Blockchain Incident Replay

How it works

Reconstructs an on-chain incident from one or more transactions: decodes each one, tries a call trace for internal ETH movements, nets every ETH and token transfer per address, and highlights the likely attacker cluster, its profit and the biggest losers — as an ordered timeline and a value-flow graph. Works offline on pasted receipts.

• Each transaction is decoded with the Transaction Decoder (function, status, fee, ERC-20 transfers with symbols/decimals); if that is unavailable the receipt is read directly and Transfer(address,address,uint256) logs with 3 topics are parsed.
• debug_traceTransaction with the callTracer is attempted for internal ETH transfers (calls with value at depth > 0, DELEGATECALL excluded). Public RPC nodes usually do not expose the debug namespace; then only the top-level transaction value is counted and the result says so (set RPC_URL_<CHAIN> to a tracing node for full coverage).
• Net flow per address and asset = received − sent across all transactions in the incident. Transactions are ordered by block number and transaction index.
• Attacker heuristic: the transaction senders, contracts they created within the incident, and called contracts that end with a net gain form the suspect cluster; the sender of the earliest transaction is the likely attacker. Victims = addresses outside the cluster with the largest net losses. This is a heuristic, not attribution.
• USD values (optional): DefiLlama historical prices at the first transaction's timestamp (coins.llama.fi/prices/historical), per token contract and native coin. Unpriced assets are listed.