitcoin, Tron and Solana the labels cover the reserve wallets of Binance,
 OKX and HTX, plus Bybit's older 2022 list — each taken from the address list the
-exchange publishes itself for proof-of-reserves. That is what lets `offramp`
-flag deposit addresses on those chains. Funds sent to an exchange not on that
+exchange publishes itself for proof-of-reserves; on TON, Binance's reserve
+wallets. That is what lets `offramp` flag deposit addresses on those chains. Funds sent to an exchange not on that
 list still show as `unknown`. Every label records where it came from — see
 `crypttrace labels audit`.
 
@@ -561,6 +568,7 @@ src/crypttrace/
     bitcoin.py     # Bitcoin UTXO (mempool.space) + clustering
     tron.py        # Tron / TRC20 (TronGrid) + base58 conversion
     solana.py      # Solana JSON-RPC
+    ton.py         # TON + jettons (toncenter v3)
     http.py        # shared cache, throttling, 429 backoff
   labels/
     known.json     # curated label DB, one source per claim
@@ -589,10 +597,10 @@ cases/             # worked investigations with their data
 
 ## Roadmap
 
-- More exchanges on Bitcoin, Tron and Solana (now: Binance, OKX, HTX, Bybit),
+- More exchanges on Bitcoin, Tron, Solana (now: Binance, OKX, HTX, Bybit) and
+  TON (now: Binance),
   and refreshing these lists as the exchanges republish them
 - Internal transactions (completes `funder` and contract-mediated transfers)
-- Per-mint filtering for Solana SPL tokens
 - More label sources: Chainabuse, CryptoScamDB, exchange deposit-address sets
 - Spam/dust token filtering in `tokens`
 - Entity clustering on EVM via the gas-funding heuristic

{crypttrace-0.10.0 → crypttrace-0.12.0}/src/crypttrace.egg-info/SOURCES.txt

@@ -34,6 +34,7 @@ src/crypttrace/fetchers/bitcoin.py
 src/crypttrace/fetchers/etherscan.py
 src/crypttrace/fetchers/http.py
 src/crypttrace/fetchers/solana.py
+src/crypttrace/fetchers/ton.py
 src/crypttrace/fetchers/tron.py
 src/crypttrace/labels/__init__.py
 src/crypttrace/labels/audit.py