follow-the-cryptolisted
Install: claude install-skill useosint/osint-skills
# Follow the Crypto
Public chains are pseudonymous, not anonymous. Every transfer is permanently
visible to anyone; what's missing is the mapping from address to human. So the
whole game is attribution, and attribution almost always happens at an
off-ramp — the point where value converts to fiat through a service that
collected identity documents. Everything between the crime and the off-ramp is
just plumbing you have to follow.
The beginner error is treating a clustering heuristic's output as fact. "These
addresses belong to the same entity" is a probabilistic inference with known
failure modes, and commercial attribution labels are proprietary guesses you
cannot audit. Trace confidently; attribute carefully.
## Triage: what are you holding?
| You have | Start with | Why |
|---|---|---|
| An address string | Identify the chain from its shape, then a block explorer | Format alone usually determines chain and script type — see the [address-format table](reference/address-formats.md) |
| A transaction hash | Explorer's transaction view | Gives you both sides, the fee, the block time, and any contract calls |
| An ENS or naming-service name | Resolve to an address, then check the *reverse* record | Forward resolution is set by the name owner; reverse is set by the address owner and is the stronger claim |
| A `0x…` address | Check the same address on every major EVM chain | One private key, one address, many chains. Activity on a chain the subject thought nobody looked at is