← ClaudeAtlas

follow-the-cryptolisted

Trace cryptocurrency addresses and transactions on public blockchains using block explorers including Etherscan, Blockchair, mempool.space and Blockscout. Covers common-input clustering, ENS resolution, exchange deposit addresses, mixers, CoinJoin, Tornado-style pools, cross-chain bridges, and OFAC sanctions screening. Use when following a Bitcoin or Ethereum wallet, investigating where a ransom or scam payment went, or checking an address against sanctions listings. Applies to ransomware incident response, AML and sanctions compliance, fraud recovery and asset tracing, and financial-crime investigation. Reference at useosint.com/skills/follow-the-crypto.
useosint/osint-skills · ★ 16 · AI & Automation · score 78
Install: claude install-skill useosint/osint-skills
# Follow the Crypto Public chains are pseudonymous, not anonymous. Every transfer is permanently visible to anyone; what's missing is the mapping from address to human. So the whole game is attribution, and attribution almost always happens at an off-ramp — the point where value converts to fiat through a service that collected identity documents. Everything between the crime and the off-ramp is just plumbing you have to follow. The beginner error is treating a clustering heuristic's output as fact. "These addresses belong to the same entity" is a probabilistic inference with known failure modes, and commercial attribution labels are proprietary guesses you cannot audit. Trace confidently; attribute carefully. ## Triage: what are you holding? | You have | Start with | Why | |---|---|---| | An address string | Identify the chain from its shape, then a block explorer | Format alone usually determines chain and script type — see the [address-format table](reference/address-formats.md) | | A transaction hash | Explorer's transaction view | Gives you both sides, the fee, the block time, and any contract calls | | An ENS or naming-service name | Resolve to an address, then check the *reverse* record | Forward resolution is set by the name owner; reverse is set by the address owner and is the stronger claim | | A `0x…` address | Check the same address on every major EVM chain | One private key, one address, many chains. Activity on a chain the subject thought nobody looked at is