crypttrace 0.5.0__tar.gz → 0.6.0__tar.gz

{crypttrace-0.5.0/src/crypttrace.egg-info → crypttrace-0.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: crypttrace
-Version: 0.5.0
+Version: 0.6.0
 Summary: OSINT toolkit for crypto investigations: trace stolen funds across Ethereum, Bitcoin, Tron and Solana
 Author: bobslayerX
 License-Expression: MIT
@@ -163,6 +163,11 @@ It is also honest with you: most stolen crypto is not recovered, and what
 matters is speed and whether the funds touch a regulated exchange. The tool
 gives you evidence and timing — it cannot move funds or name a person by itself.
 
+**Stolen USDT or USDC?** Check at once whether it is still sitting at the
+thief's address — Tether and Circle can freeze it there, and only there:
+`crypttrace freeze THEIR_ADDRESS --chain tron`. `investigate` does this too
+and puts it first.
+
 **Sent money to an address that looked right?** That is usually address
 poisoning — see below. Check your own wallet with
 `crypttrace poisoning YOUR_ADDRESS`.
@@ -195,6 +200,9 @@ crypttrace tokens 0xADDRESS
 # Who bootstrapped this wallet's first gas? Follow it toward a KYC point
 crypttrace funder 0xADDRESS --hops 6
 
+# Is the USDT/USDC at this address frozen by Tether/Circle — and who can freeze it?
+crypttrace freeze TADDRESS --chain tron
+
 # Address poisoning: look-alike addresses planted in a wallet's history
 crypttrace poisoning TADDRESS --chain tron
 
@@ -275,6 +283,29 @@ crypttrace watch run --once             # single check, for scheduled tasks
 Optional Telegram alerts: set `CRYPTTRACE_TG_TOKEN` and `CRYPTTRACE_TG_CHAT`,
 then pass `--telegram`.
 
+### Stablecoin freezes
+
+Tether and Circle can freeze USDT and USDC at any address. For a victim of a
+stablecoin theft that is the one lever that actually stops the money — while it
+is still there. `crypttrace freeze` reads the issuers' own contracts (USDT's
+`isBlackListed`, USDC's `isBlacklisted`, balances; token-account state on
+Solana) on Ethereum, Tron and Solana, and answers three things: how much is
+there, whether it is already frozen, and if not, who can freeze it:
+
+- **Tether** freezes USDT at the request of law enforcement, often before a
+  court case — so the route is the police, quickly
+  ([policy](https://tether.to/en/legal/?tab=law-enforcement-requests)).
+- **Circle** freezes USDC only on a legal order such as a court order
+  ([terms](https://www.circle.com/legal/usdc-terms)), which takes longer.
+
+No API key is needed: Ethereum is read through a public node (set
+`CRYPTTRACE_ETH_RPC` to use your own). `investigate` runs the check on the
+address the money went to and makes it the first step; the web UI shows it in
+the side panel; a freeze also counts in the assessment. A check that fails is
+reported as unknown, never as "not frozen". Other chains carry bridged or
+third-party versions of these tokens that the issuers cannot freeze in the same
+way, so they are not checked.
+
 ### Address poisoning
 
 Wallets show addresses shortened — `TDDD34…rCr9Ps`. A poisoner generates an
@@ -530,8 +561,6 @@ cases/             # worked investigations with their data
 
 - More exchanges on Bitcoin, Tron and Solana (now: Binance, OKX, HTX, Bybit),
   and refreshing these lists as the exchanges republish them
-- Stablecoin freeze check: whether USDT/USDC at an address is already frozen
-  by the issuer, and who to ask for a freeze
 - `report --html`: one self-contained file with the interactive graph, to
   send to an exchange or attach to a police report
 - `report --pdf` for exchange and law-enforcement filings

{crypttrace-0.5.0 → crypttrace-0.6.0}/README.md

@@ -129,6 +129,11 @@ It is also honest with you: most stolen crypto is not recovered, and what
 matters is speed and whether the funds touch a regulated exchange. The tool
 gives you evidence and timing — it cannot move funds or name a person by itself.
 
+**Stolen USDT or USDC?** Check at once whether it is still sitting at the
+thief's address — Tether and Circle can freeze it there, and only there:
+`crypttrace freeze THEIR_ADDRESS --chain tron`. `investigate` does this too
+and puts it first.
+
 **Sent money to an address that looked right?** That is usually address
 poisoning — see below. Check your own wallet with
 `crypttrace poisoning YOUR_ADDRESS`.
@@ -161,6 +166,9 @@ crypttrace tokens 0xADDRESS
 # Who bootstrapped this wallet's first gas? Follow it toward a KYC point
 crypttrace funder 0xADDRESS --hops 6
 
+# Is the USDT/USDC at this address frozen by Tether/Circle — and who can freeze it?
+crypttrace freeze TADDRESS --chain tron
+
 # Address poisoning: look-alike addresses planted in a wallet's history
 crypttrace poisoning TADDRESS --chain tron
 
@@ -241,6 +249,29 @@ crypttrace watch run --once             # single check, for scheduled tasks
 Optional Telegram alerts: set `CRYPTTRACE_TG_TOKEN` and `CRYPTTRACE_TG_CHAT`,
 then pass `--telegram`.
 
+### Stablecoin freezes
+
+Tether and Circle can freeze USDT and USDC at any address. For a victim of a
+stablecoin theft that is the one lever that actually stops the money — while it
+is still there. `crypttrace freeze` reads the issuers' own contracts (USDT's
+`isBlackListed`, USDC's `isBlacklisted`, balances; token-account state on
+Solana) on Ethereum, Tron and Solana, and answers three things: how much is
+there, whether it is already frozen, and if not, who can freeze it:
+
+- **Tether** freezes USDT at the request of law enforcement, often before a
+  court case — so the route is the police, quickly
+  ([policy](https://tether.to/en/legal/?tab=law-enforcement-requests)).
+- **Circle** freezes USDC only on a legal order such as a court order
+  ([terms](https://www.circle.com/legal/usdc-terms)), which takes longer.
+
+No API key is needed: Ethereum is read through a public node (set
+`CRYPTTRACE_ETH_RPC` to use your own). `investigate` runs the check on the
+address the money went to and makes it the first step; the web UI shows it in
+the side panel; a freeze also counts in the assessment. A check that fails is
+reported as unknown, never as "not frozen". Other chains carry bridged or
+third-party versions of these tokens that the issuers cannot freeze in the same
+way, so they are not checked.
+
 ### Address poisoning
 
 Wallets show addresses shortened — `TDDD34…rCr9Ps`. A poisoner generates an
@@ -496,8 +527,6 @@ cases/             # worked investigations with their data
 
 - More exchanges on Bitcoin, Tron and Solana (now: Binance, OKX, HTX, Bybit),
   and refreshing these lists as the exchanges republish them
-- Stablecoin freeze check: whether USDT/USDC at an address is already frozen
-  by the issuer, and who to ask for a freeze
 - `report --html`: one self-contained file with the interactive graph, to
   send to an exchange or attach to a police report
 - `report --pdf` for exchange and law-enforcement filings

{crypttrace-0.5.0 → crypttrace-0.6.0}/src/crypttrace/__init__.py

@@ -1,2 +1,2 @@
 """crypttrace — OSINT crypto investigation CLI."""
-__version__ = "0.5.0"
+__version__ = "0.6.0"

{crypttrace-0.5.0 → crypttrace-0.6.0}/src/crypttrace/assess.py

@@ -14,7 +14,7 @@ from collections import Counter
 from dataclasses import dataclass, field, asdict
 from typing import Dict, List, Optional
 
-from crypttrace import analysis, chains, poisoning
+from crypttrace import analysis, chains, freeze, poisoning
 from crypttrace.labels import labels
 
 
@@ -234,6 +234,17 @@ def assess(address: str, chain: str = "eth", asset: Optional[dict] = None,
             implication="this wallet was likely the victim of address poisoning",
             confidence=p["confidence"], weight=0, evidence={"pairs": sent_to_fake[:5]}))
 
+    # --- stablecoin issuer freeze ---------------------------------------
+    frozen = [e for e in freeze.check(address, chain) if e.get("frozen")]
+    if frozen:
+        e = frozen[0]
+        signals.append(Signal(
+            name="frozen by issuer",
+            observed=f"{e['frozen_amount']:,.2f} {e['token']} at this address is frozen by {e['issuer']}",
+            implication="the issuer blocked it — usually at the request of law enforcement "
+                        "or under sanctions",
+            confidence="high", weight=40, evidence={"freezes": frozen}))
+
     # --- holding behaviour ---------------------------------------------
     if received > 0 and sent == 0 and len(inbound) >= 3:
         signals.append(Signal(
@@ -314,6 +325,9 @@ def _statement(signals: List[Signal], risk: int, confidence: str, hit) -> str:
     if "paid a look-alike" in names:
         parts.append("This wallet sent money to a look-alike of an address it had used "
                      "before — the signature of an address-poisoning theft.")
+    if "frozen by issuer" in names:
+        parts.append("Stablecoins here are frozen by their issuer, which usually follows a "
+                     "law-enforcement request or a sanctions listing.")
     if "funds held" in names:
         parts.append("The proceeds have not been spent, so intervention is still possible.")
     parts.append(f"Overall risk {risk}/100, confidence {confidence}.")

{crypttrace-0.5.0 → crypttrace-0.6.0}/src/crypttrace/cli.py

@@ -262,6 +262,38 @@ def crosschain(
                   "not proof. Verify each candidate before relying on it.[/dim]")
 
 
+@app.command()
+def freeze(
+    address: str = typer.Argument(..., help="Address holding the USDT/USDC"),
+    chain: str = CHAIN_OPT,
+):
+    """Is USDT/USDC at this address frozen by its issuer — and who can freeze it?"""
+    from crypttrace import freeze as freeze_mod
+    entries = freeze_mod.check(address, chain)
+    if not entries:
+        console.print("[dim]USDT/USDC freezes are checked on Ethereum, Tron and Solana, where "
+                      "Tether and Circle issue them directly and can freeze them.[/dim]")
+        return
+    for e in entries:
+        head = f"[bold]{e['token']}[/bold] ({e['issuer']})"
+        if e.get("error"):
+            console.print(f"{head}: [yellow]could not be read[/yellow] — {e['error']}")
+        elif e["frozen"]:
+            console.print(f"{head}: [bold green]FROZEN[/bold green] — {e['frozen_amount']:,.2f} "
+                          f"{e['token']} cannot move" + (f"; {e['movable']:,.2f} still can"
+                                                          if e["movable"] else ""))
+        elif e["balance"]:
+            console.print(f"{head}: [bold red]{e['balance']:,.2f} {e['token']} NOT frozen[/bold red]"
+                          " — it can still be moved")
+            console.print(f"    {e['how']}")
+            console.print(f"    [dim]{e['url']}[/dim]")
+        else:
+            console.print(f"{head}: none at this address")
+    if labels.type_of(address) == "exchange":
+        console.print("\n[dim]This is an exchange's own wallet: ask the exchange, "
+                      "not the issuer.[/dim]")
+
+
 @app.command()
 def poisoning(
     address: str = typer.Argument(..., help="Your wallet, or the address the money went to"),

crypttrace-0.6.0/src/crypttrace/freeze.py

@@ -0,0 +1,150 @@
+"""Stablecoin freezes — has the issuer already frozen the money, and who can?
+
+Tether (USDT) and Circle (USDC) can freeze their tokens at any address. For a
+victim that is the one mechanism that actually stops stolen stablecoins, and it
+works only while the money is still sitting there. So the useful answers are:
+how much USDT/USDC is at this address, is it already frozen, and if not, who
+can freeze it and what they need.
+
+Everything is read from the issuers' own contracts, not from third-party lists:
+
+  * Ethereum — USDT's isBlackListed / USDC's isBlacklisted and balanceOf, via
+    a public JSON-RPC node (no API key; set CRYPTTRACE_ETH_RPC to use your own);
+  * Tron     — the same calls through TronGrid;
+  * Solana   — the state of the owner's token accounts, which the issuer freezes
+    one account at a time ("frozen").
+
+Other chains carry bridged or third-party versions of these tokens that the
+issuers cannot freeze in the same way, so they are not checked.
+"""
+import os
+from typing import Dict, List
+
+import requests
+
+from crypttrace import addresses, assets
+from crypttrace.fetchers import solana
+
+ETH_RPC = os.environ.get("CRYPTTRACE_ETH_RPC", "https://ethereum-rpc.publicnode.com")
+TRON_API = "https://api.trongrid.io"
+
+# selector of the issuer's own "is this address frozen?" function
+_EVM_FROZEN = {"USDT": "0xe47d6060",   # isBlackListed(address)
+               "USDC": "0xfe575a87"}   # isBlacklisted(address)
+_BALANCE_OF = "0x70a08231"             # balanceOf(address)
+_TRON_FROZEN = {"USDT": "isBlackListed(address)", "USDC": "isBlacklisted(address)"}
+
+ISSUERS = {
+    "USDT": {"issuer": "Tether",
+             "how": ("Tether freezes USDT at the request of law enforcement, often before "
+                     "a court case. Give the police this address and ask them to request a "
+                     "freeze from Tether."),
+             "url": "https://tether.to/en/legal/?tab=law-enforcement-requests"},
+    "USDC": {"issuer": "Circle",
+             "how": ("Circle freezes USDC only on a legal order — a court order, a sanctions "
+                     "designation or a request from authorities with jurisdiction over it. "
+                     "Expect to need a court order; ask the police or a lawyer."),
+             "url": "https://www.circle.com/legal/usdc-terms"},
+}
+
+SUPPORTED = ("eth", "tron", "sol")
+
+
+class FreezeError(RuntimeError):
+    pass
+
+
+def _eth_call(contract: str, selector: str, address: str) -> int:
+    data = selector + address.lower().replace("0x", "").rjust(64, "0")
+    try:
+        r = requests.post(ETH_RPC, timeout=30, json={
+            "jsonrpc": "2.0", "id": 1, "method": "eth_call",
+            "params": [{"to": contract, "data": data}, "latest"]}).json()
+    except (requests.RequestException, ValueError) as e:
+        raise FreezeError(f"Ethereum node unreachable: {e}")
+    if "result" not in r:
+        raise FreezeError(f"Ethereum node refused the call: {r.get('error')}")
+    return int(r["result"] or "0x0", 16)
+
+
+def _tron_call(contract: str, signature: str, address: str) -> int:
+    raw = addresses._b58_decode(address)            # 0x41 + 20 bytes + checksum
+    if not raw or len(raw) != 25:
+        raise FreezeError("not a Tron address")
+    headers = {"TRON-PRO-API-KEY": os.environ["TRONGRID_API_KEY"]} \
+        if os.environ.get("TRONGRID_API_KEY") else {}
+    try:
+        r = requests.post(f"{TRON_API}/wallet/triggerconstantcontract", timeout=30,
+                          headers=headers, json={
+                              # a read-only call: the caller does not matter, and
+                              # an unactivated address can be refused as the caller
+                              "owner_address": contract, "contract_address": contract,
+                              "function_selector": signature,
+                              "parameter": raw[1:21].hex().rjust(64, "0"), "visible": True}).json()
+    except (requests.RequestException, ValueError) as e:
+        raise FreezeError(f"TronGrid unreachable: {e}")
+    out = (r.get("constant_result") or [None])[0]
+    if out is None:
+        raise FreezeError(f"TronGrid refused the call: {r.get('result') or r}")
+    return int(out or "0", 16)
+
+
+def _sol_accounts(owner: str, mint: str) -> List[dict]:
+    try:
+        r = solana._rpc("getTokenAccountsByOwner",
+                        [owner, {"mint": mint}, {"encoding": "jsonParsed"}])
+    except solana.SolanaError as e:
+        raise FreezeError(str(e))
+    out = []
+    for v in (r.get("value") if isinstance(r, dict) else r) or []:
+        info = v["account"]["data"]["parsed"]["info"]
+        out.append({"state": info.get("state"),
+                    "amount": float(info["tokenAmount"].get("uiAmountString") or 0)})
+    return out
+
+
+def _one(address: str, chain: str, symbol: str, contract: str) -> Dict:
+    if chain == "eth":
+        frozen = _eth_call(contract, _EVM_FROZEN[symbol], address) == 1
+        balance = _eth_call(contract, _BALANCE_OF, address) / 1e6
+        frozen_amount = balance if frozen else 0.0
+    elif chain == "tron":
+        frozen = _tron_call(contract, _TRON_FROZEN[symbol], address) == 1
+        balance = _tron_call(contract, "balanceOf(address)", address) / 1e6
+        frozen_amount = balance if frozen else 0.0
+    else:                                             # sol: frozen per token account
+        accts = _sol_accounts(address, contract)
+        balance = sum(a["amount"] for a in accts)
+        frozen_amount = sum(a["amount"] for a in accts if a["state"] == "frozen")
+        frozen = any(a["state"] == "frozen" for a in accts)
+    return {"token": symbol, "balance": balance, "frozen": frozen,
+            "frozen_amount": frozen_amount, "movable": balance - frozen_amount}
+
+
+def check(address: str, chain: str) -> List[Dict]:
+    """One entry per issuer stablecoin on this chain; empty where none applies.
+
+    Each entry: token, issuer, balance, frozen, frozen_amount, movable (what can
+    still leave), how (what the issuer needs), url, and error if it could not be
+    read. A failed read is reported, never guessed.
+    """
+    if chain not in SUPPORTED:
+        return []
+    from crypttrace import chains
+    out = []
+    for sym in ("usdt", "usdc"):
+        tok = assets.tokens_for(chain).get(sym)
+        if not tok:
+            continue
+        symbol = tok["symbol"]
+        entry = {"token": symbol, **ISSUERS[symbol]}
+        try:
+            if chains.OFFLINE:
+                raise FreezeError("not checked: working offline")
+            entry.update(_one(address, chain, symbol, tok["contract"]))
+        except (FreezeError, KeyError, TypeError, ValueError) as e:
+            entry.update({"balance": None, "frozen": None, "frozen_amount": None,
+                          "movable": None, "error": str(e)})
+        out.append(entry)
+    return out
+

{crypttrace-0.5.0 → crypttrace-0.6.0}/src/crypttrace/investigate.py

@@ -14,7 +14,7 @@ from pathlib import Path
 from typing import Dict, List, Optional
 
 from crypttrace import chains, prices, report as report_mod, trace as trace_mod
-from crypttrace import funder as funder_mod, offramp as offramp_mod, poisoning
+from crypttrace import freeze as freeze_mod, funder as funder_mod, offramp as offramp_mod, poisoning
 from crypttrace.labels import labels
 
 
@@ -83,6 +83,9 @@ def analyse(address: str, chain: str = "eth", asset: Optional[dict] = None,
     except chains.ChainError:
         result["poisoning"] = []
 
+    # an exchange's own wallet is the exchange's to freeze, not the issuer's
+    result["freeze"] = [] if result["type"] == "exchange" else freeze_mod.check(address, chain)
+
     result["guidance"] = build_guidance(result)
     return result
 
@@ -148,6 +151,23 @@ def build_guidance(r: dict) -> dict:
             "urgent": False,
         })
 
+    for e in r.get("freeze") or []:
+        if e.get("frozen"):
+            steps.insert(0, {
+                "title": f"{e['frozen_amount']:,.2f} {e['token']} here is already frozen by {e['issuer']}",
+                "body": ("It cannot be moved. Frozen funds can be returned to victims, but only "
+                         f"through a legal process: tell the police and {e['issuer']} that you "
+                         "are a victim of this address, and include this report."),
+                "urgent": True,
+            })
+        elif e.get("movable"):
+            steps.insert(0, {
+                "title": f"Ask for a freeze: {e['movable']:,.2f} {e['token']} is still here",
+                "body": (f"{e['how']} It can be moved at any moment, so this is the most "
+                         f"time-critical step. {e['issuer']}'s policy: {e['url']}"),
+                "urgent": True,
+            })
+
     # always-applicable steps
     steps.append({
         "title": "Report it to the police",

{crypttrace-0.5.0 → crypttrace-0.6.0}/src/crypttrace/web/index.html

@@ -412,10 +412,11 @@ async function inspect(addr){
   const c=chain();
   $('#side').innerHTML=`<div class="card"><div class="muted"><span class="spin"></span>Loading ${esc(short(addr))}…</div></div>`;
   try{
-    const [p,f,o]=await Promise.all([
+    const [p,f,o,fz]=await Promise.all([
       api(`/api/profile?address=${q(addr)}&chain=${c}`),
       api(`/api/funder?address=${q(addr)}&chain=${c}`).catch(()=>({hops:[]})),
-      api(`/api/offramp?address=${q(addr)}&chain=${c}`).catch(()=>({offramp:null}))
+      api(`/api/offramp?address=${q(addr)}&chain=${c}`).catch(()=>({offramp:null})),
+      api(`/api/freeze?address=${q(addr)}&chain=${c}`).catch(()=>({freeze:[]}))
     ]);
     // A label is a claim about who controls an address — show what backs it.
     let ev={known:false};
@@ -445,6 +446,19 @@ async function inspect(addr){
         <b style="color:var(--green)">${esc(o.offramp.exchange)}</b> — likely a deposit address, i.e. a
         <b>KYC identification point</b>.</div>`,'alert');
     }
+    // Tether/Circle can freeze USDT/USDC in place — the one thing that stops them
+    const fzs=(fz.freeze||[]).filter(e=>e.error||e.frozen||e.balance>0);
+    if(fzs.length&&!fz.exchange){
+      const amt=v=>Number(v).toLocaleString(undefined,{maximumFractionDigits:2});
+      const open=fzs.filter(e=>!e.frozen&&e.balance>0);
+      h+=card('Stablecoin freeze',
+        fzs.map(e=>kv(esc(e.token), e.error ? '<span class="muted">could not be read</span>'
+          : e.frozen ? `<b style="color:var(--green)">${amt(e.frozen_amount)} frozen by ${esc(e.issuer)}</b>`
+          : `<b style="color:#ff6b6b">${amt(e.balance)} not frozen</b>`)).join('')+
+        (open.length?`<div class="vfy-note">${esc(open[0].how)}
+          <a href="${safeUrl(open[0].url)}" target="_blank" rel="noopener">${esc(open[0].issuer)} policy ↗</a></div>`:''),
+        open.length?'alert':'');
+    }
     if(f.hops&&f.hops.length){
       h+=card('First-funder chain',
         f.hops.map(x=>kv('◀ funded by',

{crypttrace-0.5.0 → crypttrace-0.6.0}/src/crypttrace/webapp.py

@@ -255,6 +255,17 @@ def create_app() -> Flask:
             return jsonify({"error": str(e)}), 400
         return jsonify({"hops": hops})
 
+    @app.route("/api/freeze")
+    def api_freeze():
+        addr = request.args.get("address", "")
+        chain = request.args.get("chain", "eth")
+        bad = validate(addr, chain)
+        if bad:
+            return jsonify({"error": bad}), 400
+        from crypttrace import freeze as freeze_mod
+        return jsonify({"freeze": freeze_mod.check(addr, chain),
+                        "exchange": labels.type_of(addr) == "exchange"})
+
     @app.route("/api/offramp")
     def api_offramp():
         addr = request.args.get("address", "")

{crypttrace-0.5.0 → crypttrace-0.6.0/src/crypttrace.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: crypttrace
-Version: 0.5.0
+Version: 0.6.0
 Summary: OSINT toolkit for crypto investigations: trace stolen funds across Ethereum, Bitcoin, Tron and Solana
 Author: bobslayerX
 License-Expression: MIT
@@ -163,6 +163,11 @@ It is also honest with you: most stolen crypto is not recovered, and what
 matters is speed and whether the funds touch a regulated exchange. The tool
 gives you evidence and timing — it cannot move funds or name a person by itself.
 
+**Stolen USDT or USDC?** Check at once whether it is still sitting at the
+thief's address — Tether and Circle can freeze it there, and only there:
+`crypttrace freeze THEIR_ADDRESS --chain tron`. `investigate` does this too
+and puts it first.
+
 **Sent money to an address that looked right?** That is usually address
 poisoning — see below. Check your own wallet with
 `crypttrace poisoning YOUR_ADDRESS`.
@@ -195,6 +200,9 @@ crypttrace tokens 0xADDRESS
 # Who bootstrapped this wallet's first gas? Follow it toward a KYC point
 crypttrace funder 0xADDRESS --hops 6
 
+# Is the USDT/USDC at this address frozen by Tether/Circle — and who can freeze it?
+crypttrace freeze TADDRESS --chain tron
+
 # Address poisoning: look-alike addresses planted in a wallet's history
 crypttrace poisoning TADDRESS --chain tron
 
@@ -275,6 +283,29 @@ crypttrace watch run --once             # single check, for scheduled tasks
 Optional Telegram alerts: set `CRYPTTRACE_TG_TOKEN` and `CRYPTTRACE_TG_CHAT`,
 then pass `--telegram`.
 
+### Stablecoin freezes
+
+Tether and Circle can freeze USDT and USDC at any address. For a victim of a
+stablecoin theft that is the one lever that actually stops the money — while it
+is still there. `crypttrace freeze` reads the issuers' own contracts (USDT's
+`isBlackListed`, USDC's `isBlacklisted`, balances; token-account state on
+Solana) on Ethereum, Tron and Solana, and answers three things: how much is
+there, whether it is already frozen, and if not, who can freeze it:
+
+- **Tether** freezes USDT at the request of law enforcement, often before a
+  court case — so the route is the police, quickly
+  ([policy](https://tether.to/en/legal/?tab=law-enforcement-requests)).
+- **Circle** freezes USDC only on a legal order such as a court order
+  ([terms](https://www.circle.com/legal/usdc-terms)), which takes longer.
+
+No API key is needed: Ethereum is read through a public node (set
+`CRYPTTRACE_ETH_RPC` to use your own). `investigate` runs the check on the
+address the money went to and makes it the first step; the web UI shows it in
+the side panel; a freeze also counts in the assessment. A check that fails is
+reported as unknown, never as "not frozen". Other chains carry bridged or
+third-party versions of these tokens that the issuers cannot freeze in the same
+way, so they are not checked.
+
 ### Address poisoning
 
 Wallets show addresses shortened — `TDDD34…rCr9Ps`. A poisoner generates an
@@ -530,8 +561,6 @@ cases/             # worked investigations with their data
 
 - More exchanges on Bitcoin, Tron and Solana (now: Binance, OKX, HTX, Bybit),
   and refreshing these lists as the exchanges republish them
-- Stablecoin freeze check: whether USDT/USDC at an address is already frozen
-  by the issuer, and who to ask for a freeze
 - `report --html`: one self-contained file with the interactive graph, to
   send to an exchange or attach to a police report
 - `report --pdf` for exchange and law-enforcement filings

{crypttrace-0.5.0 → crypttrace-0.6.0}/src/crypttrace.egg-info/SOURCES.txt

@@ -10,6 +10,7 @@ src/crypttrace/bridges.py
 src/crypttrace/chains.py
 src/crypttrace/cli.py
 src/crypttrace/config.py
+src/crypttrace/freeze.py
 src/crypttrace/funder.py
 src/crypttrace/investigate.py
 src/crypttrace/offramp.py