Signcluengine/onchain-money-trail-analyzer

Ferret is a free, no-account Windows desktop tool for someone who sent crypto to a fraudster: you paste one address or transaction hash, and it follows the flow hop by hop, labels where the funds ended up, and generates an evidence report. It reads public blockchain data; it does not recover funds, and no tool can reverse a chain transfer.

How it works

The tool lays out transfers like a bank statement: UTC time, chain, destination and amount, with the value split and carried across chains. It follows Bitcoin, Ethereum/EVM chains, TRON, BNB Chain and Solana, including swaps and bridges between them. It names the endpoint of each path — an exchange deposit address, mixer, bridge, OFAC-sanctioned address or a previously reported scam address — and shows the source and confidence behind each label, so uncertain pattern-based guesses are visible rather than hidden.

A second function collects public clues about the wallet: ENS names, held NFTs or avatars, addresses on scam-site payment pages, public posts and earlier scam reports. Each clue preserves a saved copy of the source and the capture time, so it outlives a removed scam site.

What you get out of it

One click produces a report with your addresses, every transaction hash with its UTC time, chain, asset and amount, the path to the deposit address, a plain-language summary, and a field for a police reference number. It can be saved as PDF, copied as text or exported as CSV, and the report closes with next steps: report to police (IC3/FTC in the US, Report Fraud in the UK), ask them to request an exchange freeze, and note that USDT issuers also freeze on police request. The README stresses that hours matter because funds at a deposit address can move on.

A separate check lets you paste the site, wallet or handle of a "recovery expert" and see signals such as domain age and scam reports; the tool repeatedly warns that paying a fee to recover crypto is a scam and no firm can reverse a transfer.

Requirements and limits

• Install path: the recommended release is a portable Windows 10/11 zip with Main.exe and the ferret runtime. It is code-signed and needs no installer or admin rights; keep the runtime next to the executable.
• Build path: source builds require Rust 1.85+ and the Tauri prerequisites for your system, with cargo test --workspace and cargo tauri build.
• Data access: no API key is required. Free Etherscan V2 and TronGrid keys only raise rate limits for larger cases; Bitcoin can use mempool.space or a self-hosted instance, and Solana uses a public RPC.
• Privacy: cases stay on the PC and there is no telemetry, but the addresses looked up are sent to the public sources listed in the README. It reads only public data — nothing behind a login, no home addresses or phone numbers — and it names services/entities rather than private people.
• Evidence boundary: labels can be wrong, and confidence is shown partly so you and the police can check them. If a trail ends at a mixer, the README says that is often the end for a free tool; Watch and the police report are the documented continuation. Recovery-scam checks and Watch show later activity but do not themselves prove a suspect's identity.
• Author's framing: the screenshots use fictional exchange names and addresses; the project is MIT licensed but bundles fonts under the SIL Open Font License, and it states no affiliation with named exchanges, data providers or law enforcement.

The intended fit is a victim assembling a documented trail for authorities and an exchange, not an analyst platform substitution or a recovery promise.

HotRepo's take

A NEW-REPOSITORY board observation on 2026-10-31 recorded 111 total stars at #16 in the JavaScript list (not a daily gain), and the supplied board history has no comparable daily observations, so interest trends cannot be judged from it.

Project source and documentation