analyzing-ransomware-payment-wallets

Traces ransomware cryptocurrency payment flows using blockchain analysis tools such as Chainalysis Reactor, WalletExplorer, and blockchain.com APIs. Identifies wallet clusters, tracks fund movement through mixers and exchanges, and supports law enforcement attribution. Activates for requests involving ransomware payment tracing, bitcoin wallet analysis, cryptocurrency forensics, or blockchain intelligence gathering.

Jump to install

Repository: xalgord/xalgorix
Last source activity: June 6, 2026 at 16:41
Detected SKILL.md language: English
Stars: 813
Forks: 146

Install options

The review-first prompt is selected by default. You can switch to a direct command or download a local copy.

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

A direct command skips the review prompt. Inspect the source before running it.

npx skills add https://github.com/xalgord/xalgorix --skill analyzing-ransomware-payment-wallets

The command stays on one line. Scroll horizontally to inspect it before copying.

Prefer a local copy? Download the files currently available to SkillsMP.

Review the source files

Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.

SKILL.md

Source instructions · Read-only preview

Back to search Back to installation

exploiting-http-request-smuggling

Detecting and exploiting HTTP request smuggling vulnerabilities caused by Content-Length and Transfer-Encoding parsing discrepancies between front-end and back-end servers.

2026-07-20

exploiting-oauth-misconfiguration

Identifying and exploiting OAuth 2.0 and OpenID Connect misconfigurations including redirect URI manipulation, token leakage, and authorization code theft during security assessments.

2026-07-20

exploiting-subdomain-takeover-vulnerabilities

Identifying and exploiting dangling DNS records pointing to unclaimed cloud services, enabling subdomain takeover for phishing, cookie stealing, and authentication bypass during authorized penetration tests.

2026-06-19

View all from this repository

Analyzing Ransomware Payment Wallets

When to Use

An organization has been hit by ransomware and the ransom note contains a Bitcoin or cryptocurrency wallet address that needs investigation

Law enforcement or incident responders need to trace where ransom payments flowed after the victim paid

Threat intelligence analysts are attributing ransomware campaigns by clustering payment infrastructure across incidents

Investigators need to determine if a ransomware group is reusing wallet infrastructure across multiple victims

Compliance or legal teams need evidence of fund flows for prosecution, sanctions enforcement, or insurance claims

Do not use this skill for live payment interception or to interact directly with ransomware operators. All analysis should be passive and read-only against public blockchain data.

Detection Gaps & Validation

Mixers and CoinJoin break the trail: funds routed through Wasabi/Samourai/ChipMixer-style CoinJoin or a tumbler defeat the common-input-ownership heuristic. A clean "dead end" at a mixer deposit is not proof of an endpoint, it is a tracing gap. Flag it explicitly rather than concluding the funds vanished.

Chain-hopping / cross-chain swaps: BTC swapped to Monero (untraceable) or bridged via a cross-chain DEX (THORChain, atomic swaps) will not show up in a single-chain explorer. Always check for outputs to known bridge/swap deposit addresses, not just exchange wallets.

Peel chains evade naive tracing: a 12+ hop peel chain with diminishing outputs looks like noise; follow the largest output at each hop, not the first.

Change-address misattribution: the common-input-ownership heuristic over-clusters when CoinJoin is involved, producing false "related wallet" links. Validate each cluster against a second source (OXT, WalletExplorer, Chainalysis) before asserting attribution.

How to validate: confirm the address format/checksum before querying; reconcile total_received against the ransom-note demand and known victim payment timestamps; cross-check every flagged endpoint against the OFAC SDN list. Treat a single-source exchange attribution as a lead, not a finding.

Prerequisites

Python 3.8+ with requests, json, and hashlib libraries

Access to blockchain explorer APIs (blockchain.com, WalletExplorer.com, Blockstream.info)

Familiarity with Bitcoin transaction model (UTXOs, inputs, outputs, change addresses)

Understanding of common obfuscation techniques (mixers, tumblers, peel chains, cross-chain swaps)

Optional: Chainalysis Reactor license for enterprise-grade cluster analysis