Listen to this Post
Introduction:
Blockchain investigations often fail when analysts hit performance limits tracking wallet connections across thousands of addresses. Obsidian, a free note‑taking platform, transforms into a powerful graph analytics engine when paired with custom scripts and APIs—enabling investigators to visualize tens of thousands of crypto addresses and their relationships in under an hour, without expensive commercial tools.
Learning Objectives:
- Build a free, scriptable OSINT investigation workspace using Obsidian and community plugins
- Automate blockchain data extraction via REST APIs (Etherscan, Blockchain.com) with Python/PowerShell
- Create interactive graph visualizations of wallet clusters and transaction flows for threat intelligence
You Should Know:
- Turn Obsidian into a Blockchain Investigation Graph Engine
Obsidian’s core strength lies in its plain‑text Markdown files and a plugin ecosystem that supports JavaScript, Python scripts, and API calls. By combining the Dataview plugin (for querying notes as a database), Templater (for dynamic script execution), and Obsidian Graph View, you can ingest blockchain data and display every connection between 500+ addresses instantly—completely free.
Step‑by‑step setup:
- Install Obsidian from obsidian.md (Windows/Linux/macOS).
2. Create a new vault named `Crypto_OSINT`.
- Enable community plugins: Settings → Community plugins → Turn off safe mode → Browse.
– Install Dataview, Templater, and Advanced URI.
4. Create a folder `scripts/` inside the vault.
- Add a Python script `fetch_wallets.py` (see code below). Ensure Python 3 is installed.
Linux / Windows commands to run the script:
Linux/macOS python3 ~/Documents/Obsidian/Crypto_OSINT/scripts/fetch_wallets.py Windows (PowerShell) python C:\Users\%USERNAME%\Documents\Obsidian\Crypto_OSINT\scripts\fetch_wallets.py
Example Python script – fetch transaction links from Etherscan API:
import requests
import json
import os
API_KEY = "YOUR_ETHERSCAN_API_KEY" Get free at etherscan.io
ADDRESSES = ["0xAddress1", "0xAddress2"] replace with your list
output_dir = "Crypto_OSINT/wallets"
os.makedirs(output_dir, exist_ok=True)
for addr in ADDRESSES:
url = f"https://api.etherscan.io/api?module=account&action=txlist&address={addr}&apikey={API_KEY}"
resp = requests.get(url).json()
if resp["status"] == "1":
for tx in resp["result"][:20]: limit for demo
from_addr = tx["from"]
to_addr = tx["to"]
Create markdown note linking addresses
note = f"""
tags: [bash]
from: [[{from_addr}]]
to: [[{to_addr}]]
value: {tx["value"]}
Transaction {tx["hash"]}
[[{from_addr}]] → [[{to_addr}]]
Amount: {int(tx["value"])/1e18} ETH
"""
with open(f"{output_dir}/{tx['hash']}.md", "w") as f:
f.write(note)
print(f"Processed {addr}")
After running, Obsidian’s graph view (Core plugin → Graph view) will show every connection as a node–link diagram. Use the Local Graph to explore 500+ addresses simultaneously.
2. Automating Bulk Address Enrichment with OSINT APIs
Scraping 10,000 addresses manually is impossible. Use free APIs with rate‑limiting respect to pull balances, labels, and clustering info. For blockchain investigations, prioritize Chainabuse, Blockchain.com, and Etherscan (or BscScan for BSC). The following PowerShell script (Windows) and bash script (Linux) automate multi‑API lookups and write results directly into Obsidian notes.
Windows PowerShell (save as `Get-AddressInfo.ps1`):
$apiKey = "YOUR_API_KEY"
$addresses = Get-Content "addresses.txt" one address per line
foreach ($addr in $addresses) {
$uri = "https://api.etherscan.io/api?module=account&action=balance&address=$addr&tag=latest&apikey=$apiKey"
$response = Invoke-RestMethod -Uri $uri
$balance = [bash]::Round($response.result / 1e18, 4)
$note = @"
address: $addr
balance: $balance ETH
Wallet $addr
Balance: $balance ETH
<a href="https://etherscan.io/address/$addr">Etherscan Link</a>
"@
$note | Out-File -FilePath "C:\Obsidian\Crypto_OSINT\wallets\$addr.md" -Encoding utf8
Start-Sleep -Seconds 0.2 respect rate limit
}
Linux bash with `jq` (install via sudo apt install jq):
!/bin/bash
API_KEY="YOUR_API_KEY"
while read addr; do
curl -s "https://api.etherscan.io/api?module=account&action=balance&address=$addr&tag=latest&apikey=$API_KEY" | \
jq --arg addr "$addr" '{
"address": $addr,
"balance": (.result | tonumber / 1e18)
}' > "/home/user/Obsidian/Crypto_OSINT/wallets/$addr.json"
sleep 0.2
done < addresses.txt
API Security Best Practices:
- Store API keys as environment variables (
$env:ETHERSCAN_KEYin PowerShell, `export ETHERSCAN_KEY` in Linux) – never hardcode. - Use `.gitignore` to exclude API keys and wallet lists.
- Implement exponential backoff for rate limits (Etherscan allows 5 calls/sec; use `sleep` accordingly).
- Clustering Wallets with Graph Analytics (Python + NetworkX)
Raw address lists are useless without clustering. Use NetworkX to identify wallets belonging to the same entity (e.g., an exchange or a fraud ring). The following script builds a graph from transaction history, runs connected components, and exports clusters back to Obsidian.
Step‑by‑step guide (Linux/macOS/Windows WSL):
1. Install dependencies: `pip install networkx requests pandas`
2. Create `cluster_wallets.py` in your Obsidian script folder.
import networkx as nx
import requests
import os
from collections import defaultdict
API_KEY = os.getenv("ETHERSCAN_KEY")
ADDRESSES = ["0x...", "0x..."] list of known addresses
G = nx.Graph()
for addr in ADDRESSES:
url = f"https://api.etherscan.io/api?module=account&action=txlist&address={addr}&apikey={API_KEY}"
data = requests.get(url).json()
if data["status"] == "1":
for tx in data["result"]:
G.add_edge(tx["from"], tx["to"])
cluster detection
clusters = list(nx.connected_components(G))
for idx, cluster in enumerate(clusters):
cluster_file = f"clusters/cluster_{idx}.md"
os.makedirs("clusters", exist_ok=True)
with open(cluster_file, "w") as f:
f.write(f" Cluster {idx}\nSize: {len(cluster)}\n\nAddresses:\n")
for addr in cluster:
f.write(f"- [[{addr}]]\n")
print(f"Written {cluster_file}")
Open Obsidian → refresh file explorer → click on any cluster note → use local graph view to see interconnection density. For investigators: clusters with >20 addresses and high internal transaction volume often indicate commercial exchanges or money mules.
- Automating Daily Ingest with Cron (Linux) / Task Scheduler (Windows)
Threat intelligence requires continuous monitoring. Automate the data pull to keep your Obsidian graph current.
Linux (cron job for daily at 2 AM):
crontab -e Add line: 0 2 /usr/bin/python3 /home/user/Obsidian/Crypto_OSINT/scripts/fetch_wallets.py && /usr/bin/python3 /home/user/Obsidian/Crypto_OSINT/scripts/cluster_wallets.py
Windows Task Scheduler (PowerShell script):
<!-- Save as ObsidianTask.xml, then import via Task Scheduler --> <?xml version="1.0" encoding="UTF-16"?> <Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task"> <Triggers> <CalendarTrigger> <StartBoundary>2025-03-01T02:00:00</StartBoundary> <Repetition><Interval>PT24H</Interval></Repetition> </CalendarTrigger> </Triggers> <Actions> <Exec> <Command>powershell.exe</Command> <Arguments>-File "C:\Obsidian\Crypto_OSINT\scripts\Get-AddressInfo.ps1"</Arguments> </Exec> </Actions> </Task>
After automation, the graph updates daily without manual intervention. Add a Dataview query in Obsidian to list recently changed wallets:
LIST FROM "wallets" WHERE file.mtime >= date(today) - dur(1 day) SORT file.mtime DESC
5. Mitigating Supply Chain Risks in OSINT Toolchains
The comment thread highlights a critical risk: Obsidian sync being paywalled forces teams to use third‑party sync (Dropbox, Google Drive, Git), introducing supply chain attack vectors. If an attacker compromises your sync provider or injects malicious plugins, your entire investigation graph can be poisoned.
Hardening steps:
- Self‑host sync: Use `Syncthing` (open source, encrypted p2p) instead of Obsidian Sync.
- Install: `sudo apt install syncthing` (Linux) or download for Windows.
- Share only the Obsidian vault folder.
- Verify plugin integrity: Download plugins from GitHub releases, check SHA256 hashes. Example:
Linux curl -sL https://github.com/obsidianmd/obsidian-dataview/releases/latest/download/main.js | sha256sum Compare with official hash
- Restrict API key permissions: Use read‑only API keys for Etherscan/Blockchain.com. Never use admin keys.
- Run scripts in isolated environment: Use Docker or Windows Sandbox for untrusted address enrichment.
Windows Sandbox script (run inside isolated container):
Inside sandbox, no persistent storage python fetch_wallets.py Export results only after scanning
- Creating an Interactive Dashboard with Obsidian + Leaflet Map
For geographic OSINT (e.g., identifying IP‑to‑wallet connections), combine Obsidian with the Leaflet plugin. The following step‑by‑step maps wallet clusters onto a physical map using free GeoIP data.
Steps:
1. Install Obsidian Leaflet plugin from community plugins.
- Enrich addresses with IP data (e.g., from blockchain nodes or darknet market logs).
Hypothetical enrichment API: `curl https://api.ip2location.io/?ip=8.8.8.8`
3. Create a markdown note `map_dashboard.md` with:
```bash Wallet Cluster Map lat: 40.7128 lon: -74.0060 zoom: 3 marker: cluster_A, 40.7128, -74.0060 marker: cluster_B, 51.5074, -0.1278 marker: cluster_C, 35.6895, 139.6917
[bash]
- Automate marker generation via Python script that writes coordinates to the `.md` file.
This turns Obsidian into a full‑fledged threat intelligence platform—free, offline‑first, and extensible.
What Undercode Say:
– Graph analytics is no longer enterprise‑exclusive – With Obsidian + free APIs, solo investigators can map 10,000+ addresses at zero cost, democratizing blockchain forensics.
– Security of the toolchain is often overlooked – Supply chain attacks via sync services or plugins are real threats; always self‑host or verify integrity.
The hack here isn’t a vulnerability—it’s a capability gap. Most analysts accept the myth that “you need Chainalysis for scale.” This workflow proves otherwise. However, the risk of data leakage when using free API keys (hardcoded in scripts) is high. Always rotate keys and use environment secrets. Future investigations will combine Obsidian with local LLMs (via Ollama) to auto‑tag suspicious transaction patterns, making AI‑driven OSINT accessible to everyone.
Prediction:
Within 18 months, open‑source knowledge‑graph tools like Obsidian will replace 30% of commercial blockchain investigation platforms. As regulators demand transparency, we’ll see pre‑built Obsidian “investigation vaults” distributed by law enforcement agencies. The paywalled sync problem will accelerate adoption of decentralized storage (IPFS, Arweave) for sharing threat intelligence graphs without a central point of failure—shifting the attack surface from API keys to graph poisoning attacks. Prepare for AI agents that automatically expand clusters by predicting wallet relationships from on‑chain patterns.
▶️ Related Video (82% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Rugpullfinder Every – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
