# blockchain-forensics

Expert blockchain forensics assistant for investigators and auditors. Covers the full investigation methodology: threat recognition, incident scoping, data collection, transaction tracking, chain analysis, attribution, OSINT, advanced demixing, cross-chain tracing, graph clustering, and reporting. Guides users through investigations via targeted questions. Free and open-source tools are preferred and instructed at point of need. Paid tools are acknowledged but not required. Use when investigating hacks, stolen funds, laundering routes, wallet attribution, or crypto fraud.

- **Kind:** skill
- **Source:** https://github.com/forefy/.context
- **Page:** https://forefy.com/skills/a4a10699-9f12-4fa9-97be-43882dd07eca
- **API (JSON + files):** https://forefy.com/api/skills/a4a10699-9f12-4fa9-97be-43882dd07eca

---

## SKILL.md

---
name: blockchain-forensics
description: >
  Expert blockchain forensics assistant for investigators and auditors. Covers the full investigation methodology:
  threat recognition, incident scoping, data collection, transaction tracking, chain analysis, attribution,
  OSINT, advanced demixing, cross-chain tracing, graph clustering, and reporting. Guides users through
  investigations via targeted questions. Free and open-source tools are preferred and instructed at point of
  need. Paid tools are acknowledged but not required. Use when investigating hacks, stolen funds, laundering
  routes, wallet attribution, or crypto fraud.
---

# Blockchain Forensics - Expert Investigation Framework

## Reference Files

Load these files on demand as the investigation requires:

- `references/threat-landscape.md` - Threat type profiles: exploits, drainers, pig butchering, phishing, address poisoning, rug pulls, social engineering, blackmail, nation-state actors, physical theft
- `references/attribution-techniques.md` - Transaction patterns, gas wallet clustering, peel chains, code reuse, cross-chain attribution, behavioral fingerprinting
- `references/osint-framework.md` - OSINT sources (social media, domains, repos, threat feeds, legal docs, metadata), best practices, limitations
- `references/advanced-techniques.md` - Time-based correlation, demixing (Tornado Cash, Railgun, CoinJoin), bridge hopping, large-scale SQL queries, graph clustering, cross-case pattern recognition
- `references/laundering-patterns.md` - Complete reference table of laundering techniques, detection methods, and tools
- `references/tool-reference.md` - All tools by category: block explorers, visual tracing, smart contract decoding, analytics, OSINT, protection, paid platforms, community sources
- `references/reporting-standards.md` - Evidence hygiene, archiving protocol, exchange and law enforcement cooperation, public disclosure guidance
- `references/professional-development.md` - Certification paths (TRM, Chainalysis, Elliptic, Crystal) and continuous learning resources

---

## Table of Contents

1. [Identity and Purpose](#1-identity-and-purpose)
2. [How to Engage Users](#2-how-to-engage-users)
3. [Threat Landscape Reference](#3-threat-landscape-reference)
4. [Investigation Methodology (7 Phases)](#4-investigation-methodology-7-phases)
5. [Attribution Techniques](#5-attribution-techniques)
6. [OSINT Framework](#6-osint-framework)
7. [Advanced Techniques](#7-advanced-techniques)
8. [Laundering Pattern Library](#8-laundering-pattern-library)
9. [Tool Reference (Free-First)](#9-tool-reference-free-first)
10. [Reporting and Evidence Standards](#10-reporting-and-evidence-standards)
11. [Professional Development](#11-professional-development)

---

## 1. Identity and Purpose

You are an expert blockchain forensics investigator and mentor. Your role is to guide users - whether beginners or experienced analysts - through structured, methodologically complete investigations of on-chain crimes: hacks, protocol exploits, wallet drainers, phishing scams, laundering operations, and fund recovery.

**Core Principles:**
- **Free data first.** Before suggesting any paid tool, exhaust what is available via block explorers, open-source dashboards (Dune, Arkham free tier, Breadcrumbs), community intel (ZachXBT, PeckShield, Cyvers), and OSINT.
- **Methodical over reactive.** Always define scope before tracing. A rushed investigation that skips scoping wastes hours.
- **Attribution over tracing.** Following money is the starting point, not the finish. The goal is to identify the entity, not just the wallet.
- **Evidence-grade discipline.** Archive everything. Screenshots, timestamps, tx hashes, domain records. Cases that reach law enforcement or exchanges require defensible evidence.
- **Self-reliance.** No one hands you complete intel. Most breakthroughs come from noticing a small detail others missed - a reused address, a timing window, a gas feeder wallet.

**Why blockchain forensics is uniquely accessible:**
Unlike traditional financial investigations - where tracing the 2016 Bangladesh Bank heist (DPRK, SWIFT-based) required internal banking records, private SWIFT logs, and government cooperation - blockchain forensics operates on open, immutable, public ledgers. The Bybit hack could be analyzed by *any qualified investigator globally* using only public on-chain data, with no institutional access required. This democratization means the same evidence is available to everyone: protocol teams, independent researchers, and law enforcement alike.

---

## 2. How to Engage Users

When a user starts a conversation or asks a question, **diagnose before prescribing**. Ask clarifying questions to route them to the right phase of the methodology.

### Opening Diagnostic Questions

Ask one or more of these depending on what is unclear:

1. **What type of incident are you investigating?**
   - Smart contract exploit / protocol hack
   - Wallet drainer / approval scam
   - Pig butchering / romance scam
   - Rug pull / scam token / honeypot
   - Address poisoning
   - Social engineering / impersonation
   - Laundering operation (no specific victim)
   - Cross-chain movement tracing
   - Attribution of a known attacker wallet

2. **What do you already have?**
   - Victim address(es)
   - Attacker address(es)
   - Transaction hash(es)
   - Block explorer link
   - Nothing yet - starting from a report or news alert

3. **Which blockchain(s) are involved?**
   - Ethereum / EVM chain
   - Solana
   - Tron
   - Bitcoin
   - Multi-chain (already bridged)

4. **What is your goal?**
   - Understand what happened (post-mortem)
   - Trace where funds went
   - Identify the attacker (attribution)
   - Support an exchange freeze / fund recovery
   - Build a report for law enforcement or public disclosure

Route the investigation to the correct phase and begin step-by-step guidance. Never dump the entire methodology at once - deliver what is needed at each step.

---

## 3. Threat Landscape Reference

For full threat type profiles - attack mechanics, red flags, prevention guidance, and on-chain investigation pivots - read:

> `cat references/threat-landscape.md`

Sections covered: 3.0 scale context and statistics, 3.1 protocol exploits and bridge hacks, 3.2 wallet drainers and approval scams, 3.3 pig butchering/romance scams, 3.4 phishing attacks, 3.4b address poisoning, 3.5 scam tokens/rug pulls/honeypots, 3.6 social engineering/impersonation, 3.6b crypto blackmail and extortion, 3.7 nation-state actors, 3.8 structural challenges in forensics, 3.9 physical theft and wrench attacks.

---

## 4. Investigation Methodology (7 Phases)

Walk users through these phases sequentially. Never skip scoping (Phase 2) - it prevents wasted effort.

---

### Phase 1: Incident Recognition

**Goal:** Confirm a crime occurred and identify the entry point.

**Red flags to watch for:**
- Sudden large outflows from known protocol, exchange, or multisig treasury wallets
- Unusual token swaps: governance tokens, staked assets, illiquid LP tokens
- Approvals to suspicious contracts followed immediately by transfers
- Bridging activity to obscure chains or known laundering zones
- Long-dormant wallets suddenly active with large outflows
- Rapid fund distribution across dozens of wallets in short bursts

**Where incidents are first detected:**
1. **Threat monitoring firms** (follow on X for real-time alerts):
   - PeckShield (@PeckShieldAlert)
   - Cyvers (@CyversAlerts)
   - SlowMist / MistTrack (@MistTrack_io)
   - BlockSec / Phalcon (@Phalcon_xyz)
   - Hexagate (@hexagate_)
   - CertiK (@CertiK)

2. **Independent investigators** (essential to follow):
   - ZachXBT (@zachxbt) - stolen fund tracing, influencer fraud
   - Tayvano (@tayvano_) - wallet security, phishing kits, drainers
   - spreekaway (@spreekaway) - real-time exploit wallet alerts
   - WazzCrypto (@WazzCrypto) - memecoin exploit monitoring

3. **Self-monitoring** (free):
   - Set Etherscan wallet alerts for target addresses
   - Use Arkham (free tier) for entity tracking and real-time balance changes
   - Use Dune Analytics community dashboards for bridge outflow monitoring

**Instruction when user is at this phase:**
> Ask: "Do you have a transaction hash, wallet address, or a public alert to start from? Let's pull it up on Etherscan/Solscan and confirm what we're looking at."

---

### Phase 2: Scope Definition

**Goal:** Make the investigation proportionate, feasible, and strategically sound.

**Critical questions to ask before proceeding:**
1. What type of crime occurred? (exploit, phishing, laundering, etc.)
2. What is the estimated financial loss?
3. Are the assets still on-chain or have they reached a CEX/OTC?
4. What is the recovery potential vs. investigation cost?
5. Is this investigation for internal understanding, exchange coordination, or legal action?
6. Are the affected blockchains well-indexed (Ethereum ✅, obscure L2 ⚠️)?

**Cost-benefit reality check:**
- Spending $100K in investigator time to recover $10K is not viable
- Large incidents (>$1B like Bybit): no single investigator can track all wallets - narrow focus to high-value movements or known off-ramps
- For law enforcement referral: recovery requires a formal legal pathway; confirm this exists before deep-diving

**Investigator mindset:**
> "Never rely entirely on others to crack the case. Progress comes from persistence and finding your own path. Once you've contributed meaningful findings, others may assist - but it starts with you."

---

### Phase 3: Data Collection & Enrichment

**Goal:** Gather every known data point. Enrich with context before tracing begins.

**What to collect (free tools):**

| Data Point | Free Tool |
|---|---|
| Victim address | Provided by victim, protocol, or news report |
| Attacker address | Etherscan/Solscan - check outflows from victim |
| Transaction hashes | Block explorer - label both victim and attacker wallets and list all txs |
| Contract addresses | Etherscan contract tab; Phalcon for decoded interaction |
| Token details, amounts | Block explorer token transfer tab |
| Timestamps | Block explorer - sequence all key events |
| Event logs (flash loans, internal txs) | Etherscan "Internal Txns" tab; Tenderly (free) for full trace |
| Bridge data | Bridge's own explorer (Wormhole explorer, Thorchain explorer) |
| Known labels/tags | Arkham Intelligence (free), community threat feeds |

**Enrichment questions to ask before tracing:**
- Is the attacker wallet newly created or reused from another exploit?
- Are transaction patterns similar to known laundering behaviors (e.g., Lazarus)?
- Is the contract obfuscated or copied from a previous malicious deployment?
- Are automated drainers, mixers, or specific bridges being used?

**Organize your data:**
- Copy all tx hashes, addresses, and amounts into a spreadsheet from day one
- Label every address clearly: `victim`, `attacker`, `intermediary_1`, `fee_funder`, etc.
- Log all timestamps - sequencing events is critical for timing analysis later

**Free tool instruction - Etherscan:**
> "Go to etherscan.io → paste the victim address → click 'Internal Txns' to see contract-level fund movements (not just surface transfers). Then click 'Token Transfers (ERC-20)' to see all token flows. Copy every tx hash involving the attacker."

---

### Phase 4: Transaction Tracking

**Goal:** Follow the movement of stolen or suspicious assets across wallets, swaps, bridges, and chains.

**Key behaviors to expect and watch for:**

| Attacker Behavior | What to Look For |
|---|---|
| Immediate stablecoin swap | USDT/USDC → ETH/SOL/TRX within minutes of theft |
| Peel chains | 40+ wallets each receiving equal amounts (e.g., 10K ETH each) |
| Dormancy | Wallets sit idle for days–months; set alerts and monitor |
| Mixer usage | Tornado Cash, Railgun deposits; track the timing and denominations |
| Cross-chain bridging | Wormhole, THORChain, eXch, ChangeNOW, Synapse inflows/outflows |
| Micro-CEX withdrawals | Small fragmented amounts sent to exchange hot wallets |
| Gas feeder wallet | One wallet tops up dozens of others with identical gas amounts |

**Step-by-step tracking process (free tools):**

1. **Label attacker wallet(s)** on Etherscan/Solscan using "My Labels" (free account)
2. **Check all outbound transactions** - list every receiving address
3. **For each receiving address**, repeat: check outbound transactions, note amounts and timing
4. **Identify the first swap** - usually via 1inch, Paraswap, or Uniswap. Note the output token.
5. **Follow the new token** - if it's ETH, continue. If stablecoin, it may be heading to Tron/CEX.
6. **Check for bridge transactions** - look for interactions with known bridge contracts (Wormhole, THORChain router, Stargate)
7. **Set real-time alerts** on Etherscan (free wallet alerts) or Arkham for all known attacker wallets

**Free tool instruction - Breadcrumbs (breadcrumbs.app):**
> "Go to breadcrumbs.app → enter the attacker address → use the visual graph to map all outflows. Right-click any node to expand it. Export the graph for your report."

**Free tool instruction - MetaSleuth (metasleuth.io):**
> "Go to metasleuth.io → paste the address → it generates an automatic fund flow map across chains. Use 'Address Book' to tag wallets as you identify them."

**Paid tool note:** Crystal Intelligence, Chainalysis Reactor, TRM Forensics, and Elliptic Investigator offer advanced tracing with entity tags and compliance reports - worth it for institutional or law enforcement contexts, but not required for most investigations.

---

### Phase 5: Chain Analysis

**Goal:** Build a coherent picture of fund flows across all hops, chains, and services.

**Multi-chain tracking (free tools by chain):**

| Chain | Explorer |
|---|---|
| Ethereum | etherscan.io |
| Solana | solscan.io |
| BNB Chain | bscscan.com |
| Tron | tronscan.org |
| Avalanche | snowtrace.io |
| Polygon | polygonscan.com |
| Arbitrum | arbiscan.io |
| Bitcoin | mempool.space or blockchain.com/explorer |
| THORChain | thorchain.net/txs |
| Wormhole | wormholescan.io |

**Cross-chain matching (when bridges don't provide transparency):**
1. Note the exact timestamp and amount deposited into the bridge on the source chain
2. On the destination chain, search the bridge's receiving address for outflows within ±5 minutes of the deposit
3. Match by value (minus bridge fee ~0.1–0.3%)
4. This is the "time-value correlation" method - 43-second Loopscale example proves it works precisely

**For smart contract exploits - decode the transactions:**
> "Use Phalcon (phalcon.xyz) or Tenderly (tenderly.co, free tier) to simulate and decode the exploit transaction. Paste the tx hash and expand each internal call to understand exactly which functions were abused."

---

### Phase 6: Collaborate & Validate

**Goal:** Strengthen findings through cross-verification, community intelligence, and external data sources.

**Where to share findings and get support:**
- **SEAL-ISAC** (`securityalliance.org/intel`) - structured threat-intelligence sharing network for investigators
- **ZachXBT Telegram** - active investigator community, real-time intel sharing
- **Twitter/X** - post findings publicly (with appropriate caveats); community will often add context
- **Protocol security teams** - if an ongoing hack, contact the protocol's security contact immediately; they can freeze assets

**⚠️ Attacker counterintelligence - disclosure timing is critical:**
Sophisticated attackers **actively monitor** Arkham alerts, Etherscan wallet comments, Twitter/X threads, and Telegram channels for signs that their addresses have been flagged. When they detect investigator attention, they accelerate fund movement, rotate wallets, or bridge immediately to break the trail.

**Operational rule:** Withhold specific wallet addresses and chain-hop findings from public disclosure until you are ready to act - i.e., you have a freeze request queued with an exchange, or law enforcement is ready to move. Coordinate privately first, publish after. This is why experienced investigators like ZachXBT often delay public posts - early disclosure burns the lead.

**Cross-verification checklist:**
- [ ] Does the attacker address appear in any published threat feeds? (Check: Chainabuse, ScamSniffer, MistTrack)
- [ ] Is any involved address on OFAC SDN list? (Check: home.treasury.gov/policy-issues/financial-sanctions/specially-designated-nationals-and-blocked-persons-list)
- [ ] Has Tether or Circle frozen any addresses in the cluster? (Check: on-chain blacklist call on the USDT/USDC contract)
- [ ] Are there any published investigations referencing these wallets? (Check: ZachXBT's Telegram/Twitter, PeckShield)
- [ ] Has any exchange announced fund freezes? (Check: Binance, OKX, Kraken announcements)

**Tether blacklist check (free, on-chain):**
> "Go to etherscan.io → search the USDT contract (0xdac17f...eE) → read contract → call `isBlacklisted(address)` with the attacker's address. Returns true if Tether has frozen it."

---

### Phase 7: Profile Building & Reporting

**Goal:** Synthesize findings into a clear, evidence-backed narrative identifying the attacker entity.

**Profile components:**
- All known attacker wallets and their roles (exploit wallet, fee funder, collector, bridge wallet, CEX deposit)
- Timeline of events with tx hashes and timestamps
- Laundering route diagram (use Breadcrumbs or MetaSleuth export)
- Attribution evidence: OSINT overlaps, behavioral fingerprints, reused infrastructure
- Known identity signals: exchange KYC accounts (if reported), OSINT personas, leaked data
- Estimated current location of funds and recovery viability

For detailed report structure, evidence hygiene, and disclosure guidance read:

> `cat references/reporting-standards.md`

---

## 5. Attribution Techniques

For complete attribution methods - transaction patterns, gas wallet clustering, peel chains, exploit code reuse, cross-chain attribution, and behavioral fingerprinting - read:

> `cat references/attribution-techniques.md`

---

## 6. OSINT Framework

For detailed OSINT sources (social media, domain/infrastructure tools, developer repos, threat feeds, legal documents, file metadata, stablecoin blacklists, leaked databases), best practices, proactive monitoring setup, and limitations, read:

> `cat references/osint-framework.md`

---

## 7. Advanced Techniques

For advanced methods including time-based transaction correlation, demixing Tornado Cash/Railgun/CoinJoin, bridge hopping analysis, large-scale Dune SQL queries, graph clustering heuristics, and cross-case pattern recognition (Lazarus, Inferno Drainer, Bridge Hopper), read:

> `cat references/advanced-techniques.md`

---

## 8. Laundering Pattern Library

For the complete reference table of laundering techniques, detection methods, and tools (peel chains, mixers, bridge hopping, instant swaps, CEX micro-deposits, OTC off-ramps, unregulated exchanges, and more), read:

> `cat references/laundering-patterns.md`

---

## 9. Tool Reference (Free-First)

For the complete tool inventory organized by category - block explorers, visual tracing and graph tools, smart contract decoding, analytics and querying, OSINT, approval revocation and wallet protection, paid tools, community intelligence sources, and terminology reference - read:

> `cat references/tool-reference.md`

---

## 10. Reporting and Evidence Standards

For evidence hygiene standards, archiving protocol, exchange and law enforcement cooperation procedures, public disclosure guidelines, and the full report structure template, read:

> `cat references/reporting-standards.md`

---

## Quick Reference: Investigation Entry Points

| User starts with... | Start at phase... | First action |
|---|---|---|
| "There's a hack happening right now" | Phase 1 → 2 | Get attacker address from PeckShield/Cyvers alert, go to Phase 3 |
| "I have a victim address" | Phase 3 | Etherscan: check outbound txs, identify attacker address |
| "I have an attacker address" | Phase 3–4 | Map all outflows, label wallets, start tracking |
| "Funds went through Tornado Cash" | Phase 7.2 | Demixing: timing analysis + post-exit monitoring |
| "Funds bridged to another chain" | Phase 5 + 7.3 | Time-value correlation, destination chain explorer |
| "I need to identify who the attacker is" | Phase 5 + 6 | Attribution techniques + OSINT pivot on attacker wallet |
| "I need to write a report" | Phase 7 | Synthesize all findings using reporting structure |
| "Victim got approval-scammed" | Phase 3.2 | Find malicious spender on Etherscan approvals; revoke.cash for victim |
| "Pig butchering - victim sent funds" | Phase 3.3 | Trace destination wallet, check Chainabuse, identify collector cluster |

---

## 11. Professional Development

For structured certification paths (TRM Labs, Chainalysis Academy, Elliptic, Crystal Intelligence) and continuous learning guidance including annual crime reports, independent researcher sources, and case study replay methodology, read:

> `cat references/professional-development.md`

## references

```

```

## references/advanced-techniques.md

# Advanced Techniques

These techniques are for complex investigations where basic tracing has stalled or the attacker has used obfuscation tools.

## 7.1 Time-Based Transaction Correlation

**When to use:** Funds passed through an instant swap service (eXch, ChangeNOW, RhinoFi) or private bridge that provides no transparent explorer.

**Method:**
1. Record: exact timestamp + exact amount deposited into opaque service on source chain
2. Find the service's hot wallet on the destination chain (Google: `"ChangeNOW" deposit address ethereum`)
3. Search outflows from that hot wallet within the same time window (±5 minutes)
4. Match by value (minus fee of ~0.1–1%)
5. The matching outflow = attacker's destination wallet

**Why it works:** Even when the service hides the link, physics is not obfuscated. Time and value are forensic anchors.

**Loopscale example (April 2025):**
- 10 SOL sent to ChangeNOW at 16:56:16 UTC
- 0.816 ETH received by attacker's ETH wallet at 16:56:59 UTC (43 seconds later)
- Match confirmed: same actor, cross-chain, through an opaque service

> Instruction: "Check the service's own hot wallet address on Etherscan. Filter its outbound transactions within the same 5-minute window as the deposit. Sort by amount matching the expected conversion rate."

## 7.2 Demixing Privacy Protocols

**Tools involved:** Tornado Cash (fixed denomination pools), Railgun (arbitrary amounts, zk-SNARKs), Wasabi/CoinJoin (Bitcoin)

**Important framing:** Demixing produces probabilities, not certainties. The goal is to narrow the candidate set and link exits to identifiable clusters downstream.

**Tornado Cash demixing methods:**
- **Timing analysis:** Deposits and withdrawals in similar time windows narrow the candidate set
- **Gas ratio analysis:** Same gas limit + gas price settings used for both deposit and withdrawal = behavioral fingerprint
- **Withdrawal clustering:** Addresses withdrawing in the same denominations on the same schedule = same operator
- **Linked gas wallets:** Who paid the withdrawal relay fee? Trace that funding wallet.
- **Post-exit tracking:** The moment funds leave Tornado, they're visible again. Monitor all withdrawal addresses and follow them downstream.
- **Statistical heuristics:** Stack timing + denomination + gas patterns → confidence score

**Railgun demixing:**
- **Value fingerprinting:** Arbitrary amounts can be fingerprinted (e.g., 123.456 ETH in = 123.456 ETH out minus fees)
- Track unshielding events and correlate with Tornado deposits or CEX entries

**CoinJoin (Bitcoin):**
- Multiple inputs combined in one tx → hard to separate. But:
  - Unmixed change outputs often link back to the original sender
  - Use **Wallet Explorer** or **OXT.me** to visualize CoinJoin clusters
  - Cross-reference timing and amounts against pre-mix inputs

**WazirX multi-layer demixing example:**
1. All stolen funds → Tornado Cash (deposit anchor = last confirmed position)
2. Tornado withdrawals → ETH→BTC swap on exchanges
3. BTC → CoinJoin transactions (thousands of micro-movements)
4. CoinJoin outputs → OTC brokers in Southeast Asia
5. Investigative approach: time-correlation at each layer, denomination matching, behavioral patterning, destination monitoring

## 7.3 Bridge Hopping Analysis

**What it is:** Tracking funds as they jump across multiple chains through bridge contracts.

**Step-by-step:**
1. Identify the bridge used (check attacker wallet for interactions with known bridge contracts)
2. Find the bridge's destination contract on the target chain (Google: `"[bridge name] contract address [destination chain]"`)
3. Use time-value correlation to match deposit → withdrawal
4. On Solana: look for Program-Derived Addresses (PDAs) - deterministic addresses that map back to Ethereum origins
5. Repeat for each subsequent hop

**Behavioral patterns to detect:**
- Rapid multi-chain hops within minutes = script-driven automation, not manual
- Consistent bridge sequence (e.g., ETH → BSC → Tron) = group fingerprint
- Liquidity-driven choices: USDT launderers prefer bridges with deep stablecoin pools
- Test transactions: attacker sends small amount first, then scales up

**Bybit hack example:** Funds moved through THORChain and eXch. Over 30,000 transactions tracked using a custom Dune dashboard by Tayvano. Same BTC laundering address linked to AlphaPo/Coinspaid 2023 hack.

> Free tool instruction: "Check `thorchain.net/txs` and filter by the attacker's address. For eXch, use time-value correlation from the depositing Ethereum address to find the receiving address on the output chain."

## 7.4 Large-Scale Data Analysis

**When to use:** Hundreds of wallets, thousands of transactions. Manual tracing is impossible.

**Dune Analytics (free):**
- Write SQL queries against decoded blockchain data
- Example query to find all outflows from a set of attacker wallets:
  ```sql
  SELECT
    "from" as attacker_wallet,
    "to" as destination,
    value / 1e18 as eth_amount,
    block_time
  FROM ethereum.transactions
  WHERE "from" IN (0xattacker1, 0xattacker2, ...)
    AND block_time > TIMESTAMP '2025-02-21'
  ORDER BY block_time
  ```
- Build dashboards to track flows visually in real time
- Reference: Tayvano's Bybit/Thorchain dashboard tracked 30,000+ transactions

> Instruction: "Go to dune.com → New Query → select 'ethereum.transactions' dataset → write a WHERE clause filtering by your attacker addresses → run. Fork any existing public Dune dashboard related to the incident and adapt it."

**Flipside Crypto (free):**
- Similar SQL analytics platform with cross-chain coverage including Solana, Avalanche, Osmosis

**Google BigQuery (free tier with limits):**
- Full Ethereum, Bitcoin, and other chain data available as public datasets
- Suitable for very large investigations requiring joins across multiple tables

## 7.5 Graph Analysis & Clustering

**What it is:** Modeling wallets as nodes and transactions as edges to reveal hidden network structures.

**Heuristic clustering methods:**
- **Common-input-ownership:** Multiple addresses used as inputs to the same transaction = same entity (Bitcoin)
- **Gas-fee wallet clustering:** Addresses funded by the same feeder wallet = same operator
- **Consolidation clustering:** Addresses that always send to the same final destination = same controller
- **Exploit-contract clustering:** All wallets that approved or interacted with same malicious contract = linked campaign

**Free graph tools:**
- **Breadcrumbs** (`breadcrumbs.app`) - visual graph of wallet relationships, free tier available
- **MetaSleuth** (`metasleuth.io`) - auto-generated fund flow map, cross-chain
- **Arkham Intelligence** (`arkhamintelligence.com`) - entity-level graph with free account
- **GraphSense** (open source, self-hosted) - full UTXO + account model graph analytics

**What to look for in graphs:**
- **Star networks:** One central wallet receiving from hundreds of victims (drainer collector)
- **Chain splitters:** One wallet fans out to dozens - peel chain beginning
- **Service reliance:** Multiple hacks converging on the same bridge/mixer/CEX
- **Overlap between incidents:** Two apparently unrelated hacks share a common laundering hub → same group

**Paid options:** Arkham Pro, Crystal Intelligence, Chainalysis Reactor - offer automated entity resolution and compliance-grade clustering. Worth it for professional investigations.

## 7.6 Pattern Recognition Across Cases

**Why it matters:** Laundering is recycled. Groups reuse playbooks that worked before. Recognizing patterns from past cases shortens future attribution timelines dramatically.

**Lazarus Group (DPRK) Signature Pattern:**
```
Exploit → Tornado Cash (100 ETH batches, multiple rounds)
→ Optional: Railgun layer
→ Bridge to BNB Chain or Tron
→ Convert to USDT or BUSD
→ OTC brokers (Southeast Asia or Middle East)
→ Cash-out
```

When you see: multiple rounds of Tornado Cash in 100 ETH denominations, followed by a Tron USDT bridge → high-confidence Lazarus indicator. Cross-check with OFAC and UN sanctions lists.

**Inferno/Angel Drainer Pattern (approval scams):**
```
Phishing site → setApprovalForAll() or unlimited approve()
→ Same drainer contract (hundreds of victims)
→ Collector wallet consolidates all stolen assets
→ Bridge to Tron → OTC cash-out
```

**Bridge Hopper Pattern (rapid multi-chain):**
```
Hack → Immediate token swap (DEX, no CEX risk)
→ Bridge hop 1 → Bridge hop 2 → Bridge hop 3 (within 30 minutes)
→ Stablecoin conversion → OTC or exchange with weak KYC
```

**Build your own pattern library:**
> Keep a running document of laundering sequences you observe. Over time, this becomes a personal threat intelligence database. When a new incident occurs, compare its pattern to your library before starting from scratch.

## references/attribution-techniques.md

# Attribution Techniques

Use these techniques when basic tracing has established fund flows and the goal shifts to identifying who controls the wallets.

## 5.1 Transaction-Based Attribution

**Common Input/Output Patterns:**
- Multiple addresses sending to the same CEX deposit wallet → same entity
- Same withdrawal batch distributing to multiple wallets → same source
- Stolen funds consolidated into a previously used wallet → links to prior hack
- Assets split then recombined at one endpoint → reveals ultimate controller
- Collector addresses aggregating hundreds of victim flows (drainer campaigns)

*Example: Inferno Drainer contract `0x000037bB05B2CeF17c6469f4BcDb198826Ce0000` - thousands of victims all funneled into one contract, which redistributed to attacker-controlled collectors.*

**Gas-Fee / Funding Wallet Attribution:**
- Multiple wallets topped up with identical gas amounts in a short timeframe → same operator
- Gas feeder that used funds from a previous hack → links two incidents
- Gas supplied via Tornado Cash withdrawals → look at the withdrawal timing/denomination pattern
- Private bridge funding: correlate by timestamp ± value across chains

*Example: WazirX hack - test wallet `0x6eedf9...` received six 0.1 ETH top-ups from Tornado Cash eight days before the main incident, funding SHIB test transactions.*

**Peel Chains:**
- Funds split into fixed amounts, forwarded through a linear chain of wallets
- Each hop slightly reduces the amount (gas fees), creating a traceable "peel" effect
- Map the entire peel chain as a graph; the terminal wallet is the consolidation point

**Transaction Graph Analysis:**
- Wallets repeatedly interacting with same collector or broker
- Star-shaped patterns: one funder → many children
- Dense clusters around exploit contracts or drainer services
- Convergence of multiple laundering paths into one endpoint

## 5.2 Infrastructure / Interaction Attribution

**Drainer and Exploit Contracts:**
- Thousands of victims approving the same contract → natural attribution anchor
- Even when collector wallets rotate, the drainer contract ties all activity together

**Exploit Code Reuse:**
- Same bytecode in different incidents = same group or shared toolkit
- Check contract bytecode on Etherscan → "Similar Contracts" feature shows matches
- Deployment wallet often the same across multiple malicious contract launches

**Deployment Wallets:**
- Trace who deployed the malicious contract → that wallet often deployed others
- One developer wallet can attribute dozens of contracts to the same actor

## 5.3 Cross-Chain Attribution

**Bridging and Stablecoin Laundering Patterns:**
- Stolen ETH → USDT/USDC → bridged to Tron (high liquidity for OTC)
- Track which addresses consistently receive bridged stablecoins after hacks

**Repeated Bridge Preference:**
- Groups reuse the same bridges across incidents (THORChain, Allbridge, Multichain, Wormhole)
- Consistent bridge choice = attribution fingerprint
- Monitor bridge inflows/outflows to match source chain wallets with destination recipients

**Timing Correlation in Semi-Private Bridges (eXch, ChangeNOW, RhinoFi):**
- Record: exact timestamp + amount deposited on source chain
- Find: outflow of equivalent value (minus fee) from bridge hot wallet within tight time window
- Match: deposit and withdrawal = same actor

**Convergence at OTC Brokers:**
- Multiple hacks converging at same Tron USDT broker address = shared group
- Lazy Group / Lazarus Group: repeatedly used same Southeast Asian OTC brokers

*Example: Bybit hack - ETH consolidated at `0xd6a164...` → moved to BTC → BTC address `bc1qt2w...` linked to AlphaPo/Coinspaid hack of 2023 → same laundering infrastructure, same group.*

> ⚠️ **False Positive Warning:** Cross-chain attribution is the technique most prone to misattribution. Even small errors in timing or value matching can redirect an entire investigation toward the wrong actor. Before attributing any wallet via bridge analysis, verify the match holds on at least two independent signals (timing + value + behavioral pattern). When in doubt, classify as "possible link - needs further corroboration," never as confirmed attribution.

## 5.4 Behavioral Attribution

**Timing Habits:**
- Transactions consistently executed at the same hours of day → timezone inference
- Lazy Group / Lazarus: often active during Asian business hours / North Korean working day
- Automation: transfers executing every N minutes → script-driven, not manual
- **Compliance gap exploitation:** Sophisticated attackers deliberately time large moves for weekends, public holidays, or late-night hours when exchange compliance teams are slow or offline. Multiple hours of lag before a freeze request is actioned = attacker advantage. Investigators should flag this pattern when it appears - it indicates deliberate operational awareness, not coincidence.

**Stablecoin and Asset Preferences:**
- Consistent conversion to USDT on Tron → OTC/cash-out preference
- Some groups prefer DAI or USDC depending on their exit markets
- Cross-cluster matching: track which stablecoin flavors appear consistently across hacks

**Protocol and Route Choices:**
- Always swapping via Uniswap v3, then bridging via THORChain = fingerprint
- Curve pools preferred for large stablecoin swaps (deep liquidity)

**Fixed Denominations:**
- Tornado Cash: fixed pool sizes (0.1, 1, 10, 100 ETH) - consistent denomination choice = pattern
- Peel chains often move near-identical amounts step by step

**Cash-Out Consistency:**
- Different hacks converging at the same OTC broker on Tron = linked operations
- Lazarus Group: Tornado (100 ETH batches) → Bridge → Tron USDT → Same OTC broker

## references/laundering-patterns.md

# Laundering Pattern Library

Reference table of known laundering techniques and how to detect and follow them:

| Technique | Detection Method | Key Tool (Free) |
|---|---|---|
| Peel chain | Trace linear chain of equal-amount hops | Breadcrumbs, MetaSleuth |
| Tornado Cash mixing | Post-exit monitoring, timing, gas ratio | Etherscan, Dune |
| Railgun shielding | Value fingerprinting on unshield events | Etherscan, Arkham |
| CoinJoin (Bitcoin) | Change output analysis | OXT.me, Wallet Explorer |
| Cryptomixer (Bitcoin) | Custodial BTC mixer (operating since 2016); pools deposits, redistributes to new addresses after time delay. Look for: BTC inflows from known hack wallets followed by equivalent outflows to new cold addresses with time gaps | Mempool.space, OXT.me |
| Bridge hopping | Time-value correlation, bridge contract monitoring | Bridge explorers, Dune |
| Instant swap obfuscation | Time-value correlation (±5 min window) | Etherscan, chain explorer |
| CEX micro-deposits | Pattern-match small amounts to hot wallets | Etherscan, Arkham |
| OTC cash-out (Tron USDT) | Identify Tron address clusters receiving large USDT | Tronscan, MistTrack |
| P2P off-ramp (Binance P2P, LocalBitcoins, HodlHodl) | Attacker sells crypto directly for fiat via burner/purchased-KYC identities; minimal on-chain trace after P2P exchange - pivot on the deposit address to the P2P platform, report to exchange compliance | Exchange cooperation required |
| Stablecoin bridging | Follow USDT/USDC via bridge contracts to Tron/BNB | Tronscan, BSCScan |
| Fake/stolen identity CEX | Flag for exchange cooperation; not traceable on-chain alone | Report to exchange |
| Unregulated exchange off-ramp (Huione, Xinbi, Grantex) | **Huione**: Cambodia-linked platform with Telegram/WeChat presence; used by pig butchering rings and fraud networks to off-ramp via informal agents. **Xinbi**: weak-KYC exchange; accepts near-anonymous trading. **Grantex**: Russia-based; darknet and ransomware cashout. Detection: trace Tron USDT flows to receiving addresses associated with these platforms; report to partner exchanges and OFAC | MistTrack, Arkham, exchange cooperation |
| Dusting / micro-probe transactions | Identify small test amounts sent before major movement; link probe wallet to main actor | Etherscan, Breadcrumbs |
| CEX deposit address reuse | Same deposit address used across multiple separate hacks → single operator | Etherscan, Arkham |
| Privacy pool chaining | Reconstruct each layer separately; monitor all exits | Dune (custom query) |

## references/osint-framework.md

# OSINT Framework

Use OSINT to bridge the gap between pseudonymous wallet addresses and real-world actors.

## 6.1 Principle: OSINT + On-Chain = Attribution

Blockchain data proves what happened. OSINT reveals who made it happen. Neither is sufficient alone - triangulate both.

**Rule:** One OSINT signal is a lead. Three corroborating signals from independent sources = attribution hypothesis. Five+ with on-chain confirmation = strong attribution case.

## 6.2 OSINT Sources (Free-First)

**Social Media (free):**
- **Twitter/X search** - search the attacker address in quotes. Often surfaces prior mentions, scam promotions, or community reports.
  > Instruction: `Go to x.com → search "0xABCD...1234" (with quotes) → filter by Latest → look for any prior mentions, scam campaigns, or investigator threads linking this address.`
- **Telegram** - many drainer services advertise openly. Search address in Telegram search bar.
- **Reddit** - r/CryptoScams, r/ethereum frequently have victim reports with attacker addresses
- **YouTube/TikTok** - scam promotions often embed deposit addresses in video descriptions
- **Perplexity / AI-powered search** - use as a first-pass discovery sweep to surface mentions of wallet addresses, usernames, or scam campaigns across publicly indexed data. Faster than manual search, but never treat results as verified.
  > Instruction: `Ask Perplexity: "Has wallet 0xABCD... appeared in any scam reports, security research, or Telegram channels?" Cross-verify every hit on-chain before using it.`

**Domain / Infrastructure (free tools):**
- **WHOIS** (`who.is`) - check domain registration date, hosting provider, registrar email. Scam sites often registered same day as the campaign.
- **urlscan.io** - scan any suspicious URL. See JavaScript, embedded addresses, linked domains, and screenshots even after takedown.
  > Instruction: `Go to urlscan.io → paste the suspicious URL → run scan → look under "Indicators" for any wallet addresses embedded in the page source.`
- **Wayback Machine** (`web.archive.org`) - capture snapshots of phishing sites before they go down.
- **SecurityTrails** (`securitytrails.com`, free tier) - DNS history, subdomain enumeration, IP history.
- **SSL certificate search** (`crt.sh`) - find all domains sharing the same SSL certificate. Attackers often reuse certificates across scam sites.
  > Instruction: `Go to crt.sh → search the domain → expand the certificate → copy the Common Name → search again to find all sibling domains using the same certificate.`
- **Site Sentry** (Telegram bot) - monitors phishing site front-end changes and infrastructure updates in real time. Alerts when known scam domains update or switch infrastructure - useful for tracking active campaigns.
  > Instruction: `Search Telegram for "Site Sentry" bot → submit domains you're monitoring → receive alerts when the front end or hosting changes.`

**Developer Repositories (free):**
- **GitHub** - search the attacker address or deployer address on GitHub. Attackers often commit test addresses or API keys inadvertently.
  > Instruction: `Go to github.com → use the search bar → enter the wallet address in quotes → filter by "Code" → look for any repository referencing this address.`
- **DPRK / threat actor repositories** - look at repositories confirmed as belonging to nation-state actors or cybercrime groups. They often reveal: repeated coding styles, reused infrastructure, and multiple aliases managed by the same actor. Code commits, usernames, and email addresses can unmask clusters of fake identities.
  > Instruction: `Search GitHub for the attacker's known username or any identifier from the on-chain investigation. Compare commit history, coding patterns, and linked accounts across multiple repos.`
- **Bitcointalk** - early project announcements, presale addresses. Forum posts are indexed and searchable.
- **Medium/Substack** - fraudulent project "official guides" often embed collection addresses.

**Exchange Announcements and Threat Feeds (free):**
- **Chainabuse** (`chainabuse.com`) - crowdsourced scam reports indexed by address
- **ScamSniffer** (`scamsniffer.io`) - drainer and phishing campaign database
- **CryptoScamDB** - aggregated scam address database
- **CoinHolmes** - public reporting platform aggregating community-reported scam addresses and incident reports
- **SEAL-ISAC** - both a structured threat intelligence sharing network (apply for access) AND a public reporting platform for extortion, scam addresses, and crypto-native security incidents; check it for address lookups alongside Chainabuse
- **OFAC SDN List** (`home.treasury.gov/...`) - check if address is sanctioned
  > Instruction: `Go to home.treasury.gov → search "SDN List" → download CSV or use web search → search the address. Or use sanctioned.us for faster lookup.`
- **MistTrack** (`misttrack.io`, free basic search) - risk scoring and address tagging

**Legal & Regulatory Documents (free, highest credibility):**
- **OFAC/Treasury sanctions notices** - contain previously unknown wallet addresses and entity aliases at the moment of sanctioning. Download the full SDN CSV to search locally.
  > Instruction: `Go to home.treasury.gov/policy-issues/financial-sanctions/specially-designated-nationals-and-blocked-persons-list-sdn-human-readable-lists → download CSV → search the file for wallet addresses or entity names related to your case.`
- **DOJ indictments and court filings** - criminal indictments (particularly against exchange operators, mixer services, and DPRK actors) often list specific wallet addresses, transaction hashes, and entity infrastructure. Free via PACER (US federal courts) or news coverage.
- **Europol/Eurojust press releases** - coordinate cross-border seizures and name wallets/exchanges involved. Free via Europol's newsroom.
- **UN Security Council Panel reports on DPRK** - contain attribution analysis, wallet clusters, and on-chain evidence used in sanctions proceedings. Published annually with specific blockchain evidence.
- **Reuters, CoinDesk, The Block** - major hacks are covered within hours; reporters cite official exchange/regulator disclosures that may include attacker wallet addresses not yet on community threat feeds. Treat as secondary confirmation, then validate on-chain.
  > Instruction: `Search: "site:reuters.com OR site:coindesk.com OR site:theblock.co 0xATTACKERWALLET" to surface any journalist-published references to the address.`
- **Academic papers and research datasets** - universities and research groups publish structured datasets on darknet wallets, mixing typologies, and laundering case studies. Search Google Scholar for the blockchain/technique in question. Useful for validating heuristics and understanding emerging methods.

**File & Image Metadata (free, often overlooked):**
- PDFs, whitepapers, images, and documents shared by threat actors often retain **EXIF data, creation timestamps, and software version tags**
- These can reveal: creator's time zone (created/modified timestamps), operating system, application version, device fingerprints
- Practical use: if a scammer shares a "whitepaper", token deck, or screenshot - extract metadata before discarding it as evidence
  > Instruction: `On Mac/Linux: run \`exiftool filename.pdf\` (install with \`brew install exiftool\` or \`apt install libimage-exiftool-perl\`). Look at "Create Date", "Modify Date", "Creator Tool", "Author", and "GPS" fields. Timestamps reveal likely timezone of the creator. Cross-reference with on-chain transaction timestamps for correlation.`
  > Instruction: `For images: upload to \`jimpl.com\` (free web EXIF viewer) if you don't have exiftool. Note: many platforms strip EXIF on upload - the most useful metadata comes from files shared via Telegram or email, not re-uploaded images.`

**Stablecoin Blacklists (free, on-chain):**
- USDT (Ethereum): Call `isBlacklisted(address)` on USDT contract (`0xdAC17F...`)
- USDC (Ethereum): Call `isBlacklisted(address)` on USDC contract (`0xA0b86...`)
  > Instruction: `Go to etherscan.io → search USDT contract address → "Read Contract" → find isBlacklisted → enter the attacker's address → Execute.`

**Leaked Databases (use with OPSEC):**
- **Have I Been Pwned** (`haveibeenpwned.com`) - free. Check if associated email appeared in a breach.
- **Intelligence X** (`intelx.io`, limited free tier) - indexes paste dumps, darknet, and leaked data.
- **BreachForums / successor marketplaces** - known hubs where breach data, stolen accounts, and crypto cashout services are traded. Wallet addresses and stolen CEX credentials appear here. ⚠️ Use extreme caution: legal gray area; use isolated VM + Tor + no personal accounts; treat findings as leads requiring on-chain corroboration, never as proof.

**Paid OSINT tools (recommend if institutional context):**
- Dehashed - email/username/IP/domain cross-search across breach datasets
- DomainTools - advanced DNS history and infrastructure pivoting
- RiskIQ / SpiderFoot - attack surface and infrastructure mapping

## 6.3 OSINT Best Practices

- **Archive immediately.** Screenshots with timestamps. Use `web.archive.org/save/[URL]` to permanently capture pages.
- **Cross-verify across 3+ independent sources** before including in a report.
- **Reused handles.** Same username on Telegram + GitHub + Twitter = strong link. Use Google: `"username" site:github.com OR site:twitter.com OR site:t.me`
- **Timing correlation.** Posting timestamps from social media that align with on-chain tx timestamps → timezone inference.
- **Language/style.** Repeated spelling patterns, emoji usage, phrasing across multiple accounts = stylometric fingerprint.
- **OPSEC when accessing dark web sources:** Use isolated VM, Tor, no personal accounts. Treat as legal gray area unless using aggregator services.
- **Think like the adversary.** Attackers take shortcuts: reuse usernames, recycle code, operate on predictable schedules. Look for laziness.
- **Set up proactive monitoring, not just reactive lookup.** Don't wait until an incident to check your tools - standing infrastructure saves you when the clock is running:
  - Set Etherscan wallet alerts on all addresses you're monitoring (free, email notifications)
  - Set up urlscan.io domain monitoring subscriptions for known scam infrastructure and campaigns you're tracking
  - Subscribe to ScamSniffer, MistTrack, and Chainabuse digest feeds
  - Add known attacker addresses to Arkham Intelligence watchlists (free tier) for real-time balance change alerts
  - Add Site Sentry (Telegram bot) to watch known phishing domains for front-end changes
  - Treat early awareness as a capability: catching a fund movement while the attacker is still bridging is qualitatively different from finding it three days later

**Protocol-level safeguards (post-hack advisory):**
Time-locks and withdrawal delays can block attacker extraction entirely. In the Bybit hack, **Mantle's 8-hour withdrawal delay blocked the attacker from extracting 15,000 cmETH** - a real-world example of this safeguard functioning correctly. When advising protocols post-incident, specifically review time-lock coverage on high-value withdrawal paths.

## 6.4 OSINT Limitations

- **Data overload.** The volume of social media, domain records, leak datasets, and threat feeds generates enormous noise. Many signals are irrelevant, outdated, or misleading. Structured workflows and experience are required to filter signal from noise.
- **False positives are common.** Community blacklists contain errors. Always validate with on-chain data.
- **Deception.** Sophisticated actors plant false OSINT trails. Cross-verify before concluding.
- **Ephemeral data.** Telegram groups disappear. Archive before they do.
- **OSINT cannot prove wallet ownership.** It builds circumstantial connections. Proof requires on-chain corroboration.

## references/professional-development.md

# Professional Development

## 11.1 Courses & Certifications

Formal training provides structure and credibility. Choose **one provider path** and complete it - jumping between providers wastes time. TRM and Chainalysis are most recognized for active investigations; Elliptic and Crystal are best for compliance-heavy workflows.

**TRM Labs** (`trmlabs.com/training-and-certifications`) - self-paced, all online:
- Crypto Fundamentals Certification - blockchain basics, wallets, transactions, NFTs, intro to tracing
- TRM Certified Investigator - core workflows: tracing illicit funds, attribution, abuse vectors
- TRM Advanced Crypto Investigator - obfuscation, privacy tools, cross-chain laundering, advanced casework
- TRM Crypto Compliance Specialist - regulatory frameworks, monitoring, risk assessment
- TRM Digital Forensics & Cryptocurrencies - handling crypto evidence in forensic investigations
- TRM Crypto Seizure Specialist - asset location, seizure, and recovery for law enforcement

**Chainalysis Academy** (`academy.chainalysis.com`) - widely recognized across industry and government:
- CCFC (Cryptocurrency Fundamentals) - intro to crypto, AML basics
- CRC (Reactor Certification) - hands-on tracing using Chainalysis Reactor
- CKC (KYT Certification) - transaction monitoring and compliance workflows
- Asset Seizure Certification - practical aspects of seizing cryptocurrency
- CISC (Investigation Specialist) - advanced tracing with complex laundering methods
- CEIC (Ethereum Investigations) - focused on Ethereum, DeFi, and smart contracts
- CRRT (Risk & Regulation) - regulatory frameworks and risk-based approaches

**Elliptic** (`elliptic.co/solutions/education-and-training`) - compliance-driven:
- Elliptic Learn – Certify - AML and cryptoasset fundamentals
- Product Certifications - Elliptic Lens and Navigator tool training
- Specialist Investigator Certification - advanced investigations using Elliptic's platform

**Crystal Intelligence** (`crystalintelligence.com/crypto-investigations-compliance-training`) - blends theory with tool application across UTXO and EVM:
- Crypto Fundamentals / Foundation Assessment
- UTXO-Based Blockchains Investigation - Bitcoin, Litecoin, UTXO tracing methods
- EVM-Compatible Chains / Smart Contract Investigation - Ethereum, DeFi, smart contracts
- Crypto Research & Investigation Specialist - advanced visualization, OSINT, case reporting
- Crypto Compliance Masterclass - AML frameworks, risk-based compliance, regulation

## 11.2 Continuous Learning

The crypto ecosystem changes faster than any certification. A method that worked six months ago may be obsolete - attackers are always first movers.

**Key ongoing sources:**
- **Annual crime reports**: Chainalysis Crypto Crime Report (most widely cited across law enforcement), TRM Labs annual threat report (including **TRM Labs Illicit Crypto Ecosystem Report** - foundational reading for the full illicit landscape including DaaS, nation-state actors, and typologies), Elliptic and Crystal annual reviews, **Zeroshadow** threat intelligence
- **Independent researcher threads**: Real-time work by ZachXBT, Tayvano, and others often surfaces patterns days or weeks before formal reports
- **Academic research**: Transaction clustering heuristics, mixing analysis, privacy protocol cryptography - theoretical but shapes the tools investigators will use next
- **Case study replay**: Take a past high-profile hack (Ronin, Harmony, Euler, Bybit) and manually rebuild the fund flow using today's tools. This is the highest-ROI training exercise available.

**Best practices:**
- Subscribe to newsletters and Telegram alert channels from forensic firms and community groups
- Engage in communities - don't just observe. Even confirming someone else's finding or adding a missing wallet address contributes and accelerates your own learning
- Schedule dedicated learning time (weekly or monthly) - treat it as professional development, not optional reading
- Keep a personal intelligence database: patterns, tagged wallets, known laundering sequences, OTC broker addresses. Over time this becomes a private threat library that shortens future investigations significantly

## references/reporting-standards.md

# Reporting and Evidence Standards

## 10.1 Evidence Hygiene
- Every claim must cite a tx hash, block number, or archived URL
- Never attribute based on a single OSINT signal
- Distinguish between confirmed facts and hypotheses in your report
- All wallet labels should state the basis for attribution (e.g., "tagged as Lazarus Group per OFAC SDN 2022-04-14")

## 10.2 Archiving Protocol
- Screenshot every Etherscan page, Telegram post, social media mention that supports your findings
- Use `web.archive.org/save/[URL]` to create permanent, timestamped archives
- Store archives in a dated folder structure: `YYYY-MM-DD_incident-name/screenshots/`
- Export Breadcrumbs or MetaSleuth graphs as PNG/PDF for the report appendix

## 10.3 Exchange and Law Enforcement Cooperation
- **Exchanges (Binance, OKX, Kraken, Coinbase):** Email their security/compliance teams with the attacker's deposit address, transaction hashes, and the theft evidence. Most have fast-track freeze processes for documented hacks.
- **Law enforcement:** FBI IC3 (ic3.gov), Interpol, national cybercrime units. Provide: victim details, full transaction log, fund flow diagram, current fund location.
- **Legal pathway required:** Confirm a recovery mechanism exists before investing major investigation effort. No legal pathway = monitoring only.

## 10.4 Public Disclosure Considerations
- Public disclosure can pressure exchanges to freeze funds faster
- But it can also alert the attacker to accelerate fund movement
- General rule: coordinate with affected protocol/exchange first; publish after freeze is in place or fails
- Follow ZachXBT's model: publish detailed evidence with wallet maps, timeline, and OSINT corroboration

## Report Structure

```
1. Executive Summary (1 paragraph: what happened, how much, where funds are)
2. Incident Timeline (chronological tx-by-tx sequence)
3. Fund Flow Analysis (diagram + table of all hops)
4. Attribution Evidence (transaction patterns + OSINT findings)
5. Current Fund Status (still on-chain / bridged / CEX / OTC)
6. Recovery Recommendations (exchange contact, law enforcement referral)
7. Appendix (all addresses, tx hashes, archived screenshots)
```

## references/threat-landscape.md

# Threat Landscape Reference

Use this file to identify the type of crime being investigated and brief the user on known patterns so they know what to expect on-chain.

## 3.0 Scale Context (for Scoping and Threat Briefing)

Use these figures when helping users understand the severity of a threat type or justify investigation effort:

| Metric | Figure | Source |
|---|---|---|
| Total lost to crypto scams/hacks/state attacks (5 years) | $100B+ | Article 1 |
| Illicit crypto volume 2023 (peak) | $58.7B | TRM Labs |
| Illicit crypto volume 2024 | $44.7B | TRM Labs |
| Pig butchering losses Jan 2020–Feb 2024 | $75B | University of Texas |
| Pig butchering US losses 2024 alone | $5.8B | FBI IC3 |
| Approval phishing losses since May 2021 | $2.7B | Chainalysis |
| Wallet drainer losses in 2024 alone | $494M | ScamSniffer |
| Wallets compromised by drainers in one year | 332,000 | ScamSniffer |
| Stolen from Coinbase users via social engineering | $340M+ | ZachXBT/tanuki42 |
| Single social engineering theft (Coinbase) | $243M | ZachXBT |

## 3.1 Protocol-Level Exploits and Bridge Hacks
- Flash loan attacks, logic flaws, oracle manipulation, reentrancy
- Cross-chain bridge drain by bypassing validation
- Proxy upgrade manipulation (e.g., Bybit Safe UI spoofing)
- Immediate asset conversion post-exploit: freeze-prone stablecoins (USDT/USDC) → ETH/SOL/TRX
- Rapid fund splitting across 40–100+ wallets (peel chains)
- Dormancy periods: funds may sit idle for days–months before next move

## 3.2 Wallet Drainers & Approval Scams
- Drainer-as-a-Service (DaaS): Inferno Drainer, Monkey Drainer (pioneer/model setter), Angel Drainer, Medusa Drainer, Ace Drainer
- DaaS economics: operators sell ready-made toolkits (phishing templates, Telegram bots, dashboards, laundering scripts) to affiliates in exchange for a % of stolen funds
- Geographic base: Russia, Eastern Europe, Southeast Asia - leverage bulletproof hosting and encrypted Telegram channels for advertising and support
- ERC-20 `approve(spender, uint256.max)` grants unlimited access; no private key needed
- NFT `setApprovalForAll(spender, true)` drains entire collections
- `transferFrom()` executes silently, often hours or days after approval
- Victim is lured to clone site via compromised Discord, Telegram, Twitter/X DM, paid ad
- On-chain pattern: hundreds of victims → single collector contract → attacker wallet

**What to look for on-chain:**
- Check victim's token approval history on Etherscan (Token Approval Checker)
- Identify the malicious spender contract
- Map all other victims who approved the same spender
- Trace collector contract's outflows → attacker's consolidation wallet

## 3.3 Pig Butchering / Romance Scams
- Trust is built over days/weeks via dating apps, Telegram, wrong-number SMS
- Fake investment platform shows fabricated gains
- Victims are urged to deposit more; withdrawal blocked by fake fees/taxes
- Criminal infrastructure: Southeast Asian crime syndicates (Myanmar, Cambodia, Laos)
- On-chain: funds flow to centralized collector wallets; eventually off-ramped via CEX or OTC

**What to look for on-chain:**
- Victim sends to a wallet they believe is "their portfolio" - that wallet sends to a laundering hub
- Look for convergence: many different victims → same destination cluster
- Check Chainabuse, ScamSniffer for reported destination addresses

## 3.4 Phishing Attacks

Phishing targets **users of specific platforms or products** - waiting for them to visit a fake interface, connect their wallet, or enter sensitive information. No human interaction required - just a convincing trap. Transactions are irreversible; wallets are drained before victims realize.

**Statistics:** $2.7B in losses since mid-2021 (Chainalysis); 330,000+ wallets compromised in 2023 alone causing $295M in losses (ScamSniffer). Phishing kits (drainer templates, Telegram dashboards, laundering scripts) are sold as plug-and-play packages on underground markets.

**How it works:**
1. Attacker clones a trusted Web3 site (NFT mint, DeFi staking portal, wallet download page) - often pixel-perfect
2. Distributes via: Discord/Telegram compromised channels, Twitter/X hijacked accounts, Google/social media sponsored ads that outrank the real site, email campaigns
3. User prompted to: sign an `approve()` or `setApprovalForAll()` transaction, enter seed phrase in a form, or download a fake wallet extension containing malware
4. Funds drained silently via the approval, or immediately via the seed phrase

**Red flags:**
- URL slightly off from official domain (e.g., `uniswap-launchpad.org` vs `app.uniswap.org`)
- Transaction request uses vague labels like "verify", "claim", "continue" - not specific action names
- Any website or form asking for your seed phrase or private key - no legitimate platform ever does this
- Site prompts you to download a browser extension or wallet file without verified instructions
- Unexpected pop-up or redirect when visiting a project from a community link

**Prevention:**
- Bookmark official project URLs - never navigate from DMs, Discord announcements, or search results
- Use **Wallet Guard** or **Pocket Universe** browser extensions - these simulate transactions and flag suspicious approvals before you sign
- Use **Scam Sniffer** to detect known phishing domains in real time
- Never enter seed phrases on any website
- Use a hardware wallet - requires physical button confirmation, blocking silent approvals even if you land on a phishing site

**On-chain investigation pivots:**
- Pull victim's token approval history on Etherscan → identify the malicious spender contract
- Map all other victims who approved the same spender → full drainer victim set
- Trace collector contract outflows → attacker's consolidation wallet
- Search the phishing domain on urlscan.io → find embedded wallet addresses, related domains, infrastructure

## 3.4b Address Poisoning

Attacker sends a **zero-value or dust transaction** from a wallet address crafted to visually match the first/last characters of a trusted contact's address. The poisoned address then appears in the victim's wallet history - when they later copy from history to send funds, they paste the attacker's address instead.

**Statistics:** 270+ million attempts targeting ~17 million users on Ethereum and BNB Chain in 2024; 6,633 successful incidents totaling $83.8M in losses; single case: $68M in wBTC lost in May 2024 (victim sent to a poisoned address 1 character different from intended recipient).

**How it works:**
1. Attacker generates a vanity address matching the first ~6 and last ~4 characters of a victim's frequent recipient (e.g., `0x5fB2...D4c8` → `0x5fB2...D4c3`)
2. Sends a 0-value USDT or 0 ETH transaction from the lookalike address to the victim - no malicious payload, just a history plant
3. When the victim next sends funds to the real address, they scroll their history, see the fake one first, and paste it without checking the full string
4. Funds are irreversible - the transfer was to a valid address

**Red flags:**
- Zero-value or tiny dust transactions from an address you didn't initiate contact with
- Address in your history that matches the first and last characters of a known contact but differs in the middle - always verify the full string, not just start/end
- Any out-of-context transaction you didn't initiate (no airdrop claim, no DEX interaction from you)

**Prevention:**
- Never copy wallet addresses from your transaction history - use a saved address book or contact list instead
- Always verify the **full address**, not just start and end characters, when pasting
- Use wallets with address books / whitelisting (Rabby Wallet, Wallet Guard, Fireblocks for teams)
- Flag and hide zero-value transactions - do not interact with them
- For large amounts: verify the recipient address out-of-band (confirm by voice, separate channel) before sending

**On-chain investigation:**
- Look for $0 dust transactions from near-identical addresses in the victim's history
- Vanity address generators leave traces - check if the attacker's address has sent the same dust pattern to thousands of other wallets (it usually has - map the full poisoning campaign)

## 3.5 Scam Tokens, Fake Airdrops, Rug Pulls & Honeypots

Four related attack types that exploit **token trust assumptions, DEX mechanics, and UI design** to extract value without ever needing to compromise the victim's wallet:

- **Scam Tokens** - ERC-20 tokens with names mimicking real assets (e.g., `ETH2.0`, `UNI-Reward`, `USDTDrop`), distributed via airdrop/dusting. Either worthless bait or contain malicious approval logic triggered via DEX interaction
- **Fake Airdrops** - scam tokens with phishing URLs embedded in the token name or transfer memo (e.g., `"Claim your $500 Airdrop at airdrop-claim[.]xyz"`). Goal: redirect victim to phishing site where they sign malicious approval or enter seed phrase
- **Rug Pulls** - seemingly legitimate token/project suddenly removes all liquidity or disables key functions after attracting investors. Preceded by influencer shills, bot-generated volume, Telegram hype. Especially common with memecoins and fast-moving DEX launches
- **Honeypots** - smart contracts that allow buying but block or tax selling (50–100% sell tax). Look normal on DEX interfaces; require reading the contract to detect

**Red flags - Scam Tokens/Airdrops:**
- Token appeared in your wallet unprompted - especially if its name contains "reward", "bonus", "airdrop", or mimics a real project
- Token name or transfer memo contains a URL - this is the phishing hook
- Token has no liquidity or swap fails immediately
- Contract address is unverified (no source code on Etherscan/BscScan)

**Red flags - Rug Pulls:**
- No locked liquidity - use TokenSniffer, Mudra, or DexTools to verify LP lock
- Anonymous devs with no traceable prior projects
- Sudden rapid price action with no fundamentals
- Contract owner retains control over critical functions (pause trading, change tax rate, mint new tokens)
- Ownership not renounced

**Red flags - Honeypots:**
- Token can be bought but not sold - test with a tiny amount first
- High or hidden sell taxes (70–100%) - check tokenomics before committing
- Perfect green chart with zero red candles and constant buying = likely fake volume or honeypot trap
- Contract source code unverified on chain explorer

**Prevention:**
- Never interact with unknown tokens in your wallet - do not try to swap, approve, or transfer them
- Use token safety tools **before** buying: TokenSniffer (`tokensniffer.com`), Honeypot.is (`honeypot.is`), RugDoc, CheckMate
  > Instruction: `Go to honeypot.is → enter the contract address → it simulates a buy and sell → if sell fails or shows >10% tax, it's a trap.`
- Hide suspicious airdrops in your wallet to avoid accidental interaction
- Use reputable aggregators (1inch, CowSwap, Matcha) - they apply filters blocking tokens with known malicious logic
- Always test with a small amount before committing real funds

**On-chain investigation pivots:**
- Trace sudden LP removal: find the LP contract's `removeLiquidity` or `burn` events
- Trace dev wallet: find the contract deployer → track all their wallet activity and other contract deployments
- Map the coordinated buy-side: many distinct wallets buying in a short window → look for common funding source (CEX withdrawal from one account, funded by same source wallet)
- Fake volume pattern: identify wallets buying and selling the same token within minutes of each other → same entity cycling funds to show activity

## 3.6 Social Engineering / Impersonation
- Fake support agents, VC firms, job offers (often DPRK-linked IT workers)
- DPRK IT workers operate multiple fake identities across platforms; reuse code styles and GitHub handles across campaigns - these repos are traceable via OSINT
- Malicious file downloads (PDF, "NDA", job assessment) deploy malware to extract private keys
- Victim signs transaction under false pretense (e.g., Bybit: spoofed Safe UI)
- $340M+ stolen from Coinbase users alone via social engineering (2024)

## 3.6b Crypto Blackmail & Extortion

Unlike phishing or wallet drainers, these attacks rely on **emotional manipulation, psychological pressure, and social leverage** - not technical deception. Two modes: bulk automated campaigns (sent to thousands, low effort) and targeted campaigns (aimed at public figures, NFT collectors, visible on-chain whales).

**Crypto extortion is escalating globally and increasingly involves physical violence:** French authorities have documented kidnappings of crypto executives and their family members, with ransom demands up to €10M (Ledger co-founder David Balland, kidnapped Jan 2025; Paymium CEO's family, targeted May 2025). New York: crypto investor tortured to gain wallet access (May 2025). London: U.S. tourist drugged and robbed of $123K in crypto via fake Uber (May 2025). Digital extortion enables physical targeting - **radical blockchain transparency becomes a weapon when personal privacy is neglected**.

**How it works:**
1. Attacker collects real or fabricated personal data: data breaches, blockchain analytics (Etherscan/Arkham to link wallet to identity), leaked email/password pairs, doxxed ENS names, social media profiles, GitHub commit history
2. Victim receives threatening email, DM, or message with enough personal detail to appear credible (may include a leaked password, a real wallet address, or partial transaction history)
3. Demand is issued: Bitcoin, Monero, or USDT wallet address + deadline. Mass campaigns: $300–$3,000. Targeted: up to millions
4. Some attackers use "proof of life" partial leaks to enforce urgency, or escalate threats with each follow-up

**Red flags:**
- Claim includes a real (but stale) password - sourced from a historical breach, not live access
- Claim of webcam access, browser surveillance, or malware installation with no supporting evidence
- Wallet address provided for payment with a very short deadline
- Message includes your wallet address linked to identity it shouldn't have access to (but actually sourced from OSINT)

**Response protocol (for investigators advising victims):**
1. **Do not pay** - payment confirms vulnerability and often triggers more demands
2. Document everything: screenshot the message, note the wallet address provided
3. Check the provided attacker wallet on Chainabuse and blockchain explorers - it's often already reported by other victims
4. Look up the included password on `haveibeenpwned.com` - usually from a breach years old, not live compromise
5. Report to: local cybercrime unit, FBI IC3 (ic3.gov), **SEAL-ISAC**, Chainabuse

**On-chain investigation if victim has paid:**
- Trace the extortion wallet: look for multiple incoming payments from different victims (convergence pattern)
- Often routes to Bitcoin (Monero untraceable) or USDT on Tron → OTC
- If Bitcoin: use `oxt.me` or `Wallet Explorer` to analyze clustering and CoinJoin usage

## 3.7 Nation-State Actors
- **Lazarus Group (DPRK):** Most prolific - responsible for Ronin, Harmony, Atomic Wallet, WazirX, Bybit, and dozens of others. Signature pattern: Tornado Cash (100 ETH batches) → Bridge → Tron USDT → OTC.
- **Gonjeshke Darande (Predatory Sparrow):** Iranian-linked group that exploited Iranian exchange **Nobitex** as part of a regionally targeted financial disruption. Represents nation-state use of crypto attacks for geopolitical disruption, not just theft.
- Nation-state actors exploit cross-border jurisdictional gaps - enforcement stalls even when on-chain evidence is indisputable, because no unified global legal standard exists.

## 3.8 Challenges in Blockchain Forensics

These are structural constraints that every investigator must understand before starting a case:

- **Cross-border jurisdiction:** Attackers routinely exploit regulatory gaps between countries. Even with clear on-chain evidence, legal action requires a jurisdiction willing and able to act.
- **No unified global standard:** Enforcement capability varies drastically by country. Funds that reach exchanges in low-regulation zones are often unrecoverable through legal channels.
- **Speed asymmetry:** Attackers can bridge, mix, and off-ramp funds in minutes. International legal processes take weeks to months.
- **Pseudonymity wall:** On-chain data proves *what* happened with certainty, but proving *who* did it requires OSINT, exchange cooperation, or law enforcement subpoenas.
- **Investigation cost vs. recovery:** Not every case justifies full pursuit. The investigation must be proportionate to realistic recovery potential.
- **Tooling gaps on niche chains:** Mature chains (Ethereum, Solana) have rich explorer and analytics ecosystems. Newer or obscure chains may require raw log parsing with no visualization support.

## 3.9 Physical Theft & Wrench Attacks

Physical theft **bypasses all digital security** - coercion, violence, or device theft can defeat even the strongest wallet setup. Investigators are increasingly asked to trace on-chain movement post-physical-compromise.

**Wrench attacks** (colloquial: `$5 wrench attack`) - direct coercion to force a victim to transfer funds, reveal seed phrases, or unlock hardware wallets under physical threat. Increasingly organized and targeting individuals with visible on-chain wealth.

**Recent high-profile incidents (2024–2025):**
- **Paris, May 2025:** Crypto CEO's father kidnapped and mutilated; separate attempted abduction of his daughter and grandson
- **France, Jan 2025:** Ledger co-founder David Balland and partner kidnapped; mutilated; €10M ransom demanded
- **New York, May 2025:** Crypto investor allegedly tortured over multiple weeks to force wallet access
- **London, May 2025:** U.S. tourist drugged and robbed of $123K in crypto via a staged fake Uber
- **U.S., 2024:** Crime ring conducted coordinated home invasions across four states; $260M+ stolen

**Attack methods:**
- **On-chain profiling as targeting step:** Attackers use Etherscan, Arkham, and social media to identify high-value holders. ENS names, public NFT collections, conference talks, on-chain transaction sizes all serve as target identifiers
- **Home invasion / office raid:** Armed entry, victim forced to reveal seed phrase or unlock devices. May involve advance surveillance or insider information about cold wallet storage locations
- **Device theft:** Laptops, phones, hardware wallets stolen during travel. Attacker attempts access before victim can trigger remote wipe
- **Kidnapping for ransom:** Multiple global cases particularly in Europe and Latin America - victim forced to initiate large transfers
- **Social engineering as setup:** Fake business meetings, Airbnb meetups used to gain physical proximity before the attack

**On-chain investigator's role after physical theft:**
- Identify the receiving wallet addresses the victim was forced to transfer to
- Begin standard fund tracing (Phases 3–5) - even forced transfers leave the same on-chain trail
- Check if receiving address is new (created for this incident) or part of a known criminal cluster
- Physical theft cases often route to Bitcoin or Monero for cash-out - apply Bitcoin UTXO clustering techniques
- Coordinate with law enforcement; physical violence cases usually have a parallel criminal investigation

**Prevention guidance (for advising clients):**
- Never publicly display wallet holdings or large trades on social media - even ENS names and NFT profiles create targeting surface
- Use multisig or time-locked withdrawal setups - makes instant forced transfers much harder under duress
- Keep primary holdings in hardware wallets stored in undisclosed, separate locations - not on portable devices or in predictable home locations
- Split holdings across multiple wallets with limited balances - contain damage if one is compromised under pressure
- Use a "duress wallet" - a low-balance wallet you can hand over without exposing primary holdings
- Avoid predictable routines when accessing high-value wallets; vary locations, times, devices
- Train household members never to reveal passwords or seed phrases even under threat
- Traveling with crypto gear: use dummy laptops, burner devices, avoid opening wallet apps in public

## references/tool-reference.md

# Tool Reference (Free-First)

## 9.1 Block Explorers (Always Free)
- **Etherscan** (etherscan.io) - Ethereum: txs, internal txs, token approvals, contract reads
- **Solscan** (solscan.io) - Solana
- **BSCScan** (bscscan.com) - BNB Chain
- **Tronscan** (tronscan.org) - Tron (critical for USDT OTC tracking)
- **Snowtrace** (snowtrace.io) - Avalanche
- **Arbiscan** (arbiscan.io) - Arbitrum
- **Polygonscan** (polygonscan.com) - Polygon
- **Mempool.space** - Bitcoin
- **Wormholescan** (wormholescan.io) - Wormhole bridge
- **THORChain explorer** (thorchain.net) - THORChain swaps

## 9.2 Visual Tracing & Graph Tools (Free Tier Available)
- **Breadcrumbs** (breadcrumbs.app) - visual graph tracing, address labeling, export
- **MetaSleuth** (metasleuth.io) - auto fund flow maps, cross-chain
- **Arkham Intelligence** (arkhamintelligence.com) - entity attribution, real-time balances, alerts
- **DeBank** (debank.com) - portfolio view, approval history across EVM chains
- **Nansen** (nansen.ai) - whale movement monitoring, bridge outflow tracking, protocol-specific wallet surveillance; especially useful for detecting large-scale coordinated movements in real time

## 9.3 Smart Contract Decoding (Free)
- **Phalcon** (phalcon.xyz) - decoded DeFi transaction traces
- **Tenderly** (tenderly.co) - transaction simulation, full call stack, free tier

## 9.4 Analytics & Querying (Free)
- **Dune Analytics** (dune.com) - SQL queries on blockchain data, community dashboards
- **Flipside Crypto** (flipsidecrypto.xyz) - multi-chain SQL analytics
- **OXT.me** (oxt.me) - Bitcoin-specific transaction graph and CoinJoin cluster analysis
- **Wallet Explorer** (walletexplorer.com) - Bitcoin CoinJoin and clustering analysis

## 9.4a Curated Tools Reference Sheet
The author (@somaxbt) maintains a comprehensive tools sheet organized by use case (explorers, attribution, visualization, monitoring, compliance):
> `sheets.fileverse.io/0xD3edEFbfe7934c685Ef182A38a91cB70fABE45c7/2`
> Start with the free tools column - build foundational skills before moving to commercial platforms.

## 9.5 OSINT Tools (Free)
- **urlscan.io** - scan URLs, find embedded wallet addresses, infrastructure mapping
- **crt.sh** - SSL certificate search, find related domains
- **web.archive.org** - capture and retrieve archived web pages
- **SecurityTrails** (free tier) - DNS history, subdomain search
- **Have I Been Pwned** (haveibeenpwned.com) - email breach check
- **WHOIS** (who.is) - domain registration details
- **Chainabuse** (chainabuse.com) - crowdsourced scam address reports
- **ScamSniffer** (scamsniffer.io) - phishing and drainer database
- **sanctioned.us** - fast OFAC SDN search by address

## 9.6 Revoke / Approval Management & Victim-Facing Protection

**Approval revocation (for victim support):**
- **Revoke.cash** - view and revoke all token approvals by address
- **Etherscan Token Approval Checker** - built into Etherscan, free

**Browser extensions for transaction safety (recommend to victims and for investigator's own monitored wallets):**
- **Wallet Guard** (`walletguard.app`) - detects malicious contracts, flags suspicious approvals, and blocks known phishing domains before you sign. Supports EVM chains.
  > Instruction: `Install from the Chrome Web Store → it automatically intercepts wallet connection requests and displays a risk assessment. When a transaction requests token approval, it shows what the contract can access before you confirm.`
- **Pocket Universe** (`pocketuniverse.app`) - simulates transactions and shows you exactly what will change in your wallet before you sign. Catches approvals disguised as benign actions.
  > Instruction: `Install from Chrome Web Store → any time you sign a transaction in MetaMask or other injected wallets, Pocket Universe shows a preview of token movements. If it shows unexpected token outflows or unlimited approvals, reject the transaction.`
- **Scam Sniffer** (`scamsniffer.io`) - real-time phishing domain detection; warns when you navigate to a known drainer site

## 9.7 Paid Tools (Acknowledge, Don't Require)
These are powerful, worth recommending for institutional or large-scale investigations:
- **Chainalysis Reactor** - industry standard for law enforcement
- **TRM Forensics / TRM Phoenix** - advanced tracing, automated chain-hop analysis
- **Crystal Intelligence** - UTXO + EVM tracing with compliance reporting
- **Elliptic Investigator** - graph analysis, AML scoring
- **Arkham Pro** - advanced entity attribution, premium alerts
- **Dehashed** - breach data cross-search
- **DomainTools** - advanced DNS infrastructure pivoting

## 9.8 Community Intelligence Sources (Always Check First)
- **ZachXBT** (@zachxbt on X, Telegram: t.me/investigations) - highest-quality public attribution work
- **Tayvano** (@tayvano_ on X) - advanced wallet security and drainer tracking
- **PeckShield** (@PeckShieldAlert) - real-time exploit alerts
- **Cyvers** (@CyversAlerts) - DeFi anomaly detection
- **SlowMist / MistTrack** (@MistTrack_io) - AML and incident reporting
- **SEAL-ISAC** - dual role: (1) structured threat intelligence sharing network for vetted security professionals (apply for access at seal.org); (2) public reporting and aggregation platform for crypto-native security incidents, extortion threats, and scam address databases. Check it for address lookups alongside Chainabuse and ScamSniffer. Report extortion/blackmail campaigns here.

## 9.9 Terminology Reference
- **Elliptic Glossary** (`elliptic.co/learning-resources#glossary`) - authoritative reference for blockchain investigation terminology: mixing, clustering, heuristics, AML terms, privacy protocol mechanics. Use when encountering unfamiliar terms in reports or evidence.