crypttrace 0.33.0__tar.gz → 0.34.0__tar.gz

{crypttrace-0.33.0/src/crypttrace.egg-info → crypttrace-0.34.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: crypttrace
-Version: 0.33.0
+Version: 0.34.0
 Summary: OSINT toolkit for crypto investigations: trace stolen funds across Ethereum, Bitcoin, Tron, Solana and TON
 Author: bobslayerX
 License-Expression: MIT
@@ -50,12 +50,14 @@ here's the wallet — where did the money go, and where can it still be stopped?
 Works as a terminal tool **and** as a local web app with an interactive
 fund-flow graph.
 
-![crypttrace tracing the AFX Trade exploit](https://raw.githubusercontent.com/bobslayerX/crypttrace/main/assets/graph-outflow.png)
+![crypttrace investigating the Ronin bridge exploiter in the web UI](https://raw.githubusercontent.com/bobslayerX/crypttrace/main/assets/web-ronin.png)
 
-*Real case: the AFX Trade exploiter (July 2026, $24.15M). crypttrace follows the
-stolen ETH out of the attacker's wallet — 12,467 ETH (~$23.3M) to a holding
-address, then split across three wallets and split again. Classic layering,
-mapped in seconds.*
+*Real case: the Ronin bridge exploiter (Lazarus, 2022). The graph shows the
+stolen ETH leaving in three transfers of 23,500–33,600 ETH, every one to a
+wallet on the US sanctions list. The side panel shows what is known about the
+address and where it comes from: the OFAC listing behind the label, USDT and
+USDC blacklisted by Tether and Circle, and the first funding of the wallet —
+1.06 ETH from a Binance reserve wallet, an exchange that knows who withdrew it.*
 
 ---
 
@@ -137,6 +139,8 @@ so scams that start in a Telegram chat often end there. TON addresses are
 accepted in any form (`UQ…`, `EQ…` or raw `0:…`) and shown as wallets show
 them (`UQ…`); jetton transfers are reported between the owners' wallets.
 
+![A Binance reserve wallet on Dogecoin: 2.12 billion DOGE, labelled from Binance's own proof-of-reserves list](https://raw.githubusercontent.com/bobslayerX/crypttrace/main/assets/web-dogecoin.png)
+
 ---
 
 ## Was my wallet drained?
@@ -161,6 +165,14 @@ history and answers in plain language:
   jetton balances and NFTs from trusted collections, not airdropped spam), and
   who to report to.
 
+It also names any payment the wallet made to an address on a phishing or
+sanctions list (ScamSniffer's phishing blacklist and OFAC's, downloaded with
+`crypttrace update-labels`). A fake site or a signed token approval takes money
+in one transfer, so there is no burst to find, but the destination gives it
+away:
+
+![A payment to a listed phishing address, found by the drain check](https://raw.githubusercontent.com/bobslayerX/crypttrace/main/assets/web-check-phishing.png)
+
 The web UI has the same check in its **Was I drained?** tab.
 
 ### An evidence pack for the exchange and the police
@@ -192,8 +204,11 @@ explorer. A side panel shows the profile, first-funder chain, off-ramp check
 and whether USDT/USDC at the address is frozen. Tabs add the assessment, the
 timeline, the list of who sent funds here, and address poisoning (look-alikes
 planted in the wallet's history, and payments lured by this address). **Case
-file** downloads the same one-page HTML report `crypttrace report` writes.
-Everything runs on your machine — nothing is uploaded anywhere.
+file** downloads the same one-page HTML report `crypttrace report` writes;
+**GraphML** and **CSV** download the graph for Gephi or Maltego. The page's
+address is a link to the investigation
+(`/?address=…&chain=…&direction=…&depth=…&tab=check`), ready to bookmark or
+send. Everything runs on your machine — nothing is uploaded anywhere.
 
 This exists so non-technical victims can use the tool at all: a form and a
 picture, instead of command-line flags.
@@ -454,6 +469,11 @@ explorers list newest first, so there it is the earliest of the latest 200
 transfers. On EVM chains a first funding sent by a contract (a mixer or bridge
 withdrawal, an internal transaction) counts and is flagged.
 
+![funder on the Ronin exploiter, and verify on a Dogecoin wallet](https://raw.githubusercontent.com/bobslayerX/crypttrace/main/assets/cli-funder-verify.png)
+
+*Above: the Ronin exploiter's first gas came from a Binance reserve wallet. Below:
+`verify` re-derives a Dogecoin wallet's totals and matches them with the chain.*
+
 ### Victim lists and timing analysis
 
 Two things a graph shows but can't hand you as evidence.

{crypttrace-0.33.0 → crypttrace-0.34.0}/README.md

@@ -16,12 +16,14 @@ here's the wallet — where did the money go, and where can it still be stopped?
 Works as a terminal tool **and** as a local web app with an interactive
 fund-flow graph.
 
-![crypttrace tracing the AFX Trade exploit](https://raw.githubusercontent.com/bobslayerX/crypttrace/main/assets/graph-outflow.png)
+![crypttrace investigating the Ronin bridge exploiter in the web UI](https://raw.githubusercontent.com/bobslayerX/crypttrace/main/assets/web-ronin.png)
 
-*Real case: the AFX Trade exploiter (July 2026, $24.15M). crypttrace follows the
-stolen ETH out of the attacker's wallet — 12,467 ETH (~$23.3M) to a holding
-address, then split across three wallets and split again. Classic layering,
-mapped in seconds.*
+*Real case: the Ronin bridge exploiter (Lazarus, 2022). The graph shows the
+stolen ETH leaving in three transfers of 23,500–33,600 ETH, every one to a
+wallet on the US sanctions list. The side panel shows what is known about the
+address and where it comes from: the OFAC listing behind the label, USDT and
+USDC blacklisted by Tether and Circle, and the first funding of the wallet —
+1.06 ETH from a Binance reserve wallet, an exchange that knows who withdrew it.*
 
 ---
 
@@ -103,6 +105,8 @@ so scams that start in a Telegram chat often end there. TON addresses are
 accepted in any form (`UQ…`, `EQ…` or raw `0:…`) and shown as wallets show
 them (`UQ…`); jetton transfers are reported between the owners' wallets.
 
+![A Binance reserve wallet on Dogecoin: 2.12 billion DOGE, labelled from Binance's own proof-of-reserves list](https://raw.githubusercontent.com/bobslayerX/crypttrace/main/assets/web-dogecoin.png)
+
 ---
 
 ## Was my wallet drained?
@@ -127,6 +131,14 @@ history and answers in plain language:
   jetton balances and NFTs from trusted collections, not airdropped spam), and
   who to report to.
 
+It also names any payment the wallet made to an address on a phishing or
+sanctions list (ScamSniffer's phishing blacklist and OFAC's, downloaded with
+`crypttrace update-labels`). A fake site or a signed token approval takes money
+in one transfer, so there is no burst to find, but the destination gives it
+away:
+
+![A payment to a listed phishing address, found by the drain check](https://raw.githubusercontent.com/bobslayerX/crypttrace/main/assets/web-check-phishing.png)
+
 The web UI has the same check in its **Was I drained?** tab.
 
 ### An evidence pack for the exchange and the police
@@ -158,8 +170,11 @@ explorer. A side panel shows the profile, first-funder chain, off-ramp check
 and whether USDT/USDC at the address is frozen. Tabs add the assessment, the
 timeline, the list of who sent funds here, and address poisoning (look-alikes
 planted in the wallet's history, and payments lured by this address). **Case
-file** downloads the same one-page HTML report `crypttrace report` writes.
-Everything runs on your machine — nothing is uploaded anywhere.
+file** downloads the same one-page HTML report `crypttrace report` writes;
+**GraphML** and **CSV** download the graph for Gephi or Maltego. The page's
+address is a link to the investigation
+(`/?address=…&chain=…&direction=…&depth=…&tab=check`), ready to bookmark or
+send. Everything runs on your machine — nothing is uploaded anywhere.
 
 This exists so non-technical victims can use the tool at all: a form and a
 picture, instead of command-line flags.
@@ -420,6 +435,11 @@ explorers list newest first, so there it is the earliest of the latest 200
 transfers. On EVM chains a first funding sent by a contract (a mixer or bridge
 withdrawal, an internal transaction) counts and is flagged.
 
+![funder on the Ronin exploiter, and verify on a Dogecoin wallet](https://raw.githubusercontent.com/bobslayerX/crypttrace/main/assets/cli-funder-verify.png)
+
+*Above: the Ronin exploiter's first gas came from a Binance reserve wallet. Below:
+`verify` re-derives a Dogecoin wallet's totals and matches them with the chain.*
+
 ### Victim lists and timing analysis
 
 Two things a graph shows but can't hand you as evidence.

{crypttrace-0.33.0 → crypttrace-0.34.0}/src/crypttrace/__init__.py

@@ -1,2 +1,2 @@
 """crypttrace — OSINT crypto investigation CLI."""
-__version__ = "0.33.0"
+__version__ = "0.34.0"

{crypttrace-0.33.0 → crypttrace-0.34.0}/src/crypttrace/labels/known.json

@@ -97,7 +97,7 @@
   "0x2796317b0ff8538f253012862c06787adfb8ceb6": {"name": "Synapse: Bridge", "type": "bridge"},
   "0x5427fefa711eff984124bfbb1ab6fbf5e3da1820": {"name": "Celer: cBridge V2", "type": "bridge"},
   "0x841ce48f9446c8e281d3f1444cb859b4a6d0738c": {"name": "Celer: cBridge (old)", "type": "bridge"},
-  "0x098b716b8aaf21512996dc57eb0615e2383e2f96": {"name": "Ronin Bridge Exploiter (Lazarus)", "type": "sanctioned"},
+  "0x098b716b8aaf21512996dc57eb0615e2383e2f96": {"name": "Ronin Bridge Exploiter (Lazarus)", "type": "sanctioned", "source": "US Treasury OFAC SDN list, Lazarus Group entry (address added in April 2022); present in the SDN digital-currency address extract, github.com/0xB10C/ofac-sanctioned-digital-currency-addresses, checked 2026-11-07", "source_kind": "official-list", "added": "2026-11-07"},
   "0x2f2974fabc54dba33442261211c06bd20e0feefc": {"name": "AFX Trade Exploiter (Jul 2026, $24M)", "type": "scam", "chain": "eth", "source": "Lookonchain, 23 Jul 2026 - received 24.15M USDC bridged from Arbitrum, swapped to 12,467 ETH", "source_kind": "research", "added": "2026-08-01"},
 
   "bc1qq85v2c926eg6pgxhwp6q7lf6cnsz80qs3fcu9r": {"name": "Coldcard Exploiter (Jul 2026) - consolidation", "type": "scam", "chain": "btc", "source": "Galaxy Research flow-of-funds thread, 31 Jul 2026, based on Block (clay_garrett) analysis", "source_kind": "research", "added": "2026-08-09"},

{crypttrace-0.33.0 → crypttrace-0.34.0}/src/crypttrace/web/index.html

@@ -285,6 +285,8 @@ const COLORS={exchange:'#3fdf87',mixer:'#c48cff',sanctioned:'#ff6b60',scam:'#ff6
 const EXPLORER={eth:'https://etherscan.io',bsc:'https://bscscan.com',polygon:'https://polygonscan.com',
   arbitrum:'https://arbiscan.io',optimism:'https://optimistic.etherscan.io',base:'https://basescan.org'};
 const NON_EVM={btc:a=>`https://mempool.space/address/${a}`,
+               ltc:a=>`https://litecoinspace.org/address/${a}`,
+               doge:a=>`https://blockchair.com/dogecoin/address/${a}`,
                tron:a=>`https://tronscan.org/#/address/${a}`,
                sol:a=>`https://solscan.io/account/${a}`,
                ton:a=>`https://tonviewer.com/${a}`};
@@ -486,6 +488,10 @@ async function inspect(addr){
 async function run(){
   const a=$('#addr').value.trim();
   if(!a){ setStatus('enter an address',true); return; }
+  // the page's own address becomes a link to this investigation
+  const link=new URLSearchParams({address:a,chain:chain(),asset:$('#asset').value,
+                                   direction:$('#direction').value,depth:$('#depth').value});
+  history.replaceState(null,'',`?${link}`);
   setStatus('tracing the chain…',false,true); loader(35);
   $('#hint').classList.add('hide');
   loaded={};                       // new address -> other views must reload
@@ -514,6 +520,8 @@ async function run(){
 async function syncAssets(){
   const sel=$('#asset'), c=chain();
   $('#addr').placeholder = c==='btc' ? 'bc1… / 1… / 3…  Bitcoin address'
+    : c==='ltc'  ? 'L… / M… / ltc1…  Litecoin address'
+    : c==='doge' ? 'D…  Dogecoin address'
     : c==='tron' ? 'T…  Tron address'
     : c==='sol'  ? 'Solana account address'
     : c==='ton'  ? 'UQ… / EQ…  TON address'
@@ -821,6 +829,22 @@ $('#zroot').onclick=()=>{
   setTimeout(showScale,520);
 };
 $('#addr').addEventListener('keydown',e=>{ if(e.key==='Enter') run(); });
+
+// A link opens an investigation: /?address=…&chain=eth&direction=in&depth=4&asset=usdt&tab=check
+(function(){
+  const p=new URLSearchParams(location.search), a=p.get('address');
+  if(!a) return;
+  const set=(id,v)=>{
+    const el=$(id);
+    if(v!==null && [...el.options].some(o=>o.value===v)){ el.value=v; el.dispatchEvent(new Event('change')); }
+  };
+  set('#chain',p.get('chain'));          // first: it decides which assets are offered
+  set('#asset',p.get('asset')); set('#direction',p.get('direction')); set('#depth',p.get('depth'));
+  $('#addr').value=a;
+  run();
+  const v=p.get('tab');
+  if(v && [...document.querySelectorAll('.tab')].some(t=>t.dataset.view===v)) showView(v);
+})();
 </script>
 </body>
 </html>

{crypttrace-0.33.0 → crypttrace-0.34.0/src/crypttrace.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: crypttrace
-Version: 0.33.0
+Version: 0.34.0
 Summary: OSINT toolkit for crypto investigations: trace stolen funds across Ethereum, Bitcoin, Tron, Solana and TON
 Author: bobslayerX
 License-Expression: MIT
@@ -50,12 +50,14 @@ here's the wallet — where did the money go, and where can it still be stopped?
 Works as a terminal tool **and** as a local web app with an interactive
 fund-flow graph.
 
-![crypttrace tracing the AFX Trade exploit](https://raw.githubusercontent.com/bobslayerX/crypttrace/main/assets/graph-outflow.png)
+![crypttrace investigating the Ronin bridge exploiter in the web UI](https://raw.githubusercontent.com/bobslayerX/crypttrace/main/assets/web-ronin.png)
 
-*Real case: the AFX Trade exploiter (July 2026, $24.15M). crypttrace follows the
-stolen ETH out of the attacker's wallet — 12,467 ETH (~$23.3M) to a holding
-address, then split across three wallets and split again. Classic layering,
-mapped in seconds.*
+*Real case: the Ronin bridge exploiter (Lazarus, 2022). The graph shows the
+stolen ETH leaving in three transfers of 23,500–33,600 ETH, every one to a
+wallet on the US sanctions list. The side panel shows what is known about the
+address and where it comes from: the OFAC listing behind the label, USDT and
+USDC blacklisted by Tether and Circle, and the first funding of the wallet —
+1.06 ETH from a Binance reserve wallet, an exchange that knows who withdrew it.*
 
 ---
 
@@ -137,6 +139,8 @@ so scams that start in a Telegram chat often end there. TON addresses are
 accepted in any form (`UQ…`, `EQ…` or raw `0:…`) and shown as wallets show
 them (`UQ…`); jetton transfers are reported between the owners' wallets.
 
+![A Binance reserve wallet on Dogecoin: 2.12 billion DOGE, labelled from Binance's own proof-of-reserves list](https://raw.githubusercontent.com/bobslayerX/crypttrace/main/assets/web-dogecoin.png)
+
 ---
 
 ## Was my wallet drained?
@@ -161,6 +165,14 @@ history and answers in plain language:
   jetton balances and NFTs from trusted collections, not airdropped spam), and
   who to report to.
 
+It also names any payment the wallet made to an address on a phishing or
+sanctions list (ScamSniffer's phishing blacklist and OFAC's, downloaded with
+`crypttrace update-labels`). A fake site or a signed token approval takes money
+in one transfer, so there is no burst to find, but the destination gives it
+away:
+
+![A payment to a listed phishing address, found by the drain check](https://raw.githubusercontent.com/bobslayerX/crypttrace/main/assets/web-check-phishing.png)
+
 The web UI has the same check in its **Was I drained?** tab.
 
 ### An evidence pack for the exchange and the police
@@ -192,8 +204,11 @@ explorer. A side panel shows the profile, first-funder chain, off-ramp check
 and whether USDT/USDC at the address is frozen. Tabs add the assessment, the
 timeline, the list of who sent funds here, and address poisoning (look-alikes
 planted in the wallet's history, and payments lured by this address). **Case
-file** downloads the same one-page HTML report `crypttrace report` writes.
-Everything runs on your machine — nothing is uploaded anywhere.
+file** downloads the same one-page HTML report `crypttrace report` writes;
+**GraphML** and **CSV** download the graph for Gephi or Maltego. The page's
+address is a link to the investigation
+(`/?address=…&chain=…&direction=…&depth=…&tab=check`), ready to bookmark or
+send. Everything runs on your machine — nothing is uploaded anywhere.
 
 This exists so non-technical victims can use the tool at all: a form and a
 picture, instead of command-line flags.
@@ -454,6 +469,11 @@ explorers list newest first, so there it is the earliest of the latest 200
 transfers. On EVM chains a first funding sent by a contract (a mixer or bridge
 withdrawal, an internal transaction) counts and is flagged.
 
+![funder on the Ronin exploiter, and verify on a Dogecoin wallet](https://raw.githubusercontent.com/bobslayerX/crypttrace/main/assets/cli-funder-verify.png)
+
+*Above: the Ronin exploiter's first gas came from a Binance reserve wallet. Below:
+`verify` re-derives a Dogecoin wallet's totals and matches them with the chain.*
+
 ### Victim lists and timing analysis
 
 Two things a graph shows but can't hand you as evidence.