区块链与加密货币取证深度分析

Transaction ID: 8a4e2c6b...f9d1
├── Input (1)
│   ├── Previous TXID: 3b7f5a12...c8e3
│   ├── Previous VOUT: 0
│   ├── ScriptSig: <signature> <public_key>
│   └── Address: 1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa (Satoshi's address)
├── Output (2)
│   ├── VOUT 0: 0.5 BTC → 1BvBMSEYstWetqTFn5Au4m4GFg7xJaNVN2
│   ├── VOUT 1: 0.4998 BTC → 12cA1zLQmNZPbKMQsYZrFDgXfGHKqXsUNp (找零)
│   └── Fee: 0.0002 BTC

bitcoin-cli getrawtransaction 8a4e2c6bf9d1 true
bitcoin-cli decoderawtransaction <raw_hex>
bitcoin-cli gettxout <txid> <vout>

聚类分析示例：
Transaction: abc123
├── Input 0: Address_A (0.5 BTC)
├── Input 1: Address_B (0.3 BTC)
├── Input 2: Address_C (0.2 BTC)
└── Conclusion: Address_A, Address_B, Address_C → 同一实体 Cluster_1

curl -s "https://blockchain.info/rawaddr/1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa" | python3 -m json.tool | head -50

# 查询闪电网络通道交易特征
# 通道开启：2-of-2 多签输出
# 通道关闭：需要双方签名的结算交易
bitcoin-cli getrawtransaction <channel_close_txid> true

# 使用 Geth trace API 追踪交易内部调用
curl -X POST https://mainnet.infura.io/v3/<PROJECT_ID> \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",
    "method": "debug_traceTransaction",
    "params": ["<txHash>", {"tracer": "callTracer"}],
    "id": 1
  }'

event Transfer(address indexed from, address indexed to, uint256 value);
event Swap(address indexed sender, uint256 amount0In, uint256 amount1In, uint256 amount0Out, uint256 amount1Out, address indexed to);
event Deposit(address indexed dst, uint256 wad);

curl "https://api.etherscan.io/api?module=logs&action=getLogs\
&address=0xUniswapV2Pair\
&fromBlock=12000000&toBlock=12000100\
&topic0=0xddf252ad1be2c89b69c2b068fc378daa952ba7f163c4a11628f55a4df523b3ef\
&apikey=<YOUR_API_KEY>"

# 使用 Foundry 获取合约源码
forge inspect <ContractName> abi

# 使用 Etherscan API 获取合约源码
curl "https://api.etherscan.io/api?module=contract&action=getsourcecode\
&address=<contract_address>&apikey=<YOUR_API_KEY>"

from web3 import Web3

w3 = Web3(Web3.HTTPProvider('https://mainnet.infura.io/v3/<PROJECT_ID>'))

UNISWAP_V2_PAIR = '0xB4e16d0168e52d35CaCD2c6185b44281ec28C9Dc'

Transfer_event = {
    "anonymous": False,
    "inputs": [
        {"indexed": True, "name": "from", "type": "address"},
        {"indexed": True, "name": "to", "type": "address"},
        {"indexed": False, "name": "value", "type": "uint256"}
    ],
    "name": "Transfer",
    "type": "event"
}

event_signature = Web3.keccak(text="Transfer(address,address,uint256)").hex()
logs = w3.eth.get_logs({
    "address": UNISWAP_V2_PAIR,
    "fromBlock": 12000000,
    "toBlock": 12000100,
    "topics": [event_signature]
})

for log in logs:
    from_addr = '0x' + log['topics'][1].hex()[-40:]
    to_addr = '0x' + log['topics'][2].hex()[-40:]
    value = int(log['data'].hex(), 16)
    print(f"Transfer: {from_addr} -> {to_addr} | Value: {value / 10**18:.4f} ETH")

# Electrum 钱包文件提取（Linux）
cp -r ~/.electrum/wallets/ /evidence/electrum_wallets/
cp ~/.electrum/config /evidence/electrum_config.json

# Electrum 钱包文件提取（macOS）
cp -r ~/Library/Application\ Support/Electrum/wallets/ /evidence/electrum_wallets/

# macOS Chrome MetaMask 数据提取
cp -r ~/Library/Application\ Support/Google/Chrome/Default/Local\ Storage/leveldb/ /evidence/metamask_ls/
cp -r ~/Library/Application\ Support/Google/Chrome/Default/IndexedDB/ /evidence/metamask_idb/

{
  "address": "7a250d5630b4cf539739df2c5dacb4c659f2488d",
  "crypto": {
    "cipher": "aes-128-ctr",
    "cipherparams": { "iv": "..." },
    "ciphertext": "...",
    "kdf": "scrypt",
    "kdfparams": { "n": 8192, "r": 8, "p": 1, "dklen": 32, "salt": "..." },
    "mac": "..."
  },
  "id": "...",
  "version": 3
}

hashcat -m 15700 keystore.json /path/to/wordlist.txt
# 或使用专用工具
python3 keystore2john.py keystore.json > keystore_hash.txt
john --wordlist=/path/to/wordlist.txt keystore_hash.txt

from web3 import Web3
import json

w3 = Web3(Web3.HTTPProvider('https://mainnet.infura.io/v3/<PROJECT_ID>'))

TORNADO_CASH = '0xD4B88Df4D29F5CedD6857912842cff3b20C8Cfa3'
Deposit_HASH = '0xb326618f9e7005c3a41308ec0995d4930a69d402a02aae26a39c8415e5b05c21'

deposit_logs = w3.eth.get_logs({
    "fromBlock": 12000000,
    "toBlock": 12500000,
    "address": TORNADO_CASH,
    "topics": [Deposit_HASH]
})

print(f"Found {len(deposit_logs)} deposits in the block range")

for log in deposit_logs[:5]:
    commitment = log['topics'][1].hex()
    leaf_index = int(log['topics'][2].hex(), 16)
    block_number = log['blockNumber']
    timestamp = w3.eth.get_block(block_number)['timestamp']
    print(f"Deposit: commitment={commitment[:18]}... | leaf_index={leaf_index} | block={block_number} | time={timestamp}")

阶段1：支付
├── 受害者 → 比特币 → 勒索ware提供的地址
├── 交易确认时间通常为 1-6 个区块确认
└── 支付门户通常使用 Tor 隐藏

阶段2：汇集
├── 勒索ware地址 → 热钱包/汇集地址
├── 可能使用 CoinJoin 混合
└── 部分资金直接转入混币器

阶段3：清洗
├── CoinJoin 混合（Wasabi/Whirlpool）
├── 跨链转移（BTC → XMR）
├── 去中心化交易所（DEX）交换
└── 跨链桥（RenBridge, THORChain）

阶段4：变现
├── 小型/不受监管的交易所（KYC 宽松）
├── P2P 平台（LocalBitcoins, Paxful）
├── 非法 OTC 交易商
└── 礼品卡/预付卡购买

阶段5：法币提取
├── 银行转账（通过空壳公司）
├── 房地产购买
└── 高价值资产购买

curl -X POST https://api.chainalysis.com/api/route-api/v2/alerts \
  -H "Authorization: APIKEY <YOUR_API_KEY>" \
  -H "Content-Type: application/json" \
  -d '{
    "sourceAddress": "<ransomware_address>",
    "confidenceThreshold": "high",
    "alertType": "incomingTransaction",
    "label": "Ransomware Payment Tracking"
  }'

from web3 import Web3
import json
from collections import defaultdict
from datetime import datetime

INFURA_URL = 'https://mainnet.infura.io/v3/<PROJECT_ID>'
w3 = Web3(Web3.HTTPProvider(INFURA_URL))

def get_eth_transactions(address, start_block=0, end_block='latest'):
    """追踪指定地址的 ETH 转账记录"""
    address = w3.to_checksum_address(address)
    transactions = []
    current_block = w3.eth.block_number if end_block == 'latest' else end_block

    topic = Web3.keccak(text="Transfer(address,address,uint256)").hex()

    logs = w3.eth.get_logs({
        "fromBlock": start_block,
        "toBlock": current_block,
        "address": address,
        "topics": [topic]
    })

    for log in logs:
        from_addr = '0x' + log['topics'][1].hex()[-40:]
        to_addr = '0x' + log['topics'][2].hex()[-40:]
        value_wei = int(log['data'].hex(), 16)
        value_eth = w3.from_wei(value_wei, 'ether')

        block = w3.eth.get_block(log['blockNumber'])
        timestamp = datetime.utcfromtimestamp(block['timestamp']).isoformat()

        transactions.append({
            'tx_hash': log['transactionHash'].hex(),
            'block': log['blockNumber'],
            'timestamp': timestamp,
            'from': from_addr,
            'to': to_addr,
            'value_eth': float(value_eth)
        })

    return transactions

def analyze_fund_flow(address, depth=3):
    """分析资金流向，构建多跳追踪图"""
    visited = set()
    flow_graph = defaultdict(list)
    address = w3.to_checksum_address(address)

    queue = [(address, 0)]
    visited.add(address.lower())

    while queue:
        current, level = queue.pop(0)
        if level >= depth:
            continue

        txs = get_eth_transactions(current)

        for tx in txs:
            if tx['from'].lower() == current.lower():
                counterparty = tx['to']
            elif tx['to'].lower() == current.lower():
                counterparty = tx['from']
            else:
                continue

            direction = 'OUT' if tx['from'].lower() == current.lower() else 'IN'
            flow_graph[current].append({
                'counterparty': counterparty,
                'direction': direction,
                'value': tx['value_eth'],
                'tx_hash': tx['tx_hash'],
                'timestamp': tx['timestamp']
            })

            cp_lower = counterparty.lower()
            if cp_lower not in visited and tx['value_eth'] > 0:
                visited.add(cp_lower)
                queue.append((counterparty, level + 1))

    return dict(flow_graph)

def generate_flow_report(address, flow_graph):
    """生成资金流向分析报告"""
    print(f"\n{'='*60}")
    print(f"区块链资金流向追踪报告")
    print(f"{'='*60}")
    print(f"追踪目标地址: {address}")
    print(f"追踪时间: {datetime.now().isoformat()}")
    print(f"{'='*60}\n")

    for addr, flows in flow_graph.items():
        total_in = sum(f['value'] for f in flows if f['direction'] == 'IN')
        total_out = sum(f['value'] for f in flows if f['direction'] == 'OUT')
        print(f"[{addr[:10]}...] | 入: {total_in:.4f} ETH | 出: {total_out:.4f} ETH")

        for flow in flows[:10]:
            arrow = '→' if flow['direction'] == 'OUT' else '←'
            print(f"  {arrow} {flow['direction']} | {flow['value']:.4f} ETH | "
                  f"{flow['counterparty'][:10]}... | {flow['timestamp']}")
        print()

if __name__ == '__main__':
    target = '<SUSPECTED_ADDRESS>'
    graph = analyze_fund_flow(target, depth=2)
    generate_flow_report(target, graph)

import requests
import json
import networkx as nx
from collections import defaultdict

BLOCKCHAIN_API = 'https://blockchain.info'

def get_address_info(address):
    """获取比特币地址的基本信息"""
    url = f"{BLOCKCHAIN_API}/rawaddr/{address}?limit=50"
    response = requests.get(url)
    response.raise_for_status()
    return response.json()

def build_transaction_graph(address, depth=2):
    """构建比特币交易图谱"""
    G = nx.DiGraph()
    visited = set()
    queue = [(address, 0)]

    while queue:
        current, level = queue.pop(0)
        if level >= depth or current in visited:
            continue

        visited.add(current)
        addr_info = get_address_info(current)

        G.add_node(current, balance=addr_info.get('final_balance', 0) / 1e8)

        for tx in addr_info.get('txs', []):
            tx_hash = tx['hash']

            for inp in tx.get('inputs', []):
                prev_addr = inp.get('prev_out', {}).get('addr')
                if prev_addr and prev_addr != current:
                    G.add_edge(prev_addr, current, tx_hash=tx_hash,
                              value=inp.get('prev_out', {}).get('value', 0) / 1e8,
                              block=tx.get('block_height', 0))

            for out in tx.get('out', []):
                out_addr = out.get('addr')
                if out_addr and out_addr != current:
                    G.add_edge(current, out_addr, tx_hash=tx_hash,
                              value=out.get('value', 0) / 1e8,
                              block=tx.get('block_height', 0))

                    if out_addr not in visited and level + 1 < depth:
                        queue.append((out_addr, level + 1))

    return G

def export_graph_data(G, output_file='bitcoin_graph.json'):
    """导出图数据为 JSON 格式"""
    graph_data = {
        'nodes': [],
        'edges': []
    }

    for node in G.nodes(data=True):
        graph_data['nodes'].append({
            'id': node[0],
            'balance': node[1].get('balance', 0),
            'in_degree': G.in_degree(node[0]),
            'out_degree': G.out_degree(node[0])
        })

    for edge in G.edges(data=True):
        graph_data['edges'].append({
            'source': edge[0],
            'target': edge[1],
            'value': edge[2].get('value', 0),
            'tx_hash': edge[2].get('tx_hash', ''),
            'block': edge[2].get('block', 0)
        })

    with open(output_file, 'w') as f:
        json.dump(graph_data, f, indent=2)

    print(f"Graph exported: {len(G.nodes())} nodes, {len(G.edges())} edges")
    return output_file

def print_graph_stats(G, address):
    """打印图谱统计信息"""
    print(f"\n{'='*50}")
    print(f"比特币交易图谱分析")
    print(f"{'='*50}")
    print(f"根节点: {address}")
    print(f"节点总数: {G.number_of_nodes()}")
    print(f"边总数: {G.number_of_edges()}")

    if address in G:
        in_degree = G.in_degree(address)
        out_degree = G.out_degree(address)
        print(f"入度: {in_degree} | 出度: {out_degree}")

        high_flow = sorted(
            [(n, d['value']) for n, d in G[address].items()],
            key=lambda x: x[1], reverse=True
        )[:5]
        if high_flow:
            print(f"\nTop 5 资金流向:")
            for addr, val in high_flow:
                print(f"  → {addr[:15]}... | {val:.8f} BTC")

if __name__ == '__main__':
    target_address = '<SUSPECTED_BTC_ADDRESS>'
    graph = build_transaction_graph(target_address, depth=2)
    print_graph_stats(graph, target_address)
    export_graph_data(graph)

SELECT
    t.tx_hash,
    t.block_height,
    t.timestamp,
    t.fee,
    COUNT(DISTINCT ti.address) AS input_address_count,
    COUNT(DISTINCT to2.address) AS output_address_count,
    SUM(ti.value) / 1e8 AS total_input_btc,
    SUM(to2.value) / 1e8 AS total_output_btc
FROM transactions t
JOIN transaction_inputs ti ON t.tx_hash = ti.tx_hash
JOIN transaction_outputs to2 ON t.tx_hash = to2.tx_hash
WHERE t.block_height >= 800000
GROUP BY t.tx_hash
HAVING input_address_count >= 10
   AND output_address_count >= 10
ORDER BY total_input_btc DESC
LIMIT 100;

SELECT
    address,
    COUNT(DISTINCT tx_hash) AS transaction_count,
    SUM(CASE WHEN direction = 'IN' THEN value ELSE 0 END) / 1e8 AS total_received,
    SUM(CASE WHEN direction = 'OUT' THEN value ELSE 0 END) / 1e8 AS total_sent,
    MIN(block_height) AS first_seen_block,
    MAX(block_height) AS last_seen_block
FROM address_transactions
WHERE first_seen_block >= 800000
  AND first_seen_block <= 800100
GROUP BY address
HAVING total_sent > 50 AND total_received > 50
ORDER BY transaction_count DESC;

SELECT
    a.address,
    a.first_seen_block,
    a.total_received,
    a.total_sent,
    (a.total_sent / a.total_received) * 100 AS turnover_pct,
    a.transaction_count,
    l.entity_label
FROM addresses a
LEFT JOIN address_labels l ON a.address = l.address
WHERE a.first_seen_block >= 800000
  AND a.total_received > 10
  AND (a.total_sent / a.total_received) > 0.95
  AND a.transaction_count > 5
  AND l.entity_label IS NULL
ORDER BY a.total_received DESC
LIMIT 200;

title: 可疑加密货币挖矿程序执行
id: 4a1f5e3c-2b8d-4e6a-9c3f-7d2e1a8b5c4d
status: experimental
description: 检测已知加密货币挖矿程序的进程创建行为，覆盖主流矿工软件
author: x7peeps
date: 2026/07/06
modified: 2026/07/06
references:
  - https://attack.mitre.org/techniques/T1496/
tags:
  - attack.impact
  - attack.t1496
  - cryptocurrency
  - mining

logsource:
  category: process_creation
  product: windows

detection:
  selection_miner_name:
    Image|endswith:
      - '\xmrig.exe'
      - '\xmr-stak.exe'
      - '\minergate.exe'
      - '\nicehashminer.exe'
      - '\ethminer.exe'
      - '\cpuminer.exe'
      - '\cgminer.exe'
      - '\bfgminer.exe'
      - '\nbminer.exe'
      - '\t-rex.exe'
      - '\phoenixminer.exe'
      - '\teamredminer.exe'
      - '\lolminer.exe'
      - '\gminer.exe'
      - '\kawpowminer.exe'
  selection_miner_keyword:
    Image|contains:
      - 'miner'
      - 'cryptonight'
      - 'randomx'
      - 'stratum'
  selection_suspicious_args:
    CommandLine|contains:
      - 'stratum+tcp://'
      - 'stratum+ssl://'
      - '-o pool.'
      - '--algo=cryptonight'
      - '--algo=randomx'
      - '--algo=ethash'
      - '--algo=kawpow'
      - '--donate-level='
  selection_hidden_exec:
    ParentImage|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
    Image|contains:
      - 'miner'
  condition: selection_miner_name or (selection_miner_keyword and selection_suspicious_args) or selection_hidden_exec
falsepositives:
  - 合法的挖矿软件（需人工确认）
level: high

title: 可疑加密货币钱包软件异常执行
id: 7e2c4a8f-3d1b-4e5a-8c6f-9b2d7e1a3c5b
status: experimental
description: 检测加密货币钱包软件的异常执行模式，可能表明钱包被盗取或恶意使用
author: x7peeps
date: 2026/07/06
references:
  - https://attack.mitre.org/techniques/T1021/
tags:
  - attack.lateral_movement
  - attack.t1021
  - cryptocurrency
  - wallet

logsource:
  category: process_creation
  product: windows

detection:
  selection_wallet_exec:
    Image|endswith:
      - '\electrum.exe'
      - '\electrum-ltc.exe'
      - '\bitcoin-qt.exe'
      - '\bitcoind.exe'
      - '\dash-qt.exe'
  selection_wallet_browser:
    Image|endswith:
      - '\chrome.exe'
      - '\firefox.exe'
      - '\msedge.exe'
    CommandLine|contains:
      - 'metamask'
      - 'phantom'
      - 'rabby'
      - 'brave'
  selection_remote_access:
    Image|endswith:
      - '\electrum.exe'
      - '\bitcoin-qt.exe'
    ParentImage|endswith:
      - '\psexec.exe'
      - '\wmic.exe'
      - '\wsmprovhost.exe'
      - '\mshta.exe'
  selection_unusual_path:
    Image|contains:
      - '\Temp\'
      - '\AppData\Local\Temp\'
      - '\Downloads\'
      - '\Desktop\'
    Image|endswith:
      - '\electrum.exe'
      - '\bitcoin-qt.exe'
  condition: selection_wallet_exec or (selection_wallet_browser and selection_remote_access) or selection_unusual_path
falsepositives:
  - 合法的钱包软件使用（需结合上下文判断）
level: medium

#!/bin/bash
TARGET_DIR="$HOME"
KEY_EXTENSIONS="json|dat|db|sqlite3|sqlite|log"
KEYNAMES=("wallet" "keystore" "UTC--" "electrum" "meta" "trezor" "ledger" "cipher")
WALLET_PATTERNS=("1[1-9A-HJ-NP-Za-km-z]{25,34}" "3[1-9A-HJ-NP-Za-km-z]{25,34}" "bc1q[0-9a-z]{38}" "0x[0-9a-fA-F]{40}")

echo "[+] 加密货币钱包文件搜索"
echo "[+] 目标目录: $TARGET_DIR"
echo "========================================="

echo "[*] 搜索钱包关键词文件..."
for key in "${KEYNAMES[@]}"; do
    find "$TARGET_DIR" -maxdepth 5 -type f \( -iname "*${key}*" \) \
        2>/dev/null | while read -r file; do
        size=$(stat -f%z "$file" 2>/dev/null || stat -c%s "$file" 2>/dev/null)
        mod_date=$(stat -f%m "$file" 2>/dev/null || stat -c%Y "$file" 2>/dev/null)
        echo "[WALLET] $file | Size: $size | Modified: $(date -d "@$mod_date" 2>/dev/null || date -r "$mod_date" 2>/dev/null)"
    done
done

echo ""
echo "[*] 搜索钱包地址模式..."
find "$TARGET_DIR" -maxdepth 5 -type f \( -name "*.txt" -o -name "*.log" -o -name "*.json" -o -name "*.csv" \) \
    2>/dev/null | while read -r file; do
    grep -oP '(1[1-9A-HJ-NP-Za-km-z]{25,34}|3[1-9A-HJ-NP-Za-km-z]{25,34}|bc1q[0-9a-z]{38}|0x[0-9a-fA-F]{40})' "$file" 2>/dev/null | sort -u | while read -r addr; do
        echo "[ADDR] $file: $addr"
    done
done

echo ""
echo "[*] 搜索助记词..."
find "$TARGET_DIR" -maxdepth 5 -type f \
    \( -name "*.txt" -o -name "*.md" -o -name "*.log" \) \
    2>/dev/null | while read -r file; do
    word_count=$(wc -w < "$file" 2>/dev/null)
    if [ "$word_count" -ge 12 ] && [ "$word_count" -le 24 ]; then
        if grep -qP '(abandon|ability|able|about|above|absent|absorb|abstract|absurd|abuse)\s' "$file" 2>/dev/null; then
            echo "[MNEMONIC-LIKELY] $file (word count: $word_count)"
        fi
    fi
done

echo ""
echo "[*] 搜索矿池连接日志..."
find "$TARGET_DIR" -maxdepth 5 -type f \( -name "*.log" -o -name "*.txt" \) \
    2>/dev/null | xargs grep -l -E 'pool\.|stratum\+tcp://|stratum\+ssl://|mining\.pool\.' 2>/dev/null | while read -r file; do
    echo "[MINING-POOL] $file"
done

echo ""
echo "[+] 搜索完成"
echo "[+] 发现的加密货币相关文件数量可通过以上输出进行统计"

Colonial Pipeline 支付 (75 BTC)
├── 第1跳：赎金中转地址
├── 第2跳：资金汇集地址
├── 第3跳：清洗地址（部分）
├── FBI 控制地址 ← 成功冻结 63.7 BTC
└── 其余资金追踪（~11.3 BTC 未追回）