Eight real missions from the field. Source code where available.
High-performance Bitcoin blockchain indexer in Go. Ingests Bitcoin Core RPC data into PostgreSQL 16 with Apache AGE graph support for address/transaction lookups, UTXO tracking, and analytics.
Terminal-based real-time chat over Telnet & HTTP APIs. AES-256 encryption, PostgreSQL persistence, Redis pub/sub, and Tailscale for secure peer-to-peer communication.
A from-scratch in-memory database built in Go — implementing core Redis data structures, persistence, and wire protocol from the ground up.
Fast Go-based network traffic monitor with real-time packet analysis, GeoIP insights, and observability support. Inspect live traffic at the interface level.
Private intelligence tool for tracking ransomware incidents and threat actors. Aggregates attack data, victim timelines, and group activity. Deployed and operational.
Tracing and observability tooling built with TypeScript. Tracks execution paths and system events for debugging distributed operations.
Reads Bitcoin P2P network traffic from .pcap files captured on port 8333. Reassembles TCP streams across split packets, parses Bitcoin P2P messages, extracts tx commands, and decodes each transaction — TXID, raw hex, output addresses, and satoshi values. Supports SegWit and legacy outputs.
Bitcoin CoinJoin detection engine that indexes the blockchain and detects Whirlpool, Wasabi, JoinMarket, and Stonewall patterns using research-backed structural heuristics. Stores results in PostgreSQL and serves a queryable REST API for blockchain forensics, privacy research, and adoption analysis.
