Focus shows one transaction or address and what is around it (depth = steps away). Double-click a vertex, or click a row under Funded by / Spent by / Transactions in the details, to move there; ◀ ▶ (or Alt+←/→) go back and forward through where you have been. Untick Focus to see everything loaded.
Addresses can be pasted in any case or as an explorer link; bc1… is lower-cased for you, legacy 1…/3… addresses are case-sensitive and checked before anything is sent.
Click a vertex to inspect it. Without Focus, double-click loads its neighbours. Drag a vertex to pin it; drag the background to pan; scroll to zoom.
Edges run in the direction money moves. Width = amount (log scale). Dashed = output not spent yet. Each edge is one coin; several coins between the same two vertices (say 14 inputs of one transaction from one wallet) are drawn as one arrow labelled "14 inputs · total": click it for the list of coins, or untick One arrow for coins between the same two vertices under View to draw each coin.
Shape size shows value (a transaction's total output, a wallet's total received). Under View, Proportional makes the area of a shape proportional to its value, Compact uses a log scale where sizes differ little, and Auto uses Proportional in the Force layout (and the trace's Force and Timeline + force arrangements) and Compact elsewhere. The Force layout leaves room for the shapes.
Squares are transactions (hollow = not loaded), circles addresses, diamonds coinbase, hexagons OP_RETURN.
Trace (under Layout) shows one wallet or transaction. Click ▶ beside it to show where the money went, ◀ for where it came from; each click moves one wallet along the chain and the vertices already on screen stay put. Double-click = ▶, [ ] = ◀ ▶ for the selected vertex, Ctrl+Z takes a step back, right-click for Hide this branch. Nothing is ever removed by a click. When an arrow has more than 5 behind it (change this under Expansion limits), the click opens a list instead of flooding the screen: the top few come ticked (the largest, unless you chose another order), and you can sort it (largest, smallest, newest, oldest: your choice is remembered), narrow it by amount or date, and see who is on the other side. Hover an arrow for the count, total and dates behind it; Shift-click always opens the list. Select vertices (Shift-click, or Ctrl+A) and use Hide selected / Keep only selected; right-click gives Hide this vertex, Hide this branch and Select this branch. Dragging one of several selected vertices moves them all together. Opening a new wallet or transaction adds it as another starting point; Start over from here replaces the trace. Ctrl+Z undoes any of these.
Arrange (in the Trace layout's bar): A trace starts in Columns, which keeps the vertices where you put them. Flow lays out exactly the vertices you traced left to right in the direction the money moves (go back to Columns and every vertex returns to where you had put it), Timeline spreads them over time (left to right), Timeline + force does that and also pulls connected vertices to the same height so a chain runs straight across and branches fan out above and below it, Force pulls connected vertices together in any direction, and Time × amount spreads them over time with the bigger amounts higher up, on a log scale with a scale at the left. What is shown is still only what you revealed; the other arrangements place it all again each time you add something, Columns never moves what is there. Where x is time a transaction can only be dragged up and down, so it stays at its time; hold Shift to move it sideways. Wallets have no time of their own and drag anywhere.
Selecting and hiding work in every layout. Click, Shift-click to add, or drag a box (Shift-drag, or switch ⬚ Box on with B); Select ▾ picks everything, all wallets, all transactions, everything above an amount, or a tag; Ctrl+A selects all on screen. Hide selected (or Delete) takes them off the screen without deleting anything, Keep only selected hides the rest, Hidden (n) shows some or all of them again, and Ctrl+Z undoes. Hide is not Delete: Shift+Delete (or Delete from workspace, in every layout including a trace) really deletes a vertex from the workspace, and the message offers Undo (so does Undo load in the top bar).
The time axis along the top of the Timeline layout and of the trace's time arrangements is a line with ticks and timestamps. Hover it to read the exact time under the pointer; hover a transaction and its exact time appears on the line. Inside a shortened (Compact) gap the time shown is only interpolated and is marked ≈. In the trace's Columns arrangement the line carries a timestamp over each transaction instead of a scale, since the columns are not time.
Time line: the scale shows the span of what is on screen; each dot is one transaction at its exact time (hover for the timestamp, click to select it; click a bar to select the transactions in it). Drag the two handles to show only a time window; T or the arrow folds the bar away.
Backup server: with mempool.space or Blockstream.info chosen, If it keeps failing, use … instead (on by default) lets the other one answer when the first throttles you (HTTP 429), fails or does not answer: a throttled request moves at once, other failures after one retry, and the failing server is left alone for about a minute. The message says when it switches, and each transaction keeps the server that actually sent it (the report lists both). The backup sees those look-ups too: turn the option off to keep everything on the one server. It is never used with Tor or your own server.
Key for your own server: with My own Esplora URL chosen, an optional key or token is sent with every request to that server, in the header you name (Authorization by default). It never goes to another server, into an address, an export or a report, and is forgotten when the page closes unless you tick Remember on this computer; a server that refuses it (401 or 403) is reported as that. Requests at once and Pause between starts set the pace.
A wallet's transactions in the details are told apart: ↓ in (green), ↑ out (orange) and ↔ self, each with who is on the other side, the date and the amount. All / In / Out filter them, the order can be newest, oldest, largest or smallest first (or known or labelled first), show and unspent only narrow it as in the arrow list, hovering a row outlines it on the graph, and + show puts just that transaction on the trace (in the other layouts, onto the graph). Tick rows (or all listed) to act on several at once: Show on graph and As one vertex in a trace, Show on graph and Select on graph elsewhere, and Copy ids. Change that came back to the wallet is netted off.
Time bar and arrows: with the time bar narrowed (drag its ends), the arrows in the Trace layout count and show only what falls inside that range, because what is outside would not be drawn; the tip says how many more are outside, and a transaction whose time is unknown is kept. Switch it off under Expansion limits. In a trace you can also drag across the time line's graph to choose a stretch of time for the arrows alone (it hides nothing); the × on its chip clears it. In the arrow list, show narrows to skip known services or only known or labelled wallets, unspent only keeps outputs not spent yet (where that applies), and Known or labelled first is an order.
Group vertex (Trace layout): several hidden neighbours of a vertex can stand on the trace as one vertex (a stack of cards). Make it from a group in a wallet's Transactions or in the arrow list (◼ as one, or Ticked as one). Select it to see every member; Show the largest, Show all and Choose which… put members on the trace; double-click shows the largest few. It is only a way of showing hidden vertices: it is not in the graph or the exports, and the report lists every member. A group can have a label, a tag and a note, and Undo after an auto-expand puts a vertex back in its group.
Grouping: three or more rows with the same wallet on the other side, or three or more small ones (under the limit in Expansion limits), fold into one line in a wallet's Transactions and in the list behind an arrow: "12 transactions to bc1q… · 2022-03 → 2022-06 · 0.0001 to 0.002 BTC each". Click it to list them, copy their ids, or (in a trace) put the largest few or all of them on it; in the arrow list its box ticks them all. Nothing is hidden: every row stays one click away, and Group similar rows switches it off. Group rows by (Expansion limits) can fold by month, week, day or year instead.
Copy: every address and transaction id has a small copy icon beside it (in the details, the lists under it, the balances, the clusters, the Previous/Next list and the bar under the graph); the right-click menu has Copy txid / Copy address, and Ctrl+C on the graph copies the selected addresses and transaction ids, one per line (when no text is selected). With several selected, the details offer Copy n addresses and Copy n transaction ids.
Find (the field in the top bar: click it, or press Ctrl+F while the canvas is focused) searches what is already loaded, on screen or not: any part of an id or address, your label, tag and note, a block height, a name from the built-in list or a label pack, or a cluster such as C3. Several words must all match. ↑ ↓ choose, Enter goes to it (a vertex that is not shown is brought in: in a trace as another starting point, which Undo takes back), Esc closes. An id that is not loaded yet offers to add it.
Undo and Redo: ⟲ Undo (Ctrl+Z) takes back the last step: in a trace a reveal, a hide, a group, an added starting point, a start over or a Re-layout; in the other layouts a hide or a Re-layout. ⟳ Redo (Ctrl+Shift+Z or Ctrl+Y) puts back what Undo took away; doing something new ends the chain. Re-layout places everything again and releases the vertices you dragged, and is one Undo step.
Adding: once something is open the top box says Add. In a trace what you add becomes another starting point; several ids or addresses can be pasted at once (up to 10). Shift+Enter or Shift-click starts over with it instead.
Undo load (top bar) takes back the last thing that changed what is loaded: opening or expanding something, an auto-expand, an import, a removal or Clear, with the graph, the focus and the trace as they were. Use it when a very large wallet or transaction was loaded by mistake (a toast offers it too after a big load); press Cancel first if it is still loading. It keeps the last 10 changes in memory only, and a change too large to copy cannot be undone. ↷ Redo load puts back what it took away, until something changes what is loaded.
Balance: a wallet's details show what the server says it holds now, with when it was read. Load balance reads just that (one request); select several wallets for a list of balances and their total, and Load n balances for the ones not read yet. Received here and Sent from here count only what is loaded in the graph.
The investigation report (Export menu) is one HTML file for what is on screen: a summary, the findings with their reasons, the transactions in time order with inputs and outputs, the wallets, the graph as a picture, where and when every transaction was fetched, and the method and limits. It embeds the evidence as data and states its SHA-256, so a reader can check the file was not changed afterwards (tools/verify_report.py).
Label packs (left panel) import lists of wallets and names from a CSV (address,label,category,url,note) or JSON file, such as an exchange's addresses, or OFAC's sanctions list (SDN_XML.ZIP, SDN_ENHANCED.ZIP or SDN_ADVANCED.ZIP), which is read directly. They appear as known (pack name) with a gold ring, stop an auto-expand like any known wallet, and can be switched off or removed. Export writes your own labels and tags in the same format to share with a colleague. A pack is someone else's claim, not a finding.
Analysis looks for patterns in what is loaded: CONSOL (many inputs gathered into one or two outputs), BATCH (a few inputs paying many outputs), COINJOIN? (several wallets' inputs and several outputs of exactly the same value to different addresses) and PEEL (a run of transactions that each pay a smaller amount, more than dust, out of a single coin and pass the rest on). A peel chain is named after the transaction it starts at (P-65a1) and has one colour, so both stay the same whatever else is loaded. Badges show their text where it fits and become small dots in the pattern's colour when zoomed out or crowded; point at or select a vertex to read its badge and chain name. Each kind can be switched off under Flag patterns on transactions. Detections, under the findings in the right-hand panel, lists every pattern found, oldest first, with its reason: filter it by kind or by chain, click a row to select that transaction and bring it into view, or copy the list. Pick a chain there (or open one of its steps) to light it up on the graph with numbered steps, show just that chain as a trace, or follow it further. A transaction's details also say which output most likely returns to the sender, and why; that output's edge is coloured amber. Clusters group addresses that were spent together in one transaction, which usually means one owner, and are drawn with a dashed ring in one colour; CoinJoin-like transactions are left out, and you can leave out any other by hand. All of it is heuristic: it shows its reasons and none of it is proof.
Routes and open ends (Findings): each known wallet says whether money ran between it and the reference (the first starting point, or the vertex you pick under Relative to): ◀ upstream (its money reached the reference) or ▶ downstream, with the number of transactions. Click it to light the route: each coin followed to the transaction that spent it, never by matching addresses, shown in the trace (Ctrl+Z takes it back) and listed in the Findings with Copy route. A route is not carried across a service wallet such as an exchange unless there is no other way, and it says so; a step that merges many inputs is named. A route shows the money could have travelled that way, not who controls the wallets between, and no route only means none in what is loaded: search upstream or downstream loads from both ends, within the Auto-expand limits, until a route appears or it runs out. Open ends list where the trail from the reference is still open (outputs never looked up, spenders or funders not loaded) with Continue from these, which follows them with the Auto-expand settings. Service hand-offs list where the trail meets a service wallet (a deposit or a withdrawal), and a wallet that a sanctions or ransomware list names that it passes (marked named), as a table to copy or download as CSV, and the report and the assistant evidence carry it. Suggested names offer a list's name, or a label you gave, for wallets spent together with a named one (a guess: nothing is named until you choose Name them). A wallet with thousands of transactions says that only the newest are loaded. The grey Not on screen chip counts what is loaded but not drawn and lists the named wallets, hand-offs and open ends among it; the report says at the top how many loaded vertices it leaves out.
Assistant gives an AI assistant the evidence and checks what it says. Copy for assistant copies the instructions and the evidence as text (triage, a draft of the findings text, an explanation of the selected vertex, or a challenge of the findings) to paste into any assistant. The findings come from the analysis; a model only reads, ranks or words them. Check ids compares every transaction id and address in an answer with the workspace and names the ones that are not there, which is how a made-up id is caught. Ask the local model does it with a model on this computer (Ollama, LM Studio, llama.cpp): only localhost or 127.0.0.1 is accepted, no key is sent, nothing leaves the machine. Claude is the one exception, off whenever the page opens: switched on and given your Anthropic API key, it shows the exact text and, after you confirm, sends the evidence to Anthropic (api.anthropic.com), and a marker shows in the Assistant heading while it is on. A model's text is a draft, not evidence.
Auto-expand follows the money several transactions in one go, forward or backward, from the selected vertex, stopping at the limits you set (hops, transactions, requests) and at labelled wallets or CoinJoins. Follow chooses every output, the largest, the likely change, or a peel chain. In the Trace layout everything it loaded is shown and one Ctrl+Z takes it back.
Right-click a wallet or transaction for its actions: tag it (EXCH, THREAT, …), look a wallet up in Arkham (with your own key, through the proxy) or open Arkham's page for it in a new tab (Check in Arkham: no key, and Arkham is told what you are looking at), load more. Tags give a vertex a colour, a shape and a badge; set them next to the label in the details (VICTIM is blue and points down, THREAT is red and points up). A vertex you wrote a note on carries a small yellow note at its lower right.
Previous / Next under the graph step along the money: from a transaction to the wallets it paid (or that paid in), from a wallet to the transactions that spent from it. One choice moves at once; several open a list.
Keys: [ previous, ] next, C controls (in full screen, over the graph), D details, T time line, B box select, Ctrl+A select all, Ctrl+Z undo, Del hide, Esc deselect (or leave full screen), F fit, M full screen, / search.
Hopline is open source: source code · documentation · Apache-2.0.
Hopline