Skip to content
View Kristina89-oss's full-sized avatar
25 followers · 70 following

Block or report Kristina89-oss

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Content in all repositories owned by your account will be closed.
Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. Markdown is supported. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
Kristina89-oss/README.md
rotating icosahedron

OSINT & Blockchain Investigator

AML / Financial-Crime Compliance · Enhanced Due Diligence · On-Chain Forensics

Taplink

What I do

I trace stolen and laundered crypto back to where it actually came from — and where it's actually going. I got into this because I couldn't stand watching people eat the loss while the money just disappeared, so every wallet, company, or vessel I flag comes with exactly how sure I am, and why. If the evidence doesn't get me to a name, I say so instead of guessing.

🗂️ Investigations & writeups

Case What I found Evidence
Full TRON writeup How a $72M Tether freeze unravelled into a 761-address network — written as it happened, mistakes included Step-by-step
TRON/USDT laundering — $120M A trail public reporting missed, plus a hidden $23.4M bridge to a second network 647 addresses, FATF-scored
TRON phishing kit → USDT resale Fake refund site feeding a $125M+ resale storefront on Telegram Chain of custody, SHA-256
"TGR Exchange" cash-out scam Fund-flow trace to the ad campaign & hosting records Every claim confidence-tagged
Sanctions exposure — 21-vessel fleet Clean on every list — until I found the one contact name-screening can't see Client work, no public repo

🔎 Wallet check

A local, single-page tool I built for checking a wallet the way I would by hand — FATF-style red-flag scoring, sanctions/freeze/phishing-blocklist screening, mixer and cross-chain bridge tracing, an activity heatmap, and OSINT, all from one address or tx hash. Runs on 127.0.0.1; nothing is sent anywhere except the read-only API calls it documents.

Tracing dashboard scoring a sanctioned address

  • 🚩 FATF red flags — mixer use, structuring, mule-style pass-through, abnormal counterparty fan-out
  • 🧊 Sanctions & freezes — OFAC SDN, live/historical USDT blacklist, ScamSniffer phishing list
  • 🌉 Mixer & bridge tracing — Tornado Cash interactions, a recursive cross-chain bridge tracer
  • 🔎 OSINT — Chainabuse reports, GoPlus/SlowMist/BlockSec labels, RansomLook, web search

Repo →

🗄️ Databases

Database Covers Scale
Arms trafficking: Türkiye → Europe Turkish blank-firing pistols smuggled into Europe & converted to live weapons 18 charts, customs/court sourced
Crime Networks Database Scandinavian (Foxtrot, Rumba) & Turkish-origin (Daltons, Baygaralar, Redkit) profiles Source-tagged 🟢🟡🔴
China–DRC Database China's mining, cobalt, corruption & security footprint in the DRC 51 companies, 19 charts

🧭 Core competencies

Area Skills
Compliance & AML EDD · KYC/CDD · SAR/STR Support · FATF Red Flags
Sanctions OFAC SDN · EU/UK/UN Lists · Secondary/Derivative Risk
On-chain forensics Fund-Flow Tracing · Tronscan · Etherscan · Arkham
OSINT Corporate Registries · Shell-Entity Mapping · AIS Vessel Tracking
Data & automation n8n Pipelines · Local LLM Parsing (Ollama)

🛠️ Tools & sources

Tronscan Etherscan Arkham Intelligence Chainabuse OFAC SDN Sanctions Lists FATF Red Flags n8n Ollama

Pinned Loading

  1. Arms-trafficking-Turkiye-Europe Arms-trafficking-Turkiye-Europe Public

    pen-source research files on the trafficking of Turkish blank-firing pistols into Europe and their conversion into live weapons.

  2. TGR-scam-exchange-case TGR-scam-exchange-case Public

    On-chain investigation into the "TGR Exchange" crypto cash-out scam, tracing a single victim report through USDT wallet fund flows, Meta ad infrastructure, and hosting/WHOIS records to identify the…

    HTML

  3. tracing-dashboard tracing-dashboard Public

    Local single-page tool for checking crypto wallets — FATF risk scoring, sanctions/freeze screening, mixer & bridge tracing, and OSINT, all in one place.

    Python 1

  4. tron-laundering-investigation tron-laundering-investigation Public

    On-chain investigation into a $1.56B cryptoasset laundering network on TRON, detailing the June 2026 $72M USDT Tether freeze and the connected EJon/HBK cluster.

  5. TRON-Phishing-Kit-and-USDT-Laundering-Network- TRON-Phishing-Kit-and-USDT-Laundering-Network- Public

    This repository documents a phishing-kit and multi-tier laundering network observed on the TRON blockchain, and the retail storefront selling the resulting stolen USDT through a public Telegram ch…

    Python

  6. tron-investigation-writeup tron-investigation-writeup Public

    Step-by-step writeup: how a $72M Tether freeze on TRON led to uncovering a 761-address USDT laundering network, a phishing kit, and a Telegram storefront selling stolen USDT.

    1