follow-the-crypto

Follow the Crypto is an OSINT investigation skill for tracing cryptocurrency addresses and transactions across public blockchains using block explorers such as Etherscan, Blockchair, mempool.space, and Blockscout. Its premise is that public chains are pseudonymous rather than anonymous: every transfer is permanently visible, and the investigative task is attribution, which usually resolves at an off-ramp where value converts to fiat through an identity-collecting service. It emphasizes tracing confidently but attributing carefully, warning against treating clustering-heuristic output or proprietary vendor labels as fact.

The skill provides a triage table for what to do given an address, transaction hash, ENS name, screenshot, or a ransom/scam payment demand, and a method for establishing the chain and address type, reading an explorer properly (first/last-seen, received versus balance, counterparties, contract bytecode), choosing the correct mental model for UTXO versus account-model chains, and applying clustering heuristics like common-input ownership and change-address identification with an honest account of their reliability. Reference files catalogue explorers and tooling by chain and job (block explorers, multi-chain explorers, clustering and flow analysis, query/analytics platforms, attribution/labelling, abuse and sanctions reporting, node access) and detail address formats. It covers ENS resolution, exchange deposit addresses, mixers, CoinJoin, Tornado-style pools, cross-chain bridges, and OFAC sanctions screening.

It targets fraud investigators, incident responders, AML and sanctions compliance analysts, and asset-recovery and financial-crime professionals. The work is read-only analysis of public blockchain data and public reporting sources, with a strong emphasis on evidentiary rigor, citing which tool produced which label and on what date, and checking current sanctions lists rather than memory.