soxoj · soxoj · Apr 21, 2026 · Apr 21, 2026 · Apr 21, 2026 · Apr 21, 2026
diff --git a/.gitignore b/.gitignore
@@ -44,3 +44,4 @@ settings.json
 *.egg-info
 build
 LLM
+lib
diff --git a/docs/source/use-cases/crypto.rst b/docs/source/use-cases/crypto.rst
@@ -0,0 +1,147 @@
+.. _use-case-crypto:
+
+Cryptocurrency & Web3 Investigations
+=====================================
+
+Blockchain transactions are public, but the people behind wallets are not. Maigret helps bridge this gap by finding Web3 accounts tied to a username, revealing the person behind a pseudonymous crypto persona.
+
+Why it matters
+--------------
+
+Crypto investigations often start with a wallet address or an ENS name but hit a wall — the blockchain tells you *what* happened, not *who* did it. A username, however, is reused across platforms. If someone trades on OpenSea as ``zachxbt`` and posts on Warpcast as ``zachxbt``, Maigret connects the dots and builds a full profile.
+
+Common scenarios:
+
+- **Scam attribution.** A rug-pull promoter uses the same alias on Fragment (Telegram username marketplace), OpenSea, and a personal blog.
+- **Sanctions compliance.** Verifying whether a counterparty's online footprint matches known sanctioned individuals.
+- **Due diligence.** Before an OTC deal or DAO vote, checking whether the other party has a consistent online presence or is a freshly created sockpuppet.
+- **Stolen funds tracing.** A stolen NFT appears on OpenSea under a new account — but the username matches a Warpcast profile with real-world links.
+
+Supported sites
+---------------
+
+Maigret currently checks the following crypto and Web3 platforms:
+
+.. list-table::
+   :header-rows: 1
+   :widths: 20 40 40
+
+   * - Site
+     - What it reveals
+     - Notes
+   * - **OpenSea**
+     - NFT collections, trading history, profile bio, linked website
+     -
+   * - **Rarible**
+     - NFT marketplace profile, collections, listing history
+     - Complements OpenSea for NFT attribution across marketplaces
+   * - **Zora**
+     - Zora Network profile, minted NFTs, creator activity
+     - Ethereum L2 creator platform; useful for on-chain art attribution
+   * - **Polymarket**
+     - Prediction-market profile, positions, public portfolio P&L
+     - Useful for political/financial prediction attribution
+   * - **Warpcast** (Farcaster)
+     - Decentralized social profile, posts, follower graph, Farcaster ID
+     - Every Farcaster ID maps to an Ethereum address via the on-chain ID registry
+   * - **Fragment**
+     - Telegram username ownership, TON wallet address, purchase date and price
+     - Valuable for linking Telegram identities to TON wallets
+   * - **Paragraph**
+     - Web3 blog/newsletter, ETH wallet address, linked Twitter handle
+     - Richest cross-platform data among crypto sites
+   * - **Tonometerbot**
+     - TON wallet balance, subscriber count, NFT collection, rankings
+     - TON blockchain analytics
+   * - **Spatial**
+     - Metaverse profile, linked social accounts (Discord, Twitter, Instagram, LinkedIn, TikTok)
+     - Rich cross-platform links
+   * - **Revolut.me**
+     - Payment handle: first/last name, country code, base currency, supported payment methods
+     - Not strictly Web3, but widely used by crypto OTC traders for fiat off-ramps; the public API returns structured KYC-adjacent data
+
+Real-world example: zachxbt
+---------------------------
+
+`ZachXBT <https://twitter.com/zachxbt>`_ is a well-known on-chain investigator. Let's see what Maigret can find from just the username ``zachxbt``:
+
+.. code-block:: console
+
+   maigret zachxbt --tags crypto
+
+Maigret finds 5 accounts and automatically extracts structured data from each:
+
+**Fragment** — confirms the Telegram username ``@zachxbt`` is claimed, reveals the TON wallet address (``EQBisZrk...``), purchase price (10 TON), and date (January 2023).
+
+**Paragraph** — the richest result. Returns the real name used on the platform (``ZachXBT``), bio (``Scam survivor turned 2D investigator``), an Ethereum wallet address (``0x23dBf066...``), and a linked Twitter handle (``zachxbt``). The ``wallet_address`` field is especially valuable — it directly links the pseudonym to an on-chain identity.
+
+**Warpcast** — Farcaster profile with a Farcaster ID (``fid: 20931``), profile image, and social graph (33K followers). Every Farcaster ID is tied to an Ethereum address via the on-chain ID registry, so this is another on-chain anchor.
+
+**OpenSea** — NFT marketplace profile with bio (``On-chain sleuth | 10x rug pull survivor``), avatar (hosted on ``seadn.io`` with an Ethereum address in the URL path), and a link to an external investigations page.
+
+**Hive Blog** — blockchain-based blog account created in March 2025. Low activity (1 post), but confirms the username is claimed across blockchain ecosystems.
+
+From a single username, Maigret produces:
+
+- **2 wallet addresses** — one TON (from Fragment), one Ethereum (from Paragraph)
+- **1 confirmed Twitter handle** — ``zachxbt`` (from Paragraph)
+- **1 Telegram username** — ``@zachxbt`` (from Fragment)
+- **1 external link** — ``investigations.notion.site`` (from OpenSea)
+- **Social graph data** — 33K Farcaster followers, blog activity timestamps
+
+This is enough to pivot into blockchain analysis tools (Etherscan, Arkham, Nansen) using the wallet addresses, or into social media analysis using the Twitter handle.
+
+Workflow: from username to wallet
+---------------------------------
+
+**Step 1: Search crypto platforms**
+
+.. code-block:: console
+
+   maigret <username> --tags crypto -v
+
+Review the results. Pay attention to:
+
+- **Fragment** — if the username is claimed, you get a TON wallet address directly.
+- **Paragraph** — blog profiles often contain an ETH address and a Twitter handle.
+- **Warpcast** — Farcaster IDs map to Ethereum addresses via the on-chain registry.
+- **OpenSea** — avatar URLs sometimes contain wallet addresses in the path.
+
+**Step 2: Expand with extracted identifiers**
+
+Maigret automatically extracts additional identifiers from found profiles (real names, linked accounts, profile URLs) and recursively searches for them. This is enabled by default. If Maigret finds a linked Twitter handle on a Paragraph profile, it will automatically search for that handle across all sites.
+
+**Step 3: Cross-reference with non-crypto platforms**
+
+The real power is connecting crypto personas to mainstream accounts. Drop the tag filter:
+
+.. code-block:: console
+
+   maigret <username> -a
+
+This checks all 3000+ sites. A match on GitHub, Reddit, or a forum can reveal the person behind the wallet.
+
+Workflow: from wallet to identity
+---------------------------------
+
+If you start with a wallet address rather than a username, you can use complementary tools to get a username first:
+
+1. **ENS / Unstoppable Domains** — resolve the wallet address to a human-readable name (``vitalik.eth``). Then search that name in Maigret.
+2. **Etherscan labels** — check if the address has a public label (exchange, known entity).
+3. **Fragment** — search the TON wallet address to find which Telegram usernames it purchased.
+4. **Arkham Intelligence / Nansen** — blockchain attribution platforms that may tag the address with a known identity.
+
+Once you have a username candidate, feed it to Maigret.
+
+Tips
+----
+
+- **Username reuse is the #1 signal.** Crypto-native users often reuse their ENS name (``alice.eth``) or a variation (``alice_eth``, ``aliceeth``) across platforms. Try all variations.
+- **Fragment is uniquely valuable** because it directly links Telegram usernames to TON wallet addresses — a rare on-chain / off-chain bridge.
+- **Warpcast profiles are Ethereum-native.** Every Farcaster account is tied to an Ethereum address via the ID registry contract. If you find a Warpcast profile, you implicitly have a wallet address.
+- **Paragraph often has the richest data** — wallet address, Twitter handle, bio, and activity timestamps in a single API response.
+- **Use** ``--exclude-tags`` **to skip irrelevant sites** when you're focused on crypto:
+
+  .. code-block:: console
+
+     maigret alice_eth --exclude-tags porn,dating,forum
diff --git a/maigret/resources/data.json b/maigret/resources/data.json
@@ -2620,7 +2620,8 @@
         },
         "Paypal": {
             "tags": [
-                "finance"
+                "finance",
+                "fintech"
             ],
             "checkType": "message",
             "absenceStrs": [
@@ -6041,6 +6042,7 @@
         "Venmo": {
             "tags": [
                 "finance",
+                "fintech",
                 "us"
             ],
             "checkType": "status_code",
@@ -8952,6 +8954,7 @@
         "banki.ru": {
             "disabled": true,
             "tags": [
+                "finance",
                 "ru"
             ],
             "engine": "engine404",
@@ -16017,7 +16020,8 @@
             "usernameUnclaimed": "noonewouldeverusethis7",
             "alexaRank": 108253,
             "tags": [
-                "finance"
+                "finance",
+                "fintech"
             ]
         },
         "forum.kineshemec.ru": {
@@ -24307,7 +24311,12 @@
             ],
             "url": "https://cash.app/${username}",
             "usernameClaimed": "john",
-            "usernameUnclaimed": "noonewouldeverusethis7"
+            "usernameUnclaimed": "noonewouldeverusethis7",
+            "tags": [
+                "finance",
+                "fintech",
+                "us"
+            ]
         },
         "Castingcallclub": {
             "checkType": "message",
@@ -29522,6 +29531,7 @@
             "disabled": true,
             "tags": [
                 "finance",
+                "fintech",
                 "ru"
             ],
             "urlProbe": "https://api.qiwi.me/piggybox/{username}",
@@ -34880,6 +34890,39 @@
                 "social"
             ]
         },
+        "Polymarket": {
+            "url": "https://polymarket.com/@{username}",
+            "urlMain": "https://polymarket.com",
+            "checkType": "status_code",
+            "usernameClaimed": "shayne",
+            "usernameUnclaimed": "noonewouldeverusethis7",
+            "tags": [
+                "crypto"
+            ]
+        },
+        "Zora": {
+            "url": "https://zora.co/@{username}",
+            "urlMain": "https://zora.co",
+            "checkType": "status_code",
+            "usernameClaimed": "jacob",
+            "usernameUnclaimed": "noonewouldeverusethis7",
+            "tags": [
+                "crypto",
+                "nft"
+            ]
+        },
+        "Revolut.me": {
+            "url": "https://revolut.me/{username}",
+            "urlProbe": "https://revolut.me/api/web-profile/{username}",
+            "urlMain": "https://revolut.me",
+            "checkType": "status_code",
+            "usernameClaimed": "adamp",
+            "usernameUnclaimed": "noonewouldeverusethis7",
+            "tags": [
+                "finance",
+                "fintech"
+            ]
+        },
         "Fragment": {
             "url": "https://fragment.com/username/{username}",
             "urlMain": "https://fragment.com",
@@ -35385,6 +35428,7 @@
         "erotic",
         "fashion",
         "finance",
+        "fintech",
         "forum",
         "freelance",
         "gambling",

diff --git a/maigret/resources/db_meta.json b/maigret/resources/db_meta.json
@@ -1,8 +1,8 @@
 {
     "version": 1,
-    "updated_at": "2026-04-21T08:51:46Z",
-    "sites_count": 3143,
+    "updated_at": "2026-04-21T09:05:55Z",
+    "sites_count": 3144,
     "min_maigret_version": "0.6.0",
-    "data_sha256": "839ad4bc48719e4145564ef55c96995e9dbf91e43cda1fdac96d7d3475794caa",
+    "data_sha256": "8a24e0d08b964fb1d6133e90c5580f5dd73d4aba8f567013e7df831e530624bd",
     "data_url": "https://raw.githubusercontent.com/soxoj/maigret/main/maigret/resources/data.json"
 }
-Original file line number
+Diff line change
@@ Expand Up / @@ -44,3 +44,4 @@ settings.json @@
     *.egg-info
     build
     LLM
+    lib