Chainforensics - New Bitcoin UTXO forensics tool

:police_car_light: I have created a privacy focused Bitcoin blockchain UTXO forensics tool designed to work with your local Umbrel Bitcoin node . All analysis happens locally on your LAN - no external APIs.

If you want to do any kind of forensics on the bitcoin blockchain like the authorities do for whatever reason you may have :eyes: . Then this is a great tool for you!

It currently runs as a docker container outside of umbrel but its created to work with an umbrel running Bitcoin Core and Electrs. It has the following features

  • UTXO Tracing - Track funds forward (where they went) and backward (where they came from)

  • CoinJoin Detection - Identify Whirlpool, Wasabi, JoinMarket, and PayJoin transactions

  • Privacy Scoring - Calculate privacy scores for any UTXO

  • Timeline Visualization - ASCII and graphical timelines of fund flows

  • Address Validation - Validate addresses and identify types (P2PKH, P2SH, P2WPKH, P2TR)

  • Background Jobs - Queue long-running analyses

  • MCP Integration - Use with Claude Desktop for natural language blockchain analysis (optional)(use with caution)

Would love for you guys to use it and for any devs that can help make it better so it can do what the 3letter agencies tools do!

Would love for the Umbrel team to give it a go and maybe help give some guidance on getting it integrated to work natively on the umbrel node as an app. Would be crazy if it is good enough to go on the official umbrel app store.

The github repo can be found here → GitHub - manic-startup/chainforensics: A privacy focused Bitcoin blockchain UTXO forensics tool designed to work with your local Bitcoin node (Umbrel recommended). All analysis happens locally on your LAN - no external APIs.

Happy Tracing :magnifying_glass_tilted_left:

5 Likes

you could maybe create your own community store or ask someone with a community store like @denny

1 Like

Just updated the Repo with a new feature

## :detective: KYC Privacy Check Section

This section is specifically designed to check if **your withdrawal from a KYC exchange** (like Coinbase, Kraken, Binance, etc.) can be traced to your current holdings.

### Why This Matters

When you withdraw Bitcoin from a KYC exchange:

- The exchange knows your identity

- The exchange knows the withdrawal transaction ID

- The exchange knows the address they sent your coins to

**The question is:** If someone (gov, exchange, hacker) starts from that withdrawal transaction, can they follow the trail to where your coins are now?

=======================

1 Like

This sounds like a great project. I hope umbrel will look at, evaluate and consider it!

2 Likes

Have now created an umbrel app store !!! And put the app in there. The app now runs directly on your umbrel. The community app store url is

Its my first public github repo project and its all very exciting!

Iv been making all kinds of updates on it. It now currently at version v1.2.0.

Trying to make it more user friendly as all this UTXO tracing is very confusing for me never mind the noobs. I have added tooltips to most of the menu, but I think I need to make it so its easier to understand what the output is showing you. Here is a pic of it on my umbrel node so happy right now.

is the code of your tool 100% open sourced and was audited with peer review?

I used the GNU Affero General Public License v3.0

The code has NOT been audited with peer review.

I have been testing it on my own umbrel node (umbrel 2024 hardware node). I have not tested on a umbrel software build on a raspberry pi or anything else.

The umbrel node is running on IOS 1.5

Bitcoin Core 29.2.0

Electrs 0.11.0

When I say “tested” I mean functionality. I have not yet done any pen testing or vulnerability testing.

But I would say a 3rd party will need to do the pen/ vulnerability testing. I will look into getting someone from the community to do this at some point.

UPDATE

Spent way too much time making the standard transaction analysis work better when you can just use online blockchain explores.

Once it was good enough I concentrated on what the blockchain explores don’t do and what services that the powers that be want from the companies that provide blockchain intelligence.

There is still a good usecase for the transaction analysis part of the app as it runs on your own hardware. The online blockchain explores see every address you query and who knows what logs they keep.

Working on the following features

Cluster Detection - Show if the user’s addresses are linked

Exchange Proximity Score - How many hops from known exchanges

UTXO Privacy Rating - Rating classification for each of your UTXOs

:vulcan_salute:

Thanks for your reply. Another concern I have is that if your tool has some kind of a function like call home that can log and send information of bitcoin transactions on Umbrels to a centralized server?

No, it runs on the Umbrel only and only interacts with the bitcoin node and electrs apps.

Also if one is familiar with swagger documentation, you can go to http://localhost:3000/docs (when the app is running) it will show you all the APIs

Thanks. I am going through your guide on GitHub: GitHub - manic-startup/chainforensics: A privacy focused Bitcoin blockchain UTXO forensics tool designed to work with your local Bitcoin node (Umbrel recommended). All analysis happens locally on your LAN - no external APIs. and I am a beginner techie and would like to ask you for further instructions!

At option 1 and “#1 Clone or download the project cd chainforensics”: do I perform these steps on an Umbrel

ssh umbrel@umbrel.local

cd ~
git clone https://github.com/manic-startup/chainforensics.git
cd chainforensics

1 Like

So there are 2 versions, Links to both above in the chat history.

  1. Standalone version - This runs on your own machine (Not Umbrel) you will need docker installed and python already installed. It then connects to your umbrel (bitcion node/ electrs)

  2. Umbrel version - this runs on you umbrel via a community app store. You will need bitcion node/ electrs installed.

You a probably want the umbrel version. Just go to the app store on your umbrel click the 3dots in the top right add this url GitHub - manic-startup/chainforensics-umbrel <copy the “link address” the rest is self explanatory.

2 Likes

UPDATE

I have been working on my offline dev version and come to the conclusion that Electrs cant really handle the types of requests the app requires. I am now changing it to work with Fulcrum as its just more hardcore than Electrs and ElectrumX.

but first… 3 days of this :upside_down_face:

NEW VERSION 1.2.0 is live

Fulcrum and Bitcoin apps are now mandatory. You can still use it with just Bitcoin installed but the results will be incorrect as there will be missing information that the app needs to run through its algos.

To give it a try go to the umbrel app store > hit the 3 dots in the top right hand corner > hit “Community App Stores” > copy paste the below URL > hit Add > Hit Open

GitHub - manic-startup/chainforensics-umbrel <copy the “link address”

If you installed the old version. Uninstall it first before installing the new one.

Comparison to Commercial Tools

ChainForensics now implements techniques used by:

Technique Chainalysis Elliptic ChainForensics
Temporal correlation :white_check_mark: :white_check_mark: :white_check_mark: NEW
Value fingerprinting :white_check_mark: :white_check_mark: :white_check_mark: NEW
Wallet fingerprinting :white_check_mark: :white_check_mark: :white_check_mark: NEW
Peeling chain detection :white_check_mark: :white_check_mark: :white_check_mark: NEW
Anonymity set analysis :white_check_mark: :white_check_mark: :white_check_mark: NEW
UTXO graph traversal :white_check_mark: :white_check_mark: :white_check_mark:
CoinJoin detection :white_check_mark: :white_check_mark: :white_check_mark: Enhanced
Clustering heuristics :white_check_mark: :white_check_mark: :white_check_mark: Enhanced

Advantage of ChainForensics: All analysis happens locally on your network - no external APIs, complete privacy.

Hope at least 1 person finds it useful !!
HNY :vulcan_salute:

Hi, Do you still maintain the option of running your app on a laptop and it will interact with a Umbrel bitocoin node via bitcoin RPC?

I made that a private repo as I still need to update it to the latest version. Also providing support for the standalone version will be a nightmare as there are so many pre requisites. So decided to go down the Umbrel only route.

FYI on the side I am trying to get this listed on the official umbrel app store but that will take some time I guess.

Will try updating the standalone repo when I get a chance and make it public for a week or so if you really want it.

1 Like

Standalone version is now public

One suggestion is for those who use Bitcoin Knots, you might want to consider using in your docker-compose.yml under api, environment changing your BITCOIN_RPC_PORT: to the value of $APP_BITCOIN_PORT as the hard port value will not connect to the node.

:waving_hand:

Yes I think you are right, lots of people using knots. Will think of the best way to work with core and knots.

Just concentrating on getting the app added on the umbrel app store.

:vulcan_salute: