crypttrace 0.14.0__tar.gz → 0.16.0__tar.gz

{crypttrace-0.14.0/src/crypttrace.egg-info → crypttrace-0.16.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: crypttrace
-Version: 0.14.0
+Version: 0.16.0
 Summary: OSINT toolkit for crypto investigations: trace stolen funds across Ethereum, Bitcoin, Tron, Solana and TON
 Author: bobslayerX
 License-Expression: MIT
@@ -129,6 +129,30 @@ them (`UQ…`); jetton transfers are reported between the owners' wallets.
 
 ---
 
+## Was my wallet drained?
+
+```bash
+crypttrace check YOUR_ADDRESS --chain ton
+```
+
+For someone who just found their wallet empty. `check` reads the wallet's
+history and answers in plain language:
+
+- **drained or not** — several signed transfers moving everything (tokens, NFTs,
+  then the coin) to one new address within minutes, leaving the wallet empty:
+  a program holding your key did that, not you;
+- **a mass drain?** — whether the same address emptied other wallets in the same
+  hour (leaked keys from a shared service or tool, not a scam aimed at you);
+- **is the key still in use?** — money that arrived after the drain and was
+  taken too;
+- **where the money went next** — exchange deposits with the memo that names the
+  account (see *Exchange deposits with a memo*);
+- **what to do now** — what is still on the wallet worth moving (on TON: real
+  jetton balances and NFTs from trusted collections, not airdropped spam), and
+  who to report to.
+
+The web UI has the same check in its **Was I drained?** tab.
+
 ## Web UI
 
 ```bash
@@ -412,6 +436,13 @@ flip the timing verdict entirely. Each chain has a dust threshold; override with
 paged rather than read one page deep, so an old sweep isn't hidden behind recent
 spam.
 
+**On TON, only payments count.** A drainer's collector also receives notes
+people send the attacker, dust from look-alike addresses, and gas refunds and
+notices from jetton wallets and NFT items. None of those senders are victims,
+and `victims` leaves them out. It also counts the NFTs (Telegram usernames,
+numbers, domains) each wallet lost — a victim who lost only NFTs is listed too,
+with an `nfts` column in the CSV. Failed (aborted) NFT transfers are not counted.
+
 ### Bitcoin clustering (common-input-ownership)
 
 Bitcoin's UTXO model enables the strongest clustering heuristic in blockchain

{crypttrace-0.14.0 → crypttrace-0.16.0}/README.md

@@ -95,6 +95,30 @@ them (`UQ…`); jetton transfers are reported between the owners' wallets.
 
 ---
 
+## Was my wallet drained?
+
+```bash
+crypttrace check YOUR_ADDRESS --chain ton
+```
+
+For someone who just found their wallet empty. `check` reads the wallet's
+history and answers in plain language:
+
+- **drained or not** — several signed transfers moving everything (tokens, NFTs,
+  then the coin) to one new address within minutes, leaving the wallet empty:
+  a program holding your key did that, not you;
+- **a mass drain?** — whether the same address emptied other wallets in the same
+  hour (leaked keys from a shared service or tool, not a scam aimed at you);
+- **is the key still in use?** — money that arrived after the drain and was
+  taken too;
+- **where the money went next** — exchange deposits with the memo that names the
+  account (see *Exchange deposits with a memo*);
+- **what to do now** — what is still on the wallet worth moving (on TON: real
+  jetton balances and NFTs from trusted collections, not airdropped spam), and
+  who to report to.
+
+The web UI has the same check in its **Was I drained?** tab.
+
 ## Web UI
 
 ```bash
@@ -378,6 +402,13 @@ flip the timing verdict entirely. Each chain has a dust threshold; override with
 paged rather than read one page deep, so an old sweep isn't hidden behind recent
 spam.
 
+**On TON, only payments count.** A drainer's collector also receives notes
+people send the attacker, dust from look-alike addresses, and gas refunds and
+notices from jetton wallets and NFT items. None of those senders are victims,
+and `victims` leaves them out. It also counts the NFTs (Telegram usernames,
+numbers, domains) each wallet lost — a victim who lost only NFTs is listed too,
+with an `nfts` column in the CSV. Failed (aborted) NFT transfers are not counted.
+
 ### Bitcoin clustering (common-input-ownership)
 
 Bitcoin's UTXO model enables the strongest clustering heuristic in blockchain

{crypttrace-0.14.0 → crypttrace-0.16.0}/src/crypttrace/__init__.py

@@ -1,2 +1,2 @@
 """crypttrace — OSINT crypto investigation CLI."""
-__version__ = "0.14.0"
+__version__ = "0.16.0"

{crypttrace-0.14.0 → crypttrace-0.16.0}/src/crypttrace/analysis.py

@@ -51,8 +51,8 @@ def _direct(address: str, chain: str, asset: Optional[dict], limit: int,
             continue
         other = r.get(far)
         val = r.get("value", 0) or 0
-        if not other or val <= 0 or val < min_value:
-            continue
+        if not other or val <= 0 or val < min_value or r.get("kind"):
+            continue                     # TON: gas refunds, notices and notes are not payments
         rec = agg.setdefault(other, {"address": other, "value": 0.0, "txs": 0,
                                      "first_ts": None, "last_ts": None})
         rec["value"] += val
@@ -97,6 +97,7 @@ def collect_sources(address: str, chain: str = "btc", depth: int = 1,
                     found[key]["txs"] += rec["txs"]
                     continue
                 rec = dict(rec)
+                rec.setdefault("nfts", 0)
                 rec["hop"] = hop
                 rec["into"] = node
                 rec["label"] = labels.label_of(addr)
@@ -105,11 +106,32 @@ def collect_sources(address: str, chain: str = "btc", depth: int = 1,
                 if key not in seen:
                     seen.add(key)
                     next_frontier.append(addr)
+            if chain == "ton" and asset is None:
+                _add_nfts(found, node, hop)
         frontier = next_frontier
         if not frontier or len(found) >= max_addresses:
             break
 
-    return sorted(found.values(), key=lambda r: r["value"], reverse=True)
+    return sorted(found.values(), key=lambda r: (r["value"], r.get("nfts", 0)), reverse=True)
+
+
+def _add_nfts(found: Dict[str, dict], node: str, hop: int) -> None:
+    """Count NFTs each sender handed to `node` — a drained wallet often loses only its NFTs."""
+    from crypttrace.fetchers import ton
+    try:
+        rows = ton.nft_transfers(node, 1000)
+    except ton.TonError:
+        return
+    for r in rows:
+        if r["to"] != node or not r["from"] or r["from"] == node:
+            continue
+        rec = found.setdefault(r["from"], {"address": r["from"], "value": 0.0, "txs": 0, "nfts": 0,
+                                           "first_ts": r["timestamp"], "last_ts": r["timestamp"],
+                                           "hop": hop, "into": node,
+                                           "label": labels.label_of(r["from"]),
+                                           "type": labels.type_of(r["from"])})
+        rec["nfts"] = rec.get("nfts", 0) + 1
+        rec["first_ts"] = min(rec["first_ts"] or r["timestamp"], r["timestamp"])
 
 
 def export_csv(rows: List[dict], path: Path, chain: str, symbol: str) -> Path:
@@ -117,6 +139,9 @@ def export_csv(rows: List[dict], path: Path, chain: str, symbol: str) -> Path:
     path.parent.mkdir(parents=True, exist_ok=True)
     cols = ["address", "hop", f"amount_sent_{symbol}", "transactions",
             "first_seen_utc", "last_seen_utc", "sent_into", "label", "explorer"]
+    nfts = any(r.get("nfts") for r in rows)
+    if nfts:
+        cols.append("nfts")
     with open(path, "w", newline="", encoding="utf-8") as fh:
         w = csv.writer(fh)
         w.writerow(cols)
@@ -124,7 +149,7 @@ def export_csv(rows: List[dict], path: Path, chain: str, symbol: str) -> Path:
             w.writerow([r["address"], r.get("hop", 1), round(r["value"], 8), r["txs"],
                         _ts(r.get("first_ts")), _ts(r.get("last_ts")),
                         r.get("into", ""), r.get("label", ""),
-                        chains.explorer_url(r["address"], chain)])
+                        chains.explorer_url(r["address"], chain)] + ([r.get("nfts", 0)] if nfts else []))
     return path
 
 

{crypttrace-0.14.0 → crypttrace-0.16.0}/src/crypttrace/chains.py

@@ -242,7 +242,7 @@ def flows(address: str, chain: str, top: int, direction: str = "out",
         if r.get(near) != me:
             continue
         other = r.get(far)
-        if not other or r.get("value", 0) <= 0:
+        if not other or r.get("value", 0) <= 0 or r.get("kind"):
             continue
         rec = agg.setdefault(other, [0.0, 0])
         rec[0] += r["value"]

{crypttrace-0.14.0 → crypttrace-0.16.0}/src/crypttrace/cli.py

@@ -166,6 +166,22 @@ def profile(
         console.print("[dim]No transactions found for this address on this chain.[/dim]")
 
 
+@app.command()
+def check(
+    address: str = typer.Argument(..., help="Your wallet address"),
+    chain: str = CHAIN_OPT,
+):
+    """Was this wallet drained? Who took it, whether others were hit too, what to do now."""
+    from crypttrace import drain
+    try:
+        with console.status("Reading the wallet's history…"):
+            res = drain.check(address, chain)
+    except (chains_mod.ChainError, etherscan.EtherscanError) as e:
+        console.print(f"[red]Error:[/red] {e}")
+        raise typer.Exit(1)
+    console.print(render.drain_report(res))
+
+
 @app.command()
 def trace(
     address: str = typer.Argument(..., help="Starting address (0x…)"),

crypttrace-0.16.0/src/crypttrace/drain.py

@@ -0,0 +1,197 @@
+"""Was this wallet drained? — the check a victim can run on their own address.
+
+A drain looks the same on every chain where the attacker holds the key: within
+minutes, several signed transfers move everything — tokens, NFTs, then the coin
+itself — to one address the wallet never paid before, and the wallet is left
+empty. Nobody approves a dozen transfers a minute by hand, so a burst like that
+means the key or seed phrase is in someone else's hands.
+
+Three more facts turn "my wallet is empty" into something a victim can act on:
+- the same address emptied many other wallets in the same hour: a mass drain
+  (leaked keys from a shared service or tool), not a scam aimed at you;
+- money that arrived after the drain was taken too: the attacker still has
+  the key, and anything sent to this wallet will be lost;
+- where the money went next — an exchange, with the deposit memo that names
+  the account there.
+"""
+from collections import defaultdict
+from typing import Dict, List, Optional
+
+from crypttrace import analysis, chains, spam
+from crypttrace.labels import labels
+
+WINDOW = 15 * 60        # a drain empties a wallet within minutes
+BURST = 120             # signed transfers this close together are automated
+MASS_SENDERS = 10       # wallets swept into one address within an hour of yours
+MASS_SPAN = 3600
+_ALL_TOKENS = {"contract": None, "symbol": "*"}
+
+
+def _history(address: str, chain: str, limit: int) -> List[dict]:
+    rows = list(chains.transfers(address, chain, limit))
+    if chain != "btc":
+        try:
+            rows += [r for r in chains.transfers(address, chain, limit, asset=_ALL_TOKENS)
+                     if not spam.verdict(chain, r.get("contract", ""), r.get("symbol", ""),
+                                         r.get("name", ""), bool(r.get("flagged")))]
+        except chains.ChainError:
+            pass
+    if chain == "ton":
+        from crypttrace.fetchers import ton
+        try:
+            rows += ton.nft_transfers(address, limit)
+        except ton.TonError:
+            pass
+    return rows
+
+
+def _best_burst(rows: List[dict], native: str) -> Optional[dict]:
+    """The WINDOW of outgoing transfers to one destination that took the most:
+    most kinds of asset first, then the most of the chain's own coin."""
+    by_dest: Dict[str, List[dict]] = defaultdict(list)
+    for r in rows:
+        by_dest[r["to"]].append(r)
+    best = None
+    for dest, rs in by_dest.items():
+        rs.sort(key=lambda r: r["timestamp"])
+        for i, first in enumerate(rs):
+            win = [r for r in rs[i:] if r["timestamp"] - first["timestamp"] <= WINDOW]
+            assets = {r.get("symbol") for r in win}
+            coin = sum(r.get("value", 0) or 0 for r in win if r.get("symbol") == native)
+            score = (len(assets), coin, len({r.get("hash") for r in win}))
+            if best is None or score > best["score"]:
+                best = {"score": score, "to": dest, "rows": win,
+                        "start": first["timestamp"], "end": win[-1]["timestamp"]}
+    return best
+
+
+def _amounts(rows: List[dict]) -> Dict[str, float]:
+    tot: Dict[str, float] = defaultdict(float)
+    for r in rows:
+        tot[r.get("symbol") or "?"] += r.get("value", 0) or 0
+    return dict(tot)
+
+
+def check(address: str, chain: str, limit: int = 1000) -> Dict:
+    """Verdict on one wallet: drained (and how), suspicious, or no drain found."""
+    me = chains.norm_addr(address, chain)
+    rows = _history(address, chain, limit)
+    out = [r for r in rows if r.get("from") == me and r.get("to") and r.get("to") != me
+           and not r.get("kind") and (r.get("value") or 0) > 0]
+    res: Dict = {"address": me, "chain": chain, "verdict": "no_drain", "reasons": []}
+    try:
+        res["balance"] = chains.balance(address, chain)
+    except chains.ChainError:
+        res["balance"] = None
+    if not out:
+        res["reasons"].append("this wallet has sent nothing in the history read")
+        return res
+
+    burst = _best_burst(out, chains.symbol(chain))
+    dest, win = burst["to"], burst["rows"]
+    labels.enrich([dest], chain)
+    paid_before = any(r.get("to") == dest and r["timestamp"] < burst["start"] for r in out)
+    times = sorted(r["timestamp"] for r in win)
+    tight = sum(1 for a, b in zip(times, times[1:]) if b - a <= BURST)
+    dust = analysis.dust_threshold(chain)
+    emptied = res["balance"] is not None and res["balance"] <= max(dust, 1e-9) * 5
+    nfts = sum(1 for r in win if r.get("symbol") == "NFT")
+    assets = _amounts([r for r in win if r.get("symbol") != "NFT"])
+    res.update({"to": dest, "to_label": labels.label_of(dest), "to_type": labels.type_of(dest),
+                "start": burst["start"], "end": burst["end"], "transfers": len({r.get("hash") for r in win}),
+                "assets": assets, "nfts": nfts, "emptied": emptied, "new_destination": not paid_before,
+                "tight_pairs": tight})
+
+    # a mass drain: the same address swept many wallets around the same time
+    try:
+        inflow = _history(dest, chain, limit) if labels.type_of(dest) != "exchange" else []
+    except chains.ChainError:
+        inflow = []
+    senders = {r["from"] for r in inflow
+               if r.get("to") == dest and not r.get("kind") and r.get("from") != dest
+               and abs(r["timestamp"] - burst["start"]) <= MASS_SPAN}
+    res["other_wallets_same_hour"] = max(0, len(senders) - 1)
+    mass = res["other_wallets_same_hour"] >= MASS_SENDERS
+
+    automated = tight >= 2 or (len(assets) + (1 if nfts else 0)) >= 2 or mass
+    if labels.type_of(dest) == "exchange":
+        res["reasons"].append("the largest outflow went to an exchange — usually your own deposit")
+    elif emptied and automated and not paid_before:
+        res["verdict"] = "drained"
+    elif emptied and not paid_before:
+        res["verdict"] = "suspicious"
+    if res["verdict"] == "no_drain":
+        return res
+
+    if tight >= 2 or len(assets) + (1 if nfts else 0) >= 2:
+        res["reasons"].append(f"{res['transfers']} transfers to one new address within "
+                              f"{max(1, (burst['end'] - burst['start']) // 60)} min, "
+                              "several seconds apart — signed by a program holding your key")
+    if emptied:
+        res["reasons"].append("the wallet was left empty")
+    if labels.type_of(dest) == "scam":
+        res["reasons"].append(f"the receiving address is a known drainer: {labels.label_of(dest)}")
+
+    if mass:
+        res["reasons"].append(f"the same address took money from {res['other_wallets_same_hour']} other "
+                              "wallets within an hour — a mass drain from leaked keys, not a scam aimed at you")
+
+    # taken again after the drain: the attacker still has the key
+    later = [r for r in out if r["timestamp"] > burst["end"] + 60 and r.get("to") == dest]
+    res["resweeps"] = len({r.get("hash") for r in later})
+    if res["resweeps"]:
+        res["reasons"].append(f"{res['resweeps']} later transfer(s) to the same address after the wallet "
+                              "was topped up — the attacker still has the key")
+
+    # where it went next: exchange deposits (with memo) of the receiver and its next hop
+    nxt = []
+    try:
+        hops = [dest] + [o for o, _, _ in chains.outflows(dest, chain, 3)]
+        labels.enrich(hops, chain)
+        for h in hops:
+            for d in chains.exchange_deposits(h, chain):
+                nxt.append({**d, "from": h})
+            if h != dest and labels.type_of(h) == "exchange":
+                nxt.append({"exchange_address": h, "exchange": labels.label_of(h), "memo": "",
+                            "value": None, "txs": None, "symbol": "", "from": dest})
+    except chains.ChainError:
+        pass
+    res["next"] = nxt
+
+    # what can still be saved
+    if chain == "ton":
+        res["remaining_tokens"], res["remaining_nfts"] = _ton_left(me)
+    else:
+        keep = []
+        try:
+            keep = [h for h in chains.token_holdings(address, chain) if not h.get("spam")]
+        except chains.ChainError:
+            pass
+        res["remaining_tokens"] = [{"symbol": h["symbol"], "amount": h["net"]} for h in keep[:10]]
+    return res
+
+
+def _ton_left(address: str):
+    """Jettons the wallet holds now (not spam), and NFTs from collections tonapi trusts —
+    airdropped spam NFTs are not worth the gas to move."""
+    from crypttrace.fetchers import http, ton
+    tokens = []
+    try:
+        for w in ton._get("/jetton/wallets", {"owner_address": address, "limit": 100}).get("jetton_wallets") or []:
+            master = (w.get("jetton") or "").lower()
+            meta = ton._meta(master)
+            if not meta or not int(w.get("balance") or 0):
+                continue
+            if spam.verdict("ton", master, meta["symbol"], meta["name"], meta["scam"]):
+                continue
+            tokens.append({"symbol": meta["symbol"], "amount": int(w["balance"]) / 10 ** meta["decimals"]})
+    except (ton.TonError, ValueError, TypeError):
+        pass
+    nfts = None
+    try:
+        items = http.request_json(f"https://tonapi.io/v2/accounts/{address}/nfts", {"limit": 100},
+                                  timeout=20).get("nft_items") or []
+        nfts = sum(1 for i in items if i.get("trust") == "whitelist" or i.get("approved_by"))
+    except Exception:                                    # tonapi down: say nothing rather than guess
+        pass
+    return tokens[:10], nfts

{crypttrace-0.14.0 → crypttrace-0.16.0}/src/crypttrace/fetchers/ton.py

@@ -70,6 +70,21 @@ def _addr(raw: Optional[str]) -> str:
     return addresses.ton_friendly(raw or "") or (raw or "")
 
 
+# messages contracts send back as part of a transfer: gas refunds ("excesses"),
+# jetton and NFT arrival notices, bounces. They carry TON, but nobody *sent* it.
+SERVICE_OPS = {"0xd53276db", "0x7362d09c", "0x05138d91", "0xffffffff"}
+MESSAGE_MAX = 0.05     # a comment with less TON than this is a note, not a payment
+
+
+def kind_of(opcode, memo: str, value: float) -> str:
+    """'service' for contract plumbing, 'message' for a note sent to an address, else ''."""
+    if opcode in SERVICE_OPS:
+        return "service"
+    if memo and value < MESSAGE_MAX:
+        return "message"
+    return ""
+
+
 def _memo(text) -> str:
     """A transfer comment, cleaned — exchanges read deposit memos from it."""
     return str(text or "").replace("\x00", "").strip()
@@ -110,6 +125,9 @@ def transfers(address: str, limit: int = 1000) -> List[Dict]:
             memo = _memo(((m.get("message_content") or {}).get("decoded") or {}).get("comment"))
             if memo:
                 row["memo"] = memo
+            kind = kind_of(m.get("opcode"), memo, value)
+            if kind:
+                row["kind"] = kind
             rows.append(row)
     return rows
 
@@ -135,6 +153,19 @@ def _meta(master: str) -> Optional[dict]:
     return _META[master]
 
 
+def nft_transfers(address: str, limit: int = 1000) -> List[Dict]:
+    """NFTs (Telegram usernames, numbers, domains, collectibles) moved to or from `address`."""
+    rows = []
+    for t in _pages("/nft/transfers", "nft_transfers", {"owner_address": address}, limit, JETTON_PAGE):
+        if t.get("transaction_aborted"):
+            continue
+        rows.append({"from": _addr(t.get("old_owner")), "to": _addr(t.get("new_owner")),
+                     "value": 1.0, "symbol": "NFT", "timestamp": int(t.get("transaction_now") or 0),
+                     "hash": _hex(t.get("transaction_hash", "")), "item": _addr(t.get("nft_address")),
+                     "contract": (t.get("nft_collection") or t.get("nft_address") or "").lower()})
+    return rows
+
+
 def jetton_transfers(address: str, limit: int = 1000) -> List[Dict]:
     """Jetton (token) transfers to and from `address`, between owner wallets."""
     rows = []

{crypttrace-0.14.0 → crypttrace-0.16.0}/src/crypttrace/funder.py

@@ -30,7 +30,7 @@ def first_funder(address: str, chain: str = "eth") -> Optional[dict]:
     dust = analysis.dust_threshold(chain)
     for r in rows:  # ascending => first match is the earliest funding
         # dust is not funding: it is what poisoners and spammers send everyone
-        if r.get("to") != me or r.get("value", 0) < max(dust, 1e-18):
+        if r.get("to") != me or r.get("value", 0) < max(dust, 1e-18) or r.get("kind"):
             continue
         return {
             "funder": r.get("from", ""),

{crypttrace-0.14.0 → crypttrace-0.16.0}/src/crypttrace/render.py

@@ -141,10 +141,13 @@ def sources_table(rows: list, symbol: str, top: int = 25) -> Table:
     t.add_column(f"Sent ({symbol})", justify="right")
     t.add_column("Txs", justify="right")
     t.add_column("When (UTC)")
+    nfts = any(r.get("nfts") for r in rows)
+    if nfts:
+        t.add_column("NFTs", justify="right")
     for r in rows[:top]:
         t.add_row(addr_label(r["address"]), str(r.get("hop", 1)),
-                  f"{r['value']:.8f}".rstrip("0").rstrip("."), str(r["txs"]),
-                  _ts(str(r.get("first_ts") or 0)))
+                  f"{r['value']:.8f}".rstrip("0").rstrip(".") or "0", str(r["txs"]),
+                  _ts(str(r.get("first_ts") or 0)), *([str(r.get("nfts") or "")] if nfts else []))
     return t
 
 
@@ -224,6 +227,68 @@ def funding_tree(address: str, hops: list, symbol: str = "ETH") -> Tree:
     return root
 
 
+def drain_report(res: dict):
+    """What `crypttrace check` prints: verdict, what was taken, where it went, what to do."""
+    from rich.console import Group
+    from rich.panel import Panel
+    verdict = {
+        "drained": ("[bold red]DRAINED[/bold red] — someone who has this wallet's key or seed "
+                    "phrase emptied it.", "red"),
+        "suspicious": ("[bold yellow]POSSIBLY DRAINED[/bold yellow] — the wallet was emptied to a new "
+                       "address. If you did not send it, treat the key as leaked.", "yellow"),
+        "no_drain": ("[bold green]No drain found[/bold green] in the history read.", "green"),
+    }[res["verdict"]]
+    parts = [Text.from_markup(verdict[0])]
+    for r in res.get("reasons", []):
+        parts.append(Text(f"  • {r}"))
+    if res["verdict"] != "no_drain":
+        taken = ", ".join(f"{v:,.4f} {k}" for k, v in res.get("assets", {}).items())
+        if res.get("nfts"):
+            taken += f"{', ' if taken else ''}{res['nfts']} NFT"
+        t = Table(show_header=False, box=None, pad_edge=False)
+        t.add_column(style="dim")
+        t.add_column()
+        t.add_row("when (UTC)", _ts(str(res.get("start") or 0)))
+        t.add_row("taken", escape(taken or "—"))
+        t.add_row("to", escape(res["to"] + (f"  [{res['to_label']}]" if res.get("to_label") else "")))
+        if res.get("other_wallets_same_hour") is not None:
+            t.add_row("same hour", f"this address emptied {res['other_wallets_same_hour']} other wallet(s)")
+        parts += [Text(""), t]
+        if res.get("next"):
+            nx = Table(title="Where the money went next — the memo names one account at the exchange",
+                       header_style="bold")
+            nx.add_column("Exchange")
+            nx.add_column("Memo", style="bold green")
+            nx.add_column("Amount", justify="right")
+            nx.add_column("Deposited from")
+            for d in res["next"]:
+                amt = f"{d['value']:,.4f} {d['symbol']}" if d.get("value") is not None else "—"
+                nx.add_row(escape(d["exchange"]), escape(d.get("memo") or "—"), amt,
+                           escape(d["from"][:10] + "…" + d["from"][-6:]))
+            parts += [Text(""), nx]
+        steps = ["This seed phrase is burned. Make a new wallet with a new seed phrase; never type it "
+                 "into a site, bot or \"support\" chat again.",
+                 "Send nothing to this wallet — " + ("the attacker took money that arrived after the "
+                                                     "drain, too." if res.get("resweeps") else
+                                                     "anything that arrives can be taken."),
+                 "Other wallets made from the same seed phrase (other versions, other networks) are "
+                 "exposed too: move them first."]
+        left = [f"{x['amount']:,.4f} {x['symbol']}" for x in res.get("remaining_tokens", [])]
+        if res.get("remaining_nfts"):
+            left.append(f"{res['remaining_nfts']} NFT")
+        if left:
+            steps.insert(1, "Move what is still here to the new wallet right away: " + ", ".join(left) + ".")
+        if any(d.get("memo") for d in res.get("next", [])):
+            steps.append("Report it to the police and to the exchange above, quoting the memo and the "
+                         "transaction: the exchange can freeze the account and identify its owner.")
+        else:
+            steps.append("Report it to the police with this wallet, the receiving address and the time.")
+        parts += [Text(""), Text("What to do now", style="bold")]
+        parts += [Text(f"  {i}. {s}") for i, s in enumerate(steps, 1)]
+    return Panel(Group(*parts), title=f"Drain check — {res['address']} ({res['chain']})",
+                 border_style=verdict[1])
+
+
 def deposits_table(deposits: list) -> Table:
     """Exchange deposits made with a memo — each memo names one account at the exchange."""
     t = Table(title="Exchange deposits — the memo names one account at the exchange (KYC)",

{crypttrace-0.14.0 → crypttrace-0.16.0}/src/crypttrace/store.py

@@ -77,6 +77,15 @@ def _conn() -> sqlite3.Connection:
         c.execute("DELETE FROM fetched WHERE chain='ton'")
         c.execute("PRAGMA user_version=2")
         c.commit()
+    if c.execute("PRAGMA user_version").fetchone()[0] < 3:
+        # 0.15: TON rows say whether they are contract plumbing or a note
+        cols = [r[1] for r in c.execute("PRAGMA table_info(transfers)")]
+        if "kind" not in cols:
+            c.execute("ALTER TABLE transfers ADD COLUMN kind TEXT")
+        c.execute("DELETE FROM transfers WHERE chain='ton'")
+        c.execute("DELETE FROM fetched WHERE chain='ton'")
+        c.execute("PRAGMA user_version=3")
+        c.commit()
     return c
 
 
@@ -100,12 +109,13 @@ def save(chain: str, address: str, rows: List[dict], asset_key: str = "",
     try:
         c.executemany(
             "INSERT OR REPLACE INTO transfers"
-            "(id,chain,tx_hash,from_addr,to_addr,value,symbol,contract,ts,fee_share,memo)"
-            " VALUES (?,?,?,?,?,?,?,?,?,?,?)",
+            "(id,chain,tx_hash,from_addr,to_addr,value,symbol,contract,ts,fee_share,memo,kind)"
+            " VALUES (?,?,?,?,?,?,?,?,?,?,?,?)",
             [(_row_id(chain, r), chain, r.get("hash", ""), r.get("from", ""),
               r.get("to", ""), float(r.get("value", 0) or 0), r.get("symbol", ""),
               r.get("contract", ""), int(r.get("timestamp", 0) or 0),
-              float(r.get("fee_share", 0) or 0), r.get("memo") or None) for r in rows])
+              float(r.get("fee_share", 0) or 0), r.get("memo") or None,
+              r.get("kind") or None) for r in rows])
         c.execute("INSERT OR REPLACE INTO fetched(chain,address,asset,fetched_at,rows,complete)"
                   " VALUES (?,?,?,?,?,?)",
                   (chain, address, asset_key, int(time.time()), len(rows), int(complete)))
@@ -135,7 +145,7 @@ def is_fresh(chain: str, address: str, asset_key: str = "",
 def load(chain: str, address: str, contract: str = "", native_symbol: str = "") -> List[dict]:
     """Every stored transfer touching this address, newest first."""
     c = _conn()
-    cols = "SELECT from_addr,to_addr,value,symbol,contract,ts,tx_hash,fee_share,memo FROM transfers"
+    cols = "SELECT from_addr,to_addr,value,symbol,contract,ts,tx_hash,fee_share,memo,kind FROM transfers"
     try:
         if contract == "*":
             # every token, whatever its contract (address-poisoning checks need fakes too)
@@ -161,7 +171,7 @@ def load(chain: str, address: str, contract: str = "", native_symbol: str = "")
     finally:
         c.close()
     out = []
-    for f, t, v, sym, con, ts, h, fee, memo in rows:
+    for f, t, v, sym, con, ts, h, fee, memo, kind in rows:
         r = {"from": f, "to": t, "value": v, "symbol": sym,
              "timestamp": ts, "hash": h}
         if con:
@@ -170,6 +180,8 @@ def load(chain: str, address: str, contract: str = "", native_symbol: str = "")
             r["fee_share"] = fee
         if memo:
             r["memo"] = memo
+        if kind:
+            r["kind"] = kind
         out.append(r)
     return out
 

{crypttrace-0.14.0 → crypttrace-0.16.0}/src/crypttrace/verify.py

@@ -21,6 +21,9 @@ from crypttrace.fetchers import bitcoin
 # how far computed and reported totals may drift before we complain
 REL_TOLERANCE = 0.005     # 0.5%
 ABS_TOLERANCE = 1e-6
+# fee an account-based chain may charge per outgoing transaction, which never
+# shows up as a transfer: the net-vs-balance check allows this much per tx
+GAS_PER_TX = {"ton": 0.02}
 
 
 def _within(a: float, b: float) -> bool:
@@ -99,7 +102,9 @@ def reconcile(address: str, chain: str = "btc", asset: Optional[dict] = None,
     if ref_in is None and ref_balance is not None and asset is None and complete:
         # no aggregate feed: fall back to net vs balance (fees make it inexact)
         net = got_in - got_out
-        ok = abs(net - ref_balance) <= max(0.01, abs(ref_balance) * 0.02)
+        n_out = len({r.get("hash") for r in rows if r.get("from") == me})
+        ok = abs(net - ref_balance) <= max(0.01, abs(ref_balance) * 0.02,
+                                           GAS_PER_TX.get(chain, 0) * n_out)
         checks.append(("net vs balance", net, ref_balance, ok))
         if not ok:
             notes.append("net flow differs from the current balance; on account-based "

{crypttrace-0.14.0 → crypttrace-0.16.0}/src/crypttrace/web/index.html

@@ -192,6 +192,7 @@
   .t-unknown,.t-offramp{color:var(--dim);background:rgba(147,161,181,.12)}
   .muted{color:var(--dim);font-size:13px;line-height:1.55}
   .err{color:var(--red);font-size:13px}
+  .warn{color:#ffc857;font-size:13px}
   .alert{border-color:rgba(255,107,96,.4);background:rgba(255,107,96,.08)}
   a.btnlink{display:inline-block;margin-top:9px;font-size:12.5px;color:var(--accent);text-decoration:none;
     padding:7px 12px;border-radius:10px;background:rgba(77,157,255,.10);border:1px solid rgba(77,157,255,.28);transition:.25s}
@@ -248,6 +249,7 @@
     <button class="tab" data-view="timeline">Timeline</button>
     <button class="tab" data-view="victims">Who sent funds here</button>
     <button class="tab" data-view="poison">Poisoning</button>
+    <button class="tab" data-view="check">Was I drained?</button>
   </div>
   <div class="stage">
     <div class="loader" id="loader"></div>
@@ -258,6 +260,7 @@
     <div class="view" id="v-timeline"></div>
     <div class="view" id="v-victims"></div>
     <div class="view" id="v-poison"></div>
+    <div class="view" id="v-check"></div>
     <div class="scaleview" id="scaleview" style="display:none">100%</div>
     <div class="zoomctl" id="zoomctl">
       <button id="zin"  title="Zoom in">+</button>
@@ -536,6 +539,7 @@ function showView(v){
   $('#v-timeline').classList.toggle('on',v==='timeline');
   $('#v-victims').classList.toggle('on',v==='victims');
   $('#v-poison').classList.toggle('on',v==='poison');
+  $('#v-check').classList.toggle('on',v==='check');
   const a=$('#addr').value.trim();
   if(a && !loaded[v+a]) {
     loaded[v+a]=true;
@@ -543,6 +547,7 @@ function showView(v){
     if(v==='victims') loadVictims(a);
     if(v==='assess') loadAssessment(a);
     if(v==='poison') loadPoisoning(a);
+    if(v==='check') loadCheck(a);
   }
 }
 document.querySelectorAll('.tab').forEach(t=>t.onclick=()=>showView(t.dataset.view));
@@ -610,6 +615,46 @@ async function loadAssessment(a){
 }
 
 let victimRows=[], victimSym='';
+async function loadCheck(a){
+  const el=$('#v-check');
+  el.innerHTML='<div class="muted"><span class="spin"></span>Reading the wallet\'s history…</div>';
+  try{
+    const r=await api(`/api/check?address=${q(a)}&chain=${chain()}`);
+    const head={drained:['err','DRAINED — someone who has this wallet\'s key or seed phrase emptied it.'],
+      suspicious:['warn','POSSIBLY DRAINED — the wallet was emptied to a new address. If you did not send it, treat the key as leaked.'],
+      no_drain:['muted','No drain found in the history read.']}[r.verdict];
+    let h=`<div class="${head[0]}" style="font-weight:600;margin-bottom:10px">${esc(head[1])}</div>`;
+    h+=(r.reasons||[]).map(x=>`<div>• ${esc(x)}</div>`).join('');
+    if(r.verdict!=='no_drain'){
+      const taken=Object.entries(r.assets||{}).map(([k,v])=>`${Number(v).toLocaleString()} ${esc(k)}`)
+        .concat(r.nfts?[`${r.nfts} NFT`]:[]).join(', ');
+      h+=`<table class="grid" style="margin-top:12px"><tbody>
+        <tr><td>when (UTC)</td><td>${dstamp(r.start)}</td></tr>
+        <tr><td>taken</td><td>${taken||'—'}</td></tr>
+        <tr><td>to</td><td class="mono"><a href="${safeUrl(r.to_explorer)}" target="_blank" rel="noopener">${esc(r.to)}</a>
+          ${r.to_label?`<span class="pill t-${esc(r.to_type)}" style="margin-left:6px">${esc(r.to_label)}</span>`:''}</td></tr>
+        <tr><td>same hour</td><td>this address emptied ${r.other_wallets_same_hour??'?'} other wallet(s)</td></tr>
+      </tbody></table>`;
+      if((r.next||[]).length){
+        h+=`<h3 style="margin-top:16px">Where the money went next</h3>
+          <div class="muted">The memo names one account at the exchange — quote it with the transaction when you report.</div>
+          <table class="grid"><thead><tr><th>Exchange</th><th>Memo</th><th style="text-align:right">Amount</th></tr></thead><tbody>`+
+          r.next.map(d=>`<tr><td>${esc(d.exchange)}</td><td class="mono"><b>${esc(d.memo||'—')}</b></td>
+            <td class="num">${d.value!=null?Number(d.value).toLocaleString()+' '+esc(d.symbol):'—'}</td></tr>`).join('')+'</tbody></table>';
+      }
+      const left=(r.remaining_tokens||[]).map(x=>`${Number(x.amount).toLocaleString()} ${esc(x.symbol)}`)
+        .concat(r.remaining_nfts?[`${r.remaining_nfts} NFT`]:[]);
+      h+=`<h3 style="margin-top:16px">What to do now</h3><ol>
+        <li>This seed phrase is burned. Make a new wallet with a new seed phrase; never type it into a site, bot or "support" chat again.</li>
+        ${left.length?`<li>Move what is still here to the new wallet right away: ${left.join(', ')}.</li>`:''}
+        <li>Send nothing to this wallet — ${r.resweeps?'the attacker took money that arrived after the drain, too.':'anything that arrives can be taken.'}</li>
+        <li>Other wallets made from the same seed phrase are exposed too: move them first.</li>
+        <li>${(r.next||[]).some(d=>d.memo)?'Report it to the police and to the exchange above, quoting the memo and the transaction.':'Report it to the police with this wallet, the receiving address and the time.'}</li></ol>`;
+    }
+    el.innerHTML=`<div style="max-width:860px">${h}</div>`;
+  }catch(e){ el.innerHTML=`<div class="err">${esc(e.message)}</div>`; }
+}
+
 async function loadVictims(a){
   const el=$('#v-victims');
   el.innerHTML='<div class="muted"><span class="spin"></span>Walking the money backwards…</div>';

{crypttrace-0.14.0 → crypttrace-0.16.0}/src/crypttrace/webapp.py

@@ -185,6 +185,21 @@ def create_app() -> Flask:
         v["symbol"] = asset["symbol"] if asset else chains.symbol(chain)
         return jsonify(v)
 
+    @app.route("/api/check")
+    def api_check():
+        from crypttrace import drain
+        addr = request.args.get("address", "")
+        chain = request.args.get("chain", "eth")
+        bad = validate(addr, chain)
+        if bad:
+            return jsonify({"error": bad}), 400
+        try:
+            res = drain.check(addr, chain)
+        except _KNOWN_ERRORS as e:
+            return jsonify({"error": str(e)}), 400
+        res["to_explorer"] = chains.explorer_url(res["to"], chain) if res.get("to") else None
+        return jsonify(res)
+
     @app.route("/api/victims")
     def api_victims():
         """Addresses that fed this wallet — in a mass theft, the victim list."""
@@ -212,6 +227,7 @@ def create_app() -> Flask:
                 "address": r["address"], "hop": r.get("hop", 1),
                 "value": round(r["value"], 8), "txs": r["txs"],
                 "first_seen": r.get("first_ts"), "last_seen": r.get("last_ts"),
+                "nfts": r.get("nfts", 0),
                 "label": r.get("label", ""), "type": r.get("type", "unknown"),
                 "into": r.get("into", ""),
                 "explorer": chains.explorer_url(r["address"], chain),

{crypttrace-0.14.0 → crypttrace-0.16.0/src/crypttrace.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: crypttrace
-Version: 0.14.0
+Version: 0.16.0
 Summary: OSINT toolkit for crypto investigations: trace stolen funds across Ethereum, Bitcoin, Tron, Solana and TON
 Author: bobslayerX
 License-Expression: MIT
@@ -129,6 +129,30 @@ them (`UQ…`); jetton transfers are reported between the owners' wallets.
 
 ---
 
+## Was my wallet drained?
+
+```bash
+crypttrace check YOUR_ADDRESS --chain ton
+```
+
+For someone who just found their wallet empty. `check` reads the wallet's
+history and answers in plain language:
+
+- **drained or not** — several signed transfers moving everything (tokens, NFTs,
+  then the coin) to one new address within minutes, leaving the wallet empty:
+  a program holding your key did that, not you;
+- **a mass drain?** — whether the same address emptied other wallets in the same
+  hour (leaked keys from a shared service or tool, not a scam aimed at you);
+- **is the key still in use?** — money that arrived after the drain and was
+  taken too;
+- **where the money went next** — exchange deposits with the memo that names the
+  account (see *Exchange deposits with a memo*);
+- **what to do now** — what is still on the wallet worth moving (on TON: real
+  jetton balances and NFTs from trusted collections, not airdropped spam), and
+  who to report to.
+
+The web UI has the same check in its **Was I drained?** tab.
+
 ## Web UI
 
 ```bash
@@ -412,6 +436,13 @@ flip the timing verdict entirely. Each chain has a dust threshold; override with
 paged rather than read one page deep, so an old sweep isn't hidden behind recent
 spam.
 
+**On TON, only payments count.** A drainer's collector also receives notes
+people send the attacker, dust from look-alike addresses, and gas refunds and
+notices from jetton wallets and NFT items. None of those senders are victims,
+and `victims` leaves them out. It also counts the NFTs (Telegram usernames,
+numbers, domains) each wallet lost — a victim who lost only NFTs is listed too,
+with an `nfts` column in the CSV. Failed (aborted) NFT transfers are not counted.
+
 ### Bitcoin clustering (common-input-ownership)
 
 Bitcoin's UTXO model enables the strongest clustering heuristic in blockchain

{crypttrace-0.14.0 → crypttrace-0.16.0}/src/crypttrace.egg-info/SOURCES.txt

@@ -10,6 +10,7 @@ src/crypttrace/bridges.py
 src/crypttrace/chains.py
 src/crypttrace/cli.py
 src/crypttrace/config.py
+src/crypttrace/drain.py
 src/crypttrace/freeze.py
 src/crypttrace/funder.py
 src/crypttrace/investigate.py