crypttrace 0.9.0__tar.gz → 0.11.0__tar.gz

{crypttrace-0.9.0/src/crypttrace.egg-info → crypttrace-0.11.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: crypttrace
-Version: 0.9.0
+Version: 0.11.0
 Summary: OSINT toolkit for crypto investigations: trace stolen funds across Ethereum, Bitcoin, Tron and Solana
 Author: bobslayerX
 License-Expression: MIT
@@ -338,11 +338,16 @@ Tested on a documented Tron case from August 2026: from the victim's wallet it
 finds the 2,527,862 USDT sent to `TDDDHi…rCr9Ps`, a look-alike of
 `TDDD34…rCr9Ps`, an address the wallet had paid 8.4M USDT in all. From the
 attacker's side it finds the same payment and two more victims of $2.4M and
-$2.0M, each lured by a look-alike created three to twelve minutes earlier.
+$2.0M, each lured by a look-alike created three to twelve minutes earlier, and
+for all three it names the address that was imitated.
 
-Cheap look-alikes match only one or two characters at each end, which happens
-by chance; those are reported only when they arrived as bait after the real
-address was in use.
+Look-alikes come in three strengths. Matching several characters at both ends is
+reported on sight. So is one that copies only the ending, as long as the shared
+ending is long enough to be no accident (6 characters on Tron and Solana, 7 on
+bech32 Bitcoin, 8 on hex) — one of the three victims above was caught that way,
+by `…E1doqb`. Cheap look-alikes that match one or two characters at each end
+happen by chance, so they are reported only when they arrived as bait after the
+real address was in use.
 
 ### Off-ramp detection
 
@@ -587,7 +592,6 @@ cases/             # worked investigations with their data
 - More exchanges on Bitcoin, Tron and Solana (now: Binance, OKX, HTX, Bybit),
   and refreshing these lists as the exchanges republish them
 - Internal transactions (completes `funder` and contract-mediated transfers)
-- Per-mint filtering for Solana SPL tokens
 - More label sources: Chainabuse, CryptoScamDB, exchange deposit-address sets
 - Spam/dust token filtering in `tokens`
 - Entity clustering on EVM via the gas-funding heuristic

{crypttrace-0.9.0 → crypttrace-0.11.0}/README.md

@@ -304,11 +304,16 @@ Tested on a documented Tron case from August 2026: from the victim's wallet it
 finds the 2,527,862 USDT sent to `TDDDHi…rCr9Ps`, a look-alike of
 `TDDD34…rCr9Ps`, an address the wallet had paid 8.4M USDT in all. From the
 attacker's side it finds the same payment and two more victims of $2.4M and
-$2.0M, each lured by a look-alike created three to twelve minutes earlier.
+$2.0M, each lured by a look-alike created three to twelve minutes earlier, and
+for all three it names the address that was imitated.
 
-Cheap look-alikes match only one or two characters at each end, which happens
-by chance; those are reported only when they arrived as bait after the real
-address was in use.
+Look-alikes come in three strengths. Matching several characters at both ends is
+reported on sight. So is one that copies only the ending, as long as the shared
+ending is long enough to be no accident (6 characters on Tron and Solana, 7 on
+bech32 Bitcoin, 8 on hex) — one of the three victims above was caught that way,
+by `…E1doqb`. Cheap look-alikes that match one or two characters at each end
+happen by chance, so they are reported only when they arrived as bait after the
+real address was in use.
 
 ### Off-ramp detection
 
@@ -553,7 +558,6 @@ cases/             # worked investigations with their data
 - More exchanges on Bitcoin, Tron and Solana (now: Binance, OKX, HTX, Bybit),
   and refreshing these lists as the exchanges republish them
 - Internal transactions (completes `funder` and contract-mediated transfers)
-- Per-mint filtering for Solana SPL tokens
 - More label sources: Chainabuse, CryptoScamDB, exchange deposit-address sets
 - Spam/dust token filtering in `tokens`
 - Entity clustering on EVM via the gas-funding heuristic

{crypttrace-0.9.0 → crypttrace-0.11.0}/src/crypttrace/__init__.py

@@ -1,2 +1,2 @@
 """crypttrace — OSINT crypto investigation CLI."""
-__version__ = "0.9.0"
+__version__ = "0.11.0"

{crypttrace-0.9.0 → crypttrace-0.11.0}/src/crypttrace/chains.py

@@ -138,9 +138,8 @@ def _sol_rows(address: str, limit: int, token: bool, contract: Optional[str]) ->
     rows = solana.transfers(address, limit)
     if token:
         rows = [r for r in rows if r.get("symbol") != "SOL"]
-        if contract:
-            rows = [r for r in rows if r.get("mint") in (None, contract)
-                    or (r.get("contract") or "") == contract]
+        if contract:                      # SPL rows carry their mint as the contract
+            rows = [r for r in rows if (r.get("contract") or "") == contract]
     else:
         rows = [r for r in rows if r.get("symbol") == "SOL"]
     return rows
@@ -164,11 +163,9 @@ def transfers(address: str, chain: str = "eth", limit: int = 1000,
 
     from crypttrace import store
     # What the stored rows are filed under: "" native, a contract, "*" every
-    # token, or "spl" on Solana, whose token rows carry no mint to tell apart.
+    # token (Solana token rows carry their mint as the contract).
     if not asset:
         asset_key = ""
-    elif chain == "sol":
-        asset_key = "spl"
     else:
         asset_key = (contract or "*").lower()
     skip_read = fresh or FORCE_FRESH

{crypttrace-0.9.0 → crypttrace-0.11.0}/src/crypttrace/fetchers/solana.py

@@ -10,10 +10,15 @@ from typing import List, Dict
 
 import requests
 
+from crypttrace import assets
+
 RPC = os.environ.get("CRYPTTRACE_SOLANA_RPC", "https://api.mainnet-beta.solana.com")
 LAMPORTS = 1_000_000_000
 MAX_TXS = 25  # keep the number of RPC round-trips sane
 
+# mint -> symbol for the tokens crypttrace knows; others show as "SPL"
+_KNOWN_MINTS = {t["contract"]: t["symbol"] for t in assets.tokens_for("sol").values()}
+
 
 class SolanaError(RuntimeError):
     pass
@@ -59,10 +64,26 @@ def _parse_tx(sig: str) -> List[Dict]:
         return []
     ts = int(tx.get("blockTime") or 0)
     rows = []
+    meta = tx.get("meta") or {}
     msg = (tx.get("transaction") or {}).get("message") or {}
     instrs = list(msg.get("instructions") or [])
-    for inner in (tx.get("meta") or {}).get("innerInstructions") or []:
+    for inner in meta.get("innerInstructions") or []:
         instrs.extend(inner.get("instructions") or [])
+
+    # An SPL transfer names token *accounts*, not wallets. The token balances in
+    # the transaction's metadata say which wallet owns each account, which mint
+    # it holds and how many decimals that mint has.
+    keys = [k.get("pubkey") if isinstance(k, dict) else k for k in msg.get("accountKeys") or []]
+    loaded = meta.get("loadedAddresses") or {}
+    if not any(isinstance(k, dict) and k.get("source") == "lookupTable"
+               for k in msg.get("accountKeys") or []):
+        keys += list(loaded.get("writable") or []) + list(loaded.get("readonly") or [])
+    accounts = {}
+    for b in (meta.get("preTokenBalances") or []) + (meta.get("postTokenBalances") or []):
+        i = b.get("accountIndex")
+        if isinstance(i, int) and i < len(keys):
+            accounts[keys[i]] = {"owner": b.get("owner") or "", "mint": b.get("mint") or "",
+                                 "decimals": (b.get("uiTokenAmount") or {}).get("decimals")}
     for ins in instrs:
         parsed = ins.get("parsed")
         if not isinstance(parsed, dict):
@@ -75,15 +96,27 @@ def _parse_tx(sig: str) -> List[Dict]:
                          "value": (info.get("lamports") or 0) / LAMPORTS,
                          "timestamp": ts, "hash": sig, "symbol": "SOL"})
         elif prog == "spl-token" and ptype in ("transfer", "transferChecked"):
+            src = accounts.get(info.get("source", ""), {})
+            dst = accounts.get(info.get("destination", ""), {})
+            mint = info.get("mint") or src.get("mint") or dst.get("mint") or ""
+            decimals = src.get("decimals") if src.get("decimals") is not None else dst.get("decimals")
             amt = info.get("tokenAmount") or {}
             try:
-                val = float(amt.get("uiAmountString") or amt.get("uiAmount") or info.get("amount") or 0)
+                if amt.get("uiAmountString") or amt.get("uiAmount") is not None:
+                    val = float(amt.get("uiAmountString") or amt.get("uiAmount") or 0)
+                elif decimals is not None:        # plain "transfer" gives raw base units
+                    val = int(info.get("amount") or 0) / (10 ** int(decimals))
+                else:
+                    continue                      # no way to know the unit: don't guess
             except (TypeError, ValueError):
-                val = 0.0
-            rows.append({"from": info.get("source", "") or info.get("authority", ""),
-                         "to": info.get("destination", ""), "value": val,
-                         "timestamp": ts, "hash": sig, "symbol": "SPL",
-                         "contract": "spl"})   # keeps token rows apart from SOL in the store
+                continue
+            rows.append({
+                # the wallets behind the token accounts; the account itself if unknown
+                "from": src.get("owner") or info.get("authority") or info.get("source", ""),
+                "to": dst.get("owner") or info.get("destination", ""),
+                "value": val, "timestamp": ts, "hash": sig,
+                "symbol": _KNOWN_MINTS.get(mint, "SPL"),
+                "contract": mint or "spl"})       # the mint; keeps token rows apart from SOL
     return rows
 
 

{crypttrace-0.9.0 → crypttrace-0.11.0}/src/crypttrace/fetchers/tron.py

@@ -82,10 +82,31 @@ def balance(address: str) -> float:
     return (data[0].get("balance") or 0) / SUN
 
 
+PAGE = 200    # TronGrid's page size
+
+
+def _pages(path: str, limit: int) -> List[Dict]:
+    """Up to `limit` items, following TronGrid's fingerprint cursor page by page.
+
+    One page (200 items) used to be all we read, so a busy wallet's history
+    ended a few days back and older transfers were simply invisible."""
+    items: List[Dict] = []
+    params = {"limit": min(limit, PAGE)}
+    while len(items) < limit:
+        d = _get(path, dict(params))
+        page = d.get("data", []) or []
+        items += page
+        cursor = (d.get("meta") or {}).get("fingerprint")
+        if len(page) < params["limit"] or not cursor:
+            break
+        params["fingerprint"] = cursor
+    return items[:limit]
+
+
 def _native(address: str, limit: int) -> List[Dict]:
-    d = _get(f"/v1/accounts/{address}/transactions", {"limit": min(limit, 200)})
+    # the endpoint lists every transaction type; TRX transfers are a subset of it
     rows = []
-    for tx in d.get("data", []) or []:
+    for tx in _pages(f"/v1/accounts/{address}/transactions", limit):
         try:
             c = (tx.get("raw_data", {}).get("contract") or [])[0]
             if c.get("type") != "TransferContract":
@@ -106,9 +127,8 @@ def _native(address: str, limit: int) -> List[Dict]:
 
 def token_transfers(address: str, limit: int = 200) -> List[Dict]:
     """TRC20 transfers (USDT and friends) — already base58 in the API."""
-    d = _get(f"/v1/accounts/{address}/transactions/trc20", {"limit": min(limit, 200)})
     rows = []
-    for t in d.get("data", []) or []:
+    for t in _pages(f"/v1/accounts/{address}/transactions/trc20", limit):
         # the endpoint also lists Approval events, whose "value" is an allowance
         # (often 2**256-1), not money that moved
         if t.get("type", "Transfer") != "Transfer":

{crypttrace-0.9.0 → crypttrace-0.11.0}/src/crypttrace/poisoning.py

@@ -19,6 +19,7 @@ Three views of the same attack:
   * campaign(address)   — an address sending zero/dust transfers to many
     unrelated wallets (the dust-sending style, common on Tron).
 """
+import math
 from collections import defaultdict
 from typing import Dict, List, Optional, Tuple
 
@@ -30,6 +31,20 @@ from crypttrace import analysis, assets, chains
 # the look-alike arrived with bait after the genuine address was in use.
 STRONG = (3, 3, 7)          # min prefix, min suffix, min total
 WEAK = (1, 2, 3)
+# Many people check only the ending, and poisoners know it: a look-alike can match
+# the last characters alone. That is strong evidence once the shared ending carries
+# 32 bits — 6 base58 characters, 7 bech32, 8 hex — about 1 in 4 billion by chance.
+SUFFIX_BITS = 32
+
+
+def _suffix_chars(address: str, chain: str) -> int:
+    if chains.is_evm(chain):
+        bits = 4.0                                  # hex
+    elif address.lower().startswith(("bc1", "tb1")):
+        bits = 5.0                                  # bech32
+    else:
+        bits = 5.86                                 # base58: Tron, Solana, legacy Bitcoin
+    return math.ceil(SUFFIX_BITS / bits)
 # A campaign: this many distinct recipients of zero/dust transfers.
 CAMPAIGN_MIN_TARGETS = 10
 
@@ -62,9 +77,12 @@ def resemblance(a: str, b: str, chain: str) -> Optional[str]:
     if chains.norm_addr(a, chain) == chains.norm_addr(b, chain):
         return None
     pre, suf = match_lengths(a, b, chain)
-    for name, (p, s, t) in (("strong", STRONG), ("weak", WEAK)):
-        if pre >= p and suf >= s and pre + suf >= t:
-            return name
+    p, s, t = STRONG
+    if (pre >= p and suf >= s and pre + suf >= t) or suf >= _suffix_chars(a, chain):
+        return "strong"
+    p, s, t = WEAK
+    if pre >= p and suf >= s and pre + suf >= t:
+        return "weak"
     return None
 
 
@@ -128,13 +146,17 @@ def lookalikes(address: str, chain: str, limit: int = 1000) -> List[dict]:
             c["sent_first_ts"] = ts if c["sent_first_ts"] is None else min(c["sent_first_ts"], ts)
 
     # only compare addresses that could match: bucket by visible ends
+    # (and by the ending alone, for look-alikes that only imitate the last characters)
     buckets = defaultdict(list)
     for a in seen:
         b = _body(a, chain)
         if len(b) >= WEAK[0] + WEAK[1]:
-            buckets[(b[:WEAK[0]], b[-WEAK[1]:])].append(a)
+            buckets[("ends", b[:WEAK[0]], b[-WEAK[1]:])].append(a)
+        n = _suffix_chars(a, chain)
+        if len(b) > n:
+            buckets[("tail", b[-n:])].append(a)
 
-    findings = []
+    findings, compared = [], set()
     for group in buckets.values():
         if len(group) < 2:
             continue
@@ -144,7 +166,10 @@ def lookalikes(address: str, chain: str, limit: int = 1000) -> List[dict]:
             return (c["sent_first_ts"] is None, c["sent_first_ts"] or c["first_ts"], c["first_ts"])
         genuine = min(group, key=rank)
         for fake in group:
-            level = resemblance(genuine, fake, chain) if fake != genuine else None
+            if fake == genuine or (genuine, fake) in compared:
+                continue            # a pair can sit in both kinds of bucket
+            compared.add((genuine, fake))
+            level = resemblance(genuine, fake, chain)
             if not level:
                 continue
             g, f = seen[genuine], seen[fake]

{crypttrace-0.9.0 → crypttrace-0.11.0}/src/crypttrace/store.py

@@ -118,8 +118,10 @@ def load(chain: str, address: str, contract: str = "", native_symbol: str = "")
     try:
         if contract == "*":
             # every token, whatever its contract (address-poisoning checks need fakes too)
+            # (Solana rows filed as "spl" by 0.5-0.10 name token accounts, not wallets)
             q = (f"{cols} WHERE chain=? AND (from_addr=? OR to_addr=?)"
-                 " AND contract IS NOT NULL AND contract!='' ORDER BY ts DESC")
+                 " AND contract IS NOT NULL AND contract!='' AND contract!='spl'"
+                 " ORDER BY ts DESC")
             args = (chain, address, address)
         elif contract:
             q = (f"{cols} WHERE chain=? AND (from_addr=? OR to_addr=?)"

{crypttrace-0.9.0 → crypttrace-0.11.0}/src/crypttrace/watch.py

@@ -43,7 +43,6 @@ def _save(d: Dict[str, dict]) -> None:
 
 
 _ALL_TOKENS = {"contract": None, "symbol": "*"}
-_SPL = {"contract": "spl", "symbol": "SPL"}
 
 
 def _key(row: dict) -> str:
@@ -62,8 +61,6 @@ def _rows(address: str, chain: str, limit: int) -> List[dict]:
         tokens = chains.transfers(address, chain, limit, asset=_ALL_TOKENS, fresh=True)
     except chains.ChainError:
         return rows              # the native history alone still gets watched
-    if chain == "sol":           # Solana token rows carry no mint to tell tokens apart
-        return rows + [{**r, "_asset": _SPL} for r in tokens]
     stables = {t["contract"].lower(): dict(t) for t in assets.tokens_for(chain).values()
                if t.get("stable")}
     return rows + [{**r, "_asset": stables[(r.get("contract") or "").lower()]}

{crypttrace-0.9.0 → crypttrace-0.11.0/src/crypttrace.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: crypttrace
-Version: 0.9.0
+Version: 0.11.0
 Summary: OSINT toolkit for crypto investigations: trace stolen funds across Ethereum, Bitcoin, Tron and Solana
 Author: bobslayerX
 License-Expression: MIT
@@ -338,11 +338,16 @@ Tested on a documented Tron case from August 2026: from the victim's wallet it
 finds the 2,527,862 USDT sent to `TDDDHi…rCr9Ps`, a look-alike of
 `TDDD34…rCr9Ps`, an address the wallet had paid 8.4M USDT in all. From the
 attacker's side it finds the same payment and two more victims of $2.4M and
-$2.0M, each lured by a look-alike created three to twelve minutes earlier.
+$2.0M, each lured by a look-alike created three to twelve minutes earlier, and
+for all three it names the address that was imitated.
 
-Cheap look-alikes match only one or two characters at each end, which happens
-by chance; those are reported only when they arrived as bait after the real
-address was in use.
+Look-alikes come in three strengths. Matching several characters at both ends is
+reported on sight. So is one that copies only the ending, as long as the shared
+ending is long enough to be no accident (6 characters on Tron and Solana, 7 on
+bech32 Bitcoin, 8 on hex) — one of the three victims above was caught that way,
+by `…E1doqb`. Cheap look-alikes that match one or two characters at each end
+happen by chance, so they are reported only when they arrived as bait after the
+real address was in use.
 
 ### Off-ramp detection
 
@@ -587,7 +592,6 @@ cases/             # worked investigations with their data
 - More exchanges on Bitcoin, Tron and Solana (now: Binance, OKX, HTX, Bybit),
   and refreshing these lists as the exchanges republish them
 - Internal transactions (completes `funder` and contract-mediated transfers)
-- Per-mint filtering for Solana SPL tokens
 - More label sources: Chainabuse, CryptoScamDB, exchange deposit-address sets
 - Spam/dust token filtering in `tokens`
 - Entity clustering on EVM via the gas-funding heuristic