crypttrace 0.23.0__tar.gz → 0.26.0__tar.gz

{crypttrace-0.23.0/src/crypttrace.egg-info → crypttrace-0.26.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: crypttrace
-Version: 0.23.0
+Version: 0.26.0
 Summary: OSINT toolkit for crypto investigations: trace stolen funds across Ethereum, Bitcoin, Tron, Solana and TON
 Author: bobslayerX
 License-Expression: MIT
@@ -79,7 +79,7 @@ python selftest.py                 # offline checks, no API keys needed
 
 | | Needed? | How to get it |
 |---|---|---|
-| **EVM chains** (Ethereum, BSC, Polygon, Arbitrum, Optimism, Base) | **Required** | Free key at [etherscan.io/myapikey](https://etherscan.io/myapikey). One v2 key covers all EVM chains. |
+| **EVM chains** (Ethereum, BSC, Polygon, Arbitrum, Optimism, Base) | **Required** | Free key at [etherscan.io/myapikey](https://etherscan.io/myapikey) covers Ethereum, Polygon and Arbitrum. BSC, Optimism and Base need a paid Etherscan plan; on a free key crypttrace says so instead of showing an empty wallet. |
 | **Bitcoin, Tron, Solana, TON** | **Not required** | Work out of the box via public endpoints. |
 
 ```bash
@@ -120,7 +120,7 @@ the number either way.
 
 | Chain | `--chain` | Data source | Model |
 |---|---|---|---|
-| Ethereum, BSC, Polygon, Arbitrum, Optimism, Base | `eth` `bsc` `polygon` `arbitrum` `optimism` `base` | Etherscan v2 | account |
+| Ethereum, BSC, Polygon, Arbitrum, Optimism, Base | `eth` `bsc` `polygon` `arbitrum` `optimism` `base` | Etherscan v2 (BSC, Optimism, Base: paid plan) | account |
 | Bitcoin | `btc` | mempool.space | UTXO |
 | Tron (TRX + USDT-TRC20) | `tron` | TronGrid | account |
 | Solana (SOL + SPL) | `sol` | public JSON-RPC | account |
@@ -555,7 +555,9 @@ On Bitcoin, Tron and Solana the labels cover the reserve wallets of Binance,
 OKX and HTX, plus Bybit's older 2022 list — each taken from the address list the
 exchange publishes itself for proof-of-reserves; on TON and the EVM chains
 (Ethereum, BNB Chain, Arbitrum, Polygon, Base, Optimism), Binance's reserve
-wallets. That is what lets `offramp` flag deposit addresses on those chains. Funds sent to an exchange not on that
+wallets. MEXC's reserve wallets are covered on every one of these chains, from
+the "verified wallets" table of its monthly Hacken proof-of-reserves audit.
+That is what lets `offramp` flag deposit addresses on those chains. Funds sent to an exchange not on that
 list still show as `unknown`. Every label records where it came from — see
 `crypttrace labels audit`.
 
@@ -715,8 +717,8 @@ cases/             # worked investigations with their data
 
 ## Roadmap
 
-- More exchanges on Bitcoin, Tron, Solana (now: Binance, OKX, HTX, Bybit), TON
-  and the EVM chains (now: Binance),
+- More exchanges on Bitcoin, Tron, Solana (now: Binance, OKX, HTX, Bybit, MEXC),
+  TON and the EVM chains (now: Binance, MEXC),
   and refreshing these lists as the exchanges republish them
 - More label sources: Chainabuse, CryptoScamDB, exchange deposit-address sets
 

{crypttrace-0.23.0 → crypttrace-0.26.0}/README.md

@@ -45,7 +45,7 @@ python selftest.py                 # offline checks, no API keys needed
 
 | | Needed? | How to get it |
 |---|---|---|
-| **EVM chains** (Ethereum, BSC, Polygon, Arbitrum, Optimism, Base) | **Required** | Free key at [etherscan.io/myapikey](https://etherscan.io/myapikey). One v2 key covers all EVM chains. |
+| **EVM chains** (Ethereum, BSC, Polygon, Arbitrum, Optimism, Base) | **Required** | Free key at [etherscan.io/myapikey](https://etherscan.io/myapikey) covers Ethereum, Polygon and Arbitrum. BSC, Optimism and Base need a paid Etherscan plan; on a free key crypttrace says so instead of showing an empty wallet. |
 | **Bitcoin, Tron, Solana, TON** | **Not required** | Work out of the box via public endpoints. |
 
 ```bash
@@ -86,7 +86,7 @@ the number either way.
 
 | Chain | `--chain` | Data source | Model |
 |---|---|---|---|
-| Ethereum, BSC, Polygon, Arbitrum, Optimism, Base | `eth` `bsc` `polygon` `arbitrum` `optimism` `base` | Etherscan v2 | account |
+| Ethereum, BSC, Polygon, Arbitrum, Optimism, Base | `eth` `bsc` `polygon` `arbitrum` `optimism` `base` | Etherscan v2 (BSC, Optimism, Base: paid plan) | account |
 | Bitcoin | `btc` | mempool.space | UTXO |
 | Tron (TRX + USDT-TRC20) | `tron` | TronGrid | account |
 | Solana (SOL + SPL) | `sol` | public JSON-RPC | account |
@@ -521,7 +521,9 @@ On Bitcoin, Tron and Solana the labels cover the reserve wallets of Binance,
 OKX and HTX, plus Bybit's older 2022 list — each taken from the address list the
 exchange publishes itself for proof-of-reserves; on TON and the EVM chains
 (Ethereum, BNB Chain, Arbitrum, Polygon, Base, Optimism), Binance's reserve
-wallets. That is what lets `offramp` flag deposit addresses on those chains. Funds sent to an exchange not on that
+wallets. MEXC's reserve wallets are covered on every one of these chains, from
+the "verified wallets" table of its monthly Hacken proof-of-reserves audit.
+That is what lets `offramp` flag deposit addresses on those chains. Funds sent to an exchange not on that
 list still show as `unknown`. Every label records where it came from — see
 `crypttrace labels audit`.
 
@@ -681,8 +683,8 @@ cases/             # worked investigations with their data
 
 ## Roadmap
 
-- More exchanges on Bitcoin, Tron, Solana (now: Binance, OKX, HTX, Bybit), TON
-  and the EVM chains (now: Binance),
+- More exchanges on Bitcoin, Tron, Solana (now: Binance, OKX, HTX, Bybit, MEXC),
+  TON and the EVM chains (now: Binance, MEXC),
   and refreshing these lists as the exchanges republish them
 - More label sources: Chainabuse, CryptoScamDB, exchange deposit-address sets
 

{crypttrace-0.23.0 → crypttrace-0.26.0}/src/crypttrace/__init__.py

@@ -1,2 +1,2 @@
 """crypttrace — OSINT crypto investigation CLI."""
-__version__ = "0.23.0"
+__version__ = "0.26.0"

{crypttrace-0.23.0 → crypttrace-0.26.0}/src/crypttrace/analysis.py

@@ -243,5 +243,5 @@ def describe_burst(burst, total_events: int) -> Optional[str]:
     if minutes <= 60 * 24:
         return (f"{count} of {total_events} transfers fall inside {minutes/60:.1f} hours ({when})."
                 " Activity is concentrated rather than spread out.")
-    return (f"Activity is spread over {minutes/60/24:.0f} days — no burst pattern, "
-            "which is what ordinary wallet use looks like.")
+    return (f"Activity is spread over {minutes/60/24:.0f} days — no burst pattern, so no sign "
+            "of an automated sweep (which says nothing about whose money it is).")

{crypttrace-0.23.0 → crypttrace-0.26.0}/src/crypttrace/assess.py

@@ -60,9 +60,16 @@ def constant_fee_signature(values: List[float], min_hits: int = 5) -> Optional[d
     return {"fee": delta, "hits": hits, "of": total, "share": hits / total}
 
 
-def repeated_amounts(values: List[float], min_repeat: int = 3) -> List[tuple]:
-    """Identical amounts arriving from unrelated addresses — batch automation."""
-    c = Counter(round(v, 8) for v in values if v > 0)
+def repeated_amounts(payments: List[tuple], min_repeat: int = 3) -> List[tuple]:
+    """Identical amounts arriving from unrelated addresses — batch automation.
+
+    `payments` are (amount, sender); an amount counts once per distinct sender,
+    so one wallet paying the same sum again is not a batch."""
+    senders: Dict[float, set] = {}
+    for v, frm in payments:
+        if v > 0:
+            senders.setdefault(round(v, 8), set()).add(frm)
+    c = Counter({amt: len(s) for amt, s in senders.items()})
     return [(amt, n) for amt, n in c.most_common(5) if n >= min_repeat]
 
 
@@ -143,7 +150,11 @@ def assess(address: str, chain: str = "eth", asset: Optional[dict] = None,
                 evidence={"count": b[1], "span_minutes": round(span_min, 1),
                           "from_ts": b[2], "to_ts": b[3]}))
 
-    rep = repeated_amounts([r.get("value", 0) for r in inbound])
+    # small sums are what spammers and lure campaigns send every known address, in
+    # fixed amounts by design; batch processing shows in money worth moving
+    floor = 100 * analysis.dust_threshold(chain, asset)
+    rep = repeated_amounts([(r.get("value", 0), r.get("from")) for r in inbound
+                            if r.get("value", 0) >= floor and not r.get("kind")])
     if rep:
         top = rep[0]
         signals.append(Signal(

{crypttrace-0.23.0 → crypttrace-0.26.0}/src/crypttrace/bridges.py

@@ -15,7 +15,7 @@ are reported as likely continuations with the delay and amount so the analyst
 can judge. (v1 matches native-coin value; token-bridging and recipient-address
 decoding from bridge calldata are natural extensions.)
 """
-from typing import List, Dict
+from typing import Dict, List, Optional
 
 from crypttrace.fetchers import etherscan
 from crypttrace.labels import labels
@@ -46,9 +46,13 @@ def bridge_outflows(address: str, chain: str = "eth") -> List[Dict]:
 
 
 def find_arrivals(address: str, source_chain: str, amount: float, after_ts: int,
-                  tol: float = 0.05, window_h: int = 48) -> List[Dict]:
+                  tol: float = 0.05, window_h: int = 48,
+                  unread: Optional[Dict[str, str]] = None) -> List[Dict]:
     """Search every other supported chain for an inbound transfer to `address`
-    of ~`amount` (within `tol`) within `window_h` hours after `after_ts`."""
+    of ~`amount` (within `tol`) within `window_h` hours after `after_ts`.
+
+    A chain that could not be read is no evidence of "no arrival": it goes into
+    `unread` (chain -> why) instead of silently counting as searched."""
     me = address.lower()
     hits = []
     for ch in config.CHAINS:
@@ -56,7 +60,9 @@ def find_arrivals(address: str, source_chain: str, amount: float, after_ts: int,
             continue
         try:
             txs = etherscan.get_txs(address, ch, limit=200, sort="asc")
-        except etherscan.EtherscanError:
+        except etherscan.EtherscanError as e:
+            if unread is not None:
+                unread[ch] = str(e)
             continue
         for tx in txs:
             if tx.get("to", "").lower() != me:
@@ -80,11 +86,12 @@ def find_arrivals(address: str, source_chain: str, amount: float, after_ts: int,
 
 
 def trace_cross(address: str, chain: str = "eth", tol: float = 0.05,
-                window_h: int = 48) -> List[Dict]:
-    """For each bridge-out from `address`, list likely continuations on other chains."""
+                window_h: int = 48, unread: Optional[Dict[str, str]] = None) -> List[Dict]:
+    """For each bridge-out from `address`, list likely continuations on other chains.
+    Chains that could not be searched are collected in `unread`."""
     results = []
     for out in bridge_outflows(address, chain):
         arrivals = find_arrivals(address, chain, out["amount"], out["timestamp"],
-                                 tol=tol, window_h=window_h)
+                                 tol=tol, window_h=window_h, unread=unread)
         results.append({"bridge_out": out, "arrivals": arrivals})
     return results

{crypttrace-0.23.0 → crypttrace-0.26.0}/src/crypttrace/cli.py

@@ -303,8 +303,9 @@ def crosschain(
     tol: float = typer.Option(0.05, "--tol", help="Amount tolerance (0.05 = 5%, for bridge fees)"),
 ):
     """Follow funds across bridges: find likely arrivals of the same address on other chains."""
+    unread = {}
     try:
-        results = bridges_mod.trace_cross(address, chain, tol=tol, window_h=window)
+        results = bridges_mod.trace_cross(address, chain, tol=tol, window_h=window, unread=unread)
     except etherscan.EtherscanError as e:
         console.print(f"[red]Error:[/red] {e}")
         raise typer.Exit(1)
@@ -313,6 +314,10 @@ def crosschain(
                       "address on this chain.[/dim]")
         return
     console.print(render.crosschain_tree(address, chain, results))
+    if unread:
+        console.print(f"\n[yellow]Not searched:[/yellow] {', '.join(sorted(unread))} — "
+                      "could not be read, so no arrival there is not evidence of none. "
+                      f"({next(iter(unread.values()))})")
     console.print("\n[dim]Cross-chain links are heuristic (same-address arrival by amount+time), "
                   "not proof. Verify each candidate before relying on it.[/dim]")
 
@@ -875,7 +880,8 @@ def chains():
     """List supported chains."""
     console.print("[bold]EVM[/bold] (Etherscan v2, needs ETHERSCAN_API_KEY):")
     for name, cid in config.CHAINS.items():
-        console.print(f"  {name:<10} chainid {cid}")
+        paid = "  (paid Etherscan plan only)" if name in config.PAID_PLAN_CHAINS else ""
+        console.print(f"  {name:<10} chainid {cid}{paid}")
     console.print("\n[bold]Non-EVM[/bold] (no API key needed):")
     console.print("  btc        Bitcoin — mempool.space (UTXO)")
     console.print("  tron       Tron — TronGrid (TRX + USDT-TRC20)")

{crypttrace-0.23.0 → crypttrace-0.26.0}/src/crypttrace/config.py

@@ -38,5 +38,7 @@ CHAINS = {
     "optimism": 10,
     "base": 8453,
 }
+# not served on Etherscan's free plan; the API says so and crypttrace reports it
+PAID_PLAN_CHAINS = {"bsc", "optimism", "base"}
 
 WEI = 10 ** 18

{crypttrace-0.23.0 → crypttrace-0.26.0}/src/crypttrace/evidence.py

@@ -19,7 +19,8 @@ from crypttrace import __version__, chains, drain
 from crypttrace.labels import labels
 
 # law-enforcement request portals, only where checked against the exchange's own site
-LE_PORTALS = {"KuCoin": "https://www.kucoin.com/legal/requests"}
+LE_PORTALS = {"KuCoin": "https://www.kucoin.com/legal/requests",
+              "MEXC": "https://www.mexc.com/support/ticket/submit/law-enforcement-requests"}
 SOURCES = {"ton": "toncenter.com (transactions), tonapi.io (account names)",
            "tron": "TronGrid", "btc": "mempool.space", "sol": "Solana JSON-RPC"}
 

{crypttrace-0.23.0 → crypttrace-0.26.0}/src/crypttrace/fetchers/etherscan.py

@@ -2,6 +2,11 @@
 
 The blockchain is public: every transaction is queryable. This module wraps the
 Etherscan API and caches responses so repeated traces don't re-hit the API.
+
+Etherscan's free plan does not cover every chain: BNB Chain, Base and Optimism
+need a paid plan. Etherscan says so in an error, which used to pass for an
+empty history — a wallet there looked untouched. Now any error Etherscan
+returns is raised (and never cached); only "No transactions found" is empty.
 """
 import json
 import sqlite3
@@ -50,6 +55,15 @@ class EtherscanError(RuntimeError):
     pass
 
 
+def _empty(data: dict) -> bool:
+    """A valid answer with nothing in it ("No transactions found") — not an error."""
+    return str(data.get("message", "")).startswith("No ") or isinstance(data.get("result"), list)
+
+
+def _failed(data: dict) -> bool:
+    return str(data.get("status")) == "0" and not _empty(data)
+
+
 MIN_INTERVAL = 0.22        # the free plan allows 5 calls a second
 _last_call = 0.0
 
@@ -70,7 +84,7 @@ def _call(chain: str, params: Dict[str, str], cache_age: int = 3600, _tries: int
     key = f"{chain}:" + "&".join(f"{k}={v}" for k, v in sorted(q.items()) if k != "apikey")
     from crypttrace.fetchers import http
     cached = None if http.FRESH else _cache_get(key, cache_age)
-    if cached is not None:
+    if cached is not None and not _failed(cached):      # older versions cached errors too
         return cached
 
     global _last_call
@@ -78,16 +92,23 @@ def _call(chain: str, params: Dict[str, str], cache_age: int = 3600, _tries: int
     if wait > 0:
         time.sleep(wait)
     _last_call = time.time()
-    resp = requests.get(config.ETHERSCAN_BASE, params=q, timeout=30)
-    resp.raise_for_status()
-    data = resp.json()
-    # status "0" with "No transactions found" is a valid empty result, not an error
-    if data.get("status") == "0" and "No transactions" not in str(data.get("message", "")):
-        # rate-limit or bad key etc.
-        if "rate limit" in str(data.get("result", "")).lower() and _tries < 4:
+    try:
+        resp = requests.get(config.ETHERSCAN_BASE, params=q, timeout=30)
+        resp.raise_for_status()
+        data = resp.json()
+    except (requests.RequestException, ValueError) as e:
+        raise EtherscanError(f"Etherscan request failed: {e}")
+    if _failed(data):
+        said = str(data.get("result") or data.get("message") or "")
+        if "rate limit" in said.lower() and _tries < 4:
             time.sleep(1 + _tries)
             return _call(chain, params, cache_age, _tries + 1)
-        # otherwise return as-is; caller handles empty
+        if "not supported for this chain" in said:
+            raise EtherscanError(
+                f"Etherscan's free plan does not cover {chain}: its history needs a paid "
+                "Etherscan API plan (https://etherscan.io/apis). Without one, crypttrace "
+                f"cannot read {chain} — it is not that the wallet is empty.")
+        raise EtherscanError(f"Etherscan answered: {said}")
     _cache_put(key, data)
     return data
 

{crypttrace-0.23.0 → crypttrace-0.26.0}/src/crypttrace/labels/known.json

@@ -364,5 +364,47 @@
 
   "UQAdCl0uTEHMLzvmsD6o69FXjxbNavwaP7pPAGMLCRf9aEbe": {"name": "Binance reserve wallet (custodied by Ceffu)", "type": "exchange", "chain": "ton", "source": "Binance proof-of-reserves address list (binance.com/bapi/apex/v1/public/apex/market/por/address), fetched 2026-09-23; listed since 2026-08-24", "source_kind": "self-published", "added": "2026-09-29"},
   "UQD4uGNdB4a3f52mYOZf0x1nCmdd1DAvrLppL0a1cetTYCQx": {"name": "Binance reserve wallet", "type": "exchange", "chain": "ton", "source": "Binance proof-of-reserves address list (binance.com/bapi/apex/v1/public/apex/market/por/address), fetched 2026-09-23; listed since 2025-10-15", "source_kind": "self-published", "added": "2026-09-29"},
-  "UQDKHZ7e70CzqdvZCC83Z4WVR8POC_ZB0J1Y4zo88G-zCSRH": {"name": "Binance reserve wallet", "type": "exchange", "chain": "ton", "source": "Binance proof-of-reserves address list (binance.com/bapi/apex/v1/public/apex/market/por/address), fetched 2026-09-23; listed since 2025-10-15", "source_kind": "self-published", "added": "2026-09-29"}
+  "UQDKHZ7e70CzqdvZCC83Z4WVR8POC_ZB0J1Y4zo88G-zCSRH": {"name": "Binance reserve wallet", "type": "exchange", "chain": "ton", "source": "Binance proof-of-reserves address list (binance.com/bapi/apex/v1/public/apex/market/por/address), fetched 2026-09-23; listed since 2025-10-15", "source_kind": "self-published", "added": "2026-09-29"},
+
+  "0x9b64203878f24eb0cdf55c8c6fa7d08ba0cf77e5": {"name": "MEXC reserve wallet", "type": "exchange", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09; listed for Arbitrum", "source_kind": "self-published", "added": "2026-10-23"},
+  "0xb86f1061e0d79e8319339d5fdbb187d4e7ad3300": {"name": "MEXC reserve wallet", "type": "exchange", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09; listed for Arbitrum", "source_kind": "self-published", "added": "2026-10-23"},
+  "0x4e3ae00e8323558fa5cac04b152238924aa31b60": {"name": "MEXC reserve wallet", "type": "exchange", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09; listed for Base", "source_kind": "self-published", "added": "2026-10-23"},
+  "13uZyaPbt4rTwYQ8xWFySVUzWH3pk2P5c7": {"name": "MEXC reserve wallet", "type": "exchange", "chain": "btc", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09", "source_kind": "self-published", "added": "2026-10-23"},
+  "17wgJkQ8v66fXTUawQS3sohEfzP4CCD8Xu": {"name": "MEXC reserve wallet", "type": "exchange", "chain": "btc", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09", "source_kind": "self-published", "added": "2026-10-23"},
+  "19KYQDpyssRUtpfa4pfAWiNQLeysThd1us": {"name": "MEXC reserve wallet", "type": "exchange", "chain": "btc", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09", "source_kind": "self-published", "added": "2026-10-23"},
+  "1Ak5Zk6P3Y7AbrdhWHif7GmEJhd6FqAS9J": {"name": "MEXC reserve wallet", "type": "exchange", "chain": "btc", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09", "source_kind": "self-published", "added": "2026-10-23"},
+  "1MDVjZdX8QD212pT8Z8EMP7DuFQHKqN3mx": {"name": "MEXC reserve wallet", "type": "exchange", "chain": "btc", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09", "source_kind": "self-published", "added": "2026-10-23"},
+  "1NEQFpjSqRMWuHLTrouSbmSgXuJr8zPCN7": {"name": "MEXC reserve wallet", "type": "exchange", "chain": "btc", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09", "source_kind": "self-published", "added": "2026-10-23"},
+  "35C2L1pCgwzBHNcDcVL1a5RuoefeWqyjAR": {"name": "MEXC reserve wallet", "type": "exchange", "chain": "btc", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09", "source_kind": "self-published", "added": "2026-10-23"},
+  "38RB6AuNgLjPyJqt92wJXoas7ZMYq12gHR": {"name": "MEXC reserve wallet", "type": "exchange", "chain": "btc", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09", "source_kind": "self-published", "added": "2026-10-23"},
+  "bc1qnzf53fl4a0lh00p9207c456xkk9fmgdnm6tyky": {"name": "MEXC reserve wallet", "type": "exchange", "chain": "btc", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09", "source_kind": "self-published", "added": "2026-10-23"},
+  "bc1qrlsks7xe755m05zfreyjdxn34rypc4lnghtcwc": {"name": "MEXC reserve wallet", "type": "exchange", "chain": "btc", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09", "source_kind": "self-published", "added": "2026-10-23"},
+  "0x2e8f79ad740de90dc5f5a9f0d8d9661a60725e64": {"name": "MEXC reserve wallet", "type": "exchange", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09; listed for BNB Chain", "source_kind": "self-published", "added": "2026-10-23"},
+  "0x4982085c9e2f89f2ecb8131eca71afad896e89cb": {"name": "MEXC reserve wallet", "type": "exchange", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09; listed for BNB Chain", "source_kind": "self-published", "added": "2026-10-23"},
+  "0x7354abb551e41bbd9fb32e2e79f44631349119b8": {"name": "MEXC reserve wallet", "type": "exchange", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09; listed for BNB Chain", "source_kind": "self-published", "added": "2026-10-23"},
+  "0x9bb6a22da110c6c9bab745bcaf0ee142ee83af37": {"name": "MEXC reserve wallet", "type": "exchange", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09; listed for BNB Chain", "source_kind": "self-published", "added": "2026-10-23"},
+  "0xa71180a5bfbc0dbd18f7b355e4afa101a319ff6a": {"name": "MEXC reserve wallet", "type": "exchange", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09; listed for BNB Chain", "source_kind": "self-published", "added": "2026-10-23"},
+  "0x0162cd2ba40e23378bf0fd41f919e1be075f025f": {"name": "MEXC reserve wallet", "type": "exchange", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09; listed for Ethereum", "source_kind": "self-published", "added": "2026-10-23"},
+  "0x12c5e4eeeaa20e25847b5453d23246983c512db7": {"name": "MEXC reserve wallet", "type": "exchange", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09; listed for Ethereum", "source_kind": "self-published", "added": "2026-10-23"},
+  "0x1f7370792a057227024e7a8cc15b40e3ed171ffc": {"name": "MEXC reserve wallet", "type": "exchange", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09; listed for Ethereum", "source_kind": "self-published", "added": "2026-10-23"},
+  "0x3cc936b795a188f0e246cbb2d74c5bd190aecf18": {"name": "MEXC reserve wallet", "type": "exchange", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09; listed for Ethereum", "source_kind": "self-published", "added": "2026-10-23"},
+  "0x75e89d5979e4f6fba9f97c104c2f0afb3f1dcb88": {"name": "MEXC reserve wallet", "type": "exchange", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09; listed for Ethereum", "source_kind": "self-published", "added": "2026-10-23"},
+  "0x76bf215ade956642b056b9043e014988941bbddd": {"name": "MEXC reserve wallet", "type": "exchange", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09; listed for Ethereum", "source_kind": "self-published", "added": "2026-10-23"},
+  "0x9642b23ed1e01df1092b92641051881a322f5d4e": {"name": "MEXC reserve wallet", "type": "exchange", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09; listed for Ethereum", "source_kind": "self-published", "added": "2026-10-23"},
+  "0xbcb302a64adb7f2c8697e17c1e948f5b058f0e49": {"name": "MEXC reserve wallet", "type": "exchange", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09; listed for Ethereum", "source_kind": "self-published", "added": "2026-10-23"},
+  "0xc411ab12837f63935b71b6c6643d0f7000e55e4b": {"name": "MEXC reserve wallet", "type": "exchange", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09; listed for Ethereum", "source_kind": "self-published", "added": "2026-10-23"},
+  "0xd67f25ef2399a0c769b1a35634c5ce77166714db": {"name": "MEXC reserve wallet", "type": "exchange", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09; listed for Ethereum", "source_kind": "self-published", "added": "2026-10-23"},
+  "0xe4e3eca65460c14a5245b09fee15a92ba09458b6": {"name": "MEXC reserve wallet", "type": "exchange", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09; listed for Ethereum", "source_kind": "self-published", "added": "2026-10-23"},
+  "0xe8832a868c091263ed190a9f4be304a03895dd91": {"name": "MEXC reserve wallet", "type": "exchange", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09; listed for Ethereum", "source_kind": "self-published", "added": "2026-10-23"},
+  "0xee136c0389733849dd710ac7104e92c6bf497574": {"name": "MEXC reserve wallet", "type": "exchange", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09; listed for Ethereum", "source_kind": "self-published", "added": "2026-10-23"},
+  "0xf016e1d45ef23bdd414e7a2e4d46e1b34577b508": {"name": "MEXC reserve wallet", "type": "exchange", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09; listed for Ethereum", "source_kind": "self-published", "added": "2026-10-23"},
+  "0xf95334a86d09a6eec74d69da344efaca424b13a9": {"name": "MEXC reserve wallet", "type": "exchange", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09; listed for Ethereum", "source_kind": "self-published", "added": "2026-10-23"},
+  "0xdf90c9b995a3b10a5b8570a47101e6c6a29eb945": {"name": "MEXC reserve wallet", "type": "exchange", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09; listed for Optimism", "source_kind": "self-published", "added": "2026-10-23"},
+  "0x51e3d44172868acc60d68ca99591ce4230bc75e0": {"name": "MEXC reserve wallet", "type": "exchange", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09; listed for Polygon", "source_kind": "self-published", "added": "2026-10-23"},
+  "0x576b81f0c21edbc920ad63feeeb2b0736b018a58": {"name": "MEXC reserve wallet", "type": "exchange", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09; listed for Polygon", "source_kind": "self-published", "added": "2026-10-23"},
+  "5PAhQiYdLBd6SVdjzBQDxUAEFyDdF5ExNPQfcscnPRj5": {"name": "MEXC reserve wallet", "type": "exchange", "chain": "sol", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09", "source_kind": "self-published", "added": "2026-10-23"},
+  "ASTyfSima4LLAdDgoFGkgqoKowG1LZFDr9fAQrg7iaJZ": {"name": "MEXC reserve wallet", "type": "exchange", "chain": "sol", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09", "source_kind": "self-published", "added": "2026-10-23"},
+  "UQDYh9Di0cT8QSbnHJcNM6sYlpQAAOrnA7sats7Mgwd344Mm": {"name": "MEXC reserve wallet", "type": "exchange", "chain": "ton", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09", "source_kind": "self-published", "added": "2026-10-23"},
+  "TB37WWozkkenGVYWD7Do2N5WT2CedqDktJ": {"name": "MEXC reserve wallet", "type": "exchange", "chain": "tron", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09", "source_kind": "self-published", "added": "2026-10-23"},
+  "TEPSrSYPDSQ7yXpMFPq91Fb1QEWpMkRGfn": {"name": "MEXC reserve wallet", "type": "exchange", "chain": "tron", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09", "source_kind": "self-published", "added": "2026-10-23"}
 }

{crypttrace-0.23.0 → crypttrace-0.26.0}/src/crypttrace/poisoning.py

@@ -210,6 +210,16 @@ def _substantial(row: dict, chain: str) -> bool:
     return bool(real and real.get("stable") and contract == real["contract"].lower() and v >= 10)
 
 
+def _set_up_by(wallet: str, me: str, chain: str) -> bool:
+    """Whether `me` funded `wallet` first — a wallet it set up, not a stranger."""
+    from crypttrace import funder
+    try:
+        ff = funder.first_funder(wallet, chain)
+    except chains.ChainError:
+        return False
+    return bool(ff) and chains.norm_addr(ff["funder"], chain) == me
+
+
 def baited_payments(address: str, chain: str, limit: int = 1000,
                     confirm: int = 3) -> List[dict]:
     """Payers who sent `address` real money right after it lured them.
@@ -219,11 +229,22 @@ def baited_payments(address: str, chain: str, limit: int = 1000,
     makes it appear in the payer's history. For up to `confirm` payers their
     own history is read for the address this one imitates, which turns a
     pattern into a specific claim.
+
+    Not a lured payment: money a contract sent (an internal transaction — a
+    bridge or protocol paying out), money that arrived inside a transaction this
+    address signed itself (it called a contract that paid it), and money from a
+    wallet this address set up (its own wallet returning funds). A victim of
+    poisoning signs the payment themselves, from a wallet of their own.
     """
     me = chains.norm_addr(address, chain)
     if labels.type_of(me) == "exchange" and not labels.is_deposit(me):
         return []                         # an exchange paying its own wallets lures no one
     rows = _history(address, chain, limit)
+    # transactions this address signed (TON hashes name the account's own transaction,
+    # whoever started it, so the rule cannot be read from them there)
+    signed = set() if chain == "ton" else {
+        r.get("hash") for r in rows
+        if r.get("from") == me and not r.get("contract") and not r.get("internal") and r.get("hash")}
     first_active = min((int(r.get("timestamp") or 0) for r in rows if r.get("timestamp")), default=0)
     lure: Dict[str, dict] = {}           # counterparty -> earliest lure
     paid: Dict[Tuple[str, str], dict] = {}
@@ -238,6 +259,8 @@ def baited_payments(address: str, chain: str, limit: int = 1000,
         elif frm == me:
             kind = "small transfer from this address"
         elif _substantial(r, chain):
+            if r.get("internal") or r.get("hash") in signed:
+                continue                  # paid by a contract, or in this address's own transaction
             p = paid.setdefault((other, r.get("symbol") or "?"), {"value": 0.0, "first_ts": ts})
             p["value"] += v
             p["first_ts"] = min(p["first_ts"], ts)
@@ -259,6 +282,7 @@ def baited_payments(address: str, chain: str, limit: int = 1000,
                     "address_age_s": p["first_ts"] - first_active if first_active else None,
                     "imitates": None})
     out.sort(key=lambda x: -x["paid"])
+    out = [x for x in out if not _set_up_by(x["payer"], me, chain)]
     for x in out[:confirm]:
         try:
             for pair in lookalikes(x["payer"], chain, limit):

{crypttrace-0.23.0 → crypttrace-0.26.0/src/crypttrace.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: crypttrace
-Version: 0.23.0
+Version: 0.26.0
 Summary: OSINT toolkit for crypto investigations: trace stolen funds across Ethereum, Bitcoin, Tron, Solana and TON
 Author: bobslayerX
 License-Expression: MIT
@@ -79,7 +79,7 @@ python selftest.py                 # offline checks, no API keys needed
 
 | | Needed? | How to get it |
 |---|---|---|
-| **EVM chains** (Ethereum, BSC, Polygon, Arbitrum, Optimism, Base) | **Required** | Free key at [etherscan.io/myapikey](https://etherscan.io/myapikey). One v2 key covers all EVM chains. |
+| **EVM chains** (Ethereum, BSC, Polygon, Arbitrum, Optimism, Base) | **Required** | Free key at [etherscan.io/myapikey](https://etherscan.io/myapikey) covers Ethereum, Polygon and Arbitrum. BSC, Optimism and Base need a paid Etherscan plan; on a free key crypttrace says so instead of showing an empty wallet. |
 | **Bitcoin, Tron, Solana, TON** | **Not required** | Work out of the box via public endpoints. |
 
 ```bash
@@ -120,7 +120,7 @@ the number either way.
 
 | Chain | `--chain` | Data source | Model |
 |---|---|---|---|
-| Ethereum, BSC, Polygon, Arbitrum, Optimism, Base | `eth` `bsc` `polygon` `arbitrum` `optimism` `base` | Etherscan v2 | account |
+| Ethereum, BSC, Polygon, Arbitrum, Optimism, Base | `eth` `bsc` `polygon` `arbitrum` `optimism` `base` | Etherscan v2 (BSC, Optimism, Base: paid plan) | account |
 | Bitcoin | `btc` | mempool.space | UTXO |
 | Tron (TRX + USDT-TRC20) | `tron` | TronGrid | account |
 | Solana (SOL + SPL) | `sol` | public JSON-RPC | account |
@@ -555,7 +555,9 @@ On Bitcoin, Tron and Solana the labels cover the reserve wallets of Binance,
 OKX and HTX, plus Bybit's older 2022 list — each taken from the address list the
 exchange publishes itself for proof-of-reserves; on TON and the EVM chains
 (Ethereum, BNB Chain, Arbitrum, Polygon, Base, Optimism), Binance's reserve
-wallets. That is what lets `offramp` flag deposit addresses on those chains. Funds sent to an exchange not on that
+wallets. MEXC's reserve wallets are covered on every one of these chains, from
+the "verified wallets" table of its monthly Hacken proof-of-reserves audit.
+That is what lets `offramp` flag deposit addresses on those chains. Funds sent to an exchange not on that
 list still show as `unknown`. Every label records where it came from — see
 `crypttrace labels audit`.
 
@@ -715,8 +717,8 @@ cases/             # worked investigations with their data
 
 ## Roadmap
 
-- More exchanges on Bitcoin, Tron, Solana (now: Binance, OKX, HTX, Bybit), TON
-  and the EVM chains (now: Binance),
+- More exchanges on Bitcoin, Tron, Solana (now: Binance, OKX, HTX, Bybit, MEXC),
+  TON and the EVM chains (now: Binance, MEXC),
   and refreshing these lists as the exchanges republish them
 - More label sources: Chainabuse, CryptoScamDB, exchange deposit-address sets