I built an open source Bitcoin AML forensics tool in TypeScript that runs on Android

Rajesh S — Wed, 18 Mar 2026 12:29:20 +0000

ChainTrail — Open Source Bitcoin AML Forensics
I spent the last few weeks building ChainTrail, a real-time Bitcoin
transaction monitoring and AML forensics platform. The interesting part?
I built and run the entire thing on my Android phone using Termux.

What it does

ChainTrail connects to the live Bitcoin mempool via WebSocket and lets
investigators trace fund flows across the blockchain graph.

Live demo: https://cary-uncompensated-joanie.ngrok-free.dev

Key features

Live mempool stream via mempool.space WebSocket
Transaction graph tracer using PostgreSQL recursive CTEs
Interactive D3.js graph visualization
1,258+ threat intel entries (WannaCry, Lazarus Group, Silk Road, OFAC)
ML risk scoring 0-100 with feature extraction
Address clustering using Union-Find heuristic
Pattern detection: layering, smurfing, fan-out, peeling chain
Case management with PDF report export
Ethereum support with Tornado Cash detection
Webhook alerts via Telegram and Discord

Tech stack

Backend: Node.js + TypeScript + Express
Database: PostgreSQL (recursive CTEs for graph traversal)
Cache: Redis
Frontend: Next.js + Tailwind + D3.js
Data: mempool.space WebSocket

**The interesting part — graph traversal

**
The core of ChainTrail is a PostgreSQL recursive CTE that walks the
Bitcoin transaction graph:


sql
WITH RECURSIVE tx_graph AS 
![ ](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5wfcjbr368zg7k70ow5o.jpg)(
  SELECT i.from_address, t.txid, o.value_satoshi, 1 AS hop,
         ARRAY[i.from_address] AS path
  FROM tx_inputs i
  JOIN transactions t ON t.txid = i.txid
  JOIN tx_outputs o ON o.txid = t.txid
  WHERE o.to_address = $1

  UNION ALL

  SELECT i.from_address, t.txid, o.value_satoshi, g.hop + 1,
         g.path || i.from_address
  FROM tx_graph g
  JOIN tx_inputs i ON ...
  WHERE g.hop < $2
    AND NOT (i.from_address = ANY(g.path))
)
SELECT * FROM tx_graph ORDER BY hop;
This lets you trace any Bitcoin address N hops backward to find the
origin of funds — identifying mixers, exchanges, and sanctioned wallets
along the way.
**ML Risk Scoring**
Each address gets a risk score 0-100 based on extracted features:
Direct threat intel match → +40 to +100
Proximity to bad actor (hop distance) → decays with distance
Fan-out pattern (sending to many addresses) → +20
Fan-in pattern (receiving from many) → +15
Known exchange → -30 (reduces false positives)
Cluster risk level → +5 to +50

**What I learned**
PostgreSQL recursive CTEs are surprisingly powerful for graph
traversal — no graph database needed
mempool.space WebSocket pushes ~6 new transactions every few seconds
Union-Find is the right data structure for address clustering
Running a full stack on Android is actually practical for development
**What's next**
OFAC sanctions auto-sync from US Treasury
Better ML model trained on labeled data
Lightning Network support
Deploy to cloud for production use
Links
GitHub: https://github.com/rajeshselvam02/chaintail
Live demo: https://cary-uncompensated-joanie.ngrok-free.dev
Pricing: https://chaintail-landing.vercel.app
Built with ❤️ by Rajesh Selvam
---

DEV Community: Rajesh S

I built an open source Bitcoin AML forensics tool in TypeScript that runs on Android

What it does

Key features

Tech stack

**The interesting part — graph traversal