playbooks / crypto-wallet

Crypto wallet → attribution

Trace a wallet's funds, identify which exchanges or services it touches, and look for anyone who has posted the address publicly.

start: ₿ cryptoyields: company, url, keyword, username, domainlevel: advanced

1. 01

   Identify the chain and pull the history

   The address format tells you the chain: bc1/1/3 is Bitcoin, 0x is EVM (Ethereum and its L2s), T is Tron. Record the first and last activity, the balance, and the largest counterparties.

   • Blockchairfreemiumapidetails
   • mempool.spacefreeossapidetails
   • Etherscanfreemiumacct optionalapidetails
   • Tronscanfreeapidetails
   • Solscanfreemiumacct optionalapidetails

   → can yield: ₿Crypto

2. 02

   Attribution labels

   Attribution platforms label clusters belonging to exchanges, mixers, scams and known entities. A deposit into an exchange is the classic point where legal process can reveal identity.

   • Arkham Intelligencefreemiumacct reqapidetails
   • WalletExplorerfreedetails
   • Breadcrumbsfreemiumacct reqdetails

   → can yield: ▤Company ₿Crypto

3. 03

   Abuse reports and sanctions

   Check whether the address has been reported in scams, or is on a sanctions list (OFAC lists crypto addresses directly).

   • Chainabusefreeacct optionaldetails
   • OFAC Sanctions List Searchfreedatasetdetails
   • BitcoinWhosWhofreemiumacct optionalapidetails

   → can yield: ⇗URL #Keyword

4. 04

   Search the open web for the address

   People paste their own addresses into donation pages, forum signatures, GitHub repos and social bios. A literal search can connect a pseudonymous wallet to a username.

   • Google Advanced Searchresource
   • grep.appfreedetails
   • Bingresource

   → can yield: @Username ⇗URL ◎Domain