Skip to content
BranchesTags

Latest commit

 

History

32 Commits

Folders and files

NameName
Last commit message
Last commit date
CONTRIBUTING.md
CONTRIBUTING.md
 
 
LICENSE
LICENSE
 
 
README.md
README.md
 
 

Repository files navigation

🕵️‍♂️ Legendary Crypto x OSINT & Blockchain Investigation Resources

A curated one-pager of blockchain explorers, OSINT tools, APIs, compliance resources, abuse databases, and investigation workflows. For CTI, AML, and forensic investigations.
These come various open source startpages, LinkedIn posts, the legendary (Stay Sharp Legends) Rick Harmsen, myself and more.

📑 Table of Contents

🔗 Blockchain Explorers

🔬 OSINT & Visualization Tools

🛡 Abuse & Scam Databases

📊 APIs & Data Sources

🛡 Compliance, Risk & AML

📚 Learning Resources

🎓 Certifications

🤖 AI Crypto Assistants

🚨 On-Chain Risk & Scam Detection

💼 Specialized Analytic Services

💱 Exchanges & Wallets

  • Exchanges: Coinbase · Kraken · Binance US · Crypto.com · Gemini · Bitstamp · Poloniex · HitBTC · BitMEX · Paxful

  • Wallets: Electrum · Trezor · MetaMask · Wasabi Wallet · ZenGo · Venly · Blockchain.com Wallet · MyEtherWallet

  • Mixers / Tumblers (OSINT-relevant targets): ChipMixer (seized by DOJ/Europol, 2023 — domain now shows an official law-enforcement notice) · Tornado Cash (Ethereum mixer; OFAC-sanctioned Aug 2022, sanctions lifted March 2025 after a Fifth Circuit ruling and the split-verdict Roman Storm trial — the original frontend domain is dead, so don't link it directly; see Merkle Science's write-up for the case history — it remains a major laundering vector to study)

    ⚠️ Note: Samourai Wallet / Whirlpool is intentionally not linked here. Its founders were arrested and the service was seized by the DOJ in April 2024 as part of a $2B money-laundering case. Afterward, the samouraiwallet.com domain was reported to be associated with a phishing/scam clone targeting Bitcoin users — treat any link claiming to be the live service with caution.

  • Sanctioned / Seized Exchanges (OSINT-relevant targets, referenced via case write-ups rather than the (often seized or repurposed) domains themselves):
    Garantex / Grinex (OFAC-sanctioned & seized, March 2025; successor Grinex also sanctioned) · Bitzlato (seized by DOJ, January 2023) · Suex & Chatex (OFAC-sanctioned 2021 for ransomware laundering)

  • Bridges: Squid · DeBridge · MetaMask Bridging

🖼 NFT Resources

🧵 Investigation Workflows

Bitcoin Address

  1. Check Blockstream.info for TX history.
  2. Cluster on WalletExplorer.
  3. Cross-check with Chainabuse (formerly BitcoinAbuse).
  4. Visualize in Breadcrumbs or GraphSense.

Ethereum Address

  1. Lookup on Etherscan.
  2. Verify on Ethtective.
  3. Trace ERC-20 activity via Tokenview.
  4. Visualize in Breadcrumbs.

ENS (.eth) Domain

  1. Look up the domain on ENS Domains.
  2. Identify the linked Ethereum 0x address at the top.
  3. Check if the ENS name appears in transaction history on Etherscan.
  4. Cross-check connected accounts (e.g., Lens Protocol, social links, GitHub, Twitter).
  5. Review NFT activity on OpenSea, LooksRare, or other NFT marketplaces.
  6. Expand to other chains/platforms using the same ENS name (multi-chain investigation).
  7. Visualize relationships with tools like Breadcrumbs or GraphSense.

Scam/Abuse Check

Lightning Network Payment Check

  1. Decode and inspect invoices with Amboss.
  2. Map channels with Amboss.
  3. Cross-check node IDs against OSINT sources (GitHub, Twitter, Reddit).

NFT Wallet Profiling

  1. Review activity on Dune, Nansen, or DeBank.
  2. Check NFT metadata for IPFS/Arweave links (OSINT expansion).

About

A resource full of Crypto/OSINT tools, techniques and training courses for CTI, AML, and forensic investigations.

Topics

amlcddcryptocurrencyinvestigationskycosint

Resources

Readme
CC0-1.0 license

Contributing

Contributing
Activity

Stars

164 stars

Watchers

2 watching

Forks

19 forks
Report repository

Releases

Packages

Contributors