crypttrace 0.27.0__tar.gz → 0.30.0__tar.gz

{crypttrace-0.27.0/src/crypttrace.egg-info → crypttrace-0.30.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: crypttrace
-Version: 0.27.0
+Version: 0.30.0
 Summary: OSINT toolkit for crypto investigations: trace stolen funds across Ethereum, Bitcoin, Tron, Solana and TON
 Author: bobslayerX
 License-Expression: MIT
@@ -15,14 +15,14 @@ Classifier: Intended Audience :: Information Technology
 Classifier: Intended Audience :: Legal Industry
 Classifier: Operating System :: OS Independent
 Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.9
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
 Classifier: Topic :: Security
 Classifier: Topic :: Utilities
-Requires-Python: >=3.9
+Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: typer>=0.12
@@ -66,7 +66,7 @@ pipx install "crypttrace[web]"     # or: pip install "crypttrace[web]"
 ```
 
 `[web]` also installs Flask for the web UI; leave it off for the terminal tool
-alone. Python 3.9 or newer. To work on the code instead:
+alone. Python 3.10 or newer. To work on the code instead:
 
 ```bash
 git clone https://github.com/bobslayerX/crypttrace
@@ -546,17 +546,32 @@ with the reason.
 ### Labels
 
 Ships a curated seed set (major exchanges, Tornado Cash, bridges, notable
-hacks). `update-labels` pulls authoritative public lists — currently the OFAC
-SDN sanctioned-address list — and merges them into the local DB in
-`~/.crypttrace/`. The curated seed wins on conflicts, so richer names survive.
-Add sources in `labels/labels.py` → `SOURCES`.
+hacks). `update-labels` pulls public lists and merges them into the local DB
+in `~/.crypttrace/`:
+
+- **ScamSniffer's phishing blacklist** — about 2,500 EVM addresses of
+  phishing sites and wallet drainers, kept by a security team whose lists
+  wallets such as Rabby and Phantom use. Updated daily, published with a
+  7-day delay. Labelled `scam`.
+- **The OFAC SDN list** — sanctioned addresses. Labelled `sanctioned`; it wins
+  where both lists name an address.
+
+Each download replaces that list's previous copy, so an address taken off a
+list loses its label too. The lists are fetched on your machine rather than
+shipped with crypttrace (ScamSniffer's is GPL-licensed, and both change
+daily); run `update-labels` now and then. The curated seed wins on conflicts,
+so richer names survive. Add sources in `labels/labels.py` → `SOURCES`.
+
+With the phishing list in place, `check` also names any payment the wallet
+made to a listed address. A fake site or a signed token approval takes money
+in a single transfer, so there is no burst for the drain check to find.
 
 On Bitcoin, Tron and Solana the labels cover the reserve wallets of Binance,
-OKX and HTX, plus Bybit's older 2022 list — each taken from the address list the
-exchange publishes itself for proof-of-reserves; on TON and the EVM chains
-(Ethereum, BNB Chain, Arbitrum, Polygon, Base, Optimism), Binance's reserve
-wallets. MEXC's reserve wallets are covered on every one of these chains, from
-the "verified wallets" table of its monthly Hacken proof-of-reserves audit.
+OKX and HTX — each taken from the address list the exchange publishes itself
+for proof-of-reserves; on TON and the EVM chains (Ethereum, BNB Chain,
+Arbitrum, Polygon, Base, Optimism), Binance's reserve wallets. Bybit's (274)
+and MEXC's reserve wallets are covered on every one of these chains, from the
+"verified wallets" table of their monthly Hacken proof-of-reserves audits.
 That is what lets `offramp` flag deposit addresses on those chains. Funds sent to an exchange not on that
 list still show as `unknown`. Every label records where it came from — see
 `crypttrace labels audit`.
@@ -719,8 +734,10 @@ cases/             # worked investigations with their data
 ## Roadmap
 
 - More exchanges on Bitcoin, Tron, Solana (now: Binance, OKX, HTX, Bybit, MEXC),
-  TON and the EVM chains (now: Binance, HTX, MEXC)
-- More label sources: Chainabuse, CryptoScamDB, exchange deposit-address sets
+  TON and the EVM chains (now: Binance, HTX, Bybit, MEXC)
+- More label sources: Chainabuse (needs an API key), more exchange
+  deposit-address sets (OKX's is in). CryptoScamDB is gone (its API has been
+  down since 2023); ScamSniffer's list took its place.
 
 ## Contributing
 
@@ -736,7 +753,8 @@ MEXC monthly). `python tools/refresh_por.py binance htx` shows what changed
 since the labels were taken; `--write` adds the newly listed wallets and marks
 the ones no longer listed as possibly retired (their labels stay: old funds
 still lead there). For MEXC, download the latest Hacken audit PDF from
-mexc.com/proof-of-reserve/audit-report and pass it with `--mexc FILE`.
+mexc.com/proof-of-reserve/audit-report and pass it with `--mexc FILE`; for
+Bybit, the one from bybit.com/en/app/user/audit-report with `--bybit FILE`.
 
 ## Licence
 

{crypttrace-0.27.0 → crypttrace-0.30.0}/README.md

@@ -32,7 +32,7 @@ pipx install "crypttrace[web]"     # or: pip install "crypttrace[web]"
 ```
 
 `[web]` also installs Flask for the web UI; leave it off for the terminal tool
-alone. Python 3.9 or newer. To work on the code instead:
+alone. Python 3.10 or newer. To work on the code instead:
 
 ```bash
 git clone https://github.com/bobslayerX/crypttrace
@@ -512,17 +512,32 @@ with the reason.
 ### Labels
 
 Ships a curated seed set (major exchanges, Tornado Cash, bridges, notable
-hacks). `update-labels` pulls authoritative public lists — currently the OFAC
-SDN sanctioned-address list — and merges them into the local DB in
-`~/.crypttrace/`. The curated seed wins on conflicts, so richer names survive.
-Add sources in `labels/labels.py` → `SOURCES`.
+hacks). `update-labels` pulls public lists and merges them into the local DB
+in `~/.crypttrace/`:
+
+- **ScamSniffer's phishing blacklist** — about 2,500 EVM addresses of
+  phishing sites and wallet drainers, kept by a security team whose lists
+  wallets such as Rabby and Phantom use. Updated daily, published with a
+  7-day delay. Labelled `scam`.
+- **The OFAC SDN list** — sanctioned addresses. Labelled `sanctioned`; it wins
+  where both lists name an address.
+
+Each download replaces that list's previous copy, so an address taken off a
+list loses its label too. The lists are fetched on your machine rather than
+shipped with crypttrace (ScamSniffer's is GPL-licensed, and both change
+daily); run `update-labels` now and then. The curated seed wins on conflicts,
+so richer names survive. Add sources in `labels/labels.py` → `SOURCES`.
+
+With the phishing list in place, `check` also names any payment the wallet
+made to a listed address. A fake site or a signed token approval takes money
+in a single transfer, so there is no burst for the drain check to find.
 
 On Bitcoin, Tron and Solana the labels cover the reserve wallets of Binance,
-OKX and HTX, plus Bybit's older 2022 list — each taken from the address list the
-exchange publishes itself for proof-of-reserves; on TON and the EVM chains
-(Ethereum, BNB Chain, Arbitrum, Polygon, Base, Optimism), Binance's reserve
-wallets. MEXC's reserve wallets are covered on every one of these chains, from
-the "verified wallets" table of its monthly Hacken proof-of-reserves audit.
+OKX and HTX — each taken from the address list the exchange publishes itself
+for proof-of-reserves; on TON and the EVM chains (Ethereum, BNB Chain,
+Arbitrum, Polygon, Base, Optimism), Binance's reserve wallets. Bybit's (274)
+and MEXC's reserve wallets are covered on every one of these chains, from the
+"verified wallets" table of their monthly Hacken proof-of-reserves audits.
 That is what lets `offramp` flag deposit addresses on those chains. Funds sent to an exchange not on that
 list still show as `unknown`. Every label records where it came from — see
 `crypttrace labels audit`.
@@ -685,8 +700,10 @@ cases/             # worked investigations with their data
 ## Roadmap
 
 - More exchanges on Bitcoin, Tron, Solana (now: Binance, OKX, HTX, Bybit, MEXC),
-  TON and the EVM chains (now: Binance, HTX, MEXC)
-- More label sources: Chainabuse, CryptoScamDB, exchange deposit-address sets
+  TON and the EVM chains (now: Binance, HTX, Bybit, MEXC)
+- More label sources: Chainabuse (needs an API key), more exchange
+  deposit-address sets (OKX's is in). CryptoScamDB is gone (its API has been
+  down since 2023); ScamSniffer's list took its place.
 
 ## Contributing
 
@@ -702,7 +719,8 @@ MEXC monthly). `python tools/refresh_por.py binance htx` shows what changed
 since the labels were taken; `--write` adds the newly listed wallets and marks
 the ones no longer listed as possibly retired (their labels stay: old funds
 still lead there). For MEXC, download the latest Hacken audit PDF from
-mexc.com/proof-of-reserve/audit-report and pass it with `--mexc FILE`.
+mexc.com/proof-of-reserve/audit-report and pass it with `--mexc FILE`; for
+Bybit, the one from bybit.com/en/app/user/audit-report with `--bybit FILE`.
 
 ## Licence
 

{crypttrace-0.27.0 → crypttrace-0.30.0}/pyproject.toml

@@ -6,7 +6,7 @@ readme = "README.md"
 license = "MIT"
 license-files = ["LICENSE"]
 authors = [{ name = "bobslayerX" }]
-requires-python = ">=3.9"
+requires-python = ">=3.10"
 keywords = ["osint", "blockchain", "forensics", "cryptocurrency", "bitcoin", "ethereum", "tron", "solana", "ton", "investigation"]
 classifiers = [
     "Development Status :: 4 - Beta",
@@ -16,11 +16,11 @@ classifiers = [
     "Intended Audience :: Legal Industry",
     "Operating System :: OS Independent",
     "Programming Language :: Python :: 3",
-    "Programming Language :: Python :: 3.9",
     "Programming Language :: Python :: 3.10",
     "Programming Language :: Python :: 3.11",
     "Programming Language :: Python :: 3.12",
     "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: 3.14",
     "Topic :: Security",
     "Topic :: Utilities",
 ]

{crypttrace-0.27.0 → crypttrace-0.30.0}/src/crypttrace/__init__.py

@@ -1,2 +1,2 @@
 """crypttrace — OSINT crypto investigation CLI."""
-__version__ = "0.27.0"
+__version__ = "0.30.0"

{crypttrace-0.27.0 → crypttrace-0.30.0}/src/crypttrace/drain.py

@@ -72,6 +72,25 @@ def _amounts(rows: List[dict]) -> Dict[str, float]:
     return dict(tot)
 
 
+def _flagged(out: List[dict]) -> List[dict]:
+    """Payments to an address on a phishing or sanctions list, per address.
+
+    A phishing site or a signed token approval usually takes money in one
+    transfer, so there is no burst to find; the destination's label is the tell."""
+    by: Dict[str, dict] = {}
+    for r in out:
+        kind = labels.type_of(r["to"])
+        if kind not in ("scam", "sanctioned"):
+            continue
+        f = by.setdefault(r["to"], {"address": r["to"], "label": labels.label_of(r["to"]), "type": kind,
+                                    "amounts": defaultdict(float), "first": r["timestamp"], "txs": set()})
+        f["amounts"][r.get("symbol") or "?"] += r.get("value") or 0
+        f["first"] = min(f["first"], r["timestamp"])
+        f["txs"].add(r.get("hash"))
+    return [{**f, "amounts": dict(f["amounts"]), "txs": len(f["txs"])}
+            for f in sorted(by.values(), key=lambda f: f["first"])]
+
+
 def check(address: str, chain: str, limit: int = 1000) -> Dict:
     """Verdict on one wallet: drained (and how), suspicious, or no drain found."""
     me = chains.norm_addr(address, chain)
@@ -86,6 +105,7 @@ def check(address: str, chain: str, limit: int = 1000) -> Dict:
     if not out:
         res["reasons"].append("this wallet has sent nothing in the history read")
         return res
+    res["flagged"] = _flagged(out)
 
     burst = _best_burst(out, chains.symbol(chain))
     dest, win = burst["to"], burst["rows"]