Repository navigation
Wallet overview
One address as a ledger: balance, history, counterparties and the group of wallets it was spent with.
One address as a ledger, in the style of a wallet explorer: a summary (balance, total received, total sent, pending, number of transactions, first and last seen), an Associations list of the labelled wallets that appear in the loaded transactions, and then every transaction as a card with its inputs on the left (red amounts) and its outputs on the right (green amounts). The wallet's own lines are marked, each card says when it happened (UTC), in which block, the fee, what it did to the wallet (received, sent, moved within; change that came back is netted off) and the balance after it, worked backwards from today's confirmed balance so it is right even when only the newest part of the history is loaded. Every other address links to its own overview, a transaction opens in the workspace (or in the explorer), a QR code appears when you hover (or focus) the address, and the loaded transactions can be filtered All / In / Out and downloaded as CSV (inputs and outputs as address=sats; cells that could run as spreadsheet formulas are defused).
History is loaded 25 transactions at a time (Load 25 more), or all of it with Load all (below). The page follows the data source you chose in the workspace, including the backup server and a key you saved for it, and says which server answered. Open it from index.html, from the Wallet overview ↗ link in a wallet's details in the workspace, or directly: public/wallet.html?q=<address>. Without an address the page offers Try a sample wallet, the address that received the DarkSide affiliate's share of the Colonial Pipeline ransom and was emptied on 7 June 2021 (bc1qq2eu…fsegq; Elliptic's account).
Links out. Beside the address, Check in Explorer opens the wallet on the block explorer of the data source you chose (mempool.space unless you chose Tor or your own server) in a new tab, and Check in Arkham opens Arkham's own page for it (not offered over Tor). Both only open a page in your browser: the other site is told which wallet you look at, nothing else is sent.
Names. What you wrote yourself in the workspace (labels, tags and notes, read from the saved session in this browser) comes first, then the built-in list and the label lists you saved there (a switched-off list adds nothing). A wallet that is on several lists shows every claim - the name, the list, its category, source link and note - and a wallet on a sanctions list (the OFAC pack) is marked with a banner and a sanctions list chip. A name is somebody's claim, not proof, and everything that comes from outside is shown as text only.
Amounts in a currency. Amounts in, Show and Price (above the cards) take the choice you made under Fiat value in the workspace and keep it for both pages: each amount in Bitcoin, in the currency or both, at the price of the transaction's own moment or at today's (the price used is in the tooltip). The balance in the summary is shown at today's price, and the CSV gets fiat_* columns. Prices come from the same server as the workspace's; if they cannot be loaded the page says so and shows Bitcoin.
Finding things in a long history. A search over addresses, names, transaction ids and block heights (every word must match), a date range (UTC, both ends included) and an amount range (what the transaction did to the wallet, in BTC) narrow the loaded transactions, together with All / In / Out, whose counts follow the other choices. Long lists are drawn 100 cards at a time; the search looks at everything that is loaded. Load all fetches the rest of the history a page at a time, up to the limit in up to (25 to 50,000; 1,000 to start with), with a progress line and Cancel. If a request fails part way, what was loaded stays and the page says what happened.
Export. The Export menu above the cards writes the loaded transactions as a CSV (one line each; with a currency chosen it gets the fiat_* columns), as a workspace file (.json) that the workspace's Import opens, or as a wallet report (.html), the same kind of file as the workspace's investigation report: a summary, the findings with their reasons (patterns, likely change, possible peel chains, clusters), every transaction in time order with where and when it was fetched, the wallets, a Method and limits section and a SHA-256 of the evidence it embeds, which python tools/verify_report.py report.html checks. It has no picture of a graph, and says on its first page whether it covers the whole history, the part that was loaded, or only what the search showed. Only the transactions shown leaves out what the search, the dates, the amounts and All / In / Out hide; Load the whole history first loads the rest (up to the limit beside Load all) before anything is written. The report title and Prepared by are optional.
Balance over time. A step chart of the balance after each confirmed transaction that is loaded (UTC dates, in Bitcoin). Hover it, or use the arrow keys, for the transaction, what it did and the balance after it; click it (or press Enter) to find its card below, which takes off a search that hides it. When only part of the history is loaded the chart says so: the balance before it is worked back from today's balance.
Biggest counterparties. The wallets that moved the most Bitcoin next to this one in the loaded transactions, labelled or not, with their names, the number of transactions, what they paid in and what they received, and a bar for the size; ten at a time, up to 100. Transactions narrows the ledger to the ones that involve that wallet. Wallets that were spent together with this one (usually the same owner) are in this list too.
Trace from here. Every card has a Trace box. Tick the transactions you want to follow (or Tick shown for the first ones that match the search, up to nine) and Trace from here opens the workspace with this wallet and those transactions as the starting points of a trace. Nine is the most: the workspace takes ten starting points at a time, and the wallet is one of them.
Whole wallet. The addresses that were spent together with this one in the loaded transactions, and through them the addresses spent with those (the common-input rule), with the number of transactions that joined them; a transaction that looks like a CoinJoin joins nothing and is counted. Look further loads the newest transactions of up to 25 of the other wallets to see who they were spent with, so the group can grow (press it again for the next 25); Read balances asks for each one's balance (up to 50 at a time) and adds them up. Both show their progress, can be cancelled and keep what they loaded. Copy addresses and Open in workspace (the first ten) use the group, and a wallet in the group that is on a sanctions list is called out. It is a guess, not proof: a CoinJoin, a PayJoin, a shared or custodial wallet or a multisig breaks the rule.