Guide · Agent skill
How to use the Ransomware Payment Wallet Tracer agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The Ransomware Payment Wallet Tracer is an agent skill, a packaged set of instructions and scripts that an AI agent such as Claude can load and follow. Once installed, it lets the agent follow the public transaction history of a ransomware payment address and describe where the money went. This guide shows how to install it, how to ask for the analysis in plain language, and what its limits are.
Ransomware Payment Wallet Tracermukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Download and unzip. Download the skill ZIP from this page and unzip it. You should see SKILL.md, references/api-reference.md and scripts/agent.py.
- 2Place the folder. Move the unzipped folder into ~/.claude/skills/ for personal use or .claude/skills/ inside a project. Alternatively, upload it under Settings → Capabilities → Skills in the Claude apps.
- 3Install Python dependencies. Make sure Python 3.8 or newer is available, then run pip install requests.
- 4Ask with the wallet address. Start a request that matches the skill's purpose and include the ransom note address. Say what you want, such as a fund-flow map or a report.
- 5Verify the output. Check the agent's findings against a second source, such as WalletExplorer, OXT or an OFAC list check, before you rely on any attribution.
What the skill makes the agent do
The skill covers ransomware cryptocurrency payment flows. It uses blockchain analysis sources named in its instructions, including blockchain.com APIs, WalletExplorer and Blockstream.info, to look up an address's transactions and balances.
From there the agent maps fund movement: consolidation into one wallet, funds sent to mixers, deposits to exchanges, and peel chains of sequential small outputs. It can check the address against known ransomware wallet lists and draft a structured attribution report. The skill is written for passive, read-only analysis of public blockchain data.
- Look up an address's transaction history and balance
- Trace outputs to downstream addresses and flag mixer, exchange and peel-chain patterns
- Group related addresses into clusters using the common-input-ownership and change-address heuristics
- Compare addresses against the OFAC SDN list and known wallet databases
- Draft an attribution report
How to install the skill
Download the skill ZIP from this page and unzip it. Then place the folder in one of two locations. For a personal install available across your projects, use ~/.claude/skills/. For a single project, put it in that project's .claude/skills/ folder.
If you use the Claude apps instead, you can upload the skill under Settings → Capabilities → Skills.
The package contains SKILL.md, which holds the instructions, references/api-reference.md with the API endpoints and response fields, and scripts/agent.py.
- Personal install: ~/.claude/skills/
- Project install: .claude/skills/ inside your project
- Claude apps: Settings → Capabilities → Skills, then upload
How to trigger the skill with natural requests
You do not need a special command. The skill is meant to load when your request matches its purpose: tracing ransomware bitcoin payments, performing cryptocurrency wallet forensics, or gathering blockchain threat intelligence on extortion payments. Give the agent the address and say what you need.
Include the context that matters for your work, such as whether the address came from a ransom note and what output you want. The agent will then run the lookups and summarize the findings.
- Trace the payment flow for this ransom note address: bc1q...
- Look up the transaction history for this Bitcoin address from a ransom note and map where the funds went
- Check whether this wallet is linked to known ransomware infrastructure and list related addresses
- Draft an attribution report for this extortion payment address using the blockchain data
Example: tracing a ransom wallet step by step
A typical run starts with the address. The skill describes the common formats it can recognise: Bitcoin P2PKH addresses starting with 1, P2SH addresses starting with 3, Bech32 addresses starting with bc1, and Ethereum addresses starting with 0x. It also notes that Monero addresses are much harder to trace.
The skill includes a Python function that queries the blockchain.com rawaddr endpoint and returns the transaction count, total received, total sent and final balance in satoshis. The agent can run similar queries against WalletExplorer and Blockstream.info to check entity labels and balances.
- Confirm the address format before querying APIs
- Retrieve the transaction history
- Trace outputs and note consolidation, peel chains and mixer use
- Check entity labels and known wallet lists
- Verify findings against other sources before relying on them
import requests
def get_wallet_transactions(address):
url = f"https://blockchain.info/rawaddr/{address}"
resp = requests.get(url, timeout=30)
resp.raise_for_status()
data = resp.json()
return {"address": address, "n_tx": data.get("n_tx", 0), "final_balance_satoshi": data.get("final_balance", 0), "transactions": data.get("txs", [])}What the skill needs to run
The skill requires Python 3.8 or newer and the requests library, installed with pip install requests. The SKILL.md prerequisites also list the json and hashlib libraries. The machine needs internet access to the blockchain.info, walletexplorer.com and blockstream.info APIs.
Two paid or account-based options are optional: a Chainalysis Reactor licence for enterprise cluster analysis, and an OXT.me account for transaction graph visualisation. The skill works without them but cannot use those tools.
- Python 3.8+
- requests library (pip install requests)
- Internet access to blockchain.info, walletexplorer.com and blockstream.info
- Optional: Chainalysis Reactor licence
- Optional: OXT.me account
pip install requestsSafety notes: scripts and network access
This skill runs scripts and uses the network. Its scripts/agent.py file and its API calls go to the three public blockchain services listed above. Read the scripts before you run them in a sensitive environment, especially if your organisation restricts outbound connections.
The skill's own rules forbid live payment interception and any direct interaction with ransomware operators. Do not ask the agent to contact, pay or negotiate with the operators. The source notes this is illegal in many places without authorisation.
- Review scripts/agent.py before running it
- Expect outbound requests to blockchain.info, walletexplorer.com and blockstream.info
- Do not use the skill to contact or pay ransomware operators
- Do not use it for real-time monitoring or interception, which it does not support
What people use it for
- An incident responder checks where a ransom note's Bitcoin address has sent funds during an investigation.
- A threat intelligence analyst looks for wallet reuse across several ransomware incidents.
- A compliance team gathers fund-flow evidence for a sanctions review and checks addresses against the OFAC SDN list.
- A security student follows a documented example to learn how blockchain forensics is structured.
Frequently asked questions
Is the ransomware payment wallet tracer skill free?
The skill is published under the Apache-2.0 licence. It relies on public blockchain APIs and the free WalletExplorer tool described in its instructions. Chainalysis Reactor requires its own licence and is optional.
What do I need to install the skill?
You need Python 3.8 or newer, the requests library installed with pip install requests, and internet access to blockchain.info, walletexplorer.com and blockstream.info. Then place the folder in ~/.claude/skills/ or a project's .claude/skills/ folder.
Where do I upload an agent skill in Claude?
In the Claude apps, go to Settings → Capabilities → Skills and upload the skill there. For Claude Code style setups, place the folder in ~/.claude/skills/ or the project's .claude/skills/ directory.
Can this skill identify who is behind a ransomware attack?
Not on its own. The skill's outputs are heuristic, and its sample report uses illustrative figures. Results need verification with professional tools such as Chainalysis or OFAC checks before they count as evidence.
Does the skill contact ransomware operators or pay the ransom?
No. The skill forbids interacting with ransomware operators and intercepting payments. It is designed for passive, read-only analysis of public blockchain data.
How does it compare with Chainalysis Reactor or OXT.me?
The skill uses public explorers and APIs and can be run by an agent from plain-language requests. Chainalysis Reactor is an enterprise platform with entity attribution and cross-chain tracing, and OXT.me offers UTXO graph visualisation. The skill's documentation lists them as optional complements, not replacements.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use this skill if you are an incident responder, threat intelligence analyst, investigator or security student who needs a structured, read-only first pass on a ransom payment address and can verify the results. Pick a professional platform such as Chainalysis Reactor if you need court-ready attribution, entity labels across many chains, or live monitoring, which this skill does not provide.
Download the skill