Example reports

Each page is an offline replay of recorded public chain data: the same report make demo and make reports write. Nothing here runs live. Click a report to open its dashboard, alerts, incidents and the data behind them.

Incident replay

NEAR Intents / HOT Bridge drain, 30 Sep - 1 Oct 2026

NEAR-side probing and ledger tampering, then five BNB Chain withdrawals of 3,865,000 USDT. One incident reaches under_attack, and the guard wallet's answers come with their testnet transactions.

window 2.2 days alerts 133 first high alert 31h 40m before W1 highest mode under attack

Out-of-sample check

Rules frozen first, then run on 1 - 26 Oct 2026

Data the rules never saw, counted from 8 Oct after the warm-up. One false under_attack on Ethereum, reported as measured.

window 17.3 days alerts 62 high 5 highest mode under attack

Out-of-sample check

After the rate-rule fix, 26 Oct - 1 Nov 2026

The fix frozen before this data was fetched. Nothing goes past paranoid, but the window is too quiet to test the fix itself, and the report says so.

window 6.8 days alerts 35 high 1 highest mode paranoid

Normal operations

8 - 29 Sep 2026, in sample

Ordinary traffic the thresholds were tuned on: what the false-alarm table looks like as an analyst's queue.

window 21 days alerts 84 high 3 highest mode paranoid

Benign lookalike

A 768,574 USDT payout to a new recipient, 24 Sep 2026

It trips the same spike rule as the drain, with nothing else behind it, so the answer is delay, never pause.

window 2 days alerts 12 high 1 highest mode paranoid

The rules were written after the public post-mortem of the drain, so its timing is a best case. The out-of-sample reports are the real test. Code, quick start and results: github.com/surs51/IntentWatch.