<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: analyzing-cryptocurrency-forensics
description: >-
  Cryptocurrency forensic analysis covering blockchain transaction tracing,
  wallet identification, exchange attribution, mixer/tumbler detection,
  and fund flow visualization. Uses Chainalysis-style clustering techniques,
  open-source blockchain explorers, and Python libraries for Bitcoin,
  Ethereum, and Monero investigation workflows.
domain: cybersecurity
subdomain: digital-forensics
tags:
  - cryptocurrency-forensics
  - blockchain-analysis
  - bitcoin
  - ethereum
  - wallet-tracing
  - transaction-analysis
  - mixer-detection
  - ransomware-payments
  - defi-forensics
  - fund-flow
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1657", "T1048"]
  nist-csf: ["RS.AN-1", "RS.AN-3"]
  frameworks: ["NIST SP 800-86", "FATF Virtual Assets Guidance"]
---

# Analyzing Cryptocurrency Forensics

## Overview

Cryptocurrency forensics traces the movement of digital assets across
blockchain networks to identify fund flows related to ransomware payments,
money laundering, fraud, and sanctions evasion. This skill covers
transaction graph analysis, address clustering, exchange identification,
and mixer/tumbler detection using open-source tools and blockchain APIs.

## Prerequisites

- Python 3.10+ with `web3`, `bitcoin-lib`, `blockcypher`
- Access to blockchain APIs (Blockstream, Etherscan, Blockchain.info)
- `jq`, `curl` for API queries
- Graph visualization: `networkx`, `graphviz`

```bash
pip install web3 python-bitcoinlib blockcypher networkx graphviz
```

## Key Concepts

### Blockchain Evidence Types

| Evidence | Source | Forensic Value |
|----------|--------|----------------|
| Transaction graph | Blockchain ledger | Fund flow, timing analysis |
| Address clusters | Common-input heuristic | Entity identification |
| Exchange deposits | Known addresses | Cash-out attribution |
| Smart contract calls | Ethereum/BSC | DeFi interaction history |
| Token transfers | ERC-20/BEP-20 | Asset movement tracking |
| ENS/Unstoppable domains | Name registries | Identity linkage |

### Common Heuristics

| Heuristic | Description |
|-----------|-------------|
| Common Input Ownership | Inputs in same tx belong to same entity |
| Change Address Detection | Unspent output returning to sender |
| Peeling Chain | Repeated small outputs = mixer behavior |
| Round Amount Detection | Round BTC amounts suggest human interaction |
| Time Analysis | Transaction timing reveals timezone/patterns |

## Workflow

### Step 1: Bitcoin Address Investigation

```bash
# Query address details via Blockstream API
curl -s "https://blockstream.info/api/address/bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh" | jq .

# Get transaction list
curl -s "https://blockstream.info/api/address/bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh/txs" | \
  jq '.[].txid'

# Get address balance
curl -s "https://blockstream.info/api/address/bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh" | \
  jq '{funded: .chain_stats.funded_txo_sum, spent: .chain_stats.spent_txo_sum,
       balance: (.chain_stats.funded_txo_sum - .chain_stats.spent_txo_sum)}'

# Transaction details
curl -s "https://blockstream.info/api/tx/TXID" | \
  jq '{inputs: [.vin[].prevout.scriptpubkey_address],
       outputs: [.vout[] | {address: .scriptpubkey_address, value: .value}]}'
```

### Step 2: Ethereum Address Analysis

```bash
# Query via Etherscan API (requires API key)
curl -s "https://api.etherscan.io/api?module=account&action=balance&address=0xADDRESS&apikey=KEY" | jq .

# Get transaction list
curl -s "https://api.etherscan.io/api?module=account&action=txlist&address=0xADDRESS&startblock=0&endblock=99999999&sort=desc&apikey=KEY" | \
  jq '.result[:10]'

# ERC-20 token transfers
curl -s "https://api.etherscan.io/api?module=account&action=tokentx&address=0xADDRESS&apikey=KEY" | \
  jq '.result[:10] | .[] | {token: .tokenName, from: .from, to: .to, value: .value}'

# Web3.py investigation
python3 -c "
from web3 import Web3
w3 = Web3(Web3.HTTPProvider('https://mainnet.infura.io/v3/YOUR_KEY'))
balance = w3.eth.get_balance('0xADDRESS')
print(f'Balance: {w3.from_wei(balance, \"ether\")} ETH')
tx_count = w3.eth.get_transaction_count('0xADDRESS')
print(f'Transaction count: {tx_count}')
"
```

### Step 3: Transaction Graph Analysis

```python
#!/usr/bin/env python3
"""Build transaction flow graph for address cluster analysis."""
import json
import urllib.request

import networkx as nx


def build_tx_graph(address: str, depth: int = 2) -> nx.DiGraph:
    """Build directed graph of Bitcoin transaction flows."""
    g = nx.DiGraph()
    visited: set[str] = set()
    queue = [(address, 0)]

    while queue:
        addr, level = queue.pop(0)
        if addr in visited or level >= depth:
            continue
        visited.add(addr)

        url = f"https://blockstream.info/api/address/{addr}/txs"
        with urllib.request.urlopen(url) as resp:
            txs = json.loads(resp.read())

        for tx in txs[:10]:
            for vin in tx.get("vin", []):
                src = vin.get("prevout", {}).get("scriptpubkey_address", "")
                if src:
                    g.add_edge(src, addr, txid=tx["txid"])
            for vout in tx.get("vout", []):
                dst = vout.get("scriptpubkey_address", "")
                if dst:
                    g.add_edge(addr, dst, txid=tx["txid"],
                               value=vout["value"])
                    if level + 1 < depth:
                        queue.append((dst, level + 1))

    return g
```

### Step 4: Mixer / Tumbler Detection

```bash
# Indicators of mixing services:
# - Many equal-value outputs (CoinJoin)
# - Peeling chains (sequential small outputs)
# - Known mixer addresses (Wasabi, Tornado Cash)

# Check for CoinJoin patterns
python3 -c "
import json, urllib.request
tx_url = 'https://blockstream.info/api/tx/TXID'
with urllib.request.urlopen(tx_url) as resp:
    tx = json.loads(resp.read())

# CoinJoin indicator: multiple equal-value outputs
values = [vout['value'] for vout in tx['vout']]
from collections import Counter
counts = Counter(values)
equal_outputs = {v: c for v, c in counts.items() if c > 1}
if equal_outputs:
    print(f'Possible CoinJoin — equal outputs: {equal_outputs}')
else:
    print('No CoinJoin pattern detected')
"
```

## Detection

```yaml
title: Cryptocurrency Forensics Detection
id: ac4baf56-ca34-4b2b-93d5-a133bd9ede5c
status: experimental
description: Detects suspicious activity related to analyzing cryptocurrency forensics techniques in digital forensics context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*analyzing*cryptocurrency*"
  condition: selection
level: medium
tags:
  - attack.t1657
  - attack.t1048
  - attack.collection
falsepositives:
  - Forensic investigation tools used by authorized incident response team
```

## Verification

- [ ] Target addresses identified and documented
- [ ] Transaction history fully retrieved
- [ ] Address clustering applied (common-input heuristic)
- [ ] Exchange/service attributions recorded
- [ ] Mixer/tumbler activity detected and documented
- [ ] Fund flow graph generated and visualized
- [ ] All findings timestamped and reproducible

## References

- [Blockstream API](https://github.com/Blockstream/esplora/blob/master/API.md)
- [Etherscan API](https://docs.etherscan.io/)
- [FATF Virtual Assets Guidance](https://www.fatf-gafi.org/en/publications/Fatfrecommendations/Guidance-rba-virtual-assets-2021.html)
- [OXT.me — Bitcoin Transaction Analysis](https://oxt.me/)
- [Chainalysis Reactor (Commercial)](https://www.chainalysis.com/)
- [Web3.py Documentation](https://web3py.readthedocs.io/)
