crypttrace 0.12.0__tar.gz → 0.13.0__tar.gz

{crypttrace-0.12.0/src/crypttrace.egg-info → crypttrace-0.13.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: crypttrace
-Version: 0.12.0
+Version: 0.13.0
 Summary: OSINT toolkit for crypto investigations: trace stolen funds across Ethereum, Bitcoin, Tron, Solana and TON
 Author: bobslayerX
 License-Expression: MIT
@@ -400,7 +400,9 @@ crypttrace timeline bc1qADDRESS --chain btc --buckets 24
 ![The victim list for one branch of the Coldcard sweep in the web UI](https://raw.githubusercontent.com/bobslayerX/crypttrace/main/assets/web-victims.jpg)
 
 A worked example — 1,169 swept addresses, 1,082.58 BTC, with the commands to
-reproduce it — is in [`cases/coldcard-2026`](cases/coldcard-2026).
+reproduce it — is in [`cases/coldcard-2026`](cases/coldcard-2026). A TON one — 200
+wallets emptied after a seed leak, followed to a KuCoin deposit memo — is in
+[`cases/fragment-api-ton-2026`](cases/fragment-api-ton-2026).
 
 **Dust is filtered by default.** Addresses that become publicly known get spammed
 with tiny transfers, which otherwise bury the transactions that matter and can
@@ -455,6 +457,14 @@ with USDT would be meaningless.
 
 Amounts carry approximate USD values (stablecoins pinned to $1, others priced
 via CoinGecko). If pricing is unavailable, USD shows as `—` rather than a guess.
+Only the real stablecoin contract gets the $1 — a token anyone minted and called
+"USDT" is worth nothing.
+
+`tokens` hides spam and counterfeit tokens and leaves them out of the total: a
+"USDT" or "TON" that is not the real contract, a name that is a phishing link
+("GRAM AT GRAMEVENT.ORG", "USDT - usdtunloсk.соm" with Cyrillic letters in the
+domain), and on TON anything the indexer flags as a scam. `--all` lists them
+with the reason.
 
 ### Labels
 
@@ -602,7 +612,6 @@ cases/             # worked investigations with their data
   and refreshing these lists as the exchanges republish them
 - Internal transactions (completes `funder` and contract-mediated transfers)
 - More label sources: Chainabuse, CryptoScamDB, exchange deposit-address sets
-- Spam/dust token filtering in `tokens`
 - Entity clustering on EVM via the gas-funding heuristic
 
 ## Contributing

{crypttrace-0.12.0 → crypttrace-0.13.0}/README.md

@@ -366,7 +366,9 @@ crypttrace timeline bc1qADDRESS --chain btc --buckets 24
 ![The victim list for one branch of the Coldcard sweep in the web UI](https://raw.githubusercontent.com/bobslayerX/crypttrace/main/assets/web-victims.jpg)
 
 A worked example — 1,169 swept addresses, 1,082.58 BTC, with the commands to
-reproduce it — is in [`cases/coldcard-2026`](cases/coldcard-2026).
+reproduce it — is in [`cases/coldcard-2026`](cases/coldcard-2026). A TON one — 200
+wallets emptied after a seed leak, followed to a KuCoin deposit memo — is in
+[`cases/fragment-api-ton-2026`](cases/fragment-api-ton-2026).
 
 **Dust is filtered by default.** Addresses that become publicly known get spammed
 with tiny transfers, which otherwise bury the transactions that matter and can
@@ -421,6 +423,14 @@ with USDT would be meaningless.
 
 Amounts carry approximate USD values (stablecoins pinned to $1, others priced
 via CoinGecko). If pricing is unavailable, USD shows as `—` rather than a guess.
+Only the real stablecoin contract gets the $1 — a token anyone minted and called
+"USDT" is worth nothing.
+
+`tokens` hides spam and counterfeit tokens and leaves them out of the total: a
+"USDT" or "TON" that is not the real contract, a name that is a phishing link
+("GRAM AT GRAMEVENT.ORG", "USDT - usdtunloсk.соm" with Cyrillic letters in the
+domain), and on TON anything the indexer flags as a scam. `--all` lists them
+with the reason.
 
 ### Labels
 
@@ -568,7 +578,6 @@ cases/             # worked investigations with their data
   and refreshing these lists as the exchanges republish them
 - Internal transactions (completes `funder` and contract-mediated transfers)
 - More label sources: Chainabuse, CryptoScamDB, exchange deposit-address sets
-- Spam/dust token filtering in `tokens`
 - Entity clustering on EVM via the gas-funding heuristic
 
 ## Contributing

{crypttrace-0.12.0 → crypttrace-0.13.0}/src/crypttrace/__init__.py

@@ -1,2 +1,2 @@
 """crypttrace — OSINT crypto investigation CLI."""
-__version__ = "0.12.0"
+__version__ = "0.13.0"

{crypttrace-0.12.0 → crypttrace-0.13.0}/src/crypttrace/chains.py

@@ -14,6 +14,7 @@ from typing import List, Dict, Optional
 
 from crypttrace import config
 from crypttrace import addresses as _addresses
+from crypttrace import spam as _spam
 from crypttrace.fetchers import etherscan, bitcoin, http as _http, tron, solana, ton
 
 EVM_CHAINS = set(config.CHAINS)
@@ -127,7 +128,7 @@ def _evm_token(address: str, chain: str, contract: Optional[str], limit: int) ->
         rows.append({"from": t.get("from", "").lower(), "to": t.get("to", "").lower(),
                      "value": val, "timestamp": int(t.get("timeStamp", "0") or 0),
                      "hash": t.get("hash", ""), "symbol": t.get("tokenSymbol", "?"),
-                     "contract": c})
+                     "name": t.get("tokenName", ""), "contract": c})
     return rows
 
 
@@ -278,8 +279,11 @@ def token_holdings(address: str, chain: str = "eth", limit: int = 1000) -> List[
     agg: Dict[str, dict] = {}
     for r in rows:
         key = r.get("contract") or r.get("symbol", "?")
-        rec = agg.setdefault(key, {"symbol": r.get("symbol", "?"), "contract": key,
-                                   "net": 0.0, "txs": 0})
+        rec = agg.setdefault(key, {"symbol": r.get("symbol", "?"), "name": r.get("name", ""),
+                                   "contract": key, "net": 0.0, "txs": 0,
+                                   "spam": _spam.verdict(chain, r.get("contract") or "",
+                                                         r.get("symbol", ""), r.get("name", ""),
+                                                         bool(r.get("flagged")))})
         if r.get("to") == me:
             rec["net"] += r.get("value", 0.0)
         if r.get("from") == me:

{crypttrace-0.12.0 → crypttrace-0.13.0}/src/crypttrace/cli.py

@@ -199,8 +199,12 @@ def trace(
 def tokens(
     address: str = typer.Argument(..., help="Address to inspect (0x…)"),
     chain: str = CHAIN_OPT,
+    show_all: bool = typer.Option(False, "--all", help="Also list spam and counterfeit tokens"),
 ):
-    """Show an address's token holdings (approx from transfer history) with USD."""
+    """Show an address's token holdings (approx from transfer history) with USD.
+
+    Spam and counterfeit tokens — a fake "USDT", a name that is a phishing link —
+    are hidden and never priced; --all lists them with the reason."""
     try:
         holdings = chains_mod.token_holdings(address, chain)
     except (chains_mod.ChainError, etherscan.EtherscanError) as e:
@@ -209,7 +213,7 @@ def tokens(
     if not holdings:
         console.print("[dim]No token transfers found for this address on this chain.[/dim]")
         return
-    console.print(render.holdings_table(address, chain, holdings))
+    console.print(render.holdings_table(address, chain, holdings, show_all))
 
 
 @app.command()

{crypttrace-0.12.0 → crypttrace-0.13.0}/src/crypttrace/fetchers/ton.py

@@ -28,10 +28,10 @@ TX_PAGE, JETTON_PAGE = 500, 1000
 _KEY = os.environ.get("TONCENTER_API_KEY")
 http.MIN_INTERVAL["toncenter.com"] = 0.12 if _KEY else 1.1
 
-# jetton master (raw, lower-case) -> decimals, starting with the ones we know
-_DECIMALS: Dict[str, int] = {t["contract"]: t.get("decimals", 9)
-                             for t in assets.tokens_for("ton").values()}
-_SYMBOLS: Dict[str, str] = {t["contract"]: t["symbol"] for t in assets.tokens_for("ton").values()}
+# jetton master (raw, lower-case) -> what the token calls itself, starting with the ones we know
+_META: Dict[str, dict] = {t["contract"]: {"decimals": t.get("decimals", 9), "symbol": t["symbol"],
+                                          "name": "", "scam": False}
+                          for t in assets.tokens_for("ton").values()}
 
 
 class TonError(RuntimeError):
@@ -98,21 +98,32 @@ def transfers(address: str, limit: int = 1000) -> List[Dict]:
             src, dst = _addr(src), _addr(dst)
             if me not in (src, dst):
                 continue
+            # the sender's and the receiver's transactions have different hashes;
+            # the message hash is the same on both sides (the store keys on it)
             rows.append({"from": src, "to": dst, "value": value, "timestamp": ts,
-                         "hash": h, "symbol": "TON"})
+                         "hash": h, "symbol": "TON", "msg_hash": _hex(m.get("hash") or "")})
     return rows
 
 
-def _decimals(master: str) -> Optional[int]:
-    if master not in _DECIMALS:
+def _meta(master: str) -> Optional[dict]:
+    """Decimals, symbol, name and the indexer's scam flag for a jetton master."""
+    if master not in _META:
         try:
-            m = (_get("/jetton/masters", {"address": master, "limit": 1}).get("jetton_masters")
-                 or [{}])[0]
-            content = m.get("jetton_content") or {}
-            _DECIMALS[master] = int(content.get("decimals") or 9)   # TEP-64 default is 9
+            d = _get("/jetton/masters", {"address": master, "limit": 1})
+            content = ((d.get("jetton_masters") or [{}])[0].get("jetton_content")) or {}
+            # off-chain metadata (a URI) is resolved by the indexer into "metadata"
+            info = next((i for m in (d.get("metadata") or {}).values()
+                         for i in (m.get("token_info") or []) if i.get("type") == "jetton_masters"), {})
+            _META[master] = {
+                "decimals": int(content.get("decimals") or (info.get("extra") or {}).get("decimals")
+                                or 9),                      # TEP-64 default is 9
+                "symbol": info.get("symbol") or content.get("symbol") or "JETTON",
+                "name": info.get("name") or content.get("name") or "",
+                "scam": bool(info.get("is_scam")),
+            }
         except (TonError, ValueError, TypeError):
             return None
-    return _DECIMALS[master]
+    return _META[master]
 
 
 def jetton_transfers(address: str, limit: int = 1000) -> List[Dict]:
@@ -122,15 +133,16 @@ def jetton_transfers(address: str, limit: int = 1000) -> List[Dict]:
         if t.get("aborted"):
             continue
         master = (t.get("jetton_master") or "").lower()
-        dec = _decimals(master)
-        if dec is None:
+        meta = _meta(master)
+        if meta is None:
             continue                                # unknown unit: don't guess
         try:
-            value = int(t.get("amount") or 0) / (10 ** dec)
+            value = int(t.get("amount") or 0) / (10 ** meta["decimals"])
         except (ValueError, TypeError):
             continue
         rows.append({"from": _addr(t.get("source")), "to": _addr(t.get("destination")),
                      "value": value, "timestamp": int(t.get("transaction_now") or 0),
                      "hash": _hex(t.get("transaction_hash", "")),
-                     "symbol": _SYMBOLS.get(master, "JETTON"), "contract": master})
+                     "symbol": meta["symbol"], "name": meta["name"], "contract": master,
+                     "flagged": meta["scam"]})
     return rows

{crypttrace-0.12.0 → crypttrace-0.13.0}/src/crypttrace/fetchers/tron.py

@@ -142,7 +142,7 @@ def token_transfers(address: str, limit: int = 200) -> List[Dict]:
         rows.append({"from": t.get("from", ""), "to": t.get("to", ""), "value": val,
                      "timestamp": int((t.get("block_timestamp") or 0) / 1000),
                      "hash": t.get("transaction_id", ""),
-                     "symbol": info.get("symbol", "TRC20"),
+                     "symbol": info.get("symbol", "TRC20"), "name": info.get("name", ""),
                      "contract": (info.get("address") or "").lower()})
     return rows
 

{crypttrace-0.12.0 → crypttrace-0.13.0}/src/crypttrace/labels/known.json

@@ -35,6 +35,10 @@
   "bc1qdaarag7729c2n4l2wnyt3hkhfpcs66n98z7uuh": {"name": "Coldcard Exploiter (Jul 2026) - collector C1", "type": "scam", "chain": "btc", "source": "own tracing: 100 inbound sweeps totalling 88.850 BTC at 01:10 UTC, forwarded to the 89 BTC pile", "source_kind": "research", "added": "2026-08-09"},
   "bc1qh0l7q0mca3ln7wsl9luwns0jc9jhgrtft025l4": {"name": "Coldcard Exploiter (Jul 2026) - collector C2", "type": "scam", "chain": "btc", "source": "own tracing: 78 inbound sweeps totalling 0.769 BTC at 01:10 UTC; totals reconcile with chain", "source_kind": "research", "added": "2026-08-09"},
 
+  "UQDiqkA78AG6tqpWPP3WeQs4EvvOIXZyXAg4JZwjNq9Tqwnm": {"name": "fragment-api seed leak drainer (Sep 2026) - collector", "type": "scam", "chain": "ton", "source": "own tracing (cases/fragment-api-ton-2026): swept 200 wallets from 2026-09-29 18:49 UTC, 10,080 TON + 29,494 USDT", "source_kind": "research", "added": "2026-09-30"},
+  "UQCuquK3ZOsWuGCh21eFC_SrmB6pezbtKP_Mm2kJDactC5Wb": {"name": "fragment-api seed leak drainer (Sep 2026) - second wallet", "type": "scam", "chain": "ton", "source": "own tracing (cases/fragment-api-ton-2026): received the collector's remaining TON, jettons and 15 stolen NFTs on 2026-09-30 16:34 UTC", "source_kind": "research", "added": "2026-09-30"},
+  "UQCA1BI4QRZ8qYmskSRDzJmkucGodYRTZCf_b9hckjla6Yug": {"name": "KuCoin hot wallet (memo required)", "type": "exchange", "chain": "ton", "source": "tonapi account name 'Kucoin 1', memo_required, fetched 2026-09-30", "source_kind": "explorer-tag", "added": "2026-09-30"},
+
   "1DEuKerATHWRfyB14s6QCt4LPkfCTx4zaW": {"name": "Binance reserve wallet", "type": "exchange", "chain": "btc", "source": "Binance proof-of-reserves address list (binance.com/bapi/apex/v1/public/apex/market/por/address), fetched 2026-09-23; listed since 2025-10-15", "source_kind": "self-published", "added": "2026-09-23"},
   "1PJiGp2yDLvUgqeBsuZVCBADArNsk6XEiw": {"name": "Binance reserve wallet", "type": "exchange", "chain": "btc", "source": "Binance proof-of-reserves address list (binance.com/bapi/apex/v1/public/apex/market/por/address), fetched 2026-09-23; listed since 2025-10-15", "source_kind": "self-published", "added": "2026-09-23"},
   "1PPWMe42cywnM61nVatkmiggwdRQYLiCyS": {"name": "Binance reserve wallet", "type": "exchange", "chain": "btc", "source": "Binance proof-of-reserves address list (binance.com/bapi/apex/v1/public/apex/market/por/address), fetched 2026-09-23; listed since 2025-10-15", "source_kind": "self-published", "added": "2026-09-23"},

{crypttrace-0.12.0 → crypttrace-0.13.0}/src/crypttrace/prices.py

@@ -8,6 +8,8 @@ from typing import Optional, Dict
 
 import requests
 
+from crypttrace import assets
+
 # symbols treated as ~$1
 _STABLE = {"usdt", "usdc", "dai", "busd", "tusd", "usdp", "gusd", "frax", "lusd"}
 
@@ -54,9 +56,17 @@ def native_price(chain: str = "eth") -> Optional[float]:
 
 
 def token_price(contract: str, chain: str = "eth", symbol: str = "") -> Optional[float]:
-    """USD price of an ERC-20 token by contract. Stablecoins short-circuit to $1."""
+    """USD price of a token by contract. Stablecoins short-circuit to $1 — but only
+    the real contract where the registry knows it: a "USDT" anyone can mint is not
+    worth a dollar."""
     if symbol.lower() in _STABLE:
-        return 1.0
+        real = {t["symbol"].lower(): t["contract"].lower()
+                for t in assets.tokens_for(chain).values() if t.get("stable")}
+        if not assets.tokens_for(chain):
+            return 1.0                      # no registry for this chain: trust the symbol
+        if (contract or "").lower() == real.get(symbol.lower()):
+            return 1.0
+        return None
     key = f"{chain}:{contract.lower()}"
     if key in _cache:
         return _cache[key]

{crypttrace-0.12.0 → crypttrace-0.13.0}/src/crypttrace/render.py

@@ -1,5 +1,6 @@
 """Terminal rendering helpers (rich)."""
 from datetime import datetime, timezone
+from rich.markup import escape
 from rich.table import Table
 from rich.tree import Tree
 from rich.text import Text
@@ -223,20 +224,36 @@ def funding_tree(address: str, hops: list, symbol: str = "ETH") -> Tree:
     return root
 
 
-def holdings_table(address: str, chain: str, holdings: list) -> Table:
-    """Token holdings with per-token and total USD value."""
-    t = Table(title=f"Token holdings — {address}  ({chain})", header_style="bold")
+def holdings_table(address: str, chain: str, holdings: list, show_all: bool = False) -> Table:
+    """Token holdings with per-token and total USD value.
+
+    Spam and counterfeit tokens (see spam.py) are left out unless `show_all`;
+    they never count towards the total either way.
+    """
+    hidden = [h for h in holdings if h.get("spam")]
+    shown = holdings if show_all else [h for h in holdings if not h.get("spam")]
+    t = Table(title=f"Token holdings — {address}  ({chain})", header_style="bold",
+              caption=(f"{len(hidden)} spam or counterfeit token(s) hidden — --all shows them"
+                       if hidden and not show_all else None))
     t.add_column("Token")
     t.add_column("Amount", justify="right")
     t.add_column("USD", justify="right")
     t.add_column("Txs", justify="right")
+    if show_all:
+        t.add_column("Note")
     total = 0.0
-    for h in holdings:
-        price = prices.token_price(h["contract"], chain, h["symbol"])
-        usd = prices.usd(h["net"], price)
+    for h in shown:
+        if h.get("spam"):
+            usd = None
+        else:
+            usd = prices.usd(h["net"], prices.token_price(h["contract"], chain, h["symbol"]))
         if usd is not None:
             total += usd
-        t.add_row(h["symbol"], f"{h['net']:.4f}", prices.fmt_usd(usd), str(h["txs"]))
+        cells = [escape(h["symbol"]), f"{h['net']:.4f}", prices.fmt_usd(usd), str(h["txs"])]
+        if show_all:
+            cells.append(f"[red]{escape(h['spam'])}[/red]" if h.get("spam") else "")
+        t.add_row(*cells)
     t.add_section()
-    t.add_row("[bold]Total[/bold]", "", f"[bold]{prices.fmt_usd(total)}[/bold]", "")
+    t.add_row("[bold]Total[/bold]", "", f"[bold]{prices.fmt_usd(total)}[/bold]", "",
+              *([""] if show_all else []))
     return t

crypttrace-0.13.0/src/crypttrace/spam.py

@@ -0,0 +1,72 @@
+"""Spam and counterfeit tokens — what `tokens` hides by default.
+
+Anyone can mint a token and send it to any address, so a wallet's token list
+fills up with two kinds of junk:
+
+- counterfeits: a token called "USDT" or "TON" that is not the real contract,
+  sent so the balance looks bigger or to bait a victim into a fake swap;
+- link bait: the name *is* the advert — "GRAM AT GRAMEVENT.ORG",
+  "USDT - usdtunlock.com" — pointing at a phishing site.
+
+Neither is worth money, and pricing them as the real thing would put a fake
+million dollars into a case file. A token is judged by its contract against the
+registry in assets.py, and by its name after undoing look-alike letters
+(Cyrillic "с" for Latin "c" is how "usdtunloсk.соm" dodges a naive filter).
+"""
+import re
+from typing import Optional
+
+from crypttrace import assets
+
+# Cyrillic and Greek letters that look like Latin ones, and ₮ for T
+_LOOKALIKE = str.maketrans({
+    "а": "a", "в": "b", "е": "e", "к": "k", "м": "m", "н": "h", "о": "o", "р": "p",
+    "с": "c", "т": "t", "у": "y", "х": "x", "і": "i", "ј": "j", "ѕ": "s",
+    "А": "A", "В": "B", "Е": "E", "К": "K", "М": "M", "Н": "H", "О": "O", "Р": "P",
+    "С": "C", "Т": "T", "У": "Y", "Х": "X", "І": "I", "Ј": "J", "Ѕ": "S",
+    "ο": "o", "Ο": "O", "α": "a", "Α": "A", "ε": "e", "Ε": "E", "ν": "v", "Τ": "T",
+    "₮": "T",
+})
+
+_URL = re.compile(
+    r"(https?://|www\.|t\.me/|\b[a-z0-9-]{2,}\.(com|org|net|io|xyz|click|app|site|top|info|"
+    r"cc|me|gg|pro|live|vip|fun|online|link|claim|finance|exchange|network|tech|store|"
+    r"shop|club|world|space|website|biz|us|co)\b)", re.I)
+_HANDLE = re.compile(r"(^|\s)@[a-z0-9_]{4,}", re.I)
+_BAIT = re.compile(r"\b(claim|unlock|airdrop|reward|voucher|visit|bonus|giveaway)\b", re.I)
+
+# a token named after the chain's own coin is never that coin
+_NATIVE = {"eth": "ETH", "tron": "TRX", "ton": "TON"}
+
+
+def plain(text: str) -> str:
+    """Text with look-alike letters replaced by the Latin ones they imitate."""
+    return (text or "").translate(_LOOKALIKE)
+
+
+def _ticker(symbol: str) -> str:
+    return re.sub(r"[^A-Z0-9]", "", plain(symbol).upper())
+
+
+def verdict(chain: str, contract: str, symbol: str, name: str = "",
+            flagged: bool = False) -> Optional[str]:
+    """Why this token is junk, or None if nothing marks it as such."""
+    contract = (contract or "").lower()
+    known = {t["contract"].lower(): t for t in assets.tokens_for(chain).values()}
+    if contract and contract in known:
+        return None
+    if flagged:
+        return "flagged as scam by the indexer"
+    text = plain(f"{symbol} {name}")
+    link = _URL.search(text) or _HANDLE.search(text)
+    if link:
+        return f"link in its name ({link.group(0).strip()})"
+    if _BAIT.search(text):
+        return f"bait word in its name ({_BAIT.search(text).group(0)})"
+    tick = _ticker(symbol)
+    for t in known.values():
+        if tick and tick == _ticker(t["symbol"]):
+            return f"counterfeit {t['symbol']} (not the real contract)"
+    if tick and tick == _NATIVE.get(chain):
+        return f"counterfeit {_NATIVE[chain]} (the coin itself is not a token)"
+    return None

{crypttrace-0.12.0 → crypttrace-0.13.0}/src/crypttrace/store.py

@@ -60,11 +60,22 @@ def _conn() -> sqlite3.Connection:
             PRIMARY KEY (chain, address, asset)
         );
     """)
+    if c.execute("PRAGMA user_version").fetchone()[0] < 1:
+        # 0.12.0 stored a TON transfer once per side (two transaction hashes),
+        # so a history fetched from both ends counted it twice. Refetch TON.
+        c.execute("DELETE FROM transfers WHERE chain='ton'")
+        c.execute("DELETE FROM fetched WHERE chain='ton'")
+        c.execute("PRAGMA user_version=1")
+        c.commit()
     return c
 
 
 def _row_id(chain: str, r: dict) -> str:
     """Content hash — the same transfer seen from either side stores once."""
+    if r.get("msg_hash"):
+        # TON: sender and receiver each have their own transaction for one transfer
+        key = "|".join([chain, "msg", str(r["msg_hash"]), str(r.get("symbol", ""))])
+        return hashlib.sha1(key.encode()).hexdigest()
     key = "|".join([
         chain, str(r.get("hash", "")), str(r.get("from", "")), str(r.get("to", "")),
         str(r.get("symbol", "")), f"{float(r.get('value', 0)):.12f}",

{crypttrace-0.12.0 → crypttrace-0.13.0/src/crypttrace.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: crypttrace
-Version: 0.12.0
+Version: 0.13.0
 Summary: OSINT toolkit for crypto investigations: trace stolen funds across Ethereum, Bitcoin, Tron, Solana and TON
 Author: bobslayerX
 License-Expression: MIT
@@ -400,7 +400,9 @@ crypttrace timeline bc1qADDRESS --chain btc --buckets 24
 ![The victim list for one branch of the Coldcard sweep in the web UI](https://raw.githubusercontent.com/bobslayerX/crypttrace/main/assets/web-victims.jpg)
 
 A worked example — 1,169 swept addresses, 1,082.58 BTC, with the commands to
-reproduce it — is in [`cases/coldcard-2026`](cases/coldcard-2026).
+reproduce it — is in [`cases/coldcard-2026`](cases/coldcard-2026). A TON one — 200
+wallets emptied after a seed leak, followed to a KuCoin deposit memo — is in
+[`cases/fragment-api-ton-2026`](cases/fragment-api-ton-2026).
 
 **Dust is filtered by default.** Addresses that become publicly known get spammed
 with tiny transfers, which otherwise bury the transactions that matter and can
@@ -455,6 +457,14 @@ with USDT would be meaningless.
 
 Amounts carry approximate USD values (stablecoins pinned to $1, others priced
 via CoinGecko). If pricing is unavailable, USD shows as `—` rather than a guess.
+Only the real stablecoin contract gets the $1 — a token anyone minted and called
+"USDT" is worth nothing.
+
+`tokens` hides spam and counterfeit tokens and leaves them out of the total: a
+"USDT" or "TON" that is not the real contract, a name that is a phishing link
+("GRAM AT GRAMEVENT.ORG", "USDT - usdtunloсk.соm" with Cyrillic letters in the
+domain), and on TON anything the indexer flags as a scam. `--all` lists them
+with the reason.
 
 ### Labels
 
@@ -602,7 +612,6 @@ cases/             # worked investigations with their data
   and refreshing these lists as the exchanges republish them
 - Internal transactions (completes `funder` and contract-mediated transfers)
 - More label sources: Chainabuse, CryptoScamDB, exchange deposit-address sets
-- Spam/dust token filtering in `tokens`
 - Entity clustering on EVM via the gas-funding heuristic
 
 ## Contributing

{crypttrace-0.12.0 → crypttrace-0.13.0}/src/crypttrace.egg-info/SOURCES.txt

@@ -18,6 +18,7 @@ src/crypttrace/poisoning.py
 src/crypttrace/prices.py
 src/crypttrace/render.py
 src/crypttrace/report.py
+src/crypttrace/spam.py
 src/crypttrace/store.py
 src/crypttrace/trace.py
 src/crypttrace/verify.py