crypttrace 0.18.0__tar.gz → 0.19.0__tar.gz

{crypttrace-0.18.0/src/crypttrace.egg-info → crypttrace-0.19.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: crypttrace
-Version: 0.18.0
+Version: 0.19.0
 Summary: OSINT toolkit for crypto investigations: trace stolen funds across Ethereum, Bitcoin, Tron, Solana and TON
 Author: bobslayerX
 License-Expression: MIT
@@ -689,7 +689,6 @@ cases/             # worked investigations with their data
 - More exchanges on Bitcoin, Tron, Solana (now: Binance, OKX, HTX, Bybit) and
   TON (now: Binance),
   and refreshing these lists as the exchanges republish them
-- Internal transactions (completes `funder` and contract-mediated transfers)
 - More label sources: Chainabuse, CryptoScamDB, exchange deposit-address sets
 - Entity clustering on EVM via the gas-funding heuristic
 

{crypttrace-0.18.0 → crypttrace-0.19.0}/README.md

@@ -655,7 +655,6 @@ cases/             # worked investigations with their data
 - More exchanges on Bitcoin, Tron, Solana (now: Binance, OKX, HTX, Bybit) and
   TON (now: Binance),
   and refreshing these lists as the exchanges republish them
-- Internal transactions (completes `funder` and contract-mediated transfers)
 - More label sources: Chainabuse, CryptoScamDB, exchange deposit-address sets
 - Entity clustering on EVM via the gas-funding heuristic
 

{crypttrace-0.18.0 → crypttrace-0.19.0}/src/crypttrace/__init__.py

@@ -1,2 +1,2 @@
 """crypttrace — OSINT crypto investigation CLI."""
-__version__ = "0.18.0"
+__version__ = "0.19.0"

{crypttrace-0.18.0 → crypttrace-0.19.0}/src/crypttrace/chains.py

@@ -102,15 +102,26 @@ def balance(address: str, chain: str = "eth") -> float:
 # ---------- normalized row builders ----------
 
 def _evm_native(address: str, chain: str, limit: int) -> List[Dict]:
+    """The native coin moved: normal transactions plus internal ones (sent by contracts —
+    withdrawals from mixers and exchanges, ETH back from swaps). Failed calls moved nothing."""
     rows = []
-    for tx in etherscan.get_txs(address, chain, limit=limit):
+    calls = [(tx, False) for tx in etherscan.get_txs(address, chain, limit=limit)]
+    calls += [(tx, True) for tx in etherscan.get_internal_txs(address, chain, limit=limit)]
+    for tx, internal in calls:
+        if str(tx.get("isError", "0")) == "1":
+            continue
         try:
             val = int(tx.get("value", 0)) / config.WEI
         except (TypeError, ValueError):
             val = 0.0
-        rows.append({"from": tx.get("from", "").lower(), "to": tx.get("to", "").lower(),
-                     "value": val, "timestamp": int(tx.get("timeStamp", "0") or 0),
-                     "hash": tx.get("hash", ""), "symbol": symbol(chain)})
+        if internal and val <= 0:
+            continue
+        row = {"from": tx.get("from", "").lower(), "to": (tx.get("to") or "").lower(),
+               "value": val, "timestamp": int(tx.get("timeStamp", "0") or 0),
+               "hash": tx.get("hash", ""), "symbol": symbol(chain)}
+        if internal:
+            row["internal"] = True
+        rows.append(row)
     return rows
 
 

{crypttrace-0.18.0 → crypttrace-0.19.0}/src/crypttrace/config.py

@@ -1,7 +1,22 @@
 """Configuration and shared constants."""
 import os
+import sys
 from pathlib import Path
 
+
+def env(name: str, default: str = "") -> str:
+    """An environment variable — falling back, on Windows, to the user environment, so a key
+    saved with [Environment]::SetEnvironmentVariable(..., "User") works in an already-open shell."""
+    value = os.environ.get(name)
+    if not value and sys.platform == "win32":
+        try:
+            import winreg
+            with winreg.OpenKey(winreg.HKEY_CURRENT_USER, "Environment") as reg:
+                value = winreg.QueryValueEx(reg, name)[0]
+        except OSError:
+            value = None
+    return (value or default).strip()
+
 # Data dir for cache + labels (created on first run)
 DATA_DIR = Path(os.environ.get("CRYPTTRACE_HOME", Path.home() / ".crypttrace"))
 DATA_DIR.mkdir(parents=True, exist_ok=True)
@@ -11,7 +26,7 @@ CACHE_DB = DATA_DIR / "cache.sqlite"
 # Etherscan v2 API. One key works across all EVM chains via chainid param.
 # Get a free key at https://etherscan.io/myapikey and export it:
 #   export ETHERSCAN_API_KEY=xxxx
-ETHERSCAN_API_KEY = os.environ.get("ETHERSCAN_API_KEY", "")
+ETHERSCAN_API_KEY = env("ETHERSCAN_API_KEY")
 ETHERSCAN_BASE = "https://api.etherscan.io/v2/api"
 
 # Supported EVM chains: name -> chainid

{crypttrace-0.18.0 → crypttrace-0.19.0}/src/crypttrace/fetchers/etherscan.py

@@ -104,6 +104,19 @@ def get_txs(address: str, chain: str = "eth", limit: int = 1000,
     return result if isinstance(result, list) else []
 
 
+def get_internal_txs(address: str, chain: str = "eth", limit: int = 1000,
+                     sort: str = "desc") -> List[dict]:
+    """Internal transactions: the native coin a contract sent or received as part of a call
+    (a mixer or exchange withdrawal, ETH back from a DEX swap, a multisig payout)."""
+    data = _call(chain, {
+        "module": "account", "action": "txlistinternal", "address": address,
+        "startblock": "0", "endblock": "99999999",
+        "page": "1", "offset": str(limit), "sort": sort,
+    })
+    result = data.get("result")
+    return result if isinstance(result, list) else []
+
+
 def get_token_txs(address: str, chain: str = "eth", limit: int = 1000) -> List[dict]:
     """ERC-20 token transfers, newest first."""
     data = _call(chain, {

{crypttrace-0.18.0 → crypttrace-0.19.0}/src/crypttrace/labels/known.json

@@ -10,10 +10,10 @@
   "0x1522900b6dafac587d499a862861c0869be6e428": {"name": "OKX", "type": "exchange"},
   "0x2faf487a4414fe77e2327f0bf4ae2a264a776ad2": {"name": "FTX (defunct)", "type": "exchange"},
   "0x722122df12d4e14e13ac3b6895a86e84145b6967": {"name": "Tornado Cash: Router", "type": "mixer"},
-  "0xd90e2f925da726b50c4ed8d0fb90ad053324f31b": {"name": "Tornado Cash: 0.1 ETH", "type": "mixer"},
+  "0xd90e2f925da726b50c4ed8d0fb90ad053324f31b": {"name": "Tornado Cash: router", "type": "mixer", "chain": "eth", "source": "own check of its internal transactions (2026-10-17): pays out withdrawals of the 0.1, 1 and 10 ETH pools, so a router, not the 0.1 ETH pool it was labelled as", "source_kind": "research", "added": "2026-10-17"},
   "0x910cbd523d972eb0a6f4cae4618ad62622b39dbf": {"name": "Tornado Cash: 10 ETH", "type": "mixer"},
   "0xa160cdab225685da1d56aa342ad8841c3b53f291": {"name": "Tornado Cash: 100 ETH", "type": "mixer"},
-  "0x12d66f87a04a9e220743712ce6d9bb1b5616b8fc": {"name": "Tornado Cash: 1 ETH", "type": "mixer"},
+  "0x12d66f87a04a9e220743712ce6d9bb1b5616b8fc": {"name": "Tornado Cash: 0.1 ETH", "type": "mixer", "chain": "eth", "source": "own check of its internal transactions (2026-10-17): every withdrawal pays out 0.1 ETH in total (recipient plus relayer fee); was labelled 1 ETH", "source_kind": "research", "added": "2026-10-17"},
   "0x3ee18b2214aff97000d974cf647e7c347e8fa585": {"name": "Wormhole: Token Bridge", "type": "bridge"},
   "0x99c9fc46f92e8a1c0dec1b1747d010903e884be1": {"name": "Optimism: Gateway (L1 Bridge)", "type": "bridge"},
   "0x4dbd4fc535ac27206064b68ffcf827b0a60bab3f": {"name": "Arbitrum: Delayed Inbox", "type": "bridge"},

{crypttrace-0.18.0 → crypttrace-0.19.0}/src/crypttrace/labels/tronscan.py

@@ -12,8 +12,6 @@ Lookups are cached on disk for a week; only `enrich()` uses the network.
 """
 import datetime as dt
 import json
-import os
-import sys
 import time
 from typing import Dict, Iterable, Optional
 
@@ -31,15 +29,7 @@ _cache: Optional[Dict[str, dict]] = None
 
 
 def _key() -> Optional[str]:
-    k = os.environ.get("TRONSCAN_API_KEY")
-    if not k and sys.platform == "win32":          # set with [Environment]::SetEnvironmentVariable(..., "User")
-        try:
-            import winreg
-            with winreg.OpenKey(winreg.HKEY_CURRENT_USER, "Environment") as reg:
-                k = winreg.QueryValueEx(reg, "TRONSCAN_API_KEY")[0]
-        except OSError:
-            k = None
-    return (k or "").strip() or None
+    return config.env("TRONSCAN_API_KEY") or None
 
 
 def _load() -> Dict[str, dict]:

{crypttrace-0.18.0 → crypttrace-0.19.0}/src/crypttrace/store.py

@@ -86,6 +86,14 @@ def _conn() -> sqlite3.Connection:
         c.execute("DELETE FROM fetched WHERE chain='ton'")
         c.execute("PRAGMA user_version=3")
         c.commit()
+    if c.execute("PRAGMA user_version").fetchone()[0] < 4:
+        # 0.19: EVM native history now includes internal transactions — read it again
+        evm = tuple(config.CHAINS)
+        marks = ",".join("?" * len(evm))
+        c.execute(f"DELETE FROM transfers WHERE chain IN ({marks}) AND (contract IS NULL OR contract='')", evm)
+        c.execute(f"DELETE FROM fetched WHERE chain IN ({marks}) AND asset=''", evm)
+        c.execute("PRAGMA user_version=4")
+        c.commit()
     return c
 
 

{crypttrace-0.18.0 → crypttrace-0.19.0/src/crypttrace.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: crypttrace
-Version: 0.18.0
+Version: 0.19.0
 Summary: OSINT toolkit for crypto investigations: trace stolen funds across Ethereum, Bitcoin, Tron, Solana and TON
 Author: bobslayerX
 License-Expression: MIT
@@ -689,7 +689,6 @@ cases/             # worked investigations with their data
 - More exchanges on Bitcoin, Tron, Solana (now: Binance, OKX, HTX, Bybit) and
   TON (now: Binance),
   and refreshing these lists as the exchanges republish them
-- Internal transactions (completes `funder` and contract-mediated transfers)
 - More label sources: Chainabuse, CryptoScamDB, exchange deposit-address sets
 - Entity clustering on EVM via the gas-funding heuristic