follow-the-crypto

Trace cryptocurrency addresses and transactions across public blockchains using block explorers.

38|2|Updated Aug 2, 2026
One-click install
npx skills add https://github.com/UseOSINT/Skills --skill follow-the-crypto-useosint
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: follow-the-crypto
Source: https://github.com/UseOSINT/Skills/tree/main/skills/follow-the-crypto
Command: npx skills add https://github.com/UseOSINT/Skills --skill follow-the-crypto-useosint

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Following money on public blockchains is hard because addresses are pseudonymous, clustering heuristics are probabilistic, and mixers, bridges, and privacy coins break naive tracing. This Skill provides the tradecraft to trace funds correctly, grade findings by confidence, and avoid the attribution errors that produce false accusations. ## Core Features & Use Cases - Address and Transaction Triage: Identify chain and address type from the string format, then read explorers properly including internal transactions, token transfers, and contract bytecode. - Clustering and Flow Analysis: Apply common-input ownership and change-address heuristics with explicit knowledge of their failure modes, and recognize CoinJoin, Tornado-style pools, bridges, and peel chains. - Off-Ramp Identification and Sanctions Screening: Detect exchange deposit structures where KYC records exist, and check addresses against OFAC and other sanctions lists before any interaction. - Use Case: A victim reports paying a ransom to a bc1q address. Trace the payment through a twelve-address cluster to an exchange deposit address, grade each finding as confirmed, probable, or unconfirmed, and hand counsel the deposit address, amount, and block height for legal process. ## Quick Start Trace the Bitcoin address bc1q... from this ransom demand and tell me where the funds went, with each finding graded by confidence.

Frequently Asked Questions about follow-the-crypto

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I trace a Bitcoin transaction to its destination?▼

Open the transaction in an explorer like mempool.space, then follow the outputs forward applying common-input ownership clustering to group addresses under one controller. Continue until funds reach an exchange deposit address, which is identifiable by its sweep pattern into a consolidated hot wallet.

How do I identify which blockchain an address belongs to?▼

Read the string format: Bitcoin addresses start with 1, 3, bc1q, or bc1p, while Ethereum and EVM chains use 0x plus 40 hex characters with an EIP-55 checksum. The same 0x address exists on every EVM chain, so check activity across all of them.

Can cryptocurrency transactions be traced through mixers like Tornado Cash?▼

Shielded pools break the deposit-withdrawal link cryptographically, but metadata leaks survive: small anonymity sets, deposit-withdrawal timing correlation, and gas paid from an address that also funded the deposit. State plainly when a trail ends rather than implying certainty.

What is common-input ownership clustering in blockchain analysis?▼

When a UTXO transaction spends multiple inputs, the sender had to hold keys for all of them, so those addresses share a controller. It is the strongest clustering heuristic, but fails on CoinJoin transactions where inputs deliberately belong to different people.

Why is blockchain attribution to a person unreliable?▼

On-chain data proves transactions between addresses, never the identity of the human behind them. Attribution becomes confirmed only through off-chain records like exchange KYC obtained by legal process, court filings, or signed messages, and vendor labels are unauditable proprietary claims.

How do I check a crypto address against OFAC sanctions lists?▼

Use OFAC Sanctions List Search, which carries digital currency addresses as explicit entries under designated persons, and check the current list since designations change. Never send a test transaction to a subject address, as transacting with a designated address can be a strict-liability violation.