Trace layout: dragging one of several selected vertices moves them all together After Select this branch, a box or Shift-click, a drag moves the whole selection by the same amount; where x means time each vertex keeps its time and moves up or down. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Following a payment to a threat actor: a short guide to the order of work and where an AI assistant helps The order of work from a known payment, each step tied to a finding Hopline offers (open ends, known wallets, service hand-offs, not on screen), how to confirm names outside and record them, and the four assistant tasks with the moment each one is worth asking. Written around a ransomware payment, and usable for extortion, scams and thefts, forward or backward. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Analysis and findings: the route search follows the times of the route Ends that cannot fit the times wait; from a service wallet's side the deposits or withdrawals nearest in time to the other end go first. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Analysis and findings, Reports and exports: hand-offs to named wallets, suggested names from your own labels A wallet that a sanctions or ransomware list names is a hand-off row marked named (the CSV has a kind column); your own labels and tags are not rows. Suggested names can come from a label you gave, only in a cluster where no list names a wallet. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Analysis and findings, Reports and exports: routes, hand-offs, open ends, suggested names, search and the Not on screen chip Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
victims icon
Analysis and findings: the optional Claude option in the Assistant section Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Wallet overview: the Export menu and the explorer link * Wallet-overview: an Export paragraph (CSV, workspace file, wallet report; only the transactions shown; load the whole history first), a Links out paragraph (Check in Explorer, Check in Arkham), and Load all no longer says it downloads the CSV. * Reports-and-exports: the wallet page's export and its report, with the same hashes and the same verify_report.py check. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Accuracy: the dust rule for peel steps, and one sign as a weaker lead A peel step now has to be at least 1,000 satoshis: about a fifth of the steps in detected chains peeled exactly the dust limit (546 satoshis beside an OP_RETURN output, 330 satoshis), the look of token and inscription transfers. On a sample the change was not made on it dropped 187 of 502 steps in chains (181 dust peels, 6 collateral) and added none. A medium change guess on one sign was right 89.5% of the time against 99.5% on two signs; capping those at low waits for real-wallet data. Analysis and findings words the peel rule as "not dust-sized". Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Trace layout: describe the box that rotates all, none, top 5 The list behind an arrow has one box, "Tick all · none · top 5", beside "Group similar rows", in place of the All, None and Top 5 buttons: what each click does, what the dash and the bold word mean, and that with no more rows than the step size it is only all and none. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Accuracy: the CoinJoin change and what a holdout showed; the PEEL reading The COINJOIN? rule now counts the different addresses an equal amount pays, not the outputs. A second sample it was not made on dropped 2 of 12 flags (one address paid repeatedly), kept 10 including all three Whirlpool-shaped transactions, and added none. The PEEL bullet says what the longest real chains looked like and that the default is unchanged. Analysis and findings words the rule as "to different addresses". Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Accuracy: add what real traffic and a documented case showed How often each flag fires on a sample of the real chain (both CoinJoin flags were dust-sized batches), what the change guess rests on there, and what each auto-expand rule did on the Colonial Pipeline ransom route, with what was and was not read of the documents. Development gets the commands for the new benchmark tiers. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Add the Accuracy page: how often the guesses are right, and where they break Results of the benchmark on synthetic data with known answers (change guess by confidence, clusters, the pattern badges), what the data cannot say, and what to do with the numbers. Linked from Home, the sidebar, Analysis and findings, and Development, which also gets the commands to run the benchmark. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Document the GraphSense list, the Arkham link and where the data comes from Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Document the built-in label packs, the UK Sanctions List and the weekly refresh Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Publishing a copy: describe the GitHub Pages copy Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Publish the documentation pages over the placeholder first page
Initial Home page
Move the detailed documentation out of the README The README is now a short introduction; these pages hold the details that used to follow it (wallet overview, the Trace layout and the other workspace controls, analysis, reports, labels, fiat values, data sources and limits, development, publishing a copy). The paragraphs were moved word for word; two references were repointed. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>