Криптоинвестор

Platform: hackerlab | Category: OSINT | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2025-12-24 | Status: Solved Techniques: Multi-chain transaction hash search, TON blockchain API analysis, Transaction memo/comment field extraction

Summary

Task: Find the flag hidden in a cryptocurrency transaction given a 64-character hex hash. Solution: Searched multiple blockchains, found the transaction on TON (The Open Network), and extracted the flag from the transaction's comment/memo field.

Криптоинвестор — Hackerlab

Description

"Я инвестировал в криптовалюту и случайно отправил все свои монеты на непонятный кошелек"

Given: 19a317da0d9538497bdd818f0f3132f9825ab73bbc2814a667cc9cfc3fdc419a

64-character hex hash — standard SHA256/transaction hash format used by many blockchains.

Analysis

Hash Format

• 64 hex characters = 32 bytes = SHA256 hash
• Used as transaction ID in many blockchains
• Need to determine which blockchain this transaction belongs to

Blockchain Search

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Major blockchains checked with no results:

Discovery on TON

Transaction found on TON (The Open Network) — a blockchain created by the Telegram team.

Solution

Step 1: Query TON API

 bash read-only • copy allowed Copy
curl -s "https://tonapi.io/v2/blockchain/transactions/19a317da0d9538497bdd818f0f3132f9825ab73bbc2814a667cc9cfc3fdc419a" | jq

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 2: Transaction Analysis

Transaction details:

• Blockchain: TON (The Open Network)
• Date: April 24, 2023 (timestamp: 1682344972)
• Sender: UQD_NwWmvp994dP0pijaxxlqh57ePTxr1MzDMiKZiJr5ow1W
• Receiver: UQASe-Mq3WluVt-zf3Og3Al04_Gt82StYFMnEIwX35LUEzGq
• Amount: 535 nanoTON

Step 3: Extract Flag from Comment

The flag is located in the decoded_body.text field of the transaction:

 json read-only • copy allowed Copy
{
  "in_msg": {
    "decoded_body": {
      "text": "CODEBY{REDACTED}"
    }
  }
}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Alternative Methods

Via toncenter.com API

 bash read-only • copy allowed Copy
curl -s "https://toncenter.com/api/v3/transactions?hash=19a317da0d9538497bdd818f0f3132f9825ab73bbc2814a667cc9cfc3fdc419a"

Via Web Interface

Open in browser:

https://tonscan.org/tx/19a317da0d9538497bdd818f0f3132f9825ab73bbc2814a667cc9cfc3fdc419a

Useful Resources

TON Blockchain Explorers

• https://tonapi.io — API for programmatic access
• https://toncenter.com — Alternative API
• https://tonscan.org — Web explorer interface
• https://ton.cx — Another explorer ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Multi-blockchain Search

• https://blockchair.com — Supports multiple blockchains
• https://blockchain.com — Bitcoin, Ethereum
• https://etherscan.io — Ethereum and EVM-compatible chains

Lessons

1. TON is often overlooked — when searching for crypto transactions, check beyond BTC/ETH
2. Transaction comments — can contain arbitrary data, including flags
3. Hash format is universal — 64 hex characters are used by many blockchains
4. API vs Explorer — programmatic access via API is often more convenient than web interface ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍