crypttrace 0.24.0__tar.gz → 0.27.0__tar.gz

{crypttrace-0.24.0/src/crypttrace.egg-info → crypttrace-0.27.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: crypttrace
-Version: 0.24.0
+Version: 0.27.0
 Summary: OSINT toolkit for crypto investigations: trace stolen funds across Ethereum, Bitcoin, Tron, Solana and TON
 Author: bobslayerX
 License-Expression: MIT
@@ -555,7 +555,9 @@ On Bitcoin, Tron and Solana the labels cover the reserve wallets of Binance,
 OKX and HTX, plus Bybit's older 2022 list — each taken from the address list the
 exchange publishes itself for proof-of-reserves; on TON and the EVM chains
 (Ethereum, BNB Chain, Arbitrum, Polygon, Base, Optimism), Binance's reserve
-wallets. That is what lets `offramp` flag deposit addresses on those chains. Funds sent to an exchange not on that
+wallets. MEXC's reserve wallets are covered on every one of these chains, from
+the "verified wallets" table of its monthly Hacken proof-of-reserves audit.
+That is what lets `offramp` flag deposit addresses on those chains. Funds sent to an exchange not on that
 list still show as `unknown`. Every label records where it came from — see
 `crypttrace labels audit`.
 
@@ -710,14 +712,14 @@ src/crypttrace/
   webapp.py        # Flask backend for the web UI
   web/index.html   # single-page frontend (interactive graph)
 selftest.py        # offline end-to-end checks, run by CI
+tools/refresh_por.py  # maintainer: refresh exchange reserve-wallet labels
 cases/             # worked investigations with their data
 ```
 
 ## Roadmap
 
-- More exchanges on Bitcoin, Tron, Solana (now: Binance, OKX, HTX, Bybit), TON
-  and the EVM chains (now: Binance),
-  and refreshing these lists as the exchanges republish them
+- More exchanges on Bitcoin, Tron, Solana (now: Binance, OKX, HTX, Bybit, MEXC),
+  TON and the EVM chains (now: Binance, HTX, MEXC)
 - More label sources: Chainabuse, CryptoScamDB, exchange deposit-address sets
 
 ## Contributing
@@ -729,6 +731,13 @@ a `source` a reader can check and a `source_kind` (`self-published`,
 `crypttrace labels audit` and `python selftest.py` before opening a PR.
 Accuracy matters more than volume — a wrong label is worse than no label.
 
+Exchanges republish their reserve-wallet lists (Binance continuously, HTX and
+MEXC monthly). `python tools/refresh_por.py binance htx` shows what changed
+since the labels were taken; `--write` adds the newly listed wallets and marks
+the ones no longer listed as possibly retired (their labels stay: old funds
+still lead there). For MEXC, download the latest Hacken audit PDF from
+mexc.com/proof-of-reserve/audit-report and pass it with `--mexc FILE`.
+
 ## Licence
 
 MIT — see [LICENSE](LICENSE).

{crypttrace-0.24.0 → crypttrace-0.27.0}/README.md

@@ -521,7 +521,9 @@ On Bitcoin, Tron and Solana the labels cover the reserve wallets of Binance,
 OKX and HTX, plus Bybit's older 2022 list — each taken from the address list the
 exchange publishes itself for proof-of-reserves; on TON and the EVM chains
 (Ethereum, BNB Chain, Arbitrum, Polygon, Base, Optimism), Binance's reserve
-wallets. That is what lets `offramp` flag deposit addresses on those chains. Funds sent to an exchange not on that
+wallets. MEXC's reserve wallets are covered on every one of these chains, from
+the "verified wallets" table of its monthly Hacken proof-of-reserves audit.
+That is what lets `offramp` flag deposit addresses on those chains. Funds sent to an exchange not on that
 list still show as `unknown`. Every label records where it came from — see
 `crypttrace labels audit`.
 
@@ -676,14 +678,14 @@ src/crypttrace/
   webapp.py        # Flask backend for the web UI
   web/index.html   # single-page frontend (interactive graph)
 selftest.py        # offline end-to-end checks, run by CI
+tools/refresh_por.py  # maintainer: refresh exchange reserve-wallet labels
 cases/             # worked investigations with their data
 ```
 
 ## Roadmap
 
-- More exchanges on Bitcoin, Tron, Solana (now: Binance, OKX, HTX, Bybit), TON
-  and the EVM chains (now: Binance),
-  and refreshing these lists as the exchanges republish them
+- More exchanges on Bitcoin, Tron, Solana (now: Binance, OKX, HTX, Bybit, MEXC),
+  TON and the EVM chains (now: Binance, HTX, MEXC)
 - More label sources: Chainabuse, CryptoScamDB, exchange deposit-address sets
 
 ## Contributing
@@ -695,6 +697,13 @@ a `source` a reader can check and a `source_kind` (`self-published`,
 `crypttrace labels audit` and `python selftest.py` before opening a PR.
 Accuracy matters more than volume — a wrong label is worse than no label.
 
+Exchanges republish their reserve-wallet lists (Binance continuously, HTX and
+MEXC monthly). `python tools/refresh_por.py binance htx` shows what changed
+since the labels were taken; `--write` adds the newly listed wallets and marks
+the ones no longer listed as possibly retired (their labels stay: old funds
+still lead there). For MEXC, download the latest Hacken audit PDF from
+mexc.com/proof-of-reserve/audit-report and pass it with `--mexc FILE`.
+
 ## Licence
 
 MIT — see [LICENSE](LICENSE).

{crypttrace-0.24.0 → crypttrace-0.27.0}/src/crypttrace/__init__.py

@@ -1,2 +1,2 @@
 """crypttrace — OSINT crypto investigation CLI."""
-__version__ = "0.24.0"
+__version__ = "0.27.0"

{crypttrace-0.24.0 → crypttrace-0.27.0}/src/crypttrace/analysis.py

@@ -243,5 +243,5 @@ def describe_burst(burst, total_events: int) -> Optional[str]:
     if minutes <= 60 * 24:
         return (f"{count} of {total_events} transfers fall inside {minutes/60:.1f} hours ({when})."
                 " Activity is concentrated rather than spread out.")
-    return (f"Activity is spread over {minutes/60/24:.0f} days — no burst pattern, "
-            "which is what ordinary wallet use looks like.")
+    return (f"Activity is spread over {minutes/60/24:.0f} days — no burst pattern, so no sign "
+            "of an automated sweep (which says nothing about whose money it is).")

{crypttrace-0.24.0 → crypttrace-0.27.0}/src/crypttrace/assess.py

@@ -60,9 +60,16 @@ def constant_fee_signature(values: List[float], min_hits: int = 5) -> Optional[d
     return {"fee": delta, "hits": hits, "of": total, "share": hits / total}
 
 
-def repeated_amounts(values: List[float], min_repeat: int = 3) -> List[tuple]:
-    """Identical amounts arriving from unrelated addresses — batch automation."""
-    c = Counter(round(v, 8) for v in values if v > 0)
+def repeated_amounts(payments: List[tuple], min_repeat: int = 3) -> List[tuple]:
+    """Identical amounts arriving from unrelated addresses — batch automation.
+
+    `payments` are (amount, sender); an amount counts once per distinct sender,
+    so one wallet paying the same sum again is not a batch."""
+    senders: Dict[float, set] = {}
+    for v, frm in payments:
+        if v > 0:
+            senders.setdefault(round(v, 8), set()).add(frm)
+    c = Counter({amt: len(s) for amt, s in senders.items()})
     return [(amt, n) for amt, n in c.most_common(5) if n >= min_repeat]
 
 
@@ -143,7 +150,11 @@ def assess(address: str, chain: str = "eth", asset: Optional[dict] = None,
                 evidence={"count": b[1], "span_minutes": round(span_min, 1),
                           "from_ts": b[2], "to_ts": b[3]}))
 
-    rep = repeated_amounts([r.get("value", 0) for r in inbound])
+    # small sums are what spammers and lure campaigns send every known address, in
+    # fixed amounts by design; batch processing shows in money worth moving
+    floor = 100 * analysis.dust_threshold(chain, asset)
+    rep = repeated_amounts([(r.get("value", 0), r.get("from")) for r in inbound
+                            if r.get("value", 0) >= floor and not r.get("kind")])
     if rep:
         top = rep[0]
         signals.append(Signal(

{crypttrace-0.24.0 → crypttrace-0.27.0}/src/crypttrace/evidence.py

@@ -19,7 +19,8 @@ from crypttrace import __version__, chains, drain
 from crypttrace.labels import labels
 
 # law-enforcement request portals, only where checked against the exchange's own site
-LE_PORTALS = {"KuCoin": "https://www.kucoin.com/legal/requests"}
+LE_PORTALS = {"KuCoin": "https://www.kucoin.com/legal/requests",
+              "MEXC": "https://www.mexc.com/support/ticket/submit/law-enforcement-requests"}
 SOURCES = {"ton": "toncenter.com (transactions), tonapi.io (account names)",
            "tron": "TronGrid", "btc": "mempool.space", "sol": "Solana JSON-RPC"}
 

{crypttrace-0.24.0 → crypttrace-0.27.0}/src/crypttrace/labels/known.json

@@ -326,7 +326,7 @@
 
   "143gLvWYUojXaWZRrxquRKpVNTkhmr415B": {"name": "HTX reserve wallet", "type": "exchange", "chain": "btc", "source": "HTX proof-of-reserves snapshot 2026-09-01 on HTX's official GitHub (github.com/huobiapi/Tool-Node.js-VerifyAddress, snapshot/huobi_por.csv); listed with an ownership signature (not verified by crypttrace)", "source_kind": "self-published", "added": "2026-09-23"},
   "12qTdZHx6f77aQ74CPCZGSY47VaRwYjVD8": {"name": "HTX reserve wallet", "type": "exchange", "chain": "btc", "source": "HTX proof-of-reserves snapshot 2026-09-01 on HTX's official GitHub (github.com/huobiapi/Tool-Node.js-VerifyAddress, snapshot/huobi_por.csv); listed with an ownership signature (not verified by crypttrace)", "source_kind": "self-published", "added": "2026-09-23"},
-  "1HckjUpRGcrrRAtFaaCAUaGjsPx9oYmLaZ": {"name": "HTX reserve wallet", "type": "exchange", "chain": "btc", "source": "HTX proof-of-reserves snapshot 2026-09-01 on HTX's official GitHub (github.com/huobiapi/Tool-Node.js-VerifyAddress, snapshot/huobi_por.csv); listed with an ownership signature (not verified by crypttrace)", "source_kind": "self-published", "added": "2026-09-23"},
+  "1HckjUpRGcrrRAtFaaCAUaGjsPx9oYmLaZ": {"name": "HTX reserve wallet", "type": "exchange", "chain": "btc", "source": "HTX proof-of-reserves snapshot 2026-09-01 on HTX's official GitHub (github.com/huobiapi/Tool-Node.js-VerifyAddress, snapshot/huobi_por.csv); listed with an ownership signature (not verified by crypttrace); not in the 2026-10-01 list, so possibly retired", "source_kind": "self-published", "added": "2026-09-23"},
   "1LXzGrDQqKqVBqxfGDUyhC6rTRBN5s8Sbj": {"name": "HTX reserve wallet", "type": "exchange", "chain": "btc", "source": "HTX proof-of-reserves snapshot 2026-09-01 on HTX's official GitHub (github.com/huobiapi/Tool-Node.js-VerifyAddress, snapshot/huobi_por.csv); listed with an ownership signature (not verified by crypttrace)", "source_kind": "self-published", "added": "2026-09-23"},
   "12AxQ3mM2rwY2mwLa5qNVY65uHoQGfvSVF": {"name": "HTX reserve wallet", "type": "exchange", "chain": "btc", "source": "HTX proof-of-reserves snapshot 2026-09-01 on HTX's official GitHub (github.com/huobiapi/Tool-Node.js-VerifyAddress, snapshot/huobi_por.csv); listed without a signature", "source_kind": "self-published", "added": "2026-09-23"},
   "1AQLXAB6aXSVbRMjbhSBudLf1kcsbWSEjg": {"name": "HTX reserve wallet", "type": "exchange", "chain": "btc", "source": "HTX proof-of-reserves snapshot 2026-09-01 on HTX's official GitHub (github.com/huobiapi/Tool-Node.js-VerifyAddress, snapshot/huobi_por.csv); listed with an ownership signature (not verified by crypttrace)", "source_kind": "self-published", "added": "2026-09-23"},
@@ -348,6 +348,9 @@
   "TRSXRWudzfzY4jH7AaMowdMNUXDkHisbcd": {"name": "HTX reserve wallet", "type": "exchange", "chain": "tron", "source": "HTX proof-of-reserves snapshot 2026-09-01 on HTX's official GitHub (github.com/huobiapi/Tool-Node.js-VerifyAddress, snapshot/huobi_por.csv); listed with an ownership signature (not verified by crypttrace)", "source_kind": "self-published", "added": "2026-09-23"},
   "TCiRCBNFrL6bFKWL94yWQi5hNMGNp1Nu27": {"name": "HTX reserve wallet", "type": "exchange", "chain": "tron", "source": "HTX proof-of-reserves snapshot 2026-09-01 on HTX's official GitHub (github.com/huobiapi/Tool-Node.js-VerifyAddress, snapshot/huobi_por.csv); listed with an ownership signature (not verified by crypttrace)", "source_kind": "self-published", "added": "2026-09-23"},
   "TBuzWQynfzershAsPfGjo4A9sXUfZf8wsq": {"name": "HTX reserve wallet", "type": "exchange", "chain": "tron", "source": "HTX proof-of-reserves snapshot 2026-09-01 on HTX's official GitHub (github.com/huobiapi/Tool-Node.js-VerifyAddress, snapshot/huobi_por.csv); listed with an ownership signature (not verified by crypttrace)", "source_kind": "self-published", "added": "2026-09-23"},
+  "0x6663613fbd927ce78abbf7f5ca7e2c3fe0d96d18": {"name": "HTX reserve wallet", "type": "exchange", "source": "HTX proof-of-reserves snapshot 2026-10-01 on HTX's official GitHub (github.com/huobiapi/Tool-Node.js-VerifyAddress, snapshot/huobi_por.csv); listed without a signature", "source_kind": "self-published", "added": "2026-10-23"},
+  "0x9be5b8a7314552fa47feb1355cd5b4adc7bb7516": {"name": "HTX reserve wallet", "type": "exchange", "source": "HTX proof-of-reserves snapshot 2026-10-01 on HTX's official GitHub (github.com/huobiapi/Tool-Node.js-VerifyAddress, snapshot/huobi_por.csv); listed with an ownership signature (not verified by crypttrace)", "source_kind": "self-published", "added": "2026-10-23"},
+  "0x18709e89bd403f470088abdacebe86cc60dda12e": {"name": "HTX reserve wallet", "type": "exchange", "source": "HTX proof-of-reserves snapshot 2026-10-01 on HTX's official GitHub (github.com/huobiapi/Tool-Node.js-VerifyAddress, snapshot/huobi_por.csv); listed with an ownership signature (not verified by crypttrace)", "source_kind": "self-published", "added": "2026-10-23"},
 
   "TQVxjVy2sYt4at45ezD7VG4H6nQZtsua5C": {"name": "Bybit (2022 reserve list)", "type": "exchange", "chain": "tron", "source": "Bybit proof-of-reserves address list, Dec 2022 (static.bycustody.com/download/app/bybit_por_202212.csv, linked from Bybit's help center); may since be retired", "source_kind": "self-published", "added": "2026-09-23"},
   "TKFvdC4UC1vtCoHZgn8eviK34kormXaqJ7": {"name": "Bybit (2022 reserve list)", "type": "exchange", "chain": "tron", "source": "Bybit proof-of-reserves address list, Dec 2022 (static.bycustody.com/download/app/bybit_por_202212.csv, linked from Bybit's help center); may since be retired", "source_kind": "self-published", "added": "2026-09-23"},
@@ -364,5 +367,50 @@
 
   "UQAdCl0uTEHMLzvmsD6o69FXjxbNavwaP7pPAGMLCRf9aEbe": {"name": "Binance reserve wallet (custodied by Ceffu)", "type": "exchange", "chain": "ton", "source": "Binance proof-of-reserves address list (binance.com/bapi/apex/v1/public/apex/market/por/address), fetched 2026-09-23; listed since 2026-08-24", "source_kind": "self-published", "added": "2026-09-29"},
   "UQD4uGNdB4a3f52mYOZf0x1nCmdd1DAvrLppL0a1cetTYCQx": {"name": "Binance reserve wallet", "type": "exchange", "chain": "ton", "source": "Binance proof-of-reserves address list (binance.com/bapi/apex/v1/public/apex/market/por/address), fetched 2026-09-23; listed since 2025-10-15", "source_kind": "self-published", "added": "2026-09-29"},
-  "UQDKHZ7e70CzqdvZCC83Z4WVR8POC_ZB0J1Y4zo88G-zCSRH": {"name": "Binance reserve wallet", "type": "exchange", "chain": "ton", "source": "Binance proof-of-reserves address list (binance.com/bapi/apex/v1/public/apex/market/por/address), fetched 2026-09-23; listed since 2025-10-15", "source_kind": "self-published", "added": "2026-09-29"}
+  "UQDKHZ7e70CzqdvZCC83Z4WVR8POC_ZB0J1Y4zo88G-zCSRH": {"name": "Binance reserve wallet", "type": "exchange", "chain": "ton", "source": "Binance proof-of-reserves address list (binance.com/bapi/apex/v1/public/apex/market/por/address), fetched 2026-09-23; listed since 2025-10-15", "source_kind": "self-published", "added": "2026-09-29"},
+  "34yeXcv1tQSQxwNRQXfS5qvFGSKDvk7Yiu": {"name": "Binance reserve wallet", "type": "exchange", "chain": "btc", "source": "Binance proof-of-reserves address list (binance.com/bapi/apex/v1/public/apex/market/por/address), fetched 2026-10-23; listed since 2026-10-22", "source_kind": "self-published", "added": "2026-10-23"},
+  "3HhbSpPhKsw4t7ond5Mv9oVZBtpQKFu5cx": {"name": "Binance reserve wallet", "type": "exchange", "chain": "btc", "source": "Binance proof-of-reserves address list (binance.com/bapi/apex/v1/public/apex/market/por/address), fetched 2026-10-23; listed since 2026-10-22", "source_kind": "self-published", "added": "2026-10-23"},
+  "3J6tf7fg3B5aWLCwnDqAFFmS72SssK5yeH": {"name": "Binance reserve wallet", "type": "exchange", "chain": "btc", "source": "Binance proof-of-reserves address list (binance.com/bapi/apex/v1/public/apex/market/por/address), fetched 2026-10-23; listed since 2026-10-22", "source_kind": "self-published", "added": "2026-10-23"},
+
+  "0x9b64203878f24eb0cdf55c8c6fa7d08ba0cf77e5": {"name": "MEXC reserve wallet", "type": "exchange", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09; listed for Arbitrum", "source_kind": "self-published", "added": "2026-10-23"},
+  "0xb86f1061e0d79e8319339d5fdbb187d4e7ad3300": {"name": "MEXC reserve wallet", "type": "exchange", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09; listed for Arbitrum", "source_kind": "self-published", "added": "2026-10-23"},
+  "0x4e3ae00e8323558fa5cac04b152238924aa31b60": {"name": "MEXC reserve wallet", "type": "exchange", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09; listed for Base", "source_kind": "self-published", "added": "2026-10-23"},
+  "13uZyaPbt4rTwYQ8xWFySVUzWH3pk2P5c7": {"name": "MEXC reserve wallet", "type": "exchange", "chain": "btc", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09", "source_kind": "self-published", "added": "2026-10-23"},
+  "17wgJkQ8v66fXTUawQS3sohEfzP4CCD8Xu": {"name": "MEXC reserve wallet", "type": "exchange", "chain": "btc", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09", "source_kind": "self-published", "added": "2026-10-23"},
+  "19KYQDpyssRUtpfa4pfAWiNQLeysThd1us": {"name": "MEXC reserve wallet", "type": "exchange", "chain": "btc", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09", "source_kind": "self-published", "added": "2026-10-23"},
+  "1Ak5Zk6P3Y7AbrdhWHif7GmEJhd6FqAS9J": {"name": "MEXC reserve wallet", "type": "exchange", "chain": "btc", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09", "source_kind": "self-published", "added": "2026-10-23"},
+  "1MDVjZdX8QD212pT8Z8EMP7DuFQHKqN3mx": {"name": "MEXC reserve wallet", "type": "exchange", "chain": "btc", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09", "source_kind": "self-published", "added": "2026-10-23"},
+  "1NEQFpjSqRMWuHLTrouSbmSgXuJr8zPCN7": {"name": "MEXC reserve wallet", "type": "exchange", "chain": "btc", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09", "source_kind": "self-published", "added": "2026-10-23"},
+  "35C2L1pCgwzBHNcDcVL1a5RuoefeWqyjAR": {"name": "MEXC reserve wallet", "type": "exchange", "chain": "btc", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09", "source_kind": "self-published", "added": "2026-10-23"},
+  "38RB6AuNgLjPyJqt92wJXoas7ZMYq12gHR": {"name": "MEXC reserve wallet", "type": "exchange", "chain": "btc", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09", "source_kind": "self-published", "added": "2026-10-23"},
+  "bc1qnzf53fl4a0lh00p9207c456xkk9fmgdnm6tyky": {"name": "MEXC reserve wallet", "type": "exchange", "chain": "btc", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09", "source_kind": "self-published", "added": "2026-10-23"},
+  "bc1qrlsks7xe755m05zfreyjdxn34rypc4lnghtcwc": {"name": "MEXC reserve wallet", "type": "exchange", "chain": "btc", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09", "source_kind": "self-published", "added": "2026-10-23"},
+  "0x2e8f79ad740de90dc5f5a9f0d8d9661a60725e64": {"name": "MEXC reserve wallet", "type": "exchange", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09; listed for BNB Chain", "source_kind": "self-published", "added": "2026-10-23"},
+  "0x4982085c9e2f89f2ecb8131eca71afad896e89cb": {"name": "MEXC reserve wallet", "type": "exchange", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09; listed for BNB Chain", "source_kind": "self-published", "added": "2026-10-23"},
+  "0x7354abb551e41bbd9fb32e2e79f44631349119b8": {"name": "MEXC reserve wallet", "type": "exchange", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09; listed for BNB Chain", "source_kind": "self-published", "added": "2026-10-23"},
+  "0x9bb6a22da110c6c9bab745bcaf0ee142ee83af37": {"name": "MEXC reserve wallet", "type": "exchange", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09; listed for BNB Chain", "source_kind": "self-published", "added": "2026-10-23"},
+  "0xa71180a5bfbc0dbd18f7b355e4afa101a319ff6a": {"name": "MEXC reserve wallet", "type": "exchange", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09; listed for BNB Chain", "source_kind": "self-published", "added": "2026-10-23"},
+  "0x0162cd2ba40e23378bf0fd41f919e1be075f025f": {"name": "MEXC reserve wallet", "type": "exchange", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09; listed for Ethereum", "source_kind": "self-published", "added": "2026-10-23"},
+  "0x12c5e4eeeaa20e25847b5453d23246983c512db7": {"name": "MEXC reserve wallet", "type": "exchange", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09; listed for Ethereum", "source_kind": "self-published", "added": "2026-10-23"},
+  "0x1f7370792a057227024e7a8cc15b40e3ed171ffc": {"name": "MEXC reserve wallet", "type": "exchange", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09; listed for Ethereum", "source_kind": "self-published", "added": "2026-10-23"},
+  "0x3cc936b795a188f0e246cbb2d74c5bd190aecf18": {"name": "MEXC reserve wallet", "type": "exchange", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09; listed for Ethereum", "source_kind": "self-published", "added": "2026-10-23"},
+  "0x75e89d5979e4f6fba9f97c104c2f0afb3f1dcb88": {"name": "MEXC reserve wallet", "type": "exchange", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09; listed for Ethereum", "source_kind": "self-published", "added": "2026-10-23"},
+  "0x76bf215ade956642b056b9043e014988941bbddd": {"name": "MEXC reserve wallet", "type": "exchange", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09; listed for Ethereum", "source_kind": "self-published", "added": "2026-10-23"},
+  "0x9642b23ed1e01df1092b92641051881a322f5d4e": {"name": "MEXC reserve wallet", "type": "exchange", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09; listed for Ethereum", "source_kind": "self-published", "added": "2026-10-23"},
+  "0xbcb302a64adb7f2c8697e17c1e948f5b058f0e49": {"name": "MEXC reserve wallet", "type": "exchange", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09; listed for Ethereum", "source_kind": "self-published", "added": "2026-10-23"},
+  "0xc411ab12837f63935b71b6c6643d0f7000e55e4b": {"name": "MEXC reserve wallet", "type": "exchange", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09; listed for Ethereum", "source_kind": "self-published", "added": "2026-10-23"},
+  "0xd67f25ef2399a0c769b1a35634c5ce77166714db": {"name": "MEXC reserve wallet", "type": "exchange", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09; listed for Ethereum", "source_kind": "self-published", "added": "2026-10-23"},
+  "0xe4e3eca65460c14a5245b09fee15a92ba09458b6": {"name": "MEXC reserve wallet", "type": "exchange", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09; listed for Ethereum", "source_kind": "self-published", "added": "2026-10-23"},
+  "0xe8832a868c091263ed190a9f4be304a03895dd91": {"name": "MEXC reserve wallet", "type": "exchange", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09; listed for Ethereum", "source_kind": "self-published", "added": "2026-10-23"},
+  "0xee136c0389733849dd710ac7104e92c6bf497574": {"name": "MEXC reserve wallet", "type": "exchange", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09; listed for Ethereum", "source_kind": "self-published", "added": "2026-10-23"},
+  "0xf016e1d45ef23bdd414e7a2e4d46e1b34577b508": {"name": "MEXC reserve wallet", "type": "exchange", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09; listed for Ethereum", "source_kind": "self-published", "added": "2026-10-23"},
+  "0xf95334a86d09a6eec74d69da344efaca424b13a9": {"name": "MEXC reserve wallet", "type": "exchange", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09; listed for Ethereum", "source_kind": "self-published", "added": "2026-10-23"},
+  "0xdf90c9b995a3b10a5b8570a47101e6c6a29eb945": {"name": "MEXC reserve wallet", "type": "exchange", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09; listed for Optimism", "source_kind": "self-published", "added": "2026-10-23"},
+  "0x51e3d44172868acc60d68ca99591ce4230bc75e0": {"name": "MEXC reserve wallet", "type": "exchange", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09; listed for Polygon", "source_kind": "self-published", "added": "2026-10-23"},
+  "0x576b81f0c21edbc920ad63feeeb2b0736b018a58": {"name": "MEXC reserve wallet", "type": "exchange", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09; listed for Polygon", "source_kind": "self-published", "added": "2026-10-23"},
+  "5PAhQiYdLBd6SVdjzBQDxUAEFyDdF5ExNPQfcscnPRj5": {"name": "MEXC reserve wallet", "type": "exchange", "chain": "sol", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09", "source_kind": "self-published", "added": "2026-10-23"},
+  "ASTyfSima4LLAdDgoFGkgqoKowG1LZFDr9fAQrg7iaJZ": {"name": "MEXC reserve wallet", "type": "exchange", "chain": "sol", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09", "source_kind": "self-published", "added": "2026-10-23"},
+  "UQDYh9Di0cT8QSbnHJcNM6sYlpQAAOrnA7sats7Mgwd344Mm": {"name": "MEXC reserve wallet", "type": "exchange", "chain": "ton", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09", "source_kind": "self-published", "added": "2026-10-23"},
+  "TB37WWozkkenGVYWD7Do2N5WT2CedqDktJ": {"name": "MEXC reserve wallet", "type": "exchange", "chain": "tron", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09", "source_kind": "self-published", "added": "2026-10-23"},
+  "TEPSrSYPDSQ7yXpMFPq91Fb1QEWpMkRGfn": {"name": "MEXC reserve wallet", "type": "exchange", "chain": "tron", "source": "MEXC proof-of-reserves audit by Hacken, 'Verified wallets' table (ownership proven by a test transaction from each address); MEXC_PoR_Audit_20261009.pdf, listed at mexc.com/proof-of-reserve/audit-report; snapshot 2026-10-09", "source_kind": "self-published", "added": "2026-10-23"}
 }

{crypttrace-0.24.0 → crypttrace-0.27.0}/src/crypttrace/poisoning.py

@@ -210,6 +210,16 @@ def _substantial(row: dict, chain: str) -> bool:
     return bool(real and real.get("stable") and contract == real["contract"].lower() and v >= 10)
 
 
+def _set_up_by(wallet: str, me: str, chain: str) -> bool:
+    """Whether `me` funded `wallet` first — a wallet it set up, not a stranger."""
+    from crypttrace import funder
+    try:
+        ff = funder.first_funder(wallet, chain)
+    except chains.ChainError:
+        return False
+    return bool(ff) and chains.norm_addr(ff["funder"], chain) == me
+
+
 def baited_payments(address: str, chain: str, limit: int = 1000,
                     confirm: int = 3) -> List[dict]:
     """Payers who sent `address` real money right after it lured them.
@@ -219,11 +229,22 @@ def baited_payments(address: str, chain: str, limit: int = 1000,
     makes it appear in the payer's history. For up to `confirm` payers their
     own history is read for the address this one imitates, which turns a
     pattern into a specific claim.
+
+    Not a lured payment: money a contract sent (an internal transaction — a
+    bridge or protocol paying out), money that arrived inside a transaction this
+    address signed itself (it called a contract that paid it), and money from a
+    wallet this address set up (its own wallet returning funds). A victim of
+    poisoning signs the payment themselves, from a wallet of their own.
     """
     me = chains.norm_addr(address, chain)
     if labels.type_of(me) == "exchange" and not labels.is_deposit(me):
         return []                         # an exchange paying its own wallets lures no one
     rows = _history(address, chain, limit)
+    # transactions this address signed (TON hashes name the account's own transaction,
+    # whoever started it, so the rule cannot be read from them there)
+    signed = set() if chain == "ton" else {
+        r.get("hash") for r in rows
+        if r.get("from") == me and not r.get("contract") and not r.get("internal") and r.get("hash")}
     first_active = min((int(r.get("timestamp") or 0) for r in rows if r.get("timestamp")), default=0)
     lure: Dict[str, dict] = {}           # counterparty -> earliest lure
     paid: Dict[Tuple[str, str], dict] = {}
@@ -238,6 +259,8 @@ def baited_payments(address: str, chain: str, limit: int = 1000,
         elif frm == me:
             kind = "small transfer from this address"
         elif _substantial(r, chain):
+            if r.get("internal") or r.get("hash") in signed:
+                continue                  # paid by a contract, or in this address's own transaction
             p = paid.setdefault((other, r.get("symbol") or "?"), {"value": 0.0, "first_ts": ts})
             p["value"] += v
             p["first_ts"] = min(p["first_ts"], ts)
@@ -259,6 +282,7 @@ def baited_payments(address: str, chain: str, limit: int = 1000,
                     "address_age_s": p["first_ts"] - first_active if first_active else None,
                     "imitates": None})
     out.sort(key=lambda x: -x["paid"])
+    out = [x for x in out if not _set_up_by(x["payer"], me, chain)]
     for x in out[:confirm]:
         try:
             for pair in lookalikes(x["payer"], chain, limit):

{crypttrace-0.24.0 → crypttrace-0.27.0/src/crypttrace.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: crypttrace
-Version: 0.24.0
+Version: 0.27.0
 Summary: OSINT toolkit for crypto investigations: trace stolen funds across Ethereum, Bitcoin, Tron, Solana and TON
 Author: bobslayerX
 License-Expression: MIT
@@ -555,7 +555,9 @@ On Bitcoin, Tron and Solana the labels cover the reserve wallets of Binance,
 OKX and HTX, plus Bybit's older 2022 list — each taken from the address list the
 exchange publishes itself for proof-of-reserves; on TON and the EVM chains
 (Ethereum, BNB Chain, Arbitrum, Polygon, Base, Optimism), Binance's reserve
-wallets. That is what lets `offramp` flag deposit addresses on those chains. Funds sent to an exchange not on that
+wallets. MEXC's reserve wallets are covered on every one of these chains, from
+the "verified wallets" table of its monthly Hacken proof-of-reserves audit.
+That is what lets `offramp` flag deposit addresses on those chains. Funds sent to an exchange not on that
 list still show as `unknown`. Every label records where it came from — see
 `crypttrace labels audit`.
 
@@ -710,14 +712,14 @@ src/crypttrace/
   webapp.py        # Flask backend for the web UI
   web/index.html   # single-page frontend (interactive graph)
 selftest.py        # offline end-to-end checks, run by CI
+tools/refresh_por.py  # maintainer: refresh exchange reserve-wallet labels
 cases/             # worked investigations with their data
 ```
 
 ## Roadmap
 
-- More exchanges on Bitcoin, Tron, Solana (now: Binance, OKX, HTX, Bybit), TON
-  and the EVM chains (now: Binance),
-  and refreshing these lists as the exchanges republish them
+- More exchanges on Bitcoin, Tron, Solana (now: Binance, OKX, HTX, Bybit, MEXC),
+  TON and the EVM chains (now: Binance, HTX, MEXC)
 - More label sources: Chainabuse, CryptoScamDB, exchange deposit-address sets
 
 ## Contributing
@@ -729,6 +731,13 @@ a `source` a reader can check and a `source_kind` (`self-published`,
 `crypttrace labels audit` and `python selftest.py` before opening a PR.
 Accuracy matters more than volume — a wrong label is worse than no label.
 
+Exchanges republish their reserve-wallet lists (Binance continuously, HTX and
+MEXC monthly). `python tools/refresh_por.py binance htx` shows what changed
+since the labels were taken; `--write` adds the newly listed wallets and marks
+the ones no longer listed as possibly retired (their labels stay: old funds
+still lead there). For MEXC, download the latest Hacken audit PDF from
+mexc.com/proof-of-reserve/audit-report and pass it with `--mexc FILE`.
+
 ## Licence
 
 MIT — see [LICENSE](LICENSE).