Ashiato

Demo

About

Ashiato (足跡, "footprints") is a crypto tracing tool for scam victims and the people who help them. When someone loses money to an investment or romance scam, the funds usually move through a few wallets and end up at an exchange. The exchange can freeze the account, but only if someone shows it where the money went. Commercial tools that do this cost thousands a year, so most victims never get that far. Paste an address or transaction hash (Bitcoin, Ethereum or Tron; Base, Arbitrum, Optimism, BNB Chain and Polygon with Pro) and Ashiato draws the money as a graph. Click an address to see its transactions and counterparties, add the ones that matter, and build the trail hop by hop. Every address is checked against 120k+ open-source labels, the OFAC sanctions list and scam/drainer lists. Ashiato also spots exchange deposit addresses (the detail an exchange needs to identify the account holder), CoinJoins, Tornado Cash use, DEX swaps and cross-chain bridges (Bridgers, Across, Relay and deBridge hops are followed to the destination chain). Each address gets a 0–100 risk score with the reasons shown. Anyone can sign in with a wallet or email and add community labels ("this is a scam wallet"). Labels are signed with the user's wallet, so anyone can verify who said what, and other users vote on them. Cases are saved to your account and export as a printable report, CSV, GraphML or PNG to hand to police or an exchange. Everything a victim needs is free. Ashiato Pro (paid in USDC on Base or Ethereum, verified on-chain) adds watch alerts when traced funds move, a plain-English summary of the trace written by Claude, and the five extra EVM networks.

How it's made

Ashiato is a Next.js 15 (React 19) app on Vercel. The graph uses React Flow with a dagre layout; addresses you place by hand never move when new ones are added, and a select tool moves groups of nodes together. Chain data: Etherscan V2 for Ethereum and all the EVM chains (one code path, switched by chainid, including internal transactions and ERC-20 transfers), Esplora for Bitcoin (exact coin-level tracing through outspends) and TronGrid/Tronscan for Tron. Bridge hops are resolved through each bridge's public API (Bridgers, Across, Relay, deBridge), so a trail continues on the destination chain. Labels come from GraphSense TagPacks, eth-labels, the OFAC list, MyEtherWallet's darklist and ScamSniffer, merged into one lookup. Wallets and identity use Reown AppKit with wagmi and viem. Sign-In with Ethereum creates a session, and email/social sign-ins get a Reown smart wallet. Community labels are EIP-712 typed-data signatures, verified on the server with viem's verifyTypedData so they also work for smart-contract wallets (ERC-1271). The hacky part: labels started as EAS attestations on Sepolia, but asking a scam victim to pay gas and switch networks to flag a scammer put people off, so we moved to gasless signatures that stay publicly re-verifiable. Payments: there's no payment processor. The user sends USDC on Base or Ethereum from their wallet; the server reads the receipt, checks the Transfer log (payer, our address, amount, confirmations), credits each transaction once and stacks the paid months. Email wallets report chain IDs as "eip155:1", which broke viem, so we parse the chain ourselves and send with chain: null. Pro features: the plain-English summary uses the Anthropic SDK (Claude) with the trace's facts as input. Watch alerts use a Vercel cron job that checks watched addresses daily and flags funds that reach an exchange. Accounts, cases, labels, payments and alerts live in Supabase (Postgres via PostgREST, server-side only; no emails stored, only wallet addresses). This is a Continuity-track project: the tracing engine existed before the event, and everything above involving wallets, signatures, payments, Pro features, bridges, extra chains and the new graph tools was built during ETHGlobal Tokyo.