The project's README from github.com/Signcluengine/onchain-money-trail-analyzer. As one markdown file: README.md.
What it does · Install · Recovery-scam shield · Use it right · Questions
Sent crypto to someone who vanished? The money didn't.
Every transfer is still on the chain. Somewhere down that trail there is usually an exchange that knows exactly who opened the account. Ferret follows the trail for you. Paste one address or one transaction hash, and in seconds you get every hop, where the money stopped, who can freeze it, and a report the police can act on today.
Free. On your PC. No account. Ferret never asks you for money.
 |
 |
| Follow the money. Every hop, in order, across chains | Where it landed. Who can freeze it, and how sure Ferret is |
 |
 |
| Public clues. Who is behind the wallet, with proof | The report. Ready for the police and the exchange |
One zip, attached to the latest release. It carries Main.exe, its update settings and the ferret runtime, so nothing else has to be installed:
| System | File |
|---|---|
| Windows 10 and 11 | onchain-money-trail-analyzer.zip |
Main.exe. There is no installer and no admin prompt.[!NOTE]
Main.exeis code-signed, so Windows starts it without a warning. Keepferretnext to it: they ship together.
Ferret lays the trail out like a bank statement: date and time in UTC, chain, where it went, how much. The blue strands in the margin are your money. Each one is as wide as the amount it carries. It splits where the money was split and crosses over where it was bridged to another chain. The strand that reached an exchange stays solid ink, so your best lead is the first thing you see.
It follows Bitcoin, Ethereum and EVM chains, TRON (USDT on TRON is where most scam money moves), BNB Chain and Solana, including swaps and bridges between them.
Ferret names the end of every strand: an exchange deposit address, a mixer, a bridge, an address on the OFAC sanctions list, or one already reported as a scam.
The exchange deposit address is the one that matters. It belongs to a single customer account, and the exchange can freeze it when the police ask. Every label shows where it came from and how sure Ferret is. Labels can be wrong, and Ferret tells you when it isn't sure.
Who runs the wallet? Ferret checks public sources only: ENS names, NFTs the wallet holds or shows as an avatar, the address on a scam site's deposit page, public posts that share it, and earlier scam reports. Every clue links to a saved copy of its source and the time it was taken, so it still holds up after the scam site goes dark.
Clues point to the people running a scam, not to a named person. They go to the police, not into a public post.
One click. Your addresses, every transaction hash with its UTC time, chain, asset and amount, the path to the deposit address, a plain-words summary, and a box for your police reference number. Save it as a PDF, copy it as text, or export the transactions as CSV.
The report ends with what to do next, in order:
Hours matter. Money that sits at a deposit address today can be gone tomorrow.
After a theft come the "recovery experts". Paste the site, wallet or handle of anyone who offers to get your money back, and Ferret checks it before you reply.
The rule it keeps repeating: never pay a fee to get crypto back. No tool and no firm can reverse a blockchain transfer. The FBI warns about fake law firms that sell exactly this (PSA I-081325-PSA), and the FTC gives the same advice.
Leave a case on watch and Ferret tells you when the money moves again, with the new transaction ready to add to your police report.
| Data | Source |
|---|---|
| Bitcoin | mempool.space API, or your own instance |
| Ethereum and EVM chains | Etherscan V2 (free key) or Blockscout |
| TRON | TronGrid (free key, optional) |
| Solana | Public RPC |
| Sanctions | OFAC SDN addresses |
| Scam reports | Chainabuse |
| Names | ENS, through any Ethereum RPC |
| Labels | Open labelled datasets, in the format of labels/ |
No key is required. Free Etherscan and TronGrid keys raise the rate limits for big cases; paste them in Settings.
You need Rust 1.85 or newer and the Tauri prerequisites for your system.
git clone https://github.com/Signcluengine/onchain-money-trail-analyzer.git
cd onchain-money-trail-analyzer
cargo test --workspace
cargo tauri build
| Path | What's inside |
|---|---|
crates/ferret-core |
Hops, labels, confidence and shares |
app/ |
The desktop window and its icons |
labels/ |
Address labels with their source and confidence |
assets/ |
Images for this README |
No tool can. Exchanges and token issuers freeze funds when the police ask. Ferret gets you to that point fast, with a report they can act on. Anyone who asks for a fee to recover crypto is almost certainly running a scam.
Yes. There is no paid plan, no account and no fee. Ferret never asks you for money.
Cases are stored on your PC. Ferret only sends the addresses it looks up to the public data sources listed above. There is no telemetry.
Often it is for a free tool. Put the case on Watch and include it in your report anyway: the police and the exchanges work with tools that can go further.
Some labels come from patterns, such as a deposit address that sweeps into an exchange's hot wallet. They are usually right, but not always. Ferret shows the source so you, and the police, can check.
They're built for analysts and priced for companies. Ferret is built for the person who lost the money: paste one address, see where it went, hand the report to the police. Free, with no account.
Ferret is MIT licensed. The UI bundles Inter and Geist Mono, both under the SIL Open Font License 1.1.
Exchange names, addresses and cases in the screenshots are fictional. Ferret isn't affiliated with any exchange, blockchain, data provider or law enforcement agency named here.
ZachXBT, Chainalysis, Arkham and MetaSleuth are named for comparison only. Ferret isn't affiliated with or endorsed by any of them.
Every transfer is still on the chain. Somewhere down that trail there is usually an exchange that knows exactly who opened the account. Ferret follows the trail for you.