₿ Cryptocurrency Intelligence (CRYPTINT)
Tracing Value on Public Ledgers
Financial
Sources
21
19 no-auth
Mission domains
5
reach
Data points
4
covered
Related INT
2
disciplines
🔌 Sources for Cryptocurrency Intelligence (21)
| Source | Category | Auth | Format | |
|---|---|---|---|---|
| Arkham Intelligence Entity attribution & flow analysis. | Crypto Attribution | NONE | html | home↗ api↗ |
| Blockchair API Multi-chain explorer & analytics API. | Blockchain Explorer | NONE | json | home↗ api↗ |
| Blockstream Esplora Bitcoin explorer REST API. | Blockchain Explorer | NONE | json | home↗ api↗ |
| Breadcrumbs Free visual crypto tracing. | Crypto Investigation | NONE | html | home↗ api↗ |
| Chainabuse Community scam/abuse address reporting (TRM). | Crypto Fraud | NONE | html | home↗ api↗ |
| Chainabuse reports Community scam/abuse address reporting (TRM Labs). | Crypto Fraud | NONE | html | home↗ api↗ |
| CryptoScamDB Known scam/phishing crypto addresses & domains. | Crypto Fraud | NONE | json | home↗ api↗ |
| CryptoScamDB addresses Known scam / phishing crypto addresses. | Crypto Fraud | NONE | json | home↗ api↗ |
| GraphSense TagPacks Open attribution tags for blockchain addresses. | Crypto Attribution | NONE | text | home↗ api↗ |
| mempool.space API Bitcoin transaction/address analytics API. | Blockchain Explorer | NONE | json | home↗ api↗ |
| MetaMask eth-phishing-detect Community crypto-phishing domain blocklist (100k+ domains). | Crypto Phishing | NONE | json | home↗ api↗ |
| MetaSleuth (Blocksec) Fund-flow tracing & labelling. | Crypto Investigation | NONE | html | home↗ api↗ |
| MistTrack AML risk scoring & tracing (SlowMist). | Crypto Investigation | NONE | html | home↗ api↗ |
| OFAC Sanctioned Crypto Addresses (0xB10C) Machine-readable OFAC-designated wallet lists per chain. | Crypto Sanctions | NONE | text | home↗ api↗ |
| OXT / WalletExplorer Bitcoin wallet clustering & attribution. | Crypto Attribution | NONE | html | home↗ api↗ |
| Ransomwhere export Crowd-sourced ransomware payment wallets + family attribution. | Ransom Payments | NONE | json | home↗ api↗ |
| Ransomwhere payments Crowdsourced ransomware payment address tracking. | Ransom Payments | NONE | json | home↗ api↗ |
| ScamSniffer scam addresses Community-reported scam wallet addresses. | Crypto Fraud | NONE | json | home↗ api↗ |
| ScamSniffer scam domains Community crypto scam / drainer domains. | Crypto Phishing | NONE | json | home↗ api↗ |
| BitcoinAbuse / Chainabuse Reported abusive BTC addresses (extortion, ransom). | Crypto Fraud | KEY | csv | home↗ api↗ |
| Etherscan API Ethereum explorer + address labels. | Blockchain Explorer | KEY | json | home↗ api↗ |
🎯 Mission Domains served
🔍 Lookup
📊 Pre-built Queries · Cryptocurrency Intelligence
🔄 Live Datasets & APIs (12 key-free · ingestible)
📜 Playbook — Cryptocurrency Intelligence collection
- Direction — frame the requirement for Cryptocurrency Intelligence: what decision does this support, by when?
- Collection — collect from the 21 mapped sources (19 free) — filter the catalog by CRYPTINT; capture provenance and observe OPSEC.
- Processing — normalize, de-duplicate and enrich the collected data.
- Analysis — correlate against local holdings; apply ACH; assign confidence.
- Dissemination — open a case, draft a report, share via STIX/MISP.
- Feedback — set an alert rule / watchlist to monitor for change.
⚡ AI Skills & Automation
Automate unattended via the cron pipeline (collect → ingest → resolve → enrich → score → alert).
🧩 Advanced Capabilities
🔗 Pivot to related disciplines
✨ Enrichment pathways
🎯 Mission
Cryptocurrency Intelligence collects on-chain transaction data, wallet-cluster behavior, and exchange fund-flows across public blockchains to trace the movement and control of digital assets. It answers who controls a given address, where illicit proceeds are laundered or cashed out, and which services and counterparties sit behind a transaction graph.
📡 Collection methods
- Address clustering via common-input-ownership (co-spend) heuristic
- Change-address identification and peel-chain tracing
- Exchange deposit-address attribution and hot-wallet fingerprinting
- Mempool and unconfirmed-transaction monitoring for timing intelligence
- Cross-chain bridge and wrapped-asset flow tracing
- Mixer/tumbler (CoinJoin, Tornado Cash) demixing and subset-sum analysis
- Dusting-attack and tainted-UTXO propagation analysis
📚 Key sources & datasets
🎫 Data points produced
🔧 Tools & frameworks
- Chainalysis-free/Breadcrumbs
- GraphSense
- Maltego (blockchain transforms)
- Etherscan
- BlockSci
- OXT
- Arkham Intelligence
- Crystal Expert (free tier)
📜 Cryptocurrency Intelligence Tradecraft
- Collect target addresses and pull full transaction history from block explorers and node RPCs
- Normalize UTXOs and apply co-spend and change heuristics to build wallet clusters
- Trace fund-flows forward to deposit addresses and backward to funding sources, flagging mixers and bridges
- Attribute clusters to real services using tagged datasets, exchange fingerprints, and OFAC address matches
- Package the transaction graph, entity attributions, and cash-out points into a traceable evidence report
- Push confirmed illicit addresses to the IOC workbench and file exchange-freeze/report referrals
📊 Dashboard KPIs
Addresses clusteredUSD volume tracedCash-out points identifiedSanctioned-address hitsMixer-demix success rate
🔍 Pre-built queries
🔗 Cross-discipline pivots
🧩 Advanced Capabilities
Workstation · Copilot · AI Skills · Automation · Playbooks · Lookups · Docs · Reports
🤖 AI Copilot
⚡ AI Skills
🔍 Lookup & Enrich
📚 Docs & Reports
💡 Recommendations
- Explore related tools below
- Automate recurring work via cron