DolphinStronghold9/stolen-crypto-tracer

Wake is a free Windows desktop app that follows stolen crypto from a pasted wallet address or transaction hash, hop by hop, and drafts a theft report intended for police and exchange compliance teams. It is aimed at individual victims and small cases rather than professional forensics teams.

What it actually does

You paste a transaction hash or address, press "Follow the money," and Wake reads every transfer out of that address, continuing until the funds stop or land at a named endpoint. It covers Bitcoin, Ethereum and other EVM chains, TRON, BNB Chain and Solana, and follows funds that cross bridges or swaps onto another chain project README. Each endpoint gets a label such as exchange deposit, bridge, mixer, OFAC-sanctioned or reported scam, and each label displays its source and a high/medium/low confidence rather than presenting itself as certain. A one-click report lists the victim's addresses, every transaction hash with UTC time, chain, asset and amount, and the hop-by-hop path to the labelled deposit address project README.

The practical output is the report: the project is explicit that it cannot recover funds, and that exchanges and stablecoin issuers freeze money only when police request it. Wake also checks suspected "recovery agents" for red flags and repeats the rule never to pay a fee for recovery project README.

Requirements and data sources

There is a ready-made Windows 10/11 portable zip that needs no admin rights or account; free Etherscan and TronGrid API keys are optional and only raise rate limits project README. Building from source instead requires Rust 1.85 or newer plus the Tauri desktop prerequisites, so the source path is a developer route, not the consumer one project README.

Tracing draws on public blockchain APIs and public pages: mempool.space for Bitcoin, Etherscan V2 or Blockscout for EVM chains, TronGrid for TRON, a public RPC for Solana, OFAC sanctions lists, Chainabuse scam reports, open label datasets plus the project's own labels, and ENS for names project README.

Constraints to weigh

Labels and deposit-address attribution can be wrong, which is why confidence is shown; treat results as leads, not proof. The project asks users to use public data only, warns that under GDPR an address can become personal data once linked to a person, and advises keeping cases local and small and attributing to services rather than naming private individuals project README. Cases, reports and API keys stay on the PC with no telemetry project README. Speed matters: funds sitting at an exchange may move within hours, so the report is a starting point for a police freeze request, not a guarantee.

MIT licensed, with no affiliation to any exchange or data provider, and not legal advice project README.