crypttrace 0.2.0__tar.gz → 0.3.0__tar.gz

{crypttrace-0.2.0/src/crypttrace.egg-info → crypttrace-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: crypttrace
-Version: 0.2.0
+Version: 0.3.0
 Summary: OSINT toolkit for crypto investigations: trace stolen funds across Ethereum, Bitcoin, Tron and Solana
 Author: bobslayerX
 License-Expression: MIT
@@ -273,7 +273,9 @@ behaviour: an address forwarding most of its outgoing value to a labelled
 exchange is almost certainly a deposit address, i.e. the cash-out point where
 that exchange holds the depositor's KYC. `trace` applies the same heuristic
 automatically, turning an anonymous intermediary into "→ Binance deposit (KYC
-point)".
+point)". It works on every supported chain; on Tron and Solana, where deposits
+are usually swept as stablecoins, it checks USDT and USDC as well as the native
+coin.
 
 ### First-funder (deanonymization)
 
@@ -371,11 +373,12 @@ SDN sanctioned-address list — and merges them into the local DB in
 `~/.crypttrace/`. The curated seed wins on conflicts, so richer names survive.
 Add sources in `labels/labels.py` → `SOURCES`.
 
-Bitcoin, Tron and Solana coverage is currently Binance only: its reserve
-wallets, taken from the address list Binance publishes itself for
-proof-of-reserves. So `offramp` can flag Binance deposit addresses on those
-chains, but funds sent to other exchanges there will still show as `unknown`.
-Every label records where it came from — see `crypttrace labels audit`.
+On Bitcoin, Tron and Solana the labels cover the reserve wallets of Binance,
+OKX and HTX, plus Bybit's older 2022 list — each taken from the address list the
+exchange publishes itself for proof-of-reserves. That is what lets `offramp`
+flag deposit addresses on those chains. Funds sent to an exchange not on that
+list still show as `unknown`. Every label records where it came from — see
+`crypttrace labels audit`.
 
 ### Reports
 
@@ -478,7 +481,16 @@ cases/             # worked investigations with their data
 
 ## Roadmap
 
-- Exchange/service labels for Bitcoin, Tron and Solana
+- More exchanges on Bitcoin, Tron and Solana (now: Binance, OKX, HTX, Bybit),
+  and refreshing these lists as the exchanges republish them
+- OKX's full signed address set (~310k, mostly deposit addresses) as an
+  optional `update-labels` download, so deposits are labelled outright
+- Address-poisoning detection: flag look-alike addresses (same first and last
+  characters) in a victim's history before they copy the wrong one
+- Stablecoin freeze check: whether USDT/USDC at an address is already frozen
+  by the issuer, and who to ask for a freeze
+- `report --html`: one self-contained file with the interactive graph, to
+  send to an exchange or attach to a police report
 - `report --pdf` for exchange and law-enforcement filings
 - Internal transactions (completes `funder` and contract-mediated transfers)
 - Per-mint filtering for Solana SPL tokens

{crypttrace-0.2.0 → crypttrace-0.3.0}/README.md

@@ -239,7 +239,9 @@ behaviour: an address forwarding most of its outgoing value to a labelled
 exchange is almost certainly a deposit address, i.e. the cash-out point where
 that exchange holds the depositor's KYC. `trace` applies the same heuristic
 automatically, turning an anonymous intermediary into "→ Binance deposit (KYC
-point)".
+point)". It works on every supported chain; on Tron and Solana, where deposits
+are usually swept as stablecoins, it checks USDT and USDC as well as the native
+coin.
 
 ### First-funder (deanonymization)
 
@@ -337,11 +339,12 @@ SDN sanctioned-address list — and merges them into the local DB in
 `~/.crypttrace/`. The curated seed wins on conflicts, so richer names survive.
 Add sources in `labels/labels.py` → `SOURCES`.
 
-Bitcoin, Tron and Solana coverage is currently Binance only: its reserve
-wallets, taken from the address list Binance publishes itself for
-proof-of-reserves. So `offramp` can flag Binance deposit addresses on those
-chains, but funds sent to other exchanges there will still show as `unknown`.
-Every label records where it came from — see `crypttrace labels audit`.
+On Bitcoin, Tron and Solana the labels cover the reserve wallets of Binance,
+OKX and HTX, plus Bybit's older 2022 list — each taken from the address list the
+exchange publishes itself for proof-of-reserves. That is what lets `offramp`
+flag deposit addresses on those chains. Funds sent to an exchange not on that
+list still show as `unknown`. Every label records where it came from — see
+`crypttrace labels audit`.
 
 ### Reports
 
@@ -444,7 +447,16 @@ cases/             # worked investigations with their data
 
 ## Roadmap
 
-- Exchange/service labels for Bitcoin, Tron and Solana
+- More exchanges on Bitcoin, Tron and Solana (now: Binance, OKX, HTX, Bybit),
+  and refreshing these lists as the exchanges republish them
+- OKX's full signed address set (~310k, mostly deposit addresses) as an
+  optional `update-labels` download, so deposits are labelled outright
+- Address-poisoning detection: flag look-alike addresses (same first and last
+  characters) in a victim's history before they copy the wrong one
+- Stablecoin freeze check: whether USDT/USDC at an address is already frozen
+  by the issuer, and who to ask for a freeze
+- `report --html`: one self-contained file with the interactive graph, to
+  send to an exchange or attach to a police report
 - `report --pdf` for exchange and law-enforcement filings
 - Internal transactions (completes `funder` and contract-mediated transfers)
 - Per-mint filtering for Solana SPL tokens

{crypttrace-0.2.0 → crypttrace-0.3.0}/src/crypttrace/__init__.py

@@ -1,2 +1,2 @@
 """crypttrace — OSINT crypto investigation CLI."""
-__version__ = "0.2.0"
+__version__ = "0.3.0"

{crypttrace-0.2.0 → crypttrace-0.3.0}/src/crypttrace/cli.py

@@ -262,21 +262,21 @@ def crosschain(
 
 @app.command()
 def offramp(
-    address: str = typer.Argument(..., help="Address to check (0x…)"),
+    address: str = typer.Argument(..., help="Address to check"),
     chain: str = CHAIN_OPT,
 ):
     """Check whether an address is an exchange deposit address (cash-out / off-ramp)."""
     try:
         hit = offramp_mod.detect(address, chain)
-    except etherscan.EtherscanError as e:
+    except (chains_mod.ChainError, etherscan.EtherscanError) as e:
         console.print(f"[red]Error:[/red] {e}")
         raise typer.Exit(1)
     if hit:
         pct = int(hit["fraction"] * 100)
         console.print(
             f"[green]➜ Likely off-ramp:[/green] this address forwarded ~{pct}% of outgoing "
-            f"funds ({hit['forwarded']:.4f}) to [bold]{hit['exchange']}[/bold].\n"
-            f"  It is probably a {hit['exchange']} deposit address — a KYC identification point."
+            f"funds ({hit['forwarded']:.4f} {hit['symbol']}) to [bold]{hit['exchange']}[/bold].\n"
+            f"  It is probably a deposit address at {hit['company']} — a KYC identification point."
         )
     else:
         console.print("[dim]No exchange-forwarding pattern detected. "

{crypttrace-0.2.0 → crypttrace-0.3.0}/src/crypttrace/investigate.py

@@ -74,7 +74,7 @@ def analyse(address: str, chain: str = "eth", asset: Optional[dict] = None,
         result["funding"] = []
 
     try:
-        result["offramp"] = offramp_mod.detect(address, chain) if chains.is_evm(chain) else None
+        result["offramp"] = offramp_mod.detect(address, chain)
     except Exception:
         result["offramp"] = None
 
@@ -82,20 +82,11 @@ def analyse(address: str, chain: str = "eth", asset: Optional[dict] = None,
     return result
 
 
-def _service_name(label: str) -> str:
-    """'Binance 14 (hot wallet)' -> 'Binance' — victims need the company, not our label."""
-    import re
-    name = re.sub(r"\(.*?\)", "", label)          # drop parentheticals
-    name = name.split(" deposit")[0].split(":")[0]
-    name = re.sub(r"\s+\d+\s*$", "", name.strip())  # drop trailing wallet numbers
-    return name.strip() or label
-
-
 def build_guidance(r: dict) -> dict:
     """Turn findings into plain-language next steps."""
     steps: List[dict] = []
     exchanges = r["exchanges"]
-    ex_names = sorted({_service_name(f["label"]) for f in exchanges}) if exchanges else []
+    ex_names = sorted({labels.company(f["label"]) for f in exchanges}) if exchanges else []
 
     if exchanges:
         headline = ("Good news, relatively speaking: the trail reaches a "