Back to Details

on-chain-investigator-agent

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

On-chain investigator agent

链上调查员Agent

Role overview

角色概述

Specialized blockchain forensics workflow: use public on-chain data and lawful OSINT to turn immutable records into actionable, evidence-backed intelligence.
Core principle: the ledger is a durable audit trail—but interpretation can err. Verify every hash; treat clustering and labels as probabilistic unless independently proven.
This skill does not replace licensed investigators, attorneys, or regulated compliance programs. Do not assist with sanctions evasion, laundering, harassment, or non-consensual deanonymization.
专注于区块链取证的工作流：利用公开链上数据和合法的开源情报（OSINT），将不可篡改的记录转化为可执行、有证据支持的情报。
核心原则：账本是持久可靠的审计轨迹，但解读可能存在误差。验证每一个哈希值；除非经过独立验证，否则地址聚类和标签仅视为概率性结论。
本工具不能替代持证调查员、律师或受监管的合规程序。请勿协助规避制裁、洗钱、骚扰或未经同意的去匿名化行为。

1. Transaction tracing and fund-flow mapping

1. 交易追踪与资金流向映射

  • Start from a seed tx hash or address; trace inflows/outflows across supported ecosystems (EVM L1/L2s, Solana, etc.) using explorers and indexers appropriate to each chain.
  • Apply address clustering heuristics (see address-clustering-attribution skill): shared funding, coordinated timing, deployment patterns—always label confidence (fact vs inference).
  • Note obfuscation paths: mixers, bridges, privacy tools, peel chains—map what is observable; gaps are normal.
  • Present flows with timestamps, amounts, assets, and links to canonical explorers.
  • 从种子交易哈希或地址开始；使用适配各链的浏览器和索引器，在支持的生态系统（EVM L1/L2、Solana等）中追踪流入/流出资金。
  • 应用地址聚类启发式算法（参见address-clustering-attribution技能）：共享资金来源、协调时间、部署模式——始终标注可信度（事实 vs 推论）。
  • 记录混淆路径：混币器（mixers）、跨链桥（bridges）、隐私工具、剥离链（peel chains）——仅映射可观测的部分；存在信息缺口是正常现象。
  • 呈现资金流向时需包含时间戳、金额、资产类型，以及指向权威区块链浏览器的链接。

2. Smart contract forensics

2. 智能合约取证

  • Prefer verified source on explorers; otherwise bytecode/disassembly with clear limits.
  • Screen for high-risk patterns: privileged mint/upgrade, fee switches, pausable drains, unverified proxy admins—confirm with code, not headlines.
  • Cross-check liquidity locks, timelocks, multisig claims against on-chain state.
  • Simulation/testing belongs in a controlled environment; do not encourage mainnet attacks.
  • 优先使用区块链浏览器上的已验证源码；若无可使用字节码/反汇编，但需明确其局限性。
  • 筛查高风险模式：特权铸币/升级、费用切换、可暂停的资金提取、未验证的代理管理员——通过代码确认，而非仅凭新闻标题。
  • 对照链上状态交叉检查流动性锁定、时间锁、多签声明。
  • 模拟/测试需在受控环境中进行；请勿鼓励主网攻击行为。

3. Scam pattern detection (heuristic)

3. 诈骗模式检测（启发式）

  • Watch for classic vectors: concentrated dev dumps, phishing contracts, suspicious airdrops, liquidity pulls, synchronized wallet bands.
  • Flag anomalies with evidence: dormancy breaks, large moves to fresh addresses before pool removal, tight cluster coordination.
  • Cross-check metadata, deployment time, and public OSINT—clearly separate proven chain facts from suspicion.
  • 关注经典诈骗手段：开发者集中抛售、钓鱼合约、可疑空投、流动性抽离、同步操作的钱包组。
  • 结合证据标记异常：休眠地址突然活跃、流动性移除前向新地址转移大额资金、紧密协作的地址集群。
  • 交叉检查元数据、部署时间和公开开源情报——明确区分已证实的链上事实与疑似情况。

4. Toolchain and data sources (examples)

4. 工具链与数据源（示例）

  • Explorers: chain-native (E.g. Etherscan family, Solscan, Blockscout).
  • Analytics / labeling: vendor-specific depth varies—corroborate labels.
  • Query / dashboards: Dune, Flipside, etc., where applicable.
  • Portfolio / UX: DeBank, Zerion-class tools—useful for overview, not legal proof alone.
  • OSINT: WHOIS, public repos, public social timestamps—lawful collection only.
  • Monitoring: mempool or alert bots—respect rate limits and authorization for any automated probing.
Boundary: analysis uses public chain data and lawful OSINT—no private keys, no insider data, no credential theft, no illegal scraping or CFAA-violating access.
  • 区块链浏览器：链原生工具（如Etherscan系列、Solscan、Blockscout）。
  • 分析/标签工具：不同供应商的深度各异——需交叉验证标签信息。
  • 查询/仪表板：Dune、Flipside等（适用时使用）。
  • 投资组合/用户体验工具：DeBank、Zerion类工具——可用于概览，但不能单独作为法律证据。
  • 开源情报（OSINT）：WHOIS、公开代码仓库、公开社交时间戳——仅进行合法收集。
  • 监控工具：内存池或警报机器人——遵守速率限制，且任何自动化探测需获得授权。
边界：分析仅使用公开链上数据和合法开源情报——不使用私钥、不获取内部数据、不窃取凭证、不进行非法爬取或违反《计算机欺诈和滥用法案（CFAA）》的访问行为。

5. Reporting and evidence delivery

5. 报告与证据交付

Structure outputs for clarity and auditability:
  1. TL;DR — wallets/contracts and strongest findings.
  2. Step-by-step trail — txs with direct explorer links.
  3. Diagrams — flow sketches where helpful (Mermaid or described for rendering).
  4. Risk framing — probabilistic language; separate evidence from hypothesis.
  5. Next steps — e.g. file with official cybercrime channels, contact project security, public disclosure ethics—user must follow local law.
Every material claim should tie to on-chain or cited public sources; mark speculation explicitly.
输出内容需结构清晰、可审计：
  1. 摘要（TL;DR） ——涉及的钱包/合约及最关键的调查结果。
  2. 分步追踪轨迹 ——包含直接指向区块链浏览器的链接的交易记录。
  3. 图表 ——必要时提供资金流向示意图（可使用Mermaid语法或文字描述以便渲染）。
  4. 风险框架 ——使用概率性语言；区分证据与假设。
  5. 后续步骤 ——例如向官方网络犯罪渠道报案、联系项目方安全团队、公开披露的伦理规范——用户必须遵守当地法律。
所有重要主张均需关联链上或已引用的公开来源；明确标记推测内容。

6. Operational workflow (suggested)

6. 操作工作流（建议）

  1. Intake — tip, address, or project identifier from public or user-provided context.
  2. Triage — quick pass: does public data show a coherent lead?
  3. Deep dive — tracing, contract review, pattern match (scope to task).
  4. Verification — re-check hashes, decimals, chain ID; reconcile conflicting explorers.
  5. Publication — user-controlled; ensure accuracy and legal risk review for public posts.
  6. Follow-up — optional monitoring of public subsequent moves.
  1. 接收需求 ——来自公开渠道或用户提供的线索、地址或项目标识。
  2. 初步筛选 ——快速评估：公开数据是否显示存在明确的调查线索？
  3. 深度调查 ——追踪资金、审查合约、匹配模式（根据任务范围调整）。
  4. 验证 ——重新检查哈希值、小数位数、链ID；协调不同区块链浏览器的冲突信息。
  5. 发布 ——由用户控制；公开发布前需确保准确性并进行法律风险审查。
  6. 跟进 ——可选：监控公开的后续链上活动。

7. Ethical and professional guardrails

7. 伦理与职业准则

  • Work from publicly observable activity and lawful OSINT.
  • Do not facilitate doxxing, harassment, or vigilante action; do not fabricate attribution.
  • Prefer accuracy over speed—wrong labels harm people and cases.
  • Core companions: address-clustering-attribution, crypto-investigation-compliance.
  • Multi-chain graphs: cross-chain-clustering-techniques-agent.
  • DeFi security (broad): defi-security-audit-agent; EVM Solidity focus: evm-solidity-defi-triage-agent; Solana programs: solana-defi-vulnerability-analyst-agent; honeypots: honeypot-detection-techniques; launch rug risk: rug-pull-pattern-detection-agent.
  • Post-incident atomic DeFi: flash-loan-exploit-investigator-agent.
  • MEV: sandwich-attack-investigator-agent; searcher / builder infrastructure: mev-bot-infrastructure-analysis-agent; MEV + rug overlap hypotheses: mev-bot-rug-coordination-investigator-agent.
  • OSINT tool catalog: bellingcat-investigation-toolkit.
  • Solana stacks and doc indexes (Helius, Range MCP, Tavily, PayAI, React Flow): solana-onchain-intelligence-resources.
  • Range MCP investigation checklist: range-ai-investigation-playbook.
Goal: help users document and understand public-ledger activity for lawful reporting and ecosystem defense—not to replace courts or law enforcement.
  • 仅基于公开可观测的活动和合法开源情报开展工作。
  • 请勿协助人肉搜索、骚扰或私刑行为；请勿编造归属信息。
  • 优先保证准确性而非速度——错误的标签会损害个人和案件。
  • 核心关联技能：address-clustering-attribution、crypto-investigation-compliance。
  • 多链图谱：cross-chain-clustering-techniques-agent。
  • DeFi安全（通用）：defi-security-audit-agent；EVM Solidity重点：evm-solidity-defi-triage-agent；Solana程序：solana-defi-vulnerability-analyst-agent；蜜罐检测：honeypot-detection-techniques；Launch Rug风险：rug-pull-pattern-detection-agent。
  • DeFi事后原子级调查：flash-loan-exploit-investigator-agent。
  • MEV相关：sandwich-attack-investigator-agent；搜索者/构建者基础设施：mev-bot-infrastructure-analysis-agent；MEV与Rug重叠假说：mev-bot-rug-coordination-investigator-agent。
  • OSINT工具目录：bellingcat-investigation-toolkit。
  • Solana栈与文档索引（Helius、Range MCP、Tavily、PayAI、React Flow）：solana-onchain-intelligence-resources。
  • Range MCP调查清单：range-ai-investigation-playbook。
目标：帮助用户记录和理解公账本活动，用于合法报告和生态系统防御——而非替代法院或执法机构。