Skip to content
Get packs

Ransomware Payment Wallet Tracer

Traces ransomware bitcoin payment flows on public blockchains to support investigations and attribution.

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
3 files

What it does

Once installed, the agent can take a ransomware wallet address and look up its public transaction history on blockchain explorers, map where the money moved (consolidation, mixers, exchange deposits, peel chains), check the address against known ransomware wallet lists, and draft a structured attribution report. The skill is written for passive, read-only analysis of public blockchain data, and it explicitly says not to interact with ransomware operators or intercept payments.

Great for

  • Incident responders and threat intelligence analysts reviewing a ransom note's payment address
  • Investigators or compliance teams gathering fund-flow evidence for law enforcement or sanctions work
  • Security students learning how blockchain forensics is structured

Skip it if

  • Anyone wanting to pay, negotiate with, or contact ransomware operators: the skill forbids this and it is illegal in many places without authorization
  • Definitive attribution or legal evidence on its own: the outputs are heuristic, the sample report shows illustrative figures, and results need verification with professional tools such as Chainalysis or OFAC checks
  • Live monitoring or real-time interception of payments, which the skill does not support

Try asking

  • “Trace where the bitcoin from this ransom note address (bc1q...) went after the payment was made”
  • “Check whether this wallet address is linked to known ransomware families or reused across victims”
  • “Build a fund-flow summary and cluster analysis for an incident report on a LockBit payment”
  • “Validate Bitcoin address formats from a ransom note and query their transaction history”
Step-by-step guide: how to use Ransomware Payment Wallet TracerInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.

    analyzing-ransomware-payment-wallets.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip analyzing-ransomware-payment-wallets.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip analyzing-ransomware-payment-wallets.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Run the agent only on wallet addresses taken from ransom notes or incident data you are authorized to investigate, and keep a record of queries for chain of custody.
  • Treat the built-in known-wallet list as a small starting point and cross-check results against WalletExplorer, OXT and an official threat intelligence source before relying on them.
  • Review scripts/agent.py before running it, since it makes live API calls, and confirm the sample report figures are not presented as real findings.

What's inside

  • references/api-reference.md
  • scripts/agent.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.