crypttrace 0.32.0__tar.gz → 0.34.0__tar.gz

{crypttrace-0.32.0/src/crypttrace.egg-info → crypttrace-0.34.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: crypttrace
-Version: 0.32.0
+Version: 0.34.0
 Summary: OSINT toolkit for crypto investigations: trace stolen funds across Ethereum, Bitcoin, Tron, Solana and TON
 Author: bobslayerX
 License-Expression: MIT
@@ -50,12 +50,14 @@ here's the wallet — where did the money go, and where can it still be stopped?
 Works as a terminal tool **and** as a local web app with an interactive
 fund-flow graph.
 
-![crypttrace tracing the AFX Trade exploit](https://raw.githubusercontent.com/bobslayerX/crypttrace/main/assets/graph-outflow.png)
+![crypttrace investigating the Ronin bridge exploiter in the web UI](https://raw.githubusercontent.com/bobslayerX/crypttrace/main/assets/web-ronin.png)
 
-*Real case: the AFX Trade exploiter (July 2026, $24.15M). crypttrace follows the
-stolen ETH out of the attacker's wallet — 12,467 ETH (~$23.3M) to a holding
-address, then split across three wallets and split again. Classic layering,
-mapped in seconds.*
+*Real case: the Ronin bridge exploiter (Lazarus, 2022). The graph shows the
+stolen ETH leaving in three transfers of 23,500–33,600 ETH, every one to a
+wallet on the US sanctions list. The side panel shows what is known about the
+address and where it comes from: the OFAC listing behind the label, USDT and
+USDC blacklisted by Tether and Circle, and the first funding of the wallet —
+1.06 ETH from a Binance reserve wallet, an exchange that knows who withdrew it.*
 
 ---
 
@@ -137,6 +139,8 @@ so scams that start in a Telegram chat often end there. TON addresses are
 accepted in any form (`UQ…`, `EQ…` or raw `0:…`) and shown as wallets show
 them (`UQ…`); jetton transfers are reported between the owners' wallets.
 
+![A Binance reserve wallet on Dogecoin: 2.12 billion DOGE, labelled from Binance's own proof-of-reserves list](https://raw.githubusercontent.com/bobslayerX/crypttrace/main/assets/web-dogecoin.png)
+
 ---
 
 ## Was my wallet drained?
@@ -161,6 +165,14 @@ history and answers in plain language:
   jetton balances and NFTs from trusted collections, not airdropped spam), and
   who to report to.
 
+It also names any payment the wallet made to an address on a phishing or
+sanctions list (ScamSniffer's phishing blacklist and OFAC's, downloaded with
+`crypttrace update-labels`). A fake site or a signed token approval takes money
+in one transfer, so there is no burst to find, but the destination gives it
+away:
+
+![A payment to a listed phishing address, found by the drain check](https://raw.githubusercontent.com/bobslayerX/crypttrace/main/assets/web-check-phishing.png)
+
 The web UI has the same check in its **Was I drained?** tab.
 
 ### An evidence pack for the exchange and the police
@@ -192,8 +204,11 @@ explorer. A side panel shows the profile, first-funder chain, off-ramp check
 and whether USDT/USDC at the address is frozen. Tabs add the assessment, the
 timeline, the list of who sent funds here, and address poisoning (look-alikes
 planted in the wallet's history, and payments lured by this address). **Case
-file** downloads the same one-page HTML report `crypttrace report` writes.
-Everything runs on your machine — nothing is uploaded anywhere.
+file** downloads the same one-page HTML report `crypttrace report` writes;
+**GraphML** and **CSV** download the graph for Gephi or Maltego. The page's
+address is a link to the investigation
+(`/?address=…&chain=…&direction=…&depth=…&tab=check`), ready to bookmark or
+send. Everything runs on your machine — nothing is uploaded anywhere.
 
 This exists so non-technical victims can use the tool at all: a form and a
 picture, instead of command-line flags.
@@ -329,6 +344,26 @@ entities — that's the OSINT handoff point. `--direction out` (default) answers
 money come from", which is how you vet a suspicious address or find a victim's
 source of funds.
 
+### Cases — an investigation kept as a file
+
+An investigation rarely fits one address. `case` keeps the addresses (any
+chain, each with a role: victim, suspect, intermediary, exchange, mixer, bridge
+or other), a log of notes, and the last snapshot of each address. `refresh`
+reads them all again and says what changed: a balance that went down, new
+activity since the last look.
+
+```bash
+crypttrace case new ronin --note "Ronin bridge exploit, March 2022"
+crypttrace case add ronin 0x098b…2f96 --chain eth --role suspect --note "exploiter"
+crypttrace case note ronin "asked Binance for KYC on the first-gas withdrawal"
+crypttrace case refresh ronin        # what moved since the last refresh
+crypttrace case show ronin           # addresses, current labels, last snapshot, the log
+```
+
+A case is one JSON file in `~/.crypttrace/cases/`. Every `case` command also
+takes a path to a `.json` file, so handing a case to a colleague is sending the
+file.
+
 ### Watch & alerts — catching the cash-out
 
 The only window to freeze stolen funds is the moment they reach an exchange
@@ -434,6 +469,11 @@ explorers list newest first, so there it is the earliest of the latest 200
 transfers. On EVM chains a first funding sent by a contract (a mixer or bridge
 withdrawal, an internal transaction) counts and is flagged.
 
+![funder on the Ronin exploiter, and verify on a Dogecoin wallet](https://raw.githubusercontent.com/bobslayerX/crypttrace/main/assets/cli-funder-verify.png)
+
+*Above: the Ronin exploiter's first gas came from a Binance reserve wallet. Below:
+`verify` re-derives a Dogecoin wallet's totals and matches them with the chain.*
+
 ### Victim lists and timing analysis
 
 Two things a graph shows but can't hand you as evidence.
@@ -727,6 +767,7 @@ src/crypttrace/
   offramp.py       # exchange-deposit detection
   bridges.py       # cross-chain matching
   watch.py         # watchlist + alerts
+  case.py          # investigations as files: addresses, roles, notes, snapshots
   report.py        # Markdown + JSON reports
   export.py        # traced graph as GraphML (Gephi) and edge-list CSV (Maltego)
   prices.py        # USD valuation

{crypttrace-0.32.0 → crypttrace-0.34.0}/README.md

@@ -16,12 +16,14 @@ here's the wallet — where did the money go, and where can it still be stopped?
 Works as a terminal tool **and** as a local web app with an interactive
 fund-flow graph.
 
-![crypttrace tracing the AFX Trade exploit](https://raw.githubusercontent.com/bobslayerX/crypttrace/main/assets/graph-outflow.png)
+![crypttrace investigating the Ronin bridge exploiter in the web UI](https://raw.githubusercontent.com/bobslayerX/crypttrace/main/assets/web-ronin.png)
 
-*Real case: the AFX Trade exploiter (July 2026, $24.15M). crypttrace follows the
-stolen ETH out of the attacker's wallet — 12,467 ETH (~$23.3M) to a holding
-address, then split across three wallets and split again. Classic layering,
-mapped in seconds.*
+*Real case: the Ronin bridge exploiter (Lazarus, 2022). The graph shows the
+stolen ETH leaving in three transfers of 23,500–33,600 ETH, every one to a
+wallet on the US sanctions list. The side panel shows what is known about the
+address and where it comes from: the OFAC listing behind the label, USDT and
+USDC blacklisted by Tether and Circle, and the first funding of the wallet —
+1.06 ETH from a Binance reserve wallet, an exchange that knows who withdrew it.*
 
 ---
 
@@ -103,6 +105,8 @@ so scams that start in a Telegram chat often end there. TON addresses are
 accepted in any form (`UQ…`, `EQ…` or raw `0:…`) and shown as wallets show
 them (`UQ…`); jetton transfers are reported between the owners' wallets.
 
+![A Binance reserve wallet on Dogecoin: 2.12 billion DOGE, labelled from Binance's own proof-of-reserves list](https://raw.githubusercontent.com/bobslayerX/crypttrace/main/assets/web-dogecoin.png)
+
 ---
 
 ## Was my wallet drained?
@@ -127,6 +131,14 @@ history and answers in plain language:
   jetton balances and NFTs from trusted collections, not airdropped spam), and
   who to report to.
 
+It also names any payment the wallet made to an address on a phishing or
+sanctions list (ScamSniffer's phishing blacklist and OFAC's, downloaded with
+`crypttrace update-labels`). A fake site or a signed token approval takes money
+in one transfer, so there is no burst to find, but the destination gives it
+away:
+
+![A payment to a listed phishing address, found by the drain check](https://raw.githubusercontent.com/bobslayerX/crypttrace/main/assets/web-check-phishing.png)
+
 The web UI has the same check in its **Was I drained?** tab.
 
 ### An evidence pack for the exchange and the police
@@ -158,8 +170,11 @@ explorer. A side panel shows the profile, first-funder chain, off-ramp check
 and whether USDT/USDC at the address is frozen. Tabs add the assessment, the
 timeline, the list of who sent funds here, and address poisoning (look-alikes
 planted in the wallet's history, and payments lured by this address). **Case
-file** downloads the same one-page HTML report `crypttrace report` writes.
-Everything runs on your machine — nothing is uploaded anywhere.
+file** downloads the same one-page HTML report `crypttrace report` writes;
+**GraphML** and **CSV** download the graph for Gephi or Maltego. The page's
+address is a link to the investigation
+(`/?address=…&chain=…&direction=…&depth=…&tab=check`), ready to bookmark or
+send. Everything runs on your machine — nothing is uploaded anywhere.
 
 This exists so non-technical victims can use the tool at all: a form and a
 picture, instead of command-line flags.
@@ -295,6 +310,26 @@ entities — that's the OSINT handoff point. `--direction out` (default) answers
 money come from", which is how you vet a suspicious address or find a victim's
 source of funds.
 
+### Cases — an investigation kept as a file
+
+An investigation rarely fits one address. `case` keeps the addresses (any
+chain, each with a role: victim, suspect, intermediary, exchange, mixer, bridge
+or other), a log of notes, and the last snapshot of each address. `refresh`
+reads them all again and says what changed: a balance that went down, new
+activity since the last look.
+
+```bash
+crypttrace case new ronin --note "Ronin bridge exploit, March 2022"
+crypttrace case add ronin 0x098b…2f96 --chain eth --role suspect --note "exploiter"
+crypttrace case note ronin "asked Binance for KYC on the first-gas withdrawal"
+crypttrace case refresh ronin        # what moved since the last refresh
+crypttrace case show ronin           # addresses, current labels, last snapshot, the log
+```
+
+A case is one JSON file in `~/.crypttrace/cases/`. Every `case` command also
+takes a path to a `.json` file, so handing a case to a colleague is sending the
+file.
+
 ### Watch & alerts — catching the cash-out
 
 The only window to freeze stolen funds is the moment they reach an exchange
@@ -400,6 +435,11 @@ explorers list newest first, so there it is the earliest of the latest 200
 transfers. On EVM chains a first funding sent by a contract (a mixer or bridge
 withdrawal, an internal transaction) counts and is flagged.
 
+![funder on the Ronin exploiter, and verify on a Dogecoin wallet](https://raw.githubusercontent.com/bobslayerX/crypttrace/main/assets/cli-funder-verify.png)
+
+*Above: the Ronin exploiter's first gas came from a Binance reserve wallet. Below:
+`verify` re-derives a Dogecoin wallet's totals and matches them with the chain.*
+
 ### Victim lists and timing analysis
 
 Two things a graph shows but can't hand you as evidence.
@@ -693,6 +733,7 @@ src/crypttrace/
   offramp.py       # exchange-deposit detection
   bridges.py       # cross-chain matching
   watch.py         # watchlist + alerts
+  case.py          # investigations as files: addresses, roles, notes, snapshots
   report.py        # Markdown + JSON reports
   export.py        # traced graph as GraphML (Gephi) and edge-list CSV (Maltego)
   prices.py        # USD valuation

{crypttrace-0.32.0 → crypttrace-0.34.0}/src/crypttrace/__init__.py

@@ -1,2 +1,2 @@
 """crypttrace — OSINT crypto investigation CLI."""
-__version__ = "0.32.0"
+__version__ = "0.34.0"

crypttrace-0.34.0/src/crypttrace/case.py

@@ -0,0 +1,187 @@
+"""An investigation kept as a file: its addresses, their roles, notes, and what
+changed since you last looked.
+
+A case is one JSON file — by default ~/.crypttrace/cases/NAME.json, or any path
+— so handing a case to a colleague is sending them the file. It holds:
+
+  - addresses across chains, each with a role (victim, suspect, exchange, …)
+    and a note;
+  - a log of timestamped notes;
+  - for each address, the last snapshot taken by `refresh`: native balance
+    and the time of the latest transfer (tokens included where the chain has
+    them). The next `refresh` compares against it, which is how a case tells
+    you the money moved again.
+"""
+import datetime as dt
+import json
+import re
+import time
+from pathlib import Path
+from typing import Callable, List, Optional
+
+from crypttrace import addresses, chains, config
+
+CASES_DIR = config.DATA_DIR / "cases"
+ROLES = ("victim", "suspect", "intermediary", "exchange", "mixer", "bridge", "other")
+FORMAT = 1
+_ALL_TOKENS = {"contract": None, "symbol": "*"}
+
+
+class CaseError(ValueError):
+    pass
+
+
+def path_for(name_or_path: str) -> Path:
+    """A case named in the cases folder, or a .json file anywhere."""
+    p = Path(name_or_path)
+    if p.suffix.lower() == ".json" or p.parent != Path("."):
+        return p
+    if not re.fullmatch(r"[\w.-]{1,64}", name_or_path):
+        raise CaseError("a case name is letters, digits, '.', '-' or '_' (up to 64)")
+    return CASES_DIR / f"{name_or_path}.json"
+
+
+def _now() -> int:
+    return int(time.time())
+
+
+def new(name: str, note: str = "") -> Path:
+    p = path_for(name)
+    if p.exists():
+        raise CaseError(f"case already exists: {p}")
+    case = {"crypttrace_case": FORMAT, "name": p.stem, "created": _now(), "updated": _now(),
+            "addresses": [], "notes": []}
+    if note:
+        case["notes"].append({"at": _now(), "text": note})
+    save(case, p)
+    return p
+
+
+def load(name: str) -> dict:
+    p = path_for(name)
+    try:
+        case = json.loads(p.read_text(encoding="utf-8"))
+    except FileNotFoundError:
+        raise CaseError(f"no such case: {p}")
+    except ValueError as e:
+        raise CaseError(f"{p} is not a readable case file: {e}")
+    if not isinstance(case, dict) or "crypttrace_case" not in case:
+        raise CaseError(f"{p} is not a crypttrace case file")
+    case["_path"] = str(p)
+    return case
+
+
+def save(case: dict, p: Optional[Path] = None) -> Path:
+    p = Path(p or case["_path"])
+    p.parent.mkdir(parents=True, exist_ok=True)
+    data = {k: v for k, v in case.items() if not k.startswith("_")}
+    data["updated"] = _now()
+    tmp = p.with_suffix(p.suffix + ".tmp")
+    tmp.write_text(json.dumps(data, indent=2, ensure_ascii=False), encoding="utf-8")
+    tmp.replace(p)                       # a half-written case never replaces a good one
+    return p
+
+
+def all_cases() -> List[dict]:
+    out = []
+    for p in sorted(CASES_DIR.glob("*.json")):
+        try:
+            c = load(str(p))
+        except CaseError:
+            continue
+        out.append({"name": c.get("name", p.stem), "path": str(p), "addresses": len(c.get("addresses", [])),
+                    "notes": len(c.get("notes", [])), "updated": c.get("updated")})
+    return out
+
+
+def add(name: str, address: str, chain: str, role: str = "other", note: str = "") -> dict:
+    chains.check(chain)
+    if role not in ROLES:
+        raise CaseError(f"role must be one of: {', '.join(ROLES)}")
+    ok, why = addresses.validate(address, chain)
+    if not ok:
+        raise CaseError(f"not a valid {chain} address: {why}")
+    case = load(name)
+    key = chains.norm_addr(address, chain)
+    for a in case["addresses"]:
+        if a["chain"] == chain and a["address"] == key:
+            a["role"] = role                # adding it again updates it
+            if note:
+                a["note"] = note
+            save(case)
+            return a
+    entry = {"address": key, "chain": chain, "role": role, "note": note, "added": _now(), "snapshot": None}
+    case["addresses"].append(entry)
+    save(case)
+    return entry
+
+
+def remove(name: str, address: str, chain: Optional[str] = None) -> bool:
+    case = load(name)
+    before = len(case["addresses"])
+    case["addresses"] = [a for a in case["addresses"]
+                         if not (a["address"] == chains.norm_addr(address, a["chain"])
+                                 and (chain is None or a["chain"] == chain))]
+    if len(case["addresses"]) == before:
+        return False
+    save(case)
+    return True
+
+
+def note(name: str, text: str) -> dict:
+    case = load(name)
+    entry = {"at": _now(), "text": text}
+    case["notes"].append(entry)
+    save(case)
+    return entry
+
+
+def snapshot(address: str, chain: str) -> dict:
+    """Native balance and the time of the latest transfer, read fresh."""
+    snap = {"at": _now(), "balance": None, "last_seen": None, "error": None}
+    try:
+        snap["balance"] = chains.balance(address, chain)
+        rows = list(chains.transfers(address, chain, 50, fresh=True))
+        if not chains.is_utxo(chain):
+            try:
+                rows += chains.transfers(address, chain, 50, asset=_ALL_TOKENS, fresh=True)
+            except chains.ChainError:
+                pass
+        stamps = [int(r.get("timestamp") or 0) for r in rows if r.get("timestamp")]
+        snap["last_seen"] = max(stamps) if stamps else None
+    except chains.ChainError as e:
+        snap["error"] = str(e)
+    return snap
+
+
+def changes(prev: Optional[dict], cur: dict) -> List[str]:
+    """What is different from the last snapshot, in words."""
+    if cur.get("error"):
+        return [f"could not be read: {cur['error']}"]
+    if not prev or prev.get("error"):
+        return ["first snapshot"]
+    out = []
+    a, b = prev.get("balance"), cur.get("balance")
+    if a is not None and b is not None and abs(b - a) > max(1e-9, abs(a) * 1e-9):
+        out.append(f"balance {a:,.8f} -> {b:,.8f} ({b - a:+,.8f})")
+    if (cur.get("last_seen") or 0) > (prev.get("last_seen") or 0):
+        when = dt.datetime.fromtimestamp(cur["last_seen"], dt.timezone.utc).strftime("%Y-%m-%d %H:%M UTC")
+        out.append(f"new activity, latest {when}")
+    return out
+
+
+def refresh(name: str, take: Callable[[str, str], dict] = snapshot) -> List[dict]:
+    """Snapshot every address; report what changed since the last refresh."""
+    case = load(name)
+    report = []
+    for a in case["addresses"]:
+        cur = take(a["address"], a["chain"])
+        diff = changes(a.get("snapshot"), cur)
+        report.append({**{k: a[k] for k in ("address", "chain", "role")}, "changes": diff,
+                       "moved": any(not d.startswith(("first", "could not")) for d in diff),
+                       "balance": cur.get("balance"), "previous": a.get("snapshot")})
+        if not cur.get("error"):
+            a["snapshot"] = cur
+    case.setdefault("refreshes", []).append(_now())
+    save(case)
+    return report

{crypttrace-0.32.0 → crypttrace-0.34.0}/src/crypttrace/cli.py

@@ -1034,5 +1034,124 @@ def watch_run(
         console.print("\n[dim]Stopped.[/dim]")
 
 
+# ---------------------------------------------------------------- cases
+case_app = typer.Typer(help="Keep an investigation as a file: addresses, roles, notes, what changed.")
+app.add_typer(case_app, name="case")
+CASE_ARG = typer.Argument(..., help="Case name (kept in ~/.crypttrace/cases) or a path to a .json case file")
+
+
+def _case_call(fn, *a, **kw):
+    from crypttrace import case as case_mod
+    try:
+        return fn(*a, **kw)
+    except (case_mod.CaseError, chains_mod.ChainError) as e:
+        console.print(f"[red]Error:[/red] {e}")
+        raise typer.Exit(1)
+
+
+@case_app.command("new")
+def case_new(name: str = CASE_ARG,
+             note: str = typer.Option("", "--note", "-n", help="What the case is about")):
+    """Start a case."""
+    from crypttrace import case as case_mod
+    p = _case_call(case_mod.new, name, note)
+    console.print(f"[green]✓ Case created[/green] {p}\n[dim]Add addresses with "
+                  f"`crypttrace case add {name} ADDRESS --chain … --role suspect`[/dim]")
+
+
+@case_app.command("list")
+def case_list():
+    """Cases in ~/.crypttrace/cases."""
+    from crypttrace import case as case_mod
+    cases = case_mod.all_cases()
+    if not cases:
+        console.print("[dim]No cases yet. Start one with `crypttrace case new NAME`.[/dim]")
+        return
+    t = render.Table(header_style="bold")
+    for c in ("Case", "Addresses", "Notes", "Updated (UTC)"):
+        t.add_column(c)
+    for c in cases:
+        t.add_row(c["name"], str(c["addresses"]), str(c["notes"]), render._ts(str(c["updated"] or 0)))
+    console.print(t)
+
+
+@case_app.command("add")
+def case_add(name: str = CASE_ARG,
+             address: str = typer.Argument(..., help="Address to add"),
+             chain: str = CHAIN_OPT,
+             role: str = typer.Option("other", "--role", "-r",
+                                      help="victim, suspect, intermediary, exchange, mixer, bridge or other"),
+             note: str = typer.Option("", "--note", "-n", help="Why it is in the case")):
+    """Add an address to a case (adding it again updates its role and note)."""
+    from crypttrace import case as case_mod
+    a = _case_call(case_mod.add, name, address, chain, role, note)
+    console.print(f"[green]✓[/green] {a['address']} ({a['chain']}) as {a['role']}"
+                  + (f" — {a['note']}" if a.get("note") else ""))
+
+
+@case_app.command("remove")
+def case_remove(name: str = CASE_ARG, address: str = typer.Argument(..., help="Address to drop"),
+                chain: Optional[str] = typer.Option(None, "--chain", "-c", help="Only on this chain")):
+    """Drop an address from a case."""
+    from crypttrace import case as case_mod
+    if _case_call(case_mod.remove, name, address, chain):
+        console.print(f"[green]✓ Removed[/green] {address}")
+    else:
+        console.print("[dim]That address is not in the case.[/dim]")
+
+
+@case_app.command("note")
+def case_note(name: str = CASE_ARG, text: str = typer.Argument(..., help="The note")):
+    """Add a timestamped note to the case log."""
+    from crypttrace import case as case_mod
+    _case_call(case_mod.note, name, text)
+    console.print("[green]✓ Noted[/green]")
+
+
+@case_app.command("show")
+def case_show(name: str = CASE_ARG):
+    """The case: its addresses with current labels, the last snapshot, the log."""
+    from crypttrace import case as case_mod
+    c = _case_call(case_mod.load, name)
+    console.print(f"[bold]{c['name']}[/bold]  [dim]{c['_path']}[/dim]")
+    if c["addresses"]:
+        t = render.Table(header_style="bold")
+        for col in ("Role", "Chain", "Address", "Label", "Note", "Last snapshot"):
+            t.add_column(col)
+        for a in c["addresses"]:
+            s = a.get("snapshot") or {}
+            snap = "—" if not s else (
+                (f"{s['balance']:,.8f}" if s.get("balance") is not None else "?") + " "
+                f"{chains_mod.symbol(a['chain'])} · seen "
+                + (render._ts(str(s['last_seen'])) if s.get("last_seen") else "never")
+                + f" · taken {render._ts(str(s['at']))}")
+            t.add_row(a["role"], a["chain"], a["address"], labels.label_of(a["address"]) or "",
+                      a.get("note") or "", snap)
+        console.print(t)
+    else:
+        console.print("[dim]No addresses yet.[/dim]")
+    for n in c.get("notes", []):
+        console.print(f"  [dim]{render._ts(str(n['at']))}[/dim]  {n['text']}")
+
+
+@case_app.command("refresh")
+def case_refresh(name: str = CASE_ARG):
+    """Read every address again and say what changed since the last refresh."""
+    from crypttrace import case as case_mod
+    rep = _case_call(case_mod.refresh, name)
+    if not rep:
+        console.print("[dim]The case has no addresses.[/dim]")
+        return
+    moved = [r for r in rep if r["moved"]]
+    for r in rep:
+        mark = "[bold yellow]●[/bold yellow]" if r["moved"] else "[dim]·[/dim]"
+        console.print(f"{mark} {r['role']:<12} {r['chain']:<8} {r['address']}")
+        for d in r["changes"]:
+            console.print(f"      {d}")
+    console.print(f"\n[bold]{len(moved)}[/bold] of {len(rep)} address(es) changed since the last refresh."
+                  if any(r["previous"] for r in rep) else "\nFirst snapshot taken; the next refresh "
+                  "will say what changed.")
+
+
 if __name__ == "__main__":
     app()

{crypttrace-0.32.0 → crypttrace-0.34.0}/src/crypttrace/labels/known.json

@@ -97,7 +97,7 @@
   "0x2796317b0ff8538f253012862c06787adfb8ceb6": {"name": "Synapse: Bridge", "type": "bridge"},
   "0x5427fefa711eff984124bfbb1ab6fbf5e3da1820": {"name": "Celer: cBridge V2", "type": "bridge"},
   "0x841ce48f9446c8e281d3f1444cb859b4a6d0738c": {"name": "Celer: cBridge (old)", "type": "bridge"},
-  "0x098b716b8aaf21512996dc57eb0615e2383e2f96": {"name": "Ronin Bridge Exploiter (Lazarus)", "type": "sanctioned"},
+  "0x098b716b8aaf21512996dc57eb0615e2383e2f96": {"name": "Ronin Bridge Exploiter (Lazarus)", "type": "sanctioned", "source": "US Treasury OFAC SDN list, Lazarus Group entry (address added in April 2022); present in the SDN digital-currency address extract, github.com/0xB10C/ofac-sanctioned-digital-currency-addresses, checked 2026-11-07", "source_kind": "official-list", "added": "2026-11-07"},
   "0x2f2974fabc54dba33442261211c06bd20e0feefc": {"name": "AFX Trade Exploiter (Jul 2026, $24M)", "type": "scam", "chain": "eth", "source": "Lookonchain, 23 Jul 2026 - received 24.15M USDC bridged from Arbitrum, swapped to 12,467 ETH", "source_kind": "research", "added": "2026-08-01"},
 
   "bc1qq85v2c926eg6pgxhwp6q7lf6cnsz80qs3fcu9r": {"name": "Coldcard Exploiter (Jul 2026) - consolidation", "type": "scam", "chain": "btc", "source": "Galaxy Research flow-of-funds thread, 31 Jul 2026, based on Block (clay_garrett) analysis", "source_kind": "research", "added": "2026-08-09"},

{crypttrace-0.32.0 → crypttrace-0.34.0}/src/crypttrace/web/index.html

@@ -285,6 +285,8 @@ const COLORS={exchange:'#3fdf87',mixer:'#c48cff',sanctioned:'#ff6b60',scam:'#ff6
 const EXPLORER={eth:'https://etherscan.io',bsc:'https://bscscan.com',polygon:'https://polygonscan.com',
   arbitrum:'https://arbiscan.io',optimism:'https://optimistic.etherscan.io',base:'https://basescan.org'};
 const NON_EVM={btc:a=>`https://mempool.space/address/${a}`,
+               ltc:a=>`https://litecoinspace.org/address/${a}`,
+               doge:a=>`https://blockchair.com/dogecoin/address/${a}`,
                tron:a=>`https://tronscan.org/#/address/${a}`,
                sol:a=>`https://solscan.io/account/${a}`,
                ton:a=>`https://tonviewer.com/${a}`};
@@ -486,6 +488,10 @@ async function inspect(addr){
 async function run(){
   const a=$('#addr').value.trim();
   if(!a){ setStatus('enter an address',true); return; }
+  // the page's own address becomes a link to this investigation
+  const link=new URLSearchParams({address:a,chain:chain(),asset:$('#asset').value,
+                                   direction:$('#direction').value,depth:$('#depth').value});
+  history.replaceState(null,'',`?${link}`);
   setStatus('tracing the chain…',false,true); loader(35);
   $('#hint').classList.add('hide');
   loaded={};                       // new address -> other views must reload
@@ -514,6 +520,8 @@ async function run(){
 async function syncAssets(){
   const sel=$('#asset'), c=chain();
   $('#addr').placeholder = c==='btc' ? 'bc1… / 1… / 3…  Bitcoin address'
+    : c==='ltc'  ? 'L… / M… / ltc1…  Litecoin address'
+    : c==='doge' ? 'D…  Dogecoin address'
     : c==='tron' ? 'T…  Tron address'
     : c==='sol'  ? 'Solana account address'
     : c==='ton'  ? 'UQ… / EQ…  TON address'
@@ -821,6 +829,22 @@ $('#zroot').onclick=()=>{
   setTimeout(showScale,520);
 };
 $('#addr').addEventListener('keydown',e=>{ if(e.key==='Enter') run(); });
+
+// A link opens an investigation: /?address=…&chain=eth&direction=in&depth=4&asset=usdt&tab=check
+(function(){
+  const p=new URLSearchParams(location.search), a=p.get('address');
+  if(!a) return;
+  const set=(id,v)=>{
+    const el=$(id);
+    if(v!==null && [...el.options].some(o=>o.value===v)){ el.value=v; el.dispatchEvent(new Event('change')); }
+  };
+  set('#chain',p.get('chain'));          // first: it decides which assets are offered
+  set('#asset',p.get('asset')); set('#direction',p.get('direction')); set('#depth',p.get('depth'));
+  $('#addr').value=a;
+  run();
+  const v=p.get('tab');
+  if(v && [...document.querySelectorAll('.tab')].some(t=>t.dataset.view===v)) showView(v);
+})();
 </script>
 </body>
 </html>

{crypttrace-0.32.0 → crypttrace-0.34.0/src/crypttrace.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: crypttrace
-Version: 0.32.0
+Version: 0.34.0
 Summary: OSINT toolkit for crypto investigations: trace stolen funds across Ethereum, Bitcoin, Tron, Solana and TON
 Author: bobslayerX
 License-Expression: MIT
@@ -50,12 +50,14 @@ here's the wallet — where did the money go, and where can it still be stopped?
 Works as a terminal tool **and** as a local web app with an interactive
 fund-flow graph.
 
-![crypttrace tracing the AFX Trade exploit](https://raw.githubusercontent.com/bobslayerX/crypttrace/main/assets/graph-outflow.png)
+![crypttrace investigating the Ronin bridge exploiter in the web UI](https://raw.githubusercontent.com/bobslayerX/crypttrace/main/assets/web-ronin.png)
 
-*Real case: the AFX Trade exploiter (July 2026, $24.15M). crypttrace follows the
-stolen ETH out of the attacker's wallet — 12,467 ETH (~$23.3M) to a holding
-address, then split across three wallets and split again. Classic layering,
-mapped in seconds.*
+*Real case: the Ronin bridge exploiter (Lazarus, 2022). The graph shows the
+stolen ETH leaving in three transfers of 23,500–33,600 ETH, every one to a
+wallet on the US sanctions list. The side panel shows what is known about the
+address and where it comes from: the OFAC listing behind the label, USDT and
+USDC blacklisted by Tether and Circle, and the first funding of the wallet —
+1.06 ETH from a Binance reserve wallet, an exchange that knows who withdrew it.*
 
 ---
 
@@ -137,6 +139,8 @@ so scams that start in a Telegram chat often end there. TON addresses are
 accepted in any form (`UQ…`, `EQ…` or raw `0:…`) and shown as wallets show
 them (`UQ…`); jetton transfers are reported between the owners' wallets.
 
+![A Binance reserve wallet on Dogecoin: 2.12 billion DOGE, labelled from Binance's own proof-of-reserves list](https://raw.githubusercontent.com/bobslayerX/crypttrace/main/assets/web-dogecoin.png)
+
 ---
 
 ## Was my wallet drained?
@@ -161,6 +165,14 @@ history and answers in plain language:
   jetton balances and NFTs from trusted collections, not airdropped spam), and
   who to report to.
 
+It also names any payment the wallet made to an address on a phishing or
+sanctions list (ScamSniffer's phishing blacklist and OFAC's, downloaded with
+`crypttrace update-labels`). A fake site or a signed token approval takes money
+in one transfer, so there is no burst to find, but the destination gives it
+away:
+
+![A payment to a listed phishing address, found by the drain check](https://raw.githubusercontent.com/bobslayerX/crypttrace/main/assets/web-check-phishing.png)
+
 The web UI has the same check in its **Was I drained?** tab.
 
 ### An evidence pack for the exchange and the police
@@ -192,8 +204,11 @@ explorer. A side panel shows the profile, first-funder chain, off-ramp check
 and whether USDT/USDC at the address is frozen. Tabs add the assessment, the
 timeline, the list of who sent funds here, and address poisoning (look-alikes
 planted in the wallet's history, and payments lured by this address). **Case
-file** downloads the same one-page HTML report `crypttrace report` writes.
-Everything runs on your machine — nothing is uploaded anywhere.
+file** downloads the same one-page HTML report `crypttrace report` writes;
+**GraphML** and **CSV** download the graph for Gephi or Maltego. The page's
+address is a link to the investigation
+(`/?address=…&chain=…&direction=…&depth=…&tab=check`), ready to bookmark or
+send. Everything runs on your machine — nothing is uploaded anywhere.
 
 This exists so non-technical victims can use the tool at all: a form and a
 picture, instead of command-line flags.
@@ -329,6 +344,26 @@ entities — that's the OSINT handoff point. `--direction out` (default) answers
 money come from", which is how you vet a suspicious address or find a victim's
 source of funds.
 
+### Cases — an investigation kept as a file
+
+An investigation rarely fits one address. `case` keeps the addresses (any
+chain, each with a role: victim, suspect, intermediary, exchange, mixer, bridge
+or other), a log of notes, and the last snapshot of each address. `refresh`
+reads them all again and says what changed: a balance that went down, new
+activity since the last look.
+
+```bash
+crypttrace case new ronin --note "Ronin bridge exploit, March 2022"
+crypttrace case add ronin 0x098b…2f96 --chain eth --role suspect --note "exploiter"
+crypttrace case note ronin "asked Binance for KYC on the first-gas withdrawal"
+crypttrace case refresh ronin        # what moved since the last refresh
+crypttrace case show ronin           # addresses, current labels, last snapshot, the log
+```
+
+A case is one JSON file in `~/.crypttrace/cases/`. Every `case` command also
+takes a path to a `.json` file, so handing a case to a colleague is sending the
+file.
+
 ### Watch & alerts — catching the cash-out
 
 The only window to freeze stolen funds is the moment they reach an exchange
@@ -434,6 +469,11 @@ explorers list newest first, so there it is the earliest of the latest 200
 transfers. On EVM chains a first funding sent by a contract (a mixer or bridge
 withdrawal, an internal transaction) counts and is flagged.
 
+![funder on the Ronin exploiter, and verify on a Dogecoin wallet](https://raw.githubusercontent.com/bobslayerX/crypttrace/main/assets/cli-funder-verify.png)
+
+*Above: the Ronin exploiter's first gas came from a Binance reserve wallet. Below:
+`verify` re-derives a Dogecoin wallet's totals and matches them with the chain.*
+
 ### Victim lists and timing analysis
 
 Two things a graph shows but can't hand you as evidence.
@@ -727,6 +767,7 @@ src/crypttrace/
   offramp.py       # exchange-deposit detection
   bridges.py       # cross-chain matching
   watch.py         # watchlist + alerts
+  case.py          # investigations as files: addresses, roles, notes, snapshots
   report.py        # Markdown + JSON reports
   export.py        # traced graph as GraphML (Gephi) and edge-list CSV (Maltego)
   prices.py        # USD valuation

{crypttrace-0.32.0 → crypttrace-0.34.0}/src/crypttrace.egg-info/SOURCES.txt

@@ -7,6 +7,7 @@ src/crypttrace/analysis.py
 src/crypttrace/assess.py
 src/crypttrace/assets.py
 src/crypttrace/bridges.py
+src/crypttrace/case.py
 src/crypttrace/chains.py
 src/crypttrace/cli.py
 src/crypttrace/config.py