crypttrace 0.26.0__tar.gz → 0.29.0__tar.gz

{crypttrace-0.26.0/src/crypttrace.egg-info → crypttrace-0.29.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: crypttrace
-Version: 0.26.0
+Version: 0.29.0
 Summary: OSINT toolkit for crypto investigations: trace stolen funds across Ethereum, Bitcoin, Tron, Solana and TON
 Author: bobslayerX
 License-Expression: MIT
@@ -546,17 +546,32 @@ with the reason.
 ### Labels
 
 Ships a curated seed set (major exchanges, Tornado Cash, bridges, notable
-hacks). `update-labels` pulls authoritative public lists — currently the OFAC
-SDN sanctioned-address list — and merges them into the local DB in
-`~/.crypttrace/`. The curated seed wins on conflicts, so richer names survive.
-Add sources in `labels/labels.py` → `SOURCES`.
+hacks). `update-labels` pulls public lists and merges them into the local DB
+in `~/.crypttrace/`:
+
+- **ScamSniffer's phishing blacklist** — about 2,500 EVM addresses of
+  phishing sites and wallet drainers, kept by a security team whose lists
+  wallets such as Rabby and Phantom use. Updated daily, published with a
+  7-day delay. Labelled `scam`.
+- **The OFAC SDN list** — sanctioned addresses. Labelled `sanctioned`; it wins
+  where both lists name an address.
+
+Each download replaces that list's previous copy, so an address taken off a
+list loses its label too. The lists are fetched on your machine rather than
+shipped with crypttrace (ScamSniffer's is GPL-licensed, and both change
+daily); run `update-labels` now and then. The curated seed wins on conflicts,
+so richer names survive. Add sources in `labels/labels.py` → `SOURCES`.
+
+With the phishing list in place, `check` also names any payment the wallet
+made to a listed address. A fake site or a signed token approval takes money
+in a single transfer, so there is no burst for the drain check to find.
 
 On Bitcoin, Tron and Solana the labels cover the reserve wallets of Binance,
-OKX and HTX, plus Bybit's older 2022 list — each taken from the address list the
-exchange publishes itself for proof-of-reserves; on TON and the EVM chains
-(Ethereum, BNB Chain, Arbitrum, Polygon, Base, Optimism), Binance's reserve
-wallets. MEXC's reserve wallets are covered on every one of these chains, from
-the "verified wallets" table of its monthly Hacken proof-of-reserves audit.
+OKX and HTX — each taken from the address list the exchange publishes itself
+for proof-of-reserves; on TON and the EVM chains (Ethereum, BNB Chain,
+Arbitrum, Polygon, Base, Optimism), Binance's reserve wallets. Bybit's (274)
+and MEXC's reserve wallets are covered on every one of these chains, from the
+"verified wallets" table of their monthly Hacken proof-of-reserves audits.
 That is what lets `offramp` flag deposit addresses on those chains. Funds sent to an exchange not on that
 list still show as `unknown`. Every label records where it came from — see
 `crypttrace labels audit`.
@@ -712,15 +727,17 @@ src/crypttrace/
   webapp.py        # Flask backend for the web UI
   web/index.html   # single-page frontend (interactive graph)
 selftest.py        # offline end-to-end checks, run by CI
+tools/refresh_por.py  # maintainer: refresh exchange reserve-wallet labels
 cases/             # worked investigations with their data
 ```
 
 ## Roadmap
 
 - More exchanges on Bitcoin, Tron, Solana (now: Binance, OKX, HTX, Bybit, MEXC),
-  TON and the EVM chains (now: Binance, MEXC),
-  and refreshing these lists as the exchanges republish them
-- More label sources: Chainabuse, CryptoScamDB, exchange deposit-address sets
+  TON and the EVM chains (now: Binance, HTX, Bybit, MEXC)
+- More label sources: Chainabuse (needs an API key), more exchange
+  deposit-address sets (OKX's is in). CryptoScamDB is gone (its API has been
+  down since 2023); ScamSniffer's list took its place.
 
 ## Contributing
 
@@ -731,6 +748,14 @@ a `source` a reader can check and a `source_kind` (`self-published`,
 `crypttrace labels audit` and `python selftest.py` before opening a PR.
 Accuracy matters more than volume — a wrong label is worse than no label.
 
+Exchanges republish their reserve-wallet lists (Binance continuously, HTX and
+MEXC monthly). `python tools/refresh_por.py binance htx` shows what changed
+since the labels were taken; `--write` adds the newly listed wallets and marks
+the ones no longer listed as possibly retired (their labels stay: old funds
+still lead there). For MEXC, download the latest Hacken audit PDF from
+mexc.com/proof-of-reserve/audit-report and pass it with `--mexc FILE`; for
+Bybit, the one from bybit.com/en/app/user/audit-report with `--bybit FILE`.
+
 ## Licence
 
 MIT — see [LICENSE](LICENSE).

{crypttrace-0.26.0 → crypttrace-0.29.0}/README.md

@@ -512,17 +512,32 @@ with the reason.
 ### Labels
 
 Ships a curated seed set (major exchanges, Tornado Cash, bridges, notable
-hacks). `update-labels` pulls authoritative public lists — currently the OFAC
-SDN sanctioned-address list — and merges them into the local DB in
-`~/.crypttrace/`. The curated seed wins on conflicts, so richer names survive.
-Add sources in `labels/labels.py` → `SOURCES`.
+hacks). `update-labels` pulls public lists and merges them into the local DB
+in `~/.crypttrace/`:
+
+- **ScamSniffer's phishing blacklist** — about 2,500 EVM addresses of
+  phishing sites and wallet drainers, kept by a security team whose lists
+  wallets such as Rabby and Phantom use. Updated daily, published with a
+  7-day delay. Labelled `scam`.
+- **The OFAC SDN list** — sanctioned addresses. Labelled `sanctioned`; it wins
+  where both lists name an address.
+
+Each download replaces that list's previous copy, so an address taken off a
+list loses its label too. The lists are fetched on your machine rather than
+shipped with crypttrace (ScamSniffer's is GPL-licensed, and both change
+daily); run `update-labels` now and then. The curated seed wins on conflicts,
+so richer names survive. Add sources in `labels/labels.py` → `SOURCES`.
+
+With the phishing list in place, `check` also names any payment the wallet
+made to a listed address. A fake site or a signed token approval takes money
+in a single transfer, so there is no burst for the drain check to find.
 
 On Bitcoin, Tron and Solana the labels cover the reserve wallets of Binance,
-OKX and HTX, plus Bybit's older 2022 list — each taken from the address list the
-exchange publishes itself for proof-of-reserves; on TON and the EVM chains
-(Ethereum, BNB Chain, Arbitrum, Polygon, Base, Optimism), Binance's reserve
-wallets. MEXC's reserve wallets are covered on every one of these chains, from
-the "verified wallets" table of its monthly Hacken proof-of-reserves audit.
+OKX and HTX — each taken from the address list the exchange publishes itself
+for proof-of-reserves; on TON and the EVM chains (Ethereum, BNB Chain,
+Arbitrum, Polygon, Base, Optimism), Binance's reserve wallets. Bybit's (274)
+and MEXC's reserve wallets are covered on every one of these chains, from the
+"verified wallets" table of their monthly Hacken proof-of-reserves audits.
 That is what lets `offramp` flag deposit addresses on those chains. Funds sent to an exchange not on that
 list still show as `unknown`. Every label records where it came from — see
 `crypttrace labels audit`.
@@ -678,15 +693,17 @@ src/crypttrace/
   webapp.py        # Flask backend for the web UI
   web/index.html   # single-page frontend (interactive graph)
 selftest.py        # offline end-to-end checks, run by CI
+tools/refresh_por.py  # maintainer: refresh exchange reserve-wallet labels
 cases/             # worked investigations with their data
 ```
 
 ## Roadmap
 
 - More exchanges on Bitcoin, Tron, Solana (now: Binance, OKX, HTX, Bybit, MEXC),
-  TON and the EVM chains (now: Binance, MEXC),
-  and refreshing these lists as the exchanges republish them
-- More label sources: Chainabuse, CryptoScamDB, exchange deposit-address sets
+  TON and the EVM chains (now: Binance, HTX, Bybit, MEXC)
+- More label sources: Chainabuse (needs an API key), more exchange
+  deposit-address sets (OKX's is in). CryptoScamDB is gone (its API has been
+  down since 2023); ScamSniffer's list took its place.
 
 ## Contributing
 
@@ -697,6 +714,14 @@ a `source` a reader can check and a `source_kind` (`self-published`,
 `crypttrace labels audit` and `python selftest.py` before opening a PR.
 Accuracy matters more than volume — a wrong label is worse than no label.
 
+Exchanges republish their reserve-wallet lists (Binance continuously, HTX and
+MEXC monthly). `python tools/refresh_por.py binance htx` shows what changed
+since the labels were taken; `--write` adds the newly listed wallets and marks
+the ones no longer listed as possibly retired (their labels stay: old funds
+still lead there). For MEXC, download the latest Hacken audit PDF from
+mexc.com/proof-of-reserve/audit-report and pass it with `--mexc FILE`; for
+Bybit, the one from bybit.com/en/app/user/audit-report with `--bybit FILE`.
+
 ## Licence
 
 MIT — see [LICENSE](LICENSE).

{crypttrace-0.26.0 → crypttrace-0.29.0}/src/crypttrace/__init__.py

@@ -1,2 +1,2 @@
 """crypttrace — OSINT crypto investigation CLI."""
-__version__ = "0.26.0"
+__version__ = "0.29.0"

{crypttrace-0.26.0 → crypttrace-0.29.0}/src/crypttrace/drain.py

@@ -72,6 +72,25 @@ def _amounts(rows: List[dict]) -> Dict[str, float]:
     return dict(tot)
 
 
+def _flagged(out: List[dict]) -> List[dict]:
+    """Payments to an address on a phishing or sanctions list, per address.
+
+    A phishing site or a signed token approval usually takes money in one
+    transfer, so there is no burst to find; the destination's label is the tell."""
+    by: Dict[str, dict] = {}
+    for r in out:
+        kind = labels.type_of(r["to"])
+        if kind not in ("scam", "sanctioned"):
+            continue
+        f = by.setdefault(r["to"], {"address": r["to"], "label": labels.label_of(r["to"]), "type": kind,
+                                    "amounts": defaultdict(float), "first": r["timestamp"], "txs": set()})
+        f["amounts"][r.get("symbol") or "?"] += r.get("value") or 0
+        f["first"] = min(f["first"], r["timestamp"])
+        f["txs"].add(r.get("hash"))
+    return [{**f, "amounts": dict(f["amounts"]), "txs": len(f["txs"])}
+            for f in sorted(by.values(), key=lambda f: f["first"])]
+
+
 def check(address: str, chain: str, limit: int = 1000) -> Dict:
     """Verdict on one wallet: drained (and how), suspicious, or no drain found."""
     me = chains.norm_addr(address, chain)
@@ -86,6 +105,7 @@ def check(address: str, chain: str, limit: int = 1000) -> Dict:
     if not out:
         res["reasons"].append("this wallet has sent nothing in the history read")
         return res
+    res["flagged"] = _flagged(out)
 
     burst = _best_burst(out, chains.symbol(chain))
     dest, win = burst["to"], burst["rows"]