crypttrace 0.30.0__tar.gz → 0.32.0__tar.gz

{crypttrace-0.30.0/src/crypttrace.egg-info → crypttrace-0.32.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: crypttrace
-Version: 0.30.0
+Version: 0.32.0
 Summary: OSINT toolkit for crypto investigations: trace stolen funds across Ethereum, Bitcoin, Tron, Solana and TON
 Author: bobslayerX
 License-Expression: MIT
@@ -42,7 +42,7 @@ Dynamic: license-file
 Open-source OSINT toolkit for crypto investigations. Give it a suspicious
 address; it pulls the public on-chain history, labels known entities (exchanges,
 mixers, sanctioned wallets), scores risk, and maps where the funds moved —
-across Ethereum, Bitcoin, Tron, Solana, TON and more.
+across Ethereum, Bitcoin, Tron, Solana, TON, Litecoin, Dogecoin and more.
 
 Built for the investigation that actually happens: *someone's crypto was stolen,
 here's the wallet — where did the money go, and where can it still be stopped?*
@@ -80,7 +80,7 @@ python selftest.py                 # offline checks, no API keys needed
 | | Needed? | How to get it |
 |---|---|---|
 | **EVM chains** (Ethereum, BSC, Polygon, Arbitrum, Optimism, Base) | **Required** | Free key at [etherscan.io/myapikey](https://etherscan.io/myapikey) covers Ethereum, Polygon and Arbitrum. BSC, Optimism and Base need a paid Etherscan plan; on a free key crypttrace says so instead of showing an empty wallet. |
-| **Bitcoin, Tron, Solana, TON** | **Not required** | Work out of the box via public endpoints. |
+| **Bitcoin, Litecoin, Dogecoin, Tron, Solana, TON** | **Not required** | Work out of the box via public endpoints. Dogecoin reads BlockCypher's free tier, about 100 requests an hour, so it reads the latest 200 transactions of an address. |
 
 ```bash
 export ETHERSCAN_API_KEY=xxxx           # required for EVM chains only
@@ -122,6 +122,8 @@ the number either way.
 |---|---|---|---|
 | Ethereum, BSC, Polygon, Arbitrum, Optimism, Base | `eth` `bsc` `polygon` `arbitrum` `optimism` `base` | Etherscan v2 (BSC, Optimism, Base: paid plan) | account |
 | Bitcoin | `btc` | mempool.space | UTXO |
+| Litecoin | `ltc` | litecoinspace.org | UTXO |
+| Dogecoin | `doge` | BlockCypher | UTXO |
 | Tron (TRX + USDT-TRC20) | `tron` | TronGrid | account |
 | Solana (SOL + SPL) | `sol` | public JSON-RPC | account |
 | TON (TON + jettons, e.g. USDT) | `ton` | toncenter v3 | account |
@@ -253,6 +255,10 @@ crypttrace trace 0xADDRESS --direction in
 # Trace a token rather than the native coin (most thefts are stablecoins)
 crypttrace trace 0xADDRESS --asset usdt --depth 4
 
+# Save the traced graph for Gephi / yEd / Cytoscape, or for Maltego / Neo4j
+crypttrace trace 0xADDRESS --depth 4 --export case.graphml
+crypttrace trace 0xADDRESS --depth 4 --export case.csv
+
 # Token holdings, valued in USD
 crypttrace tokens 0xADDRESS
 
@@ -472,7 +478,7 @@ with an `nfts` column in the CSV. Failed (aborted) NFT transfers are not counted
 
 ### Bitcoin clustering (common-input-ownership)
 
-Bitcoin's UTXO model enables the strongest clustering heuristic in blockchain
+Bitcoin's UTXO model (Litecoin's and Dogecoin's too) enables the strongest clustering heuristic in blockchain
 forensics: if several addresses sign the inputs of one transaction, one party
 almost certainly controls all of them. `cluster` surfaces those co-signers,
 turning a single address into a set of wallets belonging to the same owner. A
@@ -722,6 +728,7 @@ src/crypttrace/
   bridges.py       # cross-chain matching
   watch.py         # watchlist + alerts
   report.py        # Markdown + JSON reports
+  export.py        # traced graph as GraphML (Gephi) and edge-list CSV (Maltego)
   prices.py        # USD valuation
   render.py        # rich terminal rendering
   webapp.py        # Flask backend for the web UI

{crypttrace-0.30.0 → crypttrace-0.32.0}/README.md

@@ -8,7 +8,7 @@
 Open-source OSINT toolkit for crypto investigations. Give it a suspicious
 address; it pulls the public on-chain history, labels known entities (exchanges,
 mixers, sanctioned wallets), scores risk, and maps where the funds moved —
-across Ethereum, Bitcoin, Tron, Solana, TON and more.
+across Ethereum, Bitcoin, Tron, Solana, TON, Litecoin, Dogecoin and more.
 
 Built for the investigation that actually happens: *someone's crypto was stolen,
 here's the wallet — where did the money go, and where can it still be stopped?*
@@ -46,7 +46,7 @@ python selftest.py                 # offline checks, no API keys needed
 | | Needed? | How to get it |
 |---|---|---|
 | **EVM chains** (Ethereum, BSC, Polygon, Arbitrum, Optimism, Base) | **Required** | Free key at [etherscan.io/myapikey](https://etherscan.io/myapikey) covers Ethereum, Polygon and Arbitrum. BSC, Optimism and Base need a paid Etherscan plan; on a free key crypttrace says so instead of showing an empty wallet. |
-| **Bitcoin, Tron, Solana, TON** | **Not required** | Work out of the box via public endpoints. |
+| **Bitcoin, Litecoin, Dogecoin, Tron, Solana, TON** | **Not required** | Work out of the box via public endpoints. Dogecoin reads BlockCypher's free tier, about 100 requests an hour, so it reads the latest 200 transactions of an address. |
 
 ```bash
 export ETHERSCAN_API_KEY=xxxx           # required for EVM chains only
@@ -88,6 +88,8 @@ the number either way.
 |---|---|---|---|
 | Ethereum, BSC, Polygon, Arbitrum, Optimism, Base | `eth` `bsc` `polygon` `arbitrum` `optimism` `base` | Etherscan v2 (BSC, Optimism, Base: paid plan) | account |
 | Bitcoin | `btc` | mempool.space | UTXO |
+| Litecoin | `ltc` | litecoinspace.org | UTXO |
+| Dogecoin | `doge` | BlockCypher | UTXO |
 | Tron (TRX + USDT-TRC20) | `tron` | TronGrid | account |
 | Solana (SOL + SPL) | `sol` | public JSON-RPC | account |
 | TON (TON + jettons, e.g. USDT) | `ton` | toncenter v3 | account |
@@ -219,6 +221,10 @@ crypttrace trace 0xADDRESS --direction in
 # Trace a token rather than the native coin (most thefts are stablecoins)
 crypttrace trace 0xADDRESS --asset usdt --depth 4
 
+# Save the traced graph for Gephi / yEd / Cytoscape, or for Maltego / Neo4j
+crypttrace trace 0xADDRESS --depth 4 --export case.graphml
+crypttrace trace 0xADDRESS --depth 4 --export case.csv
+
 # Token holdings, valued in USD
 crypttrace tokens 0xADDRESS
 
@@ -438,7 +444,7 @@ with an `nfts` column in the CSV. Failed (aborted) NFT transfers are not counted
 
 ### Bitcoin clustering (common-input-ownership)
 
-Bitcoin's UTXO model enables the strongest clustering heuristic in blockchain
+Bitcoin's UTXO model (Litecoin's and Dogecoin's too) enables the strongest clustering heuristic in blockchain
 forensics: if several addresses sign the inputs of one transaction, one party
 almost certainly controls all of them. `cluster` surfaces those co-signers,
 turning a single address into a set of wallets belonging to the same owner. A
@@ -688,6 +694,7 @@ src/crypttrace/
   bridges.py       # cross-chain matching
   watch.py         # watchlist + alerts
   report.py        # Markdown + JSON reports
+  export.py        # traced graph as GraphML (Gephi) and edge-list CSV (Maltego)
   prices.py        # USD valuation
   render.py        # rich terminal rendering
   webapp.py        # Flask backend for the web UI

{crypttrace-0.30.0 → crypttrace-0.32.0}/src/crypttrace/__init__.py

@@ -1,2 +1,2 @@
 """crypttrace — OSINT crypto investigation CLI."""
-__version__ = "0.30.0"
+__version__ = "0.32.0"

{crypttrace-0.30.0 → crypttrace-0.32.0}/src/crypttrace/addresses.py

@@ -82,6 +82,18 @@ def check_base58check(addr: str, expect_prefix: Optional[bytes] = None) -> Tuple
     return True, "base58check checksum valid"
 
 
+def _versioned(addr: str, versions: dict, name: str) -> Tuple[bool, str]:
+    """base58check plus the chain's version byte — a Bitcoin '3…' address passes the
+    checksum too, so the version is what tells the chains apart."""
+    ok, why = check_base58check(addr)
+    if not ok:
+        return ok, why
+    v = _b58_decode(addr)[0]
+    if v not in versions:
+        return False, f"version byte {v:#04x} is not a {name} address"
+    return True, "base58check checksum valid"
+
+
 # ---------------------------------------------------------------- per chain
 
 def validate(address: str, chain: str) -> Tuple[bool, str]:
@@ -108,6 +120,18 @@ def validate(address: str, chain: str) -> Tuple[bool, str]:
             return check_base58check(a)
         return False, "not a recognised Bitcoin address format"
 
+    if chain == "ltc":
+        if a.lower().startswith("ltc1"):
+            return check_bech32(a, "ltc")
+        if a.startswith(("L", "M", "3")):
+            return _versioned(a, {0x30: "L", 0x32: "M", 0x05: "3"}, "Litecoin")
+        return False, "not a recognised Litecoin address format (L…, M…, 3… or ltc1…)"
+
+    if chain == "doge":
+        if a.startswith(("D", "A", "9")):
+            return _versioned(a, {0x1E: "D", 0x16: "A/9"}, "Dogecoin")
+        return False, "not a recognised Dogecoin address format (D…, A… or 9…)"
+
     if chain == "tron":
         if not a.startswith("T") or len(a) != 34:
             return False, "Tron addresses start with T and are 34 characters"

{crypttrace-0.30.0 → crypttrace-0.32.0}/src/crypttrace/analysis.py

@@ -22,7 +22,7 @@ from crypttrace.labels import labels
 # Amounts below these are treated as dust: spam sent to well-known addresses to
 # pollute their history (and sometimes to deanonymise the owner). Left in, dust
 # drowns out the transfers an investigation is actually about.
-DUST = {"btc": 0.0005, "eth": 0.002, "bsc": 0.005, "polygon": 5.0,
+DUST = {"btc": 0.0005, "ltc": 0.001, "doge": 5.0, "eth": 0.002, "bsc": 0.005, "polygon": 5.0,
         "arbitrum": 0.002, "optimism": 0.002, "base": 0.002,
         "tron": 5.0, "sol": 0.01, "ton": 0.01}
 

{crypttrace-0.30.0 → crypttrace-0.32.0}/src/crypttrace/assets.py

@@ -69,8 +69,8 @@ def resolve_asset(asset: Optional[str], chain: str = "eth") -> Optional[dict]:
     elif a.startswith("0x") and len(a) == 42:
         return {"contract": a, "symbol": asset.upper()[:8], "stable": False}
 
-    if chain == "btc":
-        raise ValueError("Bitcoin has no tokens — omit --asset (or use --asset btc).")
+    if chain in ("btc", "ltc", "doge"):
+        raise ValueError(f"{chain.upper()} has no tokens — omit --asset (or use --asset {chain}).")
 
     opts = ", ".join(known) or "none registered"
     raise ValueError(f"Unknown asset '{asset}' on {chain}. Known symbols: {opts}. "

{crypttrace-0.30.0 → crypttrace-0.32.0}/src/crypttrace/chains.py

@@ -19,17 +19,19 @@ from crypttrace.labels import labels as _labels
 from crypttrace.fetchers import etherscan, bitcoin, http as _http, tron, solana, ton
 
 EVM_CHAINS = set(config.CHAINS)
-NON_EVM = {"btc", "tron", "sol", "ton"}
+NON_EVM = {"btc", "ltc", "doge", "tron", "sol", "ton"}
 ALL_CHAINS = sorted(EVM_CHAINS | NON_EVM)
 
 SYMBOL = {"eth": "ETH", "bsc": "BNB", "polygon": "MATIC", "arbitrum": "ETH",
-          "optimism": "ETH", "base": "ETH", "btc": "BTC", "tron": "TRX", "sol": "SOL", "ton": "TON"}
+          "optimism": "ETH", "base": "ETH", "btc": "BTC", "ltc": "LTC", "doge": "DOGE", "tron": "TRX", "sol": "SOL",
+          "ton": "TON"}
 
 EXPLORER = {
     "eth": "https://etherscan.io/address/{}", "bsc": "https://bscscan.com/address/{}",
     "polygon": "https://polygonscan.com/address/{}", "arbitrum": "https://arbiscan.io/address/{}",
     "optimism": "https://optimistic.etherscan.io/address/{}", "base": "https://basescan.org/address/{}",
-    "btc": "https://mempool.space/address/{}", "tron": "https://tronscan.org/#/address/{}",
+    "btc": "https://mempool.space/address/{}", "ltc": "https://litecoinspace.org/address/{}",
+    "doge": "https://blockchair.com/dogecoin/address/{}", "tron": "https://tronscan.org/#/address/{}",
     "sol": "https://solscan.io/account/{}", "ton": "https://tonviewer.com/{}",
 }
 
@@ -37,7 +39,8 @@ TX_EXPLORER = {
     "eth": "https://etherscan.io/tx/{}", "bsc": "https://bscscan.com/tx/{}",
     "polygon": "https://polygonscan.com/tx/{}", "arbitrum": "https://arbiscan.io/tx/{}",
     "optimism": "https://optimistic.etherscan.io/tx/{}", "base": "https://basescan.org/tx/{}",
-    "btc": "https://mempool.space/tx/{}", "tron": "https://tronscan.org/#/transaction/{}",
+    "btc": "https://mempool.space/tx/{}", "ltc": "https://litecoinspace.org/tx/{}",
+    "doge": "https://blockchair.com/dogecoin/transaction/{}", "tron": "https://tronscan.org/#/transaction/{}",
     "sol": "https://solscan.io/tx/{}", "ton": "https://tonviewer.com/transaction/{}",
 }
 
@@ -53,6 +56,11 @@ def is_evm(chain: str) -> bool:
     return chain in EVM_CHAINS
 
 
+def is_utxo(chain: str) -> bool:
+    """Bitcoin, Litecoin, Dogecoin: outputs and inputs, no tokens."""
+    return chain in bitcoin.UTXO_CHAINS
+
+
 def case_sensitive(chain: str) -> bool:
     """Bitcoin/Tron/Solana use base58 — address case is significant."""
     return chain in NON_EVM
@@ -86,8 +94,8 @@ def balance(address: str, chain: str = "eth") -> float:
     try:
         if is_evm(chain):
             return etherscan.get_balance(address, chain)
-        if chain == "btc":
-            return bitcoin.balance(address)
+        if is_utxo(chain):
+            return bitcoin.balance(address, chain)
         if chain == "tron":
             return tron.balance(address)
         if chain == "sol":
@@ -221,10 +229,10 @@ def transfers(address: str, chain: str = "eth", limit: int = 1000,
         if is_evm(chain):
             rows = _evm_token(address, chain, contract, limit) if asset \
                 else _evm_native(address, chain, limit)
-        elif chain == "btc":
+        elif is_utxo(chain):
             if asset:
-                raise ChainError("Bitcoin has no tokens.")
-            rows = bitcoin.transfers(address, limit)
+                raise ChainError(f"{bitcoin.NETWORKS[chain]['name']} has no tokens.")
+            rows = bitcoin.transfers(address, limit, chain=chain)
         elif chain == "tron":
             # keep TRX and TRC20 strictly separate
             rows = _tron_token(address, contract, limit) if asset \
@@ -337,7 +345,7 @@ def inflows(address: str, chain: str, top: int, limit: int = 1000, asset=None):
 def token_holdings(address: str, chain: str = "eth", limit: int = 1000) -> List[Dict]:
     """Approximate token holdings from transfer history (net in − out per token)."""
     check(chain)
-    if chain == "btc":
+    if is_utxo(chain):
         return []
     me = norm_addr(address, chain)
     try:

{crypttrace-0.30.0 → crypttrace-0.32.0}/src/crypttrace/cli.py

@@ -222,6 +222,9 @@ def trace(
                                   help="Top-N outflows to follow per address"),
     direction: str = typer.Option("out", "--direction", "-D",
                                   help="'out' = where funds went, 'in' = where they came from"),
+    export: Optional[Path] = typer.Option(None, "--export", "-o",
+                                          help="Also save the graph: .graphml (Gephi, yEd, Cytoscape) "
+                                               "or .csv (Maltego, Neo4j, spreadsheets)"),
 ):
     """Trace where funds moved, hop by hop, as a coloured tree (ETH or a token)."""
     try:
@@ -232,6 +235,10 @@ def trace(
     if direction not in ("out", "in"):
         console.print("[red]Error:[/red] --direction must be 'out' or 'in'")
         raise typer.Exit(1)
+    fmt = export.suffix.lower().lstrip(".") if export else None
+    if export and fmt not in ("graphml", "csv"):
+        console.print("[red]Error:[/red] --export takes a .graphml or .csv file name")
+        raise typer.Exit(1)
     try:
         tree = trace_mod.build_tree(address, chain, depth, branching, asset_desc, direction)
     except (chains_mod.ChainError, etherscan.EtherscanError) as e:
@@ -242,6 +249,18 @@ def trace(
         "\n[dim]Legend: \U0001F7E2 exchange  \U0001F7E3 mixer  \U0001F534 sanctioned/scam"
         "  \U0001F309 bridge  \U0001F504 DEX  \U0001F537 service  ⚪ unknown[/dim]"
     )
+    if export:
+        from crypttrace import export as export_mod
+        try:
+            graph = trace_mod.build_graph(address, chain, depth, branching, asset_desc, direction)
+        except (chains_mod.ChainError, etherscan.EtherscanError) as e:
+            console.print(f"[red]Error:[/red] {e}")
+            raise typer.Exit(1)
+        export.write_text(export_mod.render(graph, chain, fmt), encoding="utf-8", newline="")
+        console.print(f"\n[green]Graph saved:[/green] {export} — {len(graph['nodes'])} addresses, "
+                      f"{len(graph['edges'])} transfers"
+                      + ("  [dim](Maltego: Import Graph from Table, map from/to to an address entity)[/dim]"
+                         if fmt == "csv" else "  [dim](open in Gephi, yEd or Cytoscape)[/dim]"))
 
 
 @app.command()
@@ -762,7 +781,7 @@ def verify(
     style = _verdict_style(v["status"])
     console.print(f"\n[{style}]{v['status'].upper()}[/{style}]  {verify_mod.headline(v)}\n")
 
-    if v["checks"]:
+    if v.get("checks"):        # absent when the chain could not be read at all
         t = render.Table(title="Cross-check against the chain", header_style="bold")
         t.add_column("Figure"); t.add_column("Computed", justify="right")
         t.add_column("Chain", justify="right"); t.add_column("", justify="center")
@@ -803,12 +822,12 @@ def cluster(
                       "funder set it up. Wallets set up by the same person's wallet are likely one party; a "
                       "funding from an exchange, mixer, bridge or any contract links nothing. A lead, not proof.[/dim]")
         return
-    if chain != "btc":
-        console.print("[red]Error:[/red] cluster works on Bitcoin and EVM chains")
+    if not chains_mod.is_utxo(chain):
+        console.print("[red]Error:[/red] cluster works on Bitcoin, Litecoin, Dogecoin and EVM chains")
         raise typer.Exit(1)
     from crypttrace.fetchers import bitcoin
     try:
-        peers = bitcoin.cluster(address)
+        peers = bitcoin.cluster(address, chain)
     except bitcoin.BitcoinError as e:
         console.print(f"[red]Error:[/red] {e}")
         raise typer.Exit(1)
@@ -884,6 +903,8 @@ def chains():
         console.print(f"  {name:<10} chainid {cid}{paid}")
     console.print("\n[bold]Non-EVM[/bold] (no API key needed):")
     console.print("  btc        Bitcoin — mempool.space (UTXO)")
+    console.print("  ltc        Litecoin — litecoinspace.org (UTXO)")
+    console.print("  doge       Dogecoin — BlockCypher (UTXO; free tier ~100 requests an hour)")
     console.print("  tron       Tron — TronGrid (TRX + USDT-TRC20)")
     console.print("  sol        Solana — public JSON-RPC")
     console.print("  ton        TON — toncenter (TON + jettons such as USDT)")

{crypttrace-0.30.0 → crypttrace-0.32.0}/src/crypttrace/drain.py

@@ -29,7 +29,7 @@ _ALL_TOKENS = {"contract": None, "symbol": "*"}
 
 def _history(address: str, chain: str, limit: int) -> List[dict]:
     rows = list(chains.transfers(address, chain, limit))
-    if chain != "btc":
+    if not chains.is_utxo(chain):
         try:
             rows += [r for r in chains.transfers(address, chain, limit, asset=_ALL_TOKENS)
                      if not spam.verdict(chain, r.get("contract", ""), r.get("symbol", ""),

crypttrace-0.32.0/src/crypttrace/export.py

@@ -0,0 +1,94 @@
+"""Export a traced fund-flow graph for the tools analysts already use.
+
+    GraphML  — Gephi, yEd, Cytoscape: nodes keep their label, kind, hop and
+               explorer link; edges their amount, USD value, transfer count and
+               exchange memo, so a layout can be coloured and sized by them.
+    CSV      — one row per edge with both ends' labels and kinds: Maltego's
+               "Import Graph from Table" (map `from` and `to` to a
+               cryptocurrency-address entity), Neo4j's LOAD CSV, a spreadsheet.
+
+Both take the dict `trace.build_graph` returns, the same graph the web UI draws.
+"""
+import csv
+import io
+from xml.sax.saxutils import escape, quoteattr
+
+from crypttrace import chains
+
+NODE_KEYS = [("label", "string"), ("kind", "string"), ("hop", "int"), ("root", "boolean"),
+             ("trail_ends", "boolean"), ("chain", "string"), ("explorer", "string")]
+EDGE_KEYS = [("amount", "double"), ("symbol", "string"), ("usd", "double"), ("transfers", "int"),
+             ("memo", "string")]
+CSV_HEAD = ["from", "from_label", "from_kind", "to", "to_label", "to_kind", "amount", "symbol",
+            "usd", "transfers", "memo", "chain", "from_explorer", "to_explorer"]
+
+
+def _node_attrs(n: dict, chain: str) -> dict:
+    return {"label": n.get("label") or n.get("short") or n["id"], "kind": n.get("type") or "unknown",
+            "hop": n.get("level", 0), "root": bool(n.get("root")), "trail_ends": bool(n.get("terminal")),
+            "chain": chain, "explorer": chains.explorer_url(n["id"], chain)}
+
+
+def _edge_attrs(e: dict, symbol: str) -> dict:
+    return {"amount": e.get("value") or 0, "symbol": symbol, "usd": e.get("usd"),
+            "transfers": e.get("tx") or 0, "memo": e.get("memo") or ""}
+
+
+def _val(v, kind: str) -> str:
+    if v is None:
+        return ""
+    if kind == "boolean":
+        return "true" if v else "false"
+    return escape(str(v))
+
+
+def to_graphml(graph: dict, chain: str) -> str:
+    """GraphML 1.0, directed: money flows along the edges."""
+    symbol = graph.get("symbol", "")
+    out = ['<?xml version="1.0" encoding="UTF-8"?>',
+           '<graphml xmlns="http://graphml.graphdrawing.org/xmlns">']
+    for k, t in NODE_KEYS:
+        out.append(f'  <key id="n_{k}" for="node" attr.name="{k}" attr.type="{t}"/>')
+    for k, t in EDGE_KEYS:
+        out.append(f'  <key id="e_{k}" for="edge" attr.name="{k}" attr.type="{t}"/>')
+    out.append(f'  <graph id={quoteattr("crypttrace " + chain)} edgedefault="directed">')
+    for n in graph.get("nodes", []):
+        out.append(f'    <node id={quoteattr(n["id"])}>')
+        for (k, t), v in zip(NODE_KEYS, _node_attrs(n, chain).values()):
+            if v not in (None, ""):
+                out.append(f'      <data key="n_{k}">{_val(v, t)}</data>')
+        out.append("    </node>")
+    for i, e in enumerate(graph.get("edges", [])):
+        out.append(f'    <edge id="e{i}" source={quoteattr(e["from"])} target={quoteattr(e["to"])}>')
+        for (k, t), v in zip(EDGE_KEYS, _edge_attrs(e, symbol).values()):
+            if v not in (None, ""):
+                out.append(f'      <data key="e_{k}">{_val(v, t)}</data>')
+        out.append("    </edge>")
+    out += ["  </graph>", "</graphml>", ""]
+    return "\n".join(out)
+
+
+def to_csv(graph: dict, chain: str) -> str:
+    """One row per edge, both ends described — what a link-analysis import wants."""
+    symbol = graph.get("symbol", "")
+    nodes = {n["id"]: n for n in graph.get("nodes", [])}
+    buf = io.StringIO()
+    w = csv.writer(buf, lineterminator="\n")
+    w.writerow(CSV_HEAD)
+    for e in graph.get("edges", []):
+        a, b = nodes.get(e["from"], {"id": e["from"]}), nodes.get(e["to"], {"id": e["to"]})
+        ea = _edge_attrs(e, symbol)
+        w.writerow([e["from"], a.get("label") or "", a.get("type") or "unknown",
+                    e["to"], b.get("label") or "", b.get("type") or "unknown",
+                    ea["amount"], symbol, "" if ea["usd"] is None else ea["usd"], ea["transfers"],
+                    ea["memo"], chain, chains.explorer_url(e["from"], chain), chains.explorer_url(e["to"], chain)])
+    return buf.getvalue()
+
+
+FORMATS = {"graphml": (to_graphml, "application/graphml+xml"), "csv": (to_csv, "text/csv")}
+
+
+def render(graph: dict, chain: str, fmt: str) -> str:
+    if fmt not in FORMATS:
+        raise ValueError(f"unknown export format '{fmt}' — use one of: {', '.join(FORMATS)}")
+    return FORMATS[fmt][0](graph, chain)