Dark Tracers

Platform: scarlet | Category: Forensics | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2026-01-09 | Status: Solved Techniques: utxo_analysis, transaction_chain_tracing, blockchain_forensics

Summary

Dark Tracers — Scarlet CTF

Description

Would you look at that!? We have a fake murder-for-hire case on our desk. Lovely. Anyway, ASAC Bobr wants you to trace through the transaction to identify the most likely hash that indicates the payment made from the perp to the scammer for the agreed upon amount.

Here is what we believe is the transaction made from a Bitcoin ATM to one of the addresses associated with the perpetrator's wallet: 427e04420fffc36e7548774d1220dad1d20c1c78dd71ad2e1e9fd1751917a035

Find the transaction made from the victim to the scammer and upload the transaction hash as the flag!

Here is the press release for the case: https://www.justice.gov/usao-ndtx/pr/woman-sentenced-9-years-dark-web-murder-hire-plot

FLAG FORMAT: RUSEC{hash} ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Analysis

Step 1: Gather Context from Press Release

The DOJ press release reveals critical information about the case:

• Subject: Michelle Murphy, 58, sentenced to 9 years for dark web murder-for-hire plot
• Key Detail: "On July 27, 2023, she transferred approximately 0.358 BTC ($10,510) to a Bitcoin wallet she believed belonged to the murder-for-hire recipient"
• Important Note: The "hitman" was actually a scammer who never intended to carry out the murder

This gives us the target amount to look for: ~0.358 BTC ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 2: Analyze Initial Transaction

Starting transaction: 427e04420fffc36e7548774d1220dad1d20c1c78dd71ad2e1e9fd1751917a035

Using Blockstream API:

 bash read-only • copy allowed Copy
curl -s "https://blockstream.info/api/tx/427e04420fffc36e7548774d1220dad1d20c1c78dd71ad2e1e9fd1751917a035" | jq

Transaction Details:

• Block: 800406 (July 27, 2023)
• Two outputs:
  • bc1qadgwek3qhng2jfc25epwuvg4cfsuq3dy4p8ccj: 23,393,837 sats (0.234 BTC)
  • bc1qt33f8ya0w4ges34f23a0xtkvflzutn0u2gy3gl: 34,112,412 sats (0.341 BTC) ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 3: Trace Transaction Chain

Following the outputs from the initial transaction:

 bash read-only • copy allowed Copy
# Get transactions for first output address
curl -s "https://blockstream.info/api/address/bc1qadgwek3qhng2jfc25epwuvg4cfsuq3dy4p8ccj/txs" | jq

# Get transactions for second output address  
curl -s "https://blockstream.info/api/address/bc1qt33f8ya0w4ges34f23a0xtkvflzutn0u2gy3gl/txs" | jq

Found consolidation transaction:

• TX: 2503bad8b5a1b4ff4555c28632475cd148a96e631ee1fdee0935b2b487c63ae1
• This consolidated funds to address: bc1q44mw0cffurnex8jxqvtvap3fwv3et0v9lxdc3t ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 4: Identify Payment to Scammer

Continuing to trace from the consolidation address:

 bash read-only • copy allowed Copy
curl -s "https://blockstream.info/api/address/bc1q44mw0cffurnex8jxqvtvap3fwv3et0v9lxdc3t/txs" | jq

Found the payment transaction:

• TX: REDACTED
• Block: 800695 (July 29, 2023)
• Output: 35,848,829 sats = 0.35848829 BTC
• Destination: 1DyodhmYorFDcPRSmJt49bs6Wh559K6FSN

Step 5: Verification

Amount Match:

• Press release states: "approximately 0.358 BTC ($10,510)"
• Transaction amount: 0.35848829 BTC ≈ 0.358 BTC ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

This is the payment from the perpetrator (Michelle Murphy) to the scammer posing as a hitman.

Solution

 bash read-only • copy allowed Copy
#!/bin/bash
# Bitcoin Transaction Tracing Script

INITIAL_TX="427e04420fffc36e7548774d1220dad1d20c1c78dd71ad2e1e9fd1751917a035"
API="https://blockstream.info/api"

# Step 1: Get initial transaction details
echo "[*] Analyzing initial transaction..."
curl -s "$API/tx/$INITIAL_TX" | jq '.vout[] | {address: .scriptpubkey_address, value_btc: (.value / 100000000)}'

# Step 2: Get outputs and trace
ADDR1="bc1qadgwek3qhng2jfc25epwuvg4cfsuq3dy4p8ccj"
ADDR2="bc1qt33f8ya0w4ges34f23a0xtkvflzutn0u2gy3gl"
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

echo "[*] Tracing address 1..."
curl -s "$API/address/$ADDR1/txs" | jq '.[].txid'

echo "[*] Tracing address 2..."
curl -s "$API/address/$ADDR2/txs" | jq '.[].txid'

# Step 3: Found consolidation TX
CONSOLIDATION_TX="2503bad8b5a1b4ff4555c28632475cd148a96e631ee1fdee0935b2b487c63ae1"
echo "[*] Analyzing consolidation transaction..."
curl -s "$API/tx/$CONSOLIDATION_TX" | jq '.vout[] | {address: .scriptpubkey_address, value_btc: (.value / 100000000)}'

# Step 4: Trace from consolidated address
CONSOLIDATED_ADDR="bc1q44mw0cffurnex8jxqvtvap3fwv3et0v9lxdc3t"
echo "[*] Tracing consolidated address..."
curl -s "$API/address/$CONSOLIDATED_ADDR/txs" | jq '.[] | {txid, vout: [.vout[] | {address: .scriptpubkey_address, value_btc: (.value / 100000000)}]}'
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Step 5: Verify payment transaction
PAYMENT_TX="REDACTED"
echo "[*] Payment transaction details:"
curl -s "$API/tx/$PAYMENT_TX" | jq '{
  txid: .txid,
  block_height: .status.block_height,
  outputs: [.vout[] | {address: .scriptpubkey_address, value_btc: (.value / 100000000)}]
}'

echo ""
echo "[+] Flag: RUSEC{$PAYMENT_TX}"

Transaction Flow Diagram

Bitcoin ATM Deposit
        |
        v
[TX: 427e0442...] (Block 800406 - July 27, 2023)
        |
        +---> bc1qadgwek... (0.234 BTC)
        |           |
        |           v
        +---> bc1qt33f8y... (0.341 BTC)
                    |
                    v
        [TX: 2503bad8...] (Consolidation)
                    |
                    v
            bc1q44mw0c... (Consolidated funds)
                    |
                    v
        [TX: 57ce32d1...] (Block 800695 - July 29, 2023)
                    |
                    v
            1DyodhmY... (0.35848829 BTC) <-- SCAMMER'S ADDRESS

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Tools & Resources

Lessons Learned

1. OSINT Integration: Blockchain forensics often requires correlating on-chain data with off-chain information (press releases, court documents)
2. Amount Matching: Specific BTC amounts mentioned in legal documents can be used to identify target transactions
3. Transaction Chaining: Funds often flow through multiple addresses before reaching final destination
4. Consolidation Patterns: Watch for transactions that combine multiple UTXOs before making the final payment
5. Timeline Correlation: Block timestamps help verify transaction timing matches case timeline ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍