Out-of-sample check

Out-of-sample check, 1 - 26 Oct 2026

What the frozen ruleset raises on treasury payouts after the drain, from 1 Oct 16:00 to 26 Oct 00:00 UTC, on data that played no part in writing or tuning it. No incident is known in this window to us; every alert is a false positive or an unexplained observation unless the notes say otherwise. The first 7 days warm up the baselines, so alerts are counted from 8 Oct 16:00.

scenario oct-oos window 17.3 days chains Ethereum, BNB Chain, NEAR rules 16 enabled events in window 42,085 generated 2026-11-04T22:14:01Z

Dashboard

Total alerts

5 high57 medium

Level 12 or above

on 4 transactions

Incidents

1 under attack2 paranoid12 normal

Highest SHIELD mode

under attack

recommended by any incident in the window

Events analyzed

42,085

Ethereum 30,949BNB Chain 8,742NEAR 2,394

Analyst notes what this example shows

Rules frozen before this data was replayed and not tuned after it, and shown here as they were then: this replay keeps the correlator of that freeze. See config/ruleset_freeze.yaml.
One incident reached under_attack with no known incident behind it. On 21 Oct, R2 fired in two consecutive hours on the NEAR Intents treasury on Ethereum, which paid about 11.7M USD in 3 hours, and the correlator counted that as high alerts on two transactions within 2h. An ordinary payment on that route is answered pause for 53 hours. It was not tuned away on this window: the correlator was changed afterwards, frozen again, and run on later data in scenario oct26-oos.
The out-of-sample rate is about twice the in-sample one: 0.29 high alerts a day against 0.14. HOT treasury traffic on BNB Chain fell by more than half after the drain, so that side is less exercised.
NEAR is a seeded random sample of block windows, not every block: see the coverage line of the false-positive table. No NEAR rule fired anywhere in it, which is weak evidence.

Timeline everything on one time axis (UTC); each payout lane has its own scale

Alert severity criticalhighmediumlow payout, no alert SHIELD mode normal paranoid under attack reference event Hover a mark for details, click it to drill down

Kill chain alerts by stage of a bridge drain, rules ranked by alerts (IntentWatch's own taxonomy, loosely after MITRE ATT&CK tactics)

Stage 1 Probing 0alerts silent: R6B, R6C
Stage 2 Ledger tampering 0alerts silent: R8, R6
Stage 3 Withdrawal 0alerts silent: R8B
Stage 4 Treasury drain 62alerts first 08 Oct 16:19
Stage 5 Fund movement 0alerts silent: R7B, R7

Level	Rule	What it detects	Alerts in window	First (UTC)
1. Probing0 alerts · silent: R6B R6C
2. Ledger tampering0 alerts · silent: R8 R6
3. Withdrawal0 alerts · silent: R8B
4. Treasury drain62 alerts · silent: R3B R9B R4
8	R5	Payout over $500K to a recipient first seen less than 7 days ago	26	08 Oct 16:19
8	R1	Treasury payout far above recent maximum	14	09 Oct 06:51
8	R3	Small test payout followed by a large payout to the same recipient	11	12 Oct 01:47
8	R10	Burst of large treasury payouts to one new counterparty	6	10 Oct 04:20
12	R2	Treasury outflow velocity above its 7-day p99	4	09 Oct 12:00
12	R1B	Treasury payout spike to a recipient first seen less than 7 days ago	1	10 Oct 07:16
5. Fund movement0 alerts · silent: R7B R7

Events

Security events 62 alerts in the window (67 in the whole replay), most severe first; click a column header to sort, a row for the full document

62 hits

2026-10-09 12:00:39

BNB Chain

R2_VAULT_OUTFLOW_VELOCITYTreasury drain

bsc hot_bridge usdt outflow 1,186,300.15 in 1h vs 7d hourly p99 494,975.27

0xd33084d3...3887

Click a field to copy its value.

timestamp	2026-10-09T12:00:39Z
rule.id	R2_VAULT_OUTFLOW_VELOCITY
rule.level	12
rule.severity	high
rule.description	Treasury outflow velocity above its 7-day p99
rule.groups	evm, treasury, payout, velocity
rule.tactic	Treasury drain
rule.weight	2.0
data.tx	0xd33084d3841e54a42b485f5c2f9d718f7d1b56bc07918fd45bca4165224b3887
data.block	126632139
data.ts	2026-10-09T12:00:39Z
data.chain	bsc
data.kind	payout
data.amount	632160.273469
data.symbol	usdt
data.from	0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
data.tx_submitter	0xcf495cea699b8beca4073279eda66882ccfa273c
data.vault	hot_bridge
data.token	bsc:usdt
data.address	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
scope.address	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
evidence.value_field	amount_usd
evidence.window_sum	1186300.145744287312195565
evidence.window	1h
evidence.baseline_percentile	99.0
evidence.baseline_value	494975.26692004275784065728
evidence.baseline_buckets	168
evidence.baseline_horizon	7d
evidence.factor	2.0
evidence.threshold	989950.53384008551568131456
evidence.window_txs	0x3c0bcb5369268ea176bb0311f6841ea746783694d31c54a35a002082955acab7, 0x2dd0ebac14ea804c636a16a3e47e9c9f0de8e17d8704d34389556ccb28df6ac8, 0xa3b9ab72b2d4c6bf3c9af54d21dbe0071936676ec5c87d352a079cc4f58405ee, 0x1b48e1e00094de5d161492f6b6537b08546ba175bdb65a5501da366b01f0cf5d, 0x2ea71ed00b46c87ee3fd2f5ec41382e92c62850c49553ad516f48f9c0cd5b76d, 0xb5d374d218003cb79fba6f5d978d4b7afd50f73e1bebafa97f6adda947a03e04, 0x3b41aed24ffea48ac40ee1419ec92d0f02ae62abece3f05c8178d4dba5a5a0cd, 0x285b0caf2a48815303a33136d3686eb5d7a23aee8ddb3b563d47763c7d377e8d, 0x32d238abc5cc22d747ec8768f259561c3f758c7e5317fdfbbe4ad9d29a603f09, 0x9572b66aa45253fa0656569e2ce8f34aa445cf75dc3b3b900f155872fc78e7b7, 0x2247cd6b2a15ca791161e3ac6e70b43b0c10ceb93f03e86348b3794ce4587667, 0x36354482b29839f59e42ed9277d34dfdd2e8da85e14d36893b0d1cf4af137073, 0x7526392daeabf86df17be170e07ae2bccfc68a83d7dd66d8adaba6728d73665d, 0x069bde1d539239221ea772d572f6b5f65e1a04d38ed92a5a015629f5e5c0f410, 0x0fbabfb7533114792e56113de2005ceab39cf13dc894ec619d028b9e3ef1992e, 0x3f54e8c52cd7d4f8e3f26366f39c222629cfb6f425a19a210726b5ea4f4bbc6c, 0xb63a0ca26be1bbb363c090c7a706dc112631beebfe3ae8c8f55b808f0fac1880, 0x509d84459a049bd26e2ecad6bc1a88c567b96cb66706e32ddc2a8ca7cf1eb682, 0x0d2ef07a76b656bca8bc267ca5b1e2a72fc4caaee3a04ab80e0e3ca9423cf526, 0xd33084d3841e54a42b485f5c2f9d718f7d1b56bc07918fd45bca4165224b3887
evidence.window_tx_count	31
matched[0]	kind=payout eq payout
matched[1]	vault=hot_bridge in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdt in ['usdt', 'usdc']
shield.mode	paranoid
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-10-10 07:16:11

Ethereum

R1B_PAYOUT_SPIKE_TO_NEW_RECIPIENTTreasury drain

ethereum near_intents paid 2,814,780.12 usdt to 0x4117ffb93a592865e37f8e3d5de77053de7f9879: 2.43x the 48h max of 1,157,274.61, recipient first seen 0s ago

0x2d0e5d40...8230

Click a field to copy its value.

timestamp	2026-10-10T07:16:11Z
rule.id	R1B_PAYOUT_SPIKE_TO_NEW_RECIPIENT
rule.level	12
rule.severity	high
rule.description	Treasury payout spike to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, spike, composite
rule.tactic	Treasury drain
rule.weight	3.0
data.tx	0x2d0e5d4094e798c710abc3dd03b73eb92f14830e4ef6b14e093808d0bea78230
data.block	26160476
data.ts	2026-10-10T07:16:11Z
data.chain	ethereum
data.kind	payout
data.amount	2814780.12
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x4117ffb93a592865e37f8e3d5de77053de7f9879
data.vault	near_intents
data.token	ethereum:usdt
data.address	0x4117ffb93a592865e37f8e3d5de77053de7f9879
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0x4117ffb93a592865e37f8e3d5de77053de7f9879
evidence.value_field	amount_usd
evidence.value	2814780.12
evidence.baseline_max	1157274.61327
evidence.baseline_tx	0x6e7641c2f3cd1c183c56a60943648d017049734e8b1cf1dadd1f8b2d94e76a23
evidence.baseline_ts	2026-10-09T21:54:59Z
evidence.baseline_window	48h
evidence.baseline_events	3208
evidence.ratio	2.43
evidence.factor	2.0
evidence.min_value	50000
evidence.address	0x4117ffb93a592865e37f8e3d5de77053de7f9879
evidence.first_seen	2026-10-10T07:16:11Z
evidence.first_seen_tx	0x2d0e5d4094e798c710abc3dd03b73eb92f14830e4ef6b14e093808d0bea78230
evidence.first_seen_kind	payout
evidence.age	0:00:00
evidence.max_age	7d
evidence.history_start	2026-10-01T16:02:11Z
evidence.parents	R1_VAULT_PAYOUT_SPIKE, R5_NEW_RECIPIENT_LARGE_PAYOUT
matched[0]	kind=payout eq payout
shield.mode	paranoid
shield.capability	raise_mode
shield.scope	chain, bridge, token, address

2026-10-10 07:16:11

Ethereum

R2_VAULT_OUTFLOW_VELOCITYTreasury drain

ethereum near_intents usdt outflow 4,485,652.18 in 1h vs 7d hourly p99 2,059,588.29

0x2d0e5d40...8230

Click a field to copy its value.

timestamp	2026-10-10T07:16:11Z
rule.id	R2_VAULT_OUTFLOW_VELOCITY
rule.level	12
rule.severity	high
rule.description	Treasury outflow velocity above its 7-day p99
rule.groups	evm, treasury, payout, velocity
rule.tactic	Treasury drain
rule.weight	2.0
data.tx	0x2d0e5d4094e798c710abc3dd03b73eb92f14830e4ef6b14e093808d0bea78230
data.block	26160476
data.ts	2026-10-10T07:16:11Z
data.chain	ethereum
data.kind	payout
data.amount	2814780.12
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x4117ffb93a592865e37f8e3d5de77053de7f9879
data.vault	near_intents
data.token	ethereum:usdt
data.address	0x4117ffb93a592865e37f8e3d5de77053de7f9879
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0x4117ffb93a592865e37f8e3d5de77053de7f9879
evidence.value_field	amount_usd
evidence.window_sum	4485652.175376
evidence.window	1h
evidence.baseline_percentile	99.0
evidence.baseline_value	2059588.29124199
evidence.baseline_buckets	168
evidence.baseline_horizon	7d
evidence.factor	2.0
evidence.threshold	4119176.58248398
evidence.window_txs	0x6bea3dda57e7ba9e22045588940911e39740386141a9362e4c5d864766df687c, 0x883938e35b4366c618e4f7bc9147604b97982d207db523979fa07b41736149dd, 0xac52611a40206f79abcfdb35389acf7743891c7912206be1e5f3bede4cfd27da, 0x23330ae0c043e63bd7b609fd8af54ba5e50e5e3a44f75535d1b4b2c000048453, 0x5ee42671f625741477e600f8c137941a5a67365c81e3b61c58cf2f1cf497c4ef, 0xea8a249e5686ed2d7fdef3af22d97f199e9238b4bb36cdbf881f7170f6363c1e, 0xef7bb3c62fb12d753f66f9362d48417289fffe57d610cdbfe09a8dea0f2eb193, 0x113ea61be69e610fc89d0b4baed566e6cf60c21ce3ae2c9d1a47a868df51a22b, 0xe0a02195f821ab187b28eaac5fffb6ca9121316de5e84f86dfae0cca4ff98617, 0x495212c1302e542347bcadab40e5fde676d1228ab2cacdbaa544f0fe2da44821, 0x67142ecfc6df16c8a16b5054095f85f70aa2701e86ea673e0adb9803f0fbf3bb, 0x66152fab59c78c15978cbf39bd86dca4e569d8b9994ed3f9f3d441bbcd4ba026, 0x871154d9493c7de8d91f36761b7dac8d8c4aaf2edc3cae19746f127048cbf27a, 0x223db4549439e012c15e744813b7100fe2986c2509298bcb972d44e3a12996ce, 0xa7972b636650c96426e503717368a1a46d0e1864c16bc02484ed81771b420d5f, 0x2028f68834915b7534819039bdbddda076651bb89d3edb08c8849c5b8347bfd2, 0xa21026f776dd77fa7aa316aa64fc3f76ec1d1e45bd515747c32fc1190067e536, 0x9a7628f30bf6a1d38afe64fcc0f28e832fc43a0a485b62eb01cd4e6907ea5a26, 0xfa302a31a0d48f3caee52da8407d1893574cb1727182a704ff8184029e6cd38b, 0x2d0e5d4094e798c710abc3dd03b73eb92f14830e4ef6b14e093808d0bea78230
evidence.window_tx_count	51
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdt in ['usdt', 'usdc']
shield.mode	paranoid
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-10-21 01:04:11

Ethereum

R2_VAULT_OUTFLOW_VELOCITYTreasury drain

ethereum near_intents usdt outflow 3,710,315.74 in 1h vs 7d hourly p99 1,815,171.66

0x980b77d3...3d2e

Click a field to copy its value.

timestamp	2026-10-21T01:04:11Z
rule.id	R2_VAULT_OUTFLOW_VELOCITY
rule.level	12
rule.severity	high
rule.description	Treasury outflow velocity above its 7-day p99
rule.groups	evm, treasury, payout, velocity
rule.tactic	Treasury drain
rule.weight	2.0
data.tx	0x980b77d395af3a5933efc5143b35349b44134cbdd926b14fee0b89d62b783d2e
data.block	26237561
data.ts	2026-10-21T01:04:11Z
data.chain	ethereum
data.kind	payout
data.amount	499948.7001
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x3ff8ed1f8df120742879faeca8bf2842f0c46b04
data.vault	near_intents
data.token	ethereum:usdt
data.address	0x3ff8ed1f8df120742879faeca8bf2842f0c46b04
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0x3ff8ed1f8df120742879faeca8bf2842f0c46b04
evidence.value_field	amount_usd
evidence.window_sum	3710315.739526
evidence.window	1h
evidence.baseline_percentile	99.0
evidence.baseline_value	1815171.65595533
evidence.baseline_buckets	168
evidence.baseline_horizon	7d
evidence.factor	2.0
evidence.threshold	3630343.31191066
evidence.window_txs	0xbf4aa65339d1d4fcfa73d529020d003c372984213d534b22f66e48d13a8d2742, 0x0e995af55f86ffcd55c3c7611feace087266e73f8e65e8a2e90aa8f2a909acaa, 0x85a06b1630bef3f87f784d35ad95067d34800006ae8845a7cb34afb8caec7ce7, 0x2cb14416ae99e64e4e859f93617332d0e0c79c0556e4b45edfac00444064262f, 0x6e736cd8a8853f910b94409d867e7a397a7b69928a48ce4e6f622a09727cad3c, 0xc55ca0a2c6606d24b411ed871fa49a9dab46fac8dae11d15282cf83cacb45589, 0xd920987fe472dc80b0d2c5a243a59ffaf35ae6402b22e853893af2c2a76ced4d, 0xa44e380748a6fc48b971409e30dad65e21227027dc00943f374d0fbb800f02e1, 0xd4e0e33573e07bc8e30873f835eee9e5900c3a4d8937d6e07de87d72f89dd42a, 0xcbace5620eda0f5e8abdaa28bc644ab75dc2edb723583fe4b05e611721010cc0, 0x3645cd3c4b0a33fb2c03d82ede6692d5961ccb0a7606f46d25855fad9ba764ab, 0xdea20f1d7832be4a8ebcaa2c191fec026705ff2cc5df13eb39c208f8dfde6404, 0xb39711c3614d373d5bcad8566e8df9dae82e6cb814b3fc8ef508cd2bd7b06c4e, 0x9bf91e71efd3fca5b894e866909c93bd09b28587787953c2a727887a94b0e6fb, 0x61fbe447998ad71181c8fe536b1ebb9f920f81bf87828410c49e8103b79e5cce, 0xb139b6026f4d77fec458811361e3c71e78f03e1e37a2311881695bfc6a0d165a, 0x9d081a2ebd9a63dd2245c33977c5cf266cba7299d962c4be0f3f8af6157759d8, 0xa236bd4e4b826bc0632621cbcceabd540d6cc43f4ad8dfab07b5310922a4b1a1, 0x88f209cdee790824489d2023df5ca5cc17e02e4c169e5ea217969ab9fa47fdd0, 0x980b77d395af3a5933efc5143b35349b44134cbdd926b14fee0b89d62b783d2e
evidence.window_tx_count	20
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdt in ['usdt', 'usdc']
shield.mode	paranoid
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-10-21 02:05:23

Ethereum

R2_VAULT_OUTFLOW_VELOCITYTreasury drain

ethereum near_intents usdt outflow 5,061,695.28 in 1h vs 7d hourly p99 2,018,045.70

0xe08943a1...a363

Click a field to copy its value.

timestamp	2026-10-21T02:05:23Z
rule.id	R2_VAULT_OUTFLOW_VELOCITY
rule.level	12
rule.severity	high
rule.description	Treasury outflow velocity above its 7-day p99
rule.groups	evm, treasury, payout, velocity
rule.tactic	Treasury drain
rule.weight	2.0
data.tx	0xe08943a13ba0e9963518e4dc74410526e4801578733d99ff3567732034f4a363
data.block	26237867
data.ts	2026-10-21T02:05:23Z
data.chain	ethereum
data.kind	payout
data.amount	953.486935
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0xad4b2e14558b5c953aa7e5675ba8ec5f083881a4
data.vault	near_intents
data.token	ethereum:usdt
data.address	0xad4b2e14558b5c953aa7e5675ba8ec5f083881a4
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0xad4b2e14558b5c953aa7e5675ba8ec5f083881a4
evidence.value_field	amount_usd
evidence.window_sum	5061695.281622
evidence.window	1h
evidence.baseline_percentile	99.0
evidence.baseline_value	2018045.69620668
evidence.baseline_buckets	168
evidence.baseline_horizon	7d
evidence.factor	2.0
evidence.threshold	4036091.39241336
evidence.window_txs	0x6b048146b9be70effb03dc7a166ccce5b3565bc8a14dfcf63af5bdede9c350b4, 0x4d84691b781b800f2e523b0e62a886f7586c8eccc39f5f8fafab59ddf58aa0cb, 0xd54d133851cf6098f6981930c21f38b986a08ce22dc08ee2b752b536a93cf215, 0x37df77e163509eacc279758331b32388ac4a5ce092a8f810cb2bb3208392bb46, 0x1eac2364927c9d9c339d836941ceeb35b598e08e74283e12fb0dcad6bcd34cd1, 0x589eb90d0d286ed2d3d20cde997a02ecc6bca1c29fd542f790d9c7713c3a0734, 0x612d84c1fa9b4551b9f5dbef004c284ab364316f84bae4ec7a210aaa7a8595e5, 0x517997ea201f4c30bf9768da11c850d8d0ce2b45cb3a0d975311540f9e08794f, 0x170c0bf050057cceb69d516b960c115a7929570218b024a2ce9ae1b9a9f64c6c, 0x720762b4e1c70956e973e910a65b9816ae1639ee84a6ba5af49988266970d643, 0x6db09d71f45e90d61470a8b607f88d81cff3d3d80ef94ad8fdc776b5a27ac6c8, 0xa0ba00d8a4468f0eda77fbbcc11565b6d3ade86bc22a862f273288a6272a968f, 0x6ffee28ec3a99d9456edb2d9ef4b50b71a2ccf60906cddd207e29334b1961b2d, 0x235dd9e0df63026be19af8b2b482316c36bad9aa8f41e1f38685f2cebd82c901, 0xa216fba4f00c1fc9149b812c070a5488d2622d326fd90e5c5069331986bb2c50, 0xcbc47c52fb6a84f2e570d0390cfb44448e3b1da9816dca78890a45fe70b4a88e, 0x31e1bf70f05a519607c0f2d3d8e3d5465b8b42b91dc5870f89e3ff1aff1c7f56, 0x99b3aba7ccc755cf20c370525982b66b77c53d94ca971aac263ce93ece2555be, 0xbdc791b14c3cc635ed18c6ea00105a2dd727e612f46cb480707eac06785fa083, 0xe08943a13ba0e9963518e4dc74410526e4801578733d99ff3567732034f4a363
evidence.window_tx_count	40
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdt in ['usdt', 'usdc']
shield.mode	paranoid
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-10-08 16:19:47

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

500,845.32 usdt to 0x4f53b552fd08c83c169974105a3801b3db7c3a05, first seen 0s ago (payout)

0xab1ce27b...b949

Click a field to copy its value.

timestamp	2026-10-08T16:19:47Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0xab1ce27bbbe14cfa7fdb9d5428818d50664f0c04afcb1739106a7d303f50b949
data.block	26148832
data.ts	2026-10-08T16:19:47Z
data.chain	ethereum
data.kind	payout
data.amount	500845.32152
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x4f53b552fd08c83c169974105a3801b3db7c3a05
data.vault	near_intents
data.token	ethereum:usdt
data.address	0x4f53b552fd08c83c169974105a3801b3db7c3a05
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0x4f53b552fd08c83c169974105a3801b3db7c3a05
evidence.address	0x4f53b552fd08c83c169974105a3801b3db7c3a05
evidence.first_seen	2026-10-08T16:19:47Z
evidence.first_seen_tx	0xab1ce27bbbe14cfa7fdb9d5428818d50664f0c04afcb1739106a7d303f50b949
evidence.first_seen_kind	payout
evidence.age	0:00:00
evidence.max_age	7d
evidence.history_start	2026-10-01T16:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=500845.32152 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-10-09 06:51:09

BNB Chain

R1_VAULT_PAYOUT_SPIKETreasury drain

bsc hot_bridge paid 431,469.40 usdt to 0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758: 2.68x the 48h max of 161,095.73

0xf2ad8349...5b1a

Click a field to copy its value.

timestamp	2026-10-09T06:51:09Z
rule.id	R1_VAULT_PAYOUT_SPIKE
rule.level	8
rule.severity	medium
rule.description	Treasury payout far above recent maximum
rule.groups	evm, treasury, payout, spike
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0xf2ad83496734bc977fd0812e1d69b54f86f0de6757b292b448ec6f3dffd95b1a
data.block	126590889
data.ts	2026-10-09T06:51:09Z
data.chain	bsc
data.kind	payout
data.amount	431469.403208
data.symbol	usdt
data.from	0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
data.tx_submitter	0xcf495cea699b8beca4073279eda66882ccfa273c
data.vault	hot_bridge
data.token	bsc:usdt
data.address	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
scope.address	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
evidence.value_field	amount_usd
evidence.value	431469.403208
evidence.baseline_max	161095.734000408993898811
evidence.baseline_tx	0x5e12ef6967256536b186644b72b26dbccd8754986b76cae980961627bfd01366
evidence.baseline_ts	2026-10-08T17:15:34Z
evidence.baseline_window	48h
evidence.baseline_events	907
evidence.ratio	2.68
evidence.factor	2.0
evidence.min_value	50000
matched[0]	kind=payout eq payout
matched[1]	vault=hot_bridge in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdt in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	chain, bridge, token

2026-10-09 08:06:47

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

821,935.34 usdc to 0x0667fe8d8d3b6a7d891f1ccde0204bb845c1868a, first seen 0s ago (payout)

0x7524a4a6...df10

Click a field to copy its value.

timestamp	2026-10-09T08:06:47Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x7524a4a643e835daf3b2c5dba7be630c8e9e6692608bf14d6e1ae2ea621bdf10
data.block	26153548
data.ts	2026-10-09T08:06:47Z
data.chain	ethereum
data.kind	payout
data.amount	821935.343013
data.symbol	usdc
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x0667fe8d8d3b6a7d891f1ccde0204bb845c1868a
data.vault	near_intents
data.token	ethereum:usdc
data.address	0x0667fe8d8d3b6a7d891f1ccde0204bb845c1868a
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdc
scope.address	0x0667fe8d8d3b6a7d891f1ccde0204bb845c1868a
evidence.address	0x0667fe8d8d3b6a7d891f1ccde0204bb845c1868a
evidence.first_seen	2026-10-09T08:06:47Z
evidence.first_seen_tx	0x7524a4a643e835daf3b2c5dba7be630c8e9e6692608bf14d6e1ae2ea621bdf10
evidence.first_seen_kind	payout
evidence.age	0:00:00
evidence.max_age	7d
evidence.history_start	2026-10-01T16:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=821935.343013 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-10-09 10:17:35

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

580,987.58 usdt to 0xa7d11059477a359f2d8d7f4f9aebf73b9bd84042, first seen 6d 20h ago (payout)

0xf3cbf8a1...6371

Click a field to copy its value.

timestamp	2026-10-09T10:17:35Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0xf3cbf8a115872d979bd7dc185601b8f1cf54a14d10b0bc89722ecd6df4946371
data.block	26154200
data.ts	2026-10-09T10:17:35Z
data.chain	ethereum
data.kind	payout
data.amount	580987.579966
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0xa7d11059477a359f2d8d7f4f9aebf73b9bd84042
data.vault	near_intents
data.token	ethereum:usdt
data.address	0xa7d11059477a359f2d8d7f4f9aebf73b9bd84042
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0xa7d11059477a359f2d8d7f4f9aebf73b9bd84042
evidence.address	0xa7d11059477a359f2d8d7f4f9aebf73b9bd84042
evidence.first_seen	2026-10-02T14:02:59Z
evidence.first_seen_tx	0x8643147319b1f3d1541d29496e957c06e2200bb59c13733e3f80b067ecd2bf8e
evidence.first_seen_kind	payout
evidence.age	6 days, 20:14:36
evidence.max_age	7d
evidence.history_start	2026-10-01T16:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=580987.579966 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-10-09 12:00:10

BNB Chain

R1_VAULT_PAYOUT_SPIKETreasury drain

bsc hot_bridge paid 331,075.50 usdt to 0x51aa68f9c5efe263fddcd28459e18d974258758a: 2.03x the 48h max of 162,955.82

0x0d2ef07a...f526

Click a field to copy its value.

timestamp	2026-10-09T12:00:10Z
rule.id	R1_VAULT_PAYOUT_SPIKE
rule.level	8
rule.severity	medium
rule.description	Treasury payout far above recent maximum
rule.groups	evm, treasury, payout, spike
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x0d2ef07a76b656bca8bc267ca5b1e2a72fc4caaee3a04ab80e0e3ca9423cf526
data.block	126632073
data.ts	2026-10-09T12:00:10Z
data.chain	bsc
data.kind	payout
data.amount	331075.498172730563257352
data.symbol	usdt
data.from	0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to	0x51aa68f9c5efe263fddcd28459e18d974258758a
data.tx_submitter	0xcf495cea699b8beca4073279eda66882ccfa273c
data.vault	hot_bridge
data.token	bsc:usdt
data.address	0x51aa68f9c5efe263fddcd28459e18d974258758a
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
scope.address	0x51aa68f9c5efe263fddcd28459e18d974258758a
evidence.value_field	amount_usd
evidence.value	331075.498172730563257352
evidence.baseline_max	162955.816359001148990231
evidence.baseline_tx	0x56a24840308a3762a57d2a6b0011ac02f2d13113128a4316799a31ac151f5e2b
evidence.baseline_ts	2026-10-09T10:24:08Z
evidence.baseline_window	48h
evidence.baseline_events	1057
evidence.ratio	2.03
evidence.factor	2.0
evidence.min_value	50000
matched[0]	kind=payout eq payout
matched[1]	vault=hot_bridge in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdt in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	chain, bridge, token

2026-10-09 12:00:39

BNB Chain

R1_VAULT_PAYOUT_SPIKETreasury drain

bsc hot_bridge paid 632,160.27 usdt to 0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758: 3.88x the 48h max of 162,955.82

0xd33084d3...3887

Click a field to copy its value.

timestamp	2026-10-09T12:00:39Z
rule.id	R1_VAULT_PAYOUT_SPIKE
rule.level	8
rule.severity	medium
rule.description	Treasury payout far above recent maximum
rule.groups	evm, treasury, payout, spike
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0xd33084d3841e54a42b485f5c2f9d718f7d1b56bc07918fd45bca4165224b3887
data.block	126632139
data.ts	2026-10-09T12:00:39Z
data.chain	bsc
data.kind	payout
data.amount	632160.273469
data.symbol	usdt
data.from	0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
data.tx_submitter	0xcf495cea699b8beca4073279eda66882ccfa273c
data.vault	hot_bridge
data.token	bsc:usdt
data.address	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
scope.address	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
evidence.value_field	amount_usd
evidence.value	632160.273469
evidence.baseline_max	162955.816359001148990231
evidence.baseline_tx	0x56a24840308a3762a57d2a6b0011ac02f2d13113128a4316799a31ac151f5e2b
evidence.baseline_ts	2026-10-09T10:24:08Z
evidence.baseline_window	48h
evidence.baseline_events	1057
evidence.ratio	3.88
evidence.factor	2.0
evidence.min_value	50000
matched[0]	kind=payout eq payout
matched[1]	vault=hot_bridge in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdt in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	chain, bridge, token

2026-10-09 14:18:35

BNB Chain

R1_VAULT_PAYOUT_SPIKETreasury drain

bsc hot_bridge paid 420,830.77 usdt to 0xa57fcee8db30a62b1fe8fab0431ac2d2a6abbafb: 2.5x the 48h max of 168,437.72

0x13655bc5...c68b

Click a field to copy its value.

timestamp	2026-10-09T14:18:35Z
rule.id	R1_VAULT_PAYOUT_SPIKE
rule.level	8
rule.severity	medium
rule.description	Treasury payout far above recent maximum
rule.groups	evm, treasury, payout, spike
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x13655bc5e88ec7de302f3aabf4fae687e76cbd3fe73b7ec9efe219a297f4c68b
data.block	126650524
data.ts	2026-10-09T14:18:35Z
data.chain	bsc
data.kind	payout
data.amount	420830.769667790064990281
data.symbol	usdt
data.from	0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to	0xa57fcee8db30a62b1fe8fab0431ac2d2a6abbafb
data.tx_submitter	0xcf495cea699b8beca4073279eda66882ccfa273c
data.vault	hot_bridge
data.token	bsc:usdt
data.address	0xa57fcee8db30a62b1fe8fab0431ac2d2a6abbafb
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
scope.address	0xa57fcee8db30a62b1fe8fab0431ac2d2a6abbafb
evidence.value_field	amount_usd
evidence.value	420830.769667790064990281
evidence.baseline_max	168437.722075
evidence.baseline_tx	0xf2be904a4004ae38484a87ceb0f14ff2063a6048bdf27853d092f034e0d4f844
evidence.baseline_ts	2026-10-09T13:06:08Z
evidence.baseline_window	48h
evidence.baseline_events	1106
evidence.ratio	2.5
evidence.factor	2.0
evidence.min_value	50000
matched[0]	kind=payout eq payout
matched[1]	vault=hot_bridge in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdt in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	chain, bridge, token

2026-10-09 22:39:08

BNB Chain

R1_VAULT_PAYOUT_SPIKETreasury drain

bsc hot_bridge paid 200,071.83 usdc to 0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758: 5.28x the 48h max of 37,864.76

0x9fcd48cc...5591

Click a field to copy its value.

timestamp	2026-10-09T22:39:08Z
rule.id	R1_VAULT_PAYOUT_SPIKE
rule.level	8
rule.severity	medium
rule.description	Treasury payout far above recent maximum
rule.groups	evm, treasury, payout, spike
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x9fcd48cce13deda85b885d55831f4bc0eeb8cb48befda7e3d3855621e5cd5591
data.block	126717251
data.ts	2026-10-09T22:39:08Z
data.chain	bsc
data.kind	payout
data.amount	200071.831818838714373158
data.symbol	usdc
data.from	0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
data.tx_submitter	0xcf495cea699b8beca4073279eda66882ccfa273c
data.vault	hot_bridge
data.token	bsc:usdc
data.address	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
scope.chain	bsc
scope.bridge	hot
scope.token	usdc
scope.address	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
evidence.value_field	amount_usd
evidence.value	200071.831818838714373158
evidence.baseline_max	37864.756390979983792039
evidence.baseline_tx	0x75ee2c2c43a0ac28fe7b19b71236925614bb54f7f15456326110c6b44d105b71
evidence.baseline_ts	2026-10-08T11:42:28Z
evidence.baseline_window	48h
evidence.baseline_events	170
evidence.ratio	5.28
evidence.factor	2.0
evidence.min_value	50000
matched[0]	kind=payout eq payout
matched[1]	vault=hot_bridge in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdc in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	chain, bridge, token

2026-10-09 22:57:22

BNB Chain

R1_VAULT_PAYOUT_SPIKETreasury drain

bsc hot_bridge paid 99,992.74 usdc to 0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758: 2.64x the 48h max of 37,864.76

0x0d29f2fc...5a17

Click a field to copy its value.

timestamp	2026-10-09T22:57:22Z
rule.id	R1_VAULT_PAYOUT_SPIKE
rule.level	8
rule.severity	medium
rule.description	Treasury payout far above recent maximum
rule.groups	evm, treasury, payout, spike
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x0d29f2fcbbe8cb91de274fb93ca1282320418bad08a7ffc569c27b30bda65a17
data.block	126719681
data.ts	2026-10-09T22:57:22Z
data.chain	bsc
data.kind	payout
data.amount	99992.740887587091467615
data.symbol	usdc
data.from	0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
data.vault	hot_bridge
data.token	bsc:usdc
data.address	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
scope.chain	bsc
scope.bridge	hot
scope.token	usdc
scope.address	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
evidence.value_field	amount_usd
evidence.value	99992.740887587091467615
evidence.baseline_max	37864.756390979983792039
evidence.baseline_tx	0x75ee2c2c43a0ac28fe7b19b71236925614bb54f7f15456326110c6b44d105b71
evidence.baseline_ts	2026-10-08T11:42:28Z
evidence.baseline_window	48h
evidence.baseline_events	169
evidence.ratio	2.64
evidence.factor	2.0
evidence.min_value	50000
matched[0]	kind=payout eq payout
matched[1]	vault=hot_bridge in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdc in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	chain, bridge, token

2026-10-09 23:21:09

BNB Chain

R1_VAULT_PAYOUT_SPIKETreasury drain

bsc hot_bridge paid 138,777.86 usdc to 0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758: 3.67x the 48h max of 37,864.76

0xc84d3eba...9585

Click a field to copy its value.

timestamp	2026-10-09T23:21:09Z
rule.id	R1_VAULT_PAYOUT_SPIKE
rule.level	8
rule.severity	medium
rule.description	Treasury payout far above recent maximum
rule.groups	evm, treasury, payout, spike
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0xc84d3ebadaa553e1bb974557496220b9b671ba401a14b8ac08cd4d0c423f9585
data.block	126722851
data.ts	2026-10-09T23:21:09Z
data.chain	bsc
data.kind	payout
data.amount	138777.855185842470913977
data.symbol	usdc
data.from	0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
data.tx_submitter	0xcf495cea699b8beca4073279eda66882ccfa273c
data.vault	hot_bridge
data.token	bsc:usdc
data.address	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
scope.chain	bsc
scope.bridge	hot
scope.token	usdc
scope.address	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
evidence.value_field	amount_usd
evidence.value	138777.855185842470913977
evidence.baseline_max	37864.756390979983792039
evidence.baseline_tx	0x75ee2c2c43a0ac28fe7b19b71236925614bb54f7f15456326110c6b44d105b71
evidence.baseline_ts	2026-10-08T11:42:28Z
evidence.baseline_window	48h
evidence.baseline_events	167
evidence.ratio	3.67
evidence.factor	2.0
evidence.min_value	50000
matched[0]	kind=payout eq payout
matched[1]	vault=hot_bridge in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdc in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	chain, bridge, token

2026-10-09 23:35:35

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

797,198.52 usdt to 0x643ca2d6f1a9fec3992881cfbf36991ec4ea5faf, first seen 0s ago (payout)

0x6d3ec046...7793

Click a field to copy its value.

timestamp	2026-10-09T23:35:35Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x6d3ec0464f69e41437509266695e8175a7a5b42e5c917cdc43c17154b4487793
data.block	26158178
data.ts	2026-10-09T23:35:35Z
data.chain	ethereum
data.kind	payout
data.amount	797198.519018
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x643ca2d6f1a9fec3992881cfbf36991ec4ea5faf
data.vault	near_intents
data.token	ethereum:usdt
data.address	0x643ca2d6f1a9fec3992881cfbf36991ec4ea5faf
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0x643ca2d6f1a9fec3992881cfbf36991ec4ea5faf
evidence.address	0x643ca2d6f1a9fec3992881cfbf36991ec4ea5faf
evidence.first_seen	2026-10-09T23:35:35Z
evidence.first_seen_tx	0x6d3ec0464f69e41437509266695e8175a7a5b42e5c917cdc43c17154b4487793
evidence.first_seen_kind	payout
evidence.age	0:00:00
evidence.max_age	7d
evidence.history_start	2026-10-01T16:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=797198.519018 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-10-10 00:11:47

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

592,488.52 usdt to 0x91e41bcd09930a4696fba55c87336774ecaaf56a, first seen 0s ago (payout)

0x684399ed...6b20

Click a field to copy its value.

timestamp	2026-10-10T00:11:47Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x684399edced702bd17597abd50e22d0ccb3af4a0f6489d34b394ee31cc766b20
data.block	26158359
data.ts	2026-10-10T00:11:47Z
data.chain	ethereum
data.kind	payout
data.amount	592488.521813
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x91e41bcd09930a4696fba55c87336774ecaaf56a
data.vault	near_intents
data.token	ethereum:usdt
data.address	0x91e41bcd09930a4696fba55c87336774ecaaf56a
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0x91e41bcd09930a4696fba55c87336774ecaaf56a
evidence.address	0x91e41bcd09930a4696fba55c87336774ecaaf56a
evidence.first_seen	2026-10-10T00:11:47Z
evidence.first_seen_tx	0x684399edced702bd17597abd50e22d0ccb3af4a0f6489d34b394ee31cc766b20
evidence.first_seen_kind	payout
evidence.age	0:00:00
evidence.max_age	7d
evidence.history_start	2026-10-01T16:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=592488.521813 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-10-10 02:46:47

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

601,163.86 usdt to 0xfd02461a10f9f29e8bf9c1acfe64e817bcb0549a, first seen 4h 13m ago (payout)

0xc98f24b1...77aa

Click a field to copy its value.

timestamp	2026-10-10T02:46:47Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0xc98f24b1b6fc94ff3be543239391b19e7b25eec5628cfe1e3640dd50de9e77aa
data.block	26159134
data.ts	2026-10-10T02:46:47Z
data.chain	ethereum
data.kind	payout
data.amount	601163.855493
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0xfd02461a10f9f29e8bf9c1acfe64e817bcb0549a
data.vault	near_intents
data.token	ethereum:usdt
data.address	0xfd02461a10f9f29e8bf9c1acfe64e817bcb0549a
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0xfd02461a10f9f29e8bf9c1acfe64e817bcb0549a
evidence.address	0xfd02461a10f9f29e8bf9c1acfe64e817bcb0549a
evidence.first_seen	2026-10-09T22:33:23Z
evidence.first_seen_tx	0x3891497e727ee8820662f72e7c574aa1df76cf2e7c309bd8e6b9c4bb68669885
evidence.first_seen_kind	payout
evidence.age	4:13:24
evidence.max_age	7d
evidence.history_start	2026-10-01T16:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=601163.855493 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-10-10 04:20:11

Ethereum

R10_RECIPIENT_PAYOUT_BURSTTreasury drain

near_intents on ethereum paid 0xfd02461a10f9f29e8bf9c1acfe64e817bcb0549a 3 times over $250K in 1h 33m (1,901,163.86 usdc), 0 such payouts in the 7d before

0x4f03f6c2...cdbf

Click a field to copy its value.

timestamp	2026-10-10T04:20:11Z
rule.id	R10_RECIPIENT_PAYOUT_BURST
rule.level	8
rule.severity	medium
rule.description	Burst of large treasury payouts to one new counterparty
rule.groups	evm, treasury, payout, frequency
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x4f03f6c239af2568947901e647d56cd19745d0a3a1682b2ed06a24035c0fcdbf
data.block	26159601
data.ts	2026-10-10T04:20:11Z
data.chain	ethereum
data.kind	payout
data.amount	800000
data.symbol	usdc
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0xfd02461a10f9f29e8bf9c1acfe64e817bcb0549a
data.vault	near_intents
data.token	ethereum:usdc
data.address	0xfd02461a10f9f29e8bf9c1acfe64e817bcb0549a
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdc
scope.address	0xfd02461a10f9f29e8bf9c1acfe64e817bcb0549a
evidence.group.chain	ethereum
evidence.group.vault	near_intents
evidence.group.to_addr	0xfd02461a10f9f29e8bf9c1acfe64e817bcb0549a
evidence.count	3
evidence.min_count	3
evidence.within	2h
evidence.window_sum	1901163.855493
evidence.burst_txs	0xc98f24b1b6fc94ff3be543239391b19e7b25eec5628cfe1e3640dd50de9e77aa, 0x1406361dae43867af09a3c147bdc83c7c81c032e631fcb9c7580bf0933352b43, 0x4f03f6c239af2568947901e647d56cd19745d0a3a1682b2ed06a24035c0fcdbf
evidence.burst_started	2026-10-10T02:46:47Z
evidence.burst_span	1:33:24
evidence.prior_events	0
evidence.max_prior	3
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdc in ['usdt', 'usdc']
matched[3]	amount_usd=800000 gt 250000
shield.capability	flag_observation
shield.scope	chain, bridge, token, address

2026-10-10 04:20:11

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

800,000 usdc to 0xfd02461a10f9f29e8bf9c1acfe64e817bcb0549a, first seen 5h 46m ago (payout)

0x4f03f6c2...cdbf

Click a field to copy its value.

timestamp	2026-10-10T04:20:11Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x4f03f6c239af2568947901e647d56cd19745d0a3a1682b2ed06a24035c0fcdbf
data.block	26159601
data.ts	2026-10-10T04:20:11Z
data.chain	ethereum
data.kind	payout
data.amount	800000
data.symbol	usdc
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0xfd02461a10f9f29e8bf9c1acfe64e817bcb0549a
data.vault	near_intents
data.token	ethereum:usdc
data.address	0xfd02461a10f9f29e8bf9c1acfe64e817bcb0549a
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdc
scope.address	0xfd02461a10f9f29e8bf9c1acfe64e817bcb0549a
evidence.address	0xfd02461a10f9f29e8bf9c1acfe64e817bcb0549a
evidence.first_seen	2026-10-09T22:33:23Z
evidence.first_seen_tx	0x3891497e727ee8820662f72e7c574aa1df76cf2e7c309bd8e6b9c4bb68669885
evidence.first_seen_kind	payout
evidence.age	5:46:48
evidence.max_age	7d
evidence.history_start	2026-10-01T16:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=800000 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-10-10 05:04:59

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

500,469.83 usdt to 0xfd02461a10f9f29e8bf9c1acfe64e817bcb0549a, first seen 6h 31m ago (payout)

0x75d5421b...cae9

Click a field to copy its value.

timestamp	2026-10-10T05:04:59Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x75d5421b920389201fa1305434d41412dc4c4218887a2fc59f2737f430cccae9
data.block	26159823
data.ts	2026-10-10T05:04:59Z
data.chain	ethereum
data.kind	payout
data.amount	500469.832207
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0xfd02461a10f9f29e8bf9c1acfe64e817bcb0549a
data.vault	near_intents
data.token	ethereum:usdt
data.address	0xfd02461a10f9f29e8bf9c1acfe64e817bcb0549a
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0xfd02461a10f9f29e8bf9c1acfe64e817bcb0549a
evidence.address	0xfd02461a10f9f29e8bf9c1acfe64e817bcb0549a
evidence.first_seen	2026-10-09T22:33:23Z
evidence.first_seen_tx	0x3891497e727ee8820662f72e7c574aa1df76cf2e7c309bd8e6b9c4bb68669885
evidence.first_seen_kind	payout
evidence.age	6:31:36
evidence.max_age	7d
evidence.history_start	2026-10-01T16:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=500469.832207 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-10-10 05:23:35

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

700,000 usdt to 0xfd02461a10f9f29e8bf9c1acfe64e817bcb0549a, first seen 6h 50m ago (payout)

0x89285d8d...0878

Click a field to copy its value.

timestamp	2026-10-10T05:23:35Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x89285d8de095f5b6b8c05205dd2e57c9aafa9c831d618f1fc273607c18a10878
data.block	26159916
data.ts	2026-10-10T05:23:35Z
data.chain	ethereum
data.kind	payout
data.amount	700000
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0xfd02461a10f9f29e8bf9c1acfe64e817bcb0549a
data.vault	near_intents
data.token	ethereum:usdt
data.address	0xfd02461a10f9f29e8bf9c1acfe64e817bcb0549a
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0xfd02461a10f9f29e8bf9c1acfe64e817bcb0549a
evidence.address	0xfd02461a10f9f29e8bf9c1acfe64e817bcb0549a
evidence.first_seen	2026-10-09T22:33:23Z
evidence.first_seen_tx	0x3891497e727ee8820662f72e7c574aa1df76cf2e7c309bd8e6b9c4bb68669885
evidence.first_seen_kind	payout
evidence.age	6:50:12
evidence.max_age	7d
evidence.history_start	2026-10-01T16:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=700000 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-10-10 06:04:23

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

700,000 usdc to 0xfd02461a10f9f29e8bf9c1acfe64e817bcb0549a, first seen 7h 31m ago (payout)

0x379af706...ecc2

Click a field to copy its value.

timestamp	2026-10-10T06:04:23Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x379af70652dc8cc7c7656717cf5dc3b5869c32b22b4e89d61619336fe605ecc2
data.block	26160118
data.ts	2026-10-10T06:04:23Z
data.chain	ethereum
data.kind	payout
data.amount	700000
data.symbol	usdc
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0xfd02461a10f9f29e8bf9c1acfe64e817bcb0549a
data.vault	near_intents
data.token	ethereum:usdc
data.address	0xfd02461a10f9f29e8bf9c1acfe64e817bcb0549a
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdc
scope.address	0xfd02461a10f9f29e8bf9c1acfe64e817bcb0549a
evidence.address	0xfd02461a10f9f29e8bf9c1acfe64e817bcb0549a
evidence.first_seen	2026-10-09T22:33:23Z
evidence.first_seen_tx	0x3891497e727ee8820662f72e7c574aa1df76cf2e7c309bd8e6b9c4bb68669885
evidence.first_seen_kind	payout
evidence.age	7:31:00
evidence.max_age	7d
evidence.history_start	2026-10-01T16:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=700000 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-10-10 06:05:11

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

800,000 usdc to 0xfd02461a10f9f29e8bf9c1acfe64e817bcb0549a, first seen 7h 31m ago (payout)

0xf02d6465...4478

Click a field to copy its value.

timestamp	2026-10-10T06:05:11Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0xf02d6465fca9746cdd0c46c4b3045850f90b4b0ea9a37614ea619a208b924478
data.block	26160122
data.ts	2026-10-10T06:05:11Z
data.chain	ethereum
data.kind	payout
data.amount	800000
data.symbol	usdc
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0xfd02461a10f9f29e8bf9c1acfe64e817bcb0549a
data.vault	near_intents
data.token	ethereum:usdc
data.address	0xfd02461a10f9f29e8bf9c1acfe64e817bcb0549a
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdc
scope.address	0xfd02461a10f9f29e8bf9c1acfe64e817bcb0549a
evidence.address	0xfd02461a10f9f29e8bf9c1acfe64e817bcb0549a
evidence.first_seen	2026-10-09T22:33:23Z
evidence.first_seen_tx	0x3891497e727ee8820662f72e7c574aa1df76cf2e7c309bd8e6b9c4bb68669885
evidence.first_seen_kind	payout
evidence.age	7:31:48
evidence.max_age	7d
evidence.history_start	2026-10-01T16:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=800000 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-10-10 07:16:11

Ethereum

R1_VAULT_PAYOUT_SPIKETreasury drain

ethereum near_intents paid 2,814,780.12 usdt to 0x4117ffb93a592865e37f8e3d5de77053de7f9879: 2.43x the 48h max of 1,157,274.61

0x2d0e5d40...8230

Click a field to copy its value.

timestamp	2026-10-10T07:16:11Z
rule.id	R1_VAULT_PAYOUT_SPIKE
rule.level	8
rule.severity	medium
rule.description	Treasury payout far above recent maximum
rule.groups	evm, treasury, payout, spike
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x2d0e5d4094e798c710abc3dd03b73eb92f14830e4ef6b14e093808d0bea78230
data.block	26160476
data.ts	2026-10-10T07:16:11Z
data.chain	ethereum
data.kind	payout
data.amount	2814780.12
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x4117ffb93a592865e37f8e3d5de77053de7f9879
data.vault	near_intents
data.token	ethereum:usdt
data.address	0x4117ffb93a592865e37f8e3d5de77053de7f9879
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0x4117ffb93a592865e37f8e3d5de77053de7f9879
evidence.value_field	amount_usd
evidence.value	2814780.12
evidence.baseline_max	1157274.61327
evidence.baseline_tx	0x6e7641c2f3cd1c183c56a60943648d017049734e8b1cf1dadd1f8b2d94e76a23
evidence.baseline_ts	2026-10-09T21:54:59Z
evidence.baseline_window	48h
evidence.baseline_events	3208
evidence.ratio	2.43
evidence.factor	2.0
evidence.min_value	50000
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdt in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	chain, bridge, token

2026-10-10 07:16:11

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

2,814,780.12 usdt to 0x4117ffb93a592865e37f8e3d5de77053de7f9879, first seen 0s ago (payout)

0x2d0e5d40...8230

Click a field to copy its value.

timestamp	2026-10-10T07:16:11Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x2d0e5d4094e798c710abc3dd03b73eb92f14830e4ef6b14e093808d0bea78230
data.block	26160476
data.ts	2026-10-10T07:16:11Z
data.chain	ethereum
data.kind	payout
data.amount	2814780.12
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x4117ffb93a592865e37f8e3d5de77053de7f9879
data.vault	near_intents
data.token	ethereum:usdt
data.address	0x4117ffb93a592865e37f8e3d5de77053de7f9879
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0x4117ffb93a592865e37f8e3d5de77053de7f9879
evidence.address	0x4117ffb93a592865e37f8e3d5de77053de7f9879
evidence.first_seen	2026-10-10T07:16:11Z
evidence.first_seen_tx	0x2d0e5d4094e798c710abc3dd03b73eb92f14830e4ef6b14e093808d0bea78230
evidence.first_seen_kind	payout
evidence.age	0:00:00
evidence.max_age	7d
evidence.history_start	2026-10-01T16:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=2814780.12 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-10-10 08:00:24

BNB Chain

R1_VAULT_PAYOUT_SPIKETreasury drain

bsc hot_bridge paid 99,220.32 usdc to 0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758: 2.62x the 48h max of 37,864.76

0x9b972779...a284

Click a field to copy its value.

timestamp	2026-10-10T08:00:24Z
rule.id	R1_VAULT_PAYOUT_SPIKE
rule.level	8
rule.severity	medium
rule.description	Treasury payout far above recent maximum
rule.groups	evm, treasury, payout, spike
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x9b9727796433f972ac380ab626282822a6c3b889e077d6e0c88d7d4e06d1a284
data.block	126792070
data.ts	2026-10-10T08:00:24Z
data.chain	bsc
data.kind	payout
data.amount	99220.316318359237675803
data.symbol	usdc
data.from	0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
data.vault	hot_bridge
data.token	bsc:usdc
data.address	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
scope.chain	bsc
scope.bridge	hot
scope.token	usdc
scope.address	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
evidence.value_field	amount_usd
evidence.value	99220.316318359237675803
evidence.baseline_max	37864.756390979983792039
evidence.baseline_tx	0x75ee2c2c43a0ac28fe7b19b71236925614bb54f7f15456326110c6b44d105b71
evidence.baseline_ts	2026-10-08T11:42:28Z
evidence.baseline_window	48h
evidence.baseline_events	155
evidence.ratio	2.62
evidence.factor	2.0
evidence.min_value	50000
matched[0]	kind=payout eq payout
matched[1]	vault=hot_bridge in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdc in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	chain, bridge, token

2026-10-10 15:24:06

BNB Chain

R1_VAULT_PAYOUT_SPIKETreasury drain

bsc hot_bridge paid 149,718.62 usdc to 0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758: 3x the 48h max of 49,912.38

0xb04d1fa3...664d

Click a field to copy its value.

timestamp	2026-10-10T15:24:06Z
rule.id	R1_VAULT_PAYOUT_SPIKE
rule.level	8
rule.severity	medium
rule.description	Treasury payout far above recent maximum
rule.groups	evm, treasury, payout, spike
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0xb04d1fa3bf29c4820699deabca3850a32fc4a3202d0f70966ac7f9b15378664d
data.block	126851208
data.ts	2026-10-10T15:24:06Z
data.chain	bsc
data.kind	payout
data.amount	149718.622272781583368041
data.symbol	usdc
data.from	0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
data.tx_submitter	0xcf495cea699b8beca4073279eda66882ccfa273c
data.vault	hot_bridge
data.token	bsc:usdc
data.address	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
scope.chain	bsc
scope.bridge	hot
scope.token	usdc
scope.address	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
evidence.value_field	amount_usd
evidence.value	149718.622272781583368041
evidence.baseline_max	49912.376556409102791098
evidence.baseline_tx	0xa645329b2efd0600325049f871221b0ea0e5b307e4d4348ab382ed912f733211
evidence.baseline_ts	2026-10-10T08:09:09Z
evidence.baseline_window	48h
evidence.baseline_events	121
evidence.ratio	3
evidence.factor	2.0
evidence.min_value	50000
matched[0]	kind=payout eq payout
matched[1]	vault=hot_bridge in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdc in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	chain, bridge, token

2026-10-12 01:47:35

Ethereum

R3_TEST_THEN_DRAINTreasury drain

0x2db35030bf4c8c360610b3b54865f71234a8e74c received a test payout 6m 36s before this 425,609.22 usdt payout

0x506923e0...7e32

Click a field to copy its value.

timestamp	2026-10-12T01:47:35Z
rule.id	R3_TEST_THEN_DRAIN
rule.level	8
rule.severity	medium
rule.description	Small test payout followed by a large payout to the same recipient
rule.groups	evm, treasury, payout, sequence
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x506923e0f36bf98421a6040eee6233bf99d39f761e0b31c12660c29741ff7e32
data.block	26173193
data.ts	2026-10-12T01:47:35Z
data.chain	ethereum
data.kind	payout
data.amount	425609.22
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x2db35030bf4c8c360610b3b54865f71234a8e74c
data.vault	near_intents
data.token	ethereum:usdt
data.address	0x2db35030bf4c8c360610b3b54865f71234a8e74c
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0x2db35030bf4c8c360610b3b54865f71234a8e74c
evidence.group.to_addr	0x2db35030bf4c8c360610b3b54865f71234a8e74c
evidence.within	24h
evidence.steps	[{"step": "test_payout", "tx": "0xc04d4afcb79107d50e3be1b33b11c7bee06b277d8fa0cdd682a561334fc474b8", "ts": "2026-10-12T01:40:59Z", "amount": "50"}, {"step": "large_payout", "tx": "0x506923e0f36bf98421a6040eee6233bf99d39f761e0b31c12660c29741ff7e32", "ts": "2026-10-12T01:47:35Z", "amount": "425609.22"}]
evidence.first_step_age	0:06:36
evidence.prior_events	[{"step": "test_payout", "tx": "0xc04d4afcb79107d50e3be1b33b11c7bee06b277d8fa0cdd682a561334fc474b8", "ts": "2026-10-12T01:40:59Z", "amount": "50"}]
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdt in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	address

2026-10-12 02:08:47

Ethereum

R3_TEST_THEN_DRAINTreasury drain

0x2521b75b786dce5ba2e51ed8ac3ed55786772b06 received a test payout 27m 24s before this 136,709.17 usdt payout

0x6a094b32...0269

Click a field to copy its value.

timestamp	2026-10-12T02:08:47Z
rule.id	R3_TEST_THEN_DRAIN
rule.level	8
rule.severity	medium
rule.description	Small test payout followed by a large payout to the same recipient
rule.groups	evm, treasury, payout, sequence
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x6a094b32d99667be4fd437f9984d2bfef4583b3c1e0c70766c28ebcd59380269
data.block	26173299
data.ts	2026-10-12T02:08:47Z
data.chain	ethereum
data.kind	payout
data.amount	136709.17
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x2521b75b786dce5ba2e51ed8ac3ed55786772b06
data.vault	near_intents
data.token	ethereum:usdt
data.address	0x2521b75b786dce5ba2e51ed8ac3ed55786772b06
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0x2521b75b786dce5ba2e51ed8ac3ed55786772b06
evidence.group.to_addr	0x2521b75b786dce5ba2e51ed8ac3ed55786772b06
evidence.within	24h
evidence.steps	[{"step": "test_payout", "tx": "0x071c64e3e0e8f20291d785b43f30f0013b64f69a3777cfe93945e76731d98b6f", "ts": "2026-10-12T01:41:23Z", "amount": "30"}, {"step": "large_payout", "tx": "0x6a094b32d99667be4fd437f9984d2bfef4583b3c1e0c70766c28ebcd59380269", "ts": "2026-10-12T02:08:47Z", "amount": "136709.17"}]
evidence.first_step_age	0:27:24
evidence.prior_events	[{"step": "test_payout", "tx": "0x071c64e3e0e8f20291d785b43f30f0013b64f69a3777cfe93945e76731d98b6f", "ts": "2026-10-12T01:41:23Z", "amount": "30"}]
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdt in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	address

2026-10-12 02:13:35

Ethereum

R3_TEST_THEN_DRAINTreasury drain

0x2521b75b786dce5ba2e51ed8ac3ed55786772b06 received a test payout 32m 12s before this 116,800.68 usdt payout

0xa4aa32ad...c5ca

Click a field to copy its value.

timestamp	2026-10-12T02:13:35Z
rule.id	R3_TEST_THEN_DRAIN
rule.level	8
rule.severity	medium
rule.description	Small test payout followed by a large payout to the same recipient
rule.groups	evm, treasury, payout, sequence
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0xa4aa32ad2ce49f61dee531176b088e68c24dc774a905abf9477f688a666ac5ca
data.block	26173323
data.ts	2026-10-12T02:13:35Z
data.chain	ethereum
data.kind	payout
data.amount	116800.68
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x2521b75b786dce5ba2e51ed8ac3ed55786772b06
data.vault	near_intents
data.token	ethereum:usdt
data.address	0x2521b75b786dce5ba2e51ed8ac3ed55786772b06
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0x2521b75b786dce5ba2e51ed8ac3ed55786772b06
evidence.group.to_addr	0x2521b75b786dce5ba2e51ed8ac3ed55786772b06
evidence.within	24h
evidence.steps	[{"step": "test_payout", "tx": "0x071c64e3e0e8f20291d785b43f30f0013b64f69a3777cfe93945e76731d98b6f", "ts": "2026-10-12T01:41:23Z", "amount": "30"}, {"step": "large_payout", "tx": "0xa4aa32ad2ce49f61dee531176b088e68c24dc774a905abf9477f688a666ac5ca", "ts": "2026-10-12T02:13:35Z", "amount": "116800.68"}]
evidence.first_step_age	0:32:12
evidence.prior_events	[{"step": "test_payout", "tx": "0x071c64e3e0e8f20291d785b43f30f0013b64f69a3777cfe93945e76731d98b6f", "ts": "2026-10-12T01:41:23Z", "amount": "30"}]
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdt in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	address

2026-10-12 05:11:59

Ethereum

R3_TEST_THEN_DRAINTreasury drain

0x601dcf2b971f30272fbe76cbdaec30b9a6f9b8fa received a test payout 4m 12s before this 282,799.40 usdc payout

0x8e7a258a...04b4

Click a field to copy its value.

timestamp	2026-10-12T05:11:59Z
rule.id	R3_TEST_THEN_DRAIN
rule.level	8
rule.severity	medium
rule.description	Small test payout followed by a large payout to the same recipient
rule.groups	evm, treasury, payout, sequence
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x8e7a258a67389649b52be029108db7eb7612855a5a0163bd0ffc3efc9efa04b4
data.block	26174213
data.ts	2026-10-12T05:11:59Z
data.chain	ethereum
data.kind	payout
data.amount	282799.4
data.symbol	usdc
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x601dcf2b971f30272fbe76cbdaec30b9a6f9b8fa
data.vault	near_intents
data.token	ethereum:usdc
data.address	0x601dcf2b971f30272fbe76cbdaec30b9a6f9b8fa
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdc
scope.address	0x601dcf2b971f30272fbe76cbdaec30b9a6f9b8fa
evidence.group.to_addr	0x601dcf2b971f30272fbe76cbdaec30b9a6f9b8fa
evidence.within	24h
evidence.steps	[{"step": "test_payout", "tx": "0x386697ee4119cfb4791a698a3f97938a667d0755900c965c0230e4f674d065bb", "ts": "2026-10-12T05:07:47Z", "amount": "1"}, {"step": "large_payout", "tx": "0x8e7a258a67389649b52be029108db7eb7612855a5a0163bd0ffc3efc9efa04b4", "ts": "2026-10-12T05:11:59Z", "amount": "282799.4"}]
evidence.first_step_age	0:04:12
evidence.prior_events	[{"step": "test_payout", "tx": "0x386697ee4119cfb4791a698a3f97938a667d0755900c965c0230e4f674d065bb", "ts": "2026-10-12T05:07:47Z", "amount": "1"}]
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdc in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	address

2026-10-12 14:04:23

Ethereum

R3_TEST_THEN_DRAINTreasury drain

0xb67459ada39227f94bb9e9840a8736a271db75b3 received a test payout 29m 12s before this 119,387.22 usdt payout

0xcb86855d...c380

Click a field to copy its value.

timestamp	2026-10-12T14:04:23Z
rule.id	R3_TEST_THEN_DRAIN
rule.level	8
rule.severity	medium
rule.description	Small test payout followed by a large payout to the same recipient
rule.groups	evm, treasury, payout, sequence
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0xcb86855d0f5dca22304f0cbc324a52c55a0903e1e9c0ab9d585709f30ac6c380
data.block	26176872
data.ts	2026-10-12T14:04:23Z
data.chain	ethereum
data.kind	payout
data.amount	119387.221224
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0xb67459ada39227f94bb9e9840a8736a271db75b3
data.vault	near_intents
data.token	ethereum:usdt
data.address	0xb67459ada39227f94bb9e9840a8736a271db75b3
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0xb67459ada39227f94bb9e9840a8736a271db75b3
evidence.group.to_addr	0xb67459ada39227f94bb9e9840a8736a271db75b3
evidence.within	24h
evidence.steps	[{"step": "test_payout", "tx": "0xe2faba4c97ef9d879bf4ee4641238d56d66f24d805c5631117481171f1e51a3b", "ts": "2026-10-12T13:35:11Z", "amount": "99.3898"}, {"step": "large_payout", "tx": "0xcb86855d0f5dca22304f0cbc324a52c55a0903e1e9c0ab9d585709f30ac6c380", "ts": "2026-10-12T14:04:23Z", "amount": "119387.221224"}]
evidence.first_step_age	0:29:12
evidence.prior_events	[{"step": "test_payout", "tx": "0xe2faba4c97ef9d879bf4ee4641238d56d66f24d805c5631117481171f1e51a3b", "ts": "2026-10-12T13:35:11Z", "amount": "99.3898"}]
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdt in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	address

2026-10-13 13:28:11

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

1,002,257.86 usdt to 0x9aa9c3382072d76ad62cacf5e103e99232b72729, first seen 0s ago (payout)

0x4e066aeb...e88d

Click a field to copy its value.

timestamp	2026-10-13T13:28:11Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x4e066aeb0cea44389022db66aaf3557a06ac1b478c489e7baebaecc9ad24e88d
data.block	26183868
data.ts	2026-10-13T13:28:11Z
data.chain	ethereum
data.kind	payout
data.amount	1002257.859744
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x9aa9c3382072d76ad62cacf5e103e99232b72729
data.vault	near_intents
data.token	ethereum:usdt
data.address	0x9aa9c3382072d76ad62cacf5e103e99232b72729
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0x9aa9c3382072d76ad62cacf5e103e99232b72729
evidence.address	0x9aa9c3382072d76ad62cacf5e103e99232b72729
evidence.first_seen	2026-10-13T13:28:11Z
evidence.first_seen_tx	0x4e066aeb0cea44389022db66aaf3557a06ac1b478c489e7baebaecc9ad24e88d
evidence.first_seen_kind	payout
evidence.age	0:00:00
evidence.max_age	7d
evidence.history_start	2026-10-01T16:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=1002257.859744 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-10-13 22:15:15

BNB Chain

R1_VAULT_PAYOUT_SPIKETreasury drain

bsc hot_bridge paid 203,643.96 usdc to 0x5a8e12d1f7148886fe35f6fa04f5a2c2b60ac354: 2.25x the 48h max of 90,434.46

0xfab2f669...0f88

Click a field to copy its value.

timestamp	2026-10-13T22:15:15Z
rule.id	R1_VAULT_PAYOUT_SPIKE
rule.level	8
rule.severity	medium
rule.description	Treasury payout far above recent maximum
rule.groups	evm, treasury, payout, spike
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0xfab2f66919736fdb7bf248af4adffa8be016b04718b2ae574109057de1e60f88
data.block	127480983
data.ts	2026-10-13T22:15:15Z
data.chain	bsc
data.kind	payout
data.amount	203643.959506865336
data.symbol	usdc
data.from	0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to	0x5a8e12d1f7148886fe35f6fa04f5a2c2b60ac354
data.tx_submitter	0xcf495cea699b8beca4073279eda66882ccfa273c
data.vault	hot_bridge
data.token	bsc:usdc
data.address	0x5a8e12d1f7148886fe35f6fa04f5a2c2b60ac354
scope.chain	bsc
scope.bridge	hot
scope.token	usdc
scope.address	0x5a8e12d1f7148886fe35f6fa04f5a2c2b60ac354
evidence.value_field	amount_usd
evidence.value	203643.959506865336
evidence.baseline_max	90434.460976861136
evidence.baseline_tx	0xa83e6a6dd8a0ec9c25ae1b678af2b2cd031b6e184080d69afd288b766ecfe6df
evidence.baseline_ts	2026-10-13T22:06:08Z
evidence.baseline_window	48h
evidence.baseline_events	88
evidence.ratio	2.25
evidence.factor	2.0
evidence.min_value	50000
matched[0]	kind=payout eq payout
matched[1]	vault=hot_bridge in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdc in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	chain, bridge, token

2026-10-15 05:40:59

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

727,403.60 usdc to 0x444dd61eb498438d1aac297bed8678af5caba58f, first seen 0s ago (payout)

0x22e56ca4...9d83

Click a field to copy its value.

timestamp	2026-10-15T05:40:59Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x22e56ca40c57335299811434f3a1b6c44485b9bfee73158413f4e695962b9d83
data.block	26195884
data.ts	2026-10-15T05:40:59Z
data.chain	ethereum
data.kind	payout
data.amount	727403.597656
data.symbol	usdc
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x444dd61eb498438d1aac297bed8678af5caba58f
data.vault	near_intents
data.token	ethereum:usdc
data.address	0x444dd61eb498438d1aac297bed8678af5caba58f
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdc
scope.address	0x444dd61eb498438d1aac297bed8678af5caba58f
evidence.address	0x444dd61eb498438d1aac297bed8678af5caba58f
evidence.first_seen	2026-10-15T05:40:59Z
evidence.first_seen_tx	0x22e56ca40c57335299811434f3a1b6c44485b9bfee73158413f4e695962b9d83
evidence.first_seen_kind	payout
evidence.age	0:00:00
evidence.max_age	7d
evidence.history_start	2026-10-01T16:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=727403.597656 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-10-16 18:47:59

Ethereum

R10_RECIPIENT_PAYOUT_BURSTTreasury drain

near_intents on ethereum paid 0x4e0650291a7099e39bae36a63dde1c36c55847fb 3 times over $250K in 1h 36m (887,586.20 usdc), 0 such payouts in the 7d before

0xece137ac...0ffb

Click a field to copy its value.

timestamp	2026-10-16T18:47:59Z
rule.id	R10_RECIPIENT_PAYOUT_BURST
rule.level	8
rule.severity	medium
rule.description	Burst of large treasury payouts to one new counterparty
rule.groups	evm, treasury, payout, frequency
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0xece137ac7909d82cb8a3d3a36a352c394fd937c044d5be0af290cfdb63630ffb
data.block	26206991
data.ts	2026-10-16T18:47:59Z
data.chain	ethereum
data.kind	payout
data.amount	287784.599456
data.symbol	usdc
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x4e0650291a7099e39bae36a63dde1c36c55847fb
data.vault	near_intents
data.token	ethereum:usdc
data.address	0x4e0650291a7099e39bae36a63dde1c36c55847fb
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdc
scope.address	0x4e0650291a7099e39bae36a63dde1c36c55847fb
evidence.group.chain	ethereum
evidence.group.vault	near_intents
evidence.group.to_addr	0x4e0650291a7099e39bae36a63dde1c36c55847fb
evidence.count	3
evidence.min_count	3
evidence.within	2h
evidence.window_sum	887586.196123
evidence.burst_txs	0xca16c4e715f5e5ac5efca9c2689567b07fee5694fd6ecc7445f38fffc96494cc, 0x43f598bf8c6d81547514d35d52f1d28eea0ceec17f7224a973fa2b460c5af2f9, 0xece137ac7909d82cb8a3d3a36a352c394fd937c044d5be0af290cfdb63630ffb
evidence.burst_started	2026-10-16T17:11:35Z
evidence.burst_span	1:36:24
evidence.prior_events	0
evidence.max_prior	3
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdc in ['usdt', 'usdc']
matched[3]	amount_usd=287784.599456 gt 250000
shield.capability	flag_observation
shield.scope	chain, bridge, token, address

2026-10-16 19:32:23

Ethereum

R3_TEST_THEN_DRAINTreasury drain

0xe88f2f28de98177712844c24572ea55223f2dca9 received a test payout 6m 0s before this 649,994.50 usdc payout

0x669784ef...2855

Click a field to copy its value.

timestamp	2026-10-16T19:32:23Z
rule.id	R3_TEST_THEN_DRAIN
rule.level	8
rule.severity	medium
rule.description	Small test payout followed by a large payout to the same recipient
rule.groups	evm, treasury, payout, sequence
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x669784ef9cf773a0d204cafc7d14c667fa28a6b4696cac682122a2cda7c22855
data.block	26207212
data.ts	2026-10-16T19:32:23Z
data.chain	ethereum
data.kind	payout
data.amount	649994.5
data.symbol	usdc
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0xe88f2f28de98177712844c24572ea55223f2dca9
data.vault	near_intents
data.token	ethereum:usdc
data.address	0xe88f2f28de98177712844c24572ea55223f2dca9
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdc
scope.address	0xe88f2f28de98177712844c24572ea55223f2dca9
evidence.group.to_addr	0xe88f2f28de98177712844c24572ea55223f2dca9
evidence.within	24h
evidence.steps	[{"step": "test_payout", "tx": "0x29033e8fe99b3699892d1dbb01609616a4ca4941f2110addc3a6589160d50a0e", "ts": "2026-10-16T19:26:23Z", "amount": "5.5"}, {"step": "large_payout", "tx": "0x669784ef9cf773a0d204cafc7d14c667fa28a6b4696cac682122a2cda7c22855", "ts": "2026-10-16T19:32:23Z", "amount": "649994.5"}]
evidence.first_step_age	0:06:00
evidence.prior_events	[{"step": "test_payout", "tx": "0x29033e8fe99b3699892d1dbb01609616a4ca4941f2110addc3a6589160d50a0e", "ts": "2026-10-16T19:26:23Z", "amount": "5.5"}]
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdc in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	address

2026-10-16 19:32:23

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

649,994.50 usdc to 0xe88f2f28de98177712844c24572ea55223f2dca9, first seen 6m 0s ago (payout)

0x669784ef...2855

Click a field to copy its value.

timestamp	2026-10-16T19:32:23Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x669784ef9cf773a0d204cafc7d14c667fa28a6b4696cac682122a2cda7c22855
data.block	26207212
data.ts	2026-10-16T19:32:23Z
data.chain	ethereum
data.kind	payout
data.amount	649994.5
data.symbol	usdc
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0xe88f2f28de98177712844c24572ea55223f2dca9
data.vault	near_intents
data.token	ethereum:usdc
data.address	0xe88f2f28de98177712844c24572ea55223f2dca9
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdc
scope.address	0xe88f2f28de98177712844c24572ea55223f2dca9
evidence.address	0xe88f2f28de98177712844c24572ea55223f2dca9
evidence.first_seen	2026-10-16T19:26:23Z
evidence.first_seen_tx	0x29033e8fe99b3699892d1dbb01609616a4ca4941f2110addc3a6589160d50a0e
evidence.first_seen_kind	payout
evidence.age	0:06:00
evidence.max_age	7d
evidence.history_start	2026-10-01T16:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=649994.5 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-10-17 17:51:11

Ethereum

R10_RECIPIENT_PAYOUT_BURSTTreasury drain

near_intents on ethereum paid 0x51aa68f9c5efe263fddcd28459e18d974258758a 3 times over $250K in 1h 47m (1,302,916.92 usdc), 1 such payouts in the 7d before

0x8f1bb5fb...f779

Click a field to copy its value.

timestamp	2026-10-17T17:51:11Z
rule.id	R10_RECIPIENT_PAYOUT_BURST
rule.level	8
rule.severity	medium
rule.description	Burst of large treasury payouts to one new counterparty
rule.groups	evm, treasury, payout, frequency
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x8f1bb5fbd4ad11a27be0924844b7740e4962765188365f0208469896064ef779
data.block	26213884
data.ts	2026-10-17T17:51:11Z
data.chain	ethereum
data.kind	payout
data.amount	426829.524816
data.symbol	usdc
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x51aa68f9c5efe263fddcd28459e18d974258758a
data.vault	near_intents
data.token	ethereum:usdc
data.address	0x51aa68f9c5efe263fddcd28459e18d974258758a
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdc
scope.address	0x51aa68f9c5efe263fddcd28459e18d974258758a
evidence.group.chain	ethereum
evidence.group.vault	near_intents
evidence.group.to_addr	0x51aa68f9c5efe263fddcd28459e18d974258758a
evidence.count	3
evidence.min_count	3
evidence.within	2h
evidence.window_sum	1302916.919892
evidence.burst_txs	0x89e52ccc5bc970d5b6f93c0ac5d617949ca916c1c5aba04ec97c3ed86111bcd3, 0x7b43740ee123bdcc08f7a0b3a29a8f3b8bf2c0900c4491eb298d614f73bb2198, 0x8f1bb5fbd4ad11a27be0924844b7740e4962765188365f0208469896064ef779
evidence.burst_started	2026-10-17T16:03:23Z
evidence.burst_span	1:47:48
evidence.prior_events	1
evidence.max_prior	3
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdc in ['usdt', 'usdc']
matched[3]	amount_usd=426829.524816 gt 250000
shield.capability	flag_observation
shield.scope	chain, bridge, token, address

2026-10-18 00:37:11

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

641,262.06 usdc to 0x0dd692f37c21fbaef782cbc9fb7fd1ede6a50937, first seen 0s ago (payout)

0x5629e44f...7e39

Click a field to copy its value.

timestamp	2026-10-18T00:37:11Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x5629e44f8c97453784d71ad35ffe9a218b1b01e9125c5d7cb4979ac826117e39
data.block	26215907
data.ts	2026-10-18T00:37:11Z
data.chain	ethereum
data.kind	payout
data.amount	641262.063811
data.symbol	usdc
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x0dd692f37c21fbaef782cbc9fb7fd1ede6a50937
data.vault	near_intents
data.token	ethereum:usdc
data.address	0x0dd692f37c21fbaef782cbc9fb7fd1ede6a50937
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdc
scope.address	0x0dd692f37c21fbaef782cbc9fb7fd1ede6a50937
evidence.address	0x0dd692f37c21fbaef782cbc9fb7fd1ede6a50937
evidence.first_seen	2026-10-18T00:37:11Z
evidence.first_seen_tx	0x5629e44f8c97453784d71ad35ffe9a218b1b01e9125c5d7cb4979ac826117e39
evidence.first_seen_kind	payout
evidence.age	0:00:00
evidence.max_age	7d
evidence.history_start	2026-10-01T16:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=641262.063811 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-10-18 12:21:35

Ethereum

R3_TEST_THEN_DRAINTreasury drain

0x3a3c2bfe279f9d92fa5da609e9b3ff439384fa3f received a test payout 6m 0s before this 109,982.58 usdt payout

0xc43a358c...b995

Click a field to copy its value.

timestamp	2026-10-18T12:21:35Z
rule.id	R3_TEST_THEN_DRAIN
rule.level	8
rule.severity	medium
rule.description	Small test payout followed by a large payout to the same recipient
rule.groups	evm, treasury, payout, sequence
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0xc43a358ceceaa79000f1cc3c09214f7833bb1c017c2dea05c1cd5f005647b995
data.block	26219415
data.ts	2026-10-18T12:21:35Z
data.chain	ethereum
data.kind	payout
data.amount	109982.58002
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x3a3c2bfe279f9d92fa5da609e9b3ff439384fa3f
data.vault	near_intents
data.token	ethereum:usdt
data.address	0x3a3c2bfe279f9d92fa5da609e9b3ff439384fa3f
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0x3a3c2bfe279f9d92fa5da609e9b3ff439384fa3f
evidence.group.to_addr	0x3a3c2bfe279f9d92fa5da609e9b3ff439384fa3f
evidence.within	24h
evidence.steps	[{"step": "test_payout", "tx": "0x2e464b45e8139cb47c98c3d185c09f9bfcdcb24b11f646800dad8e282badac15", "ts": "2026-10-18T12:15:35Z", "amount": "5"}, {"step": "large_payout", "tx": "0xc43a358ceceaa79000f1cc3c09214f7833bb1c017c2dea05c1cd5f005647b995", "ts": "2026-10-18T12:21:35Z", "amount": "109982.58002"}]
evidence.first_step_age	0:06:00
evidence.prior_events	[{"step": "test_payout", "tx": "0x2e464b45e8139cb47c98c3d185c09f9bfcdcb24b11f646800dad8e282badac15", "ts": "2026-10-18T12:15:35Z", "amount": "5"}]
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdt in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	address

2026-10-19 14:17:47

Ethereum

R3_TEST_THEN_DRAINTreasury drain

0x87238f8889d7b9226059cbc0e9888c4da5661003 received a test payout 1h 8m before this 135,000 usdt payout

0x40d415ae...04be

Click a field to copy its value.

timestamp	2026-10-19T14:17:47Z
rule.id	R3_TEST_THEN_DRAIN
rule.level	8
rule.severity	medium
rule.description	Small test payout followed by a large payout to the same recipient
rule.groups	evm, treasury, payout, sequence
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x40d415ae919e2888639ce5b2d6062d8b2d18a810566c28c9ad04370040d104be
data.block	26227167
data.ts	2026-10-19T14:17:47Z
data.chain	ethereum
data.kind	payout
data.amount	135000
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x87238f8889d7b9226059cbc0e9888c4da5661003
data.vault	near_intents
data.token	ethereum:usdt
data.address	0x87238f8889d7b9226059cbc0e9888c4da5661003
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0x87238f8889d7b9226059cbc0e9888c4da5661003
evidence.group.to_addr	0x87238f8889d7b9226059cbc0e9888c4da5661003
evidence.within	24h
evidence.steps	[{"step": "test_payout", "tx": "0xc5950aad1b31da3446ba8f8e92c73db982f6785dfc57e2a221571ff2d53ffb48", "ts": "2026-10-19T13:09:47Z", "amount": "1"}, {"step": "large_payout", "tx": "0x40d415ae919e2888639ce5b2d6062d8b2d18a810566c28c9ad04370040d104be", "ts": "2026-10-19T14:17:47Z", "amount": "135000"}]
evidence.first_step_age	1:08:00
evidence.prior_events	[{"step": "test_payout", "tx": "0xc5950aad1b31da3446ba8f8e92c73db982f6785dfc57e2a221571ff2d53ffb48", "ts": "2026-10-19T13:09:47Z", "amount": "1"}]
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdt in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	address

2026-10-19 16:36:59

Ethereum

R3_TEST_THEN_DRAINTreasury drain

0x6fbe22d04a157972bfae7b94e6e44928de57c28a received a test payout 3h 49m before this 110,000 usdt payout

0x87cf6ddd...241a

Click a field to copy its value.

timestamp	2026-10-19T16:36:59Z
rule.id	R3_TEST_THEN_DRAIN
rule.level	8
rule.severity	medium
rule.description	Small test payout followed by a large payout to the same recipient
rule.groups	evm, treasury, payout, sequence
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x87cf6ddd8478356f9d253cb748ac84c4ac517146116e629809f22a336deb241a
data.block	26227861
data.ts	2026-10-19T16:36:59Z
data.chain	ethereum
data.kind	payout
data.amount	110000
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x6fbe22d04a157972bfae7b94e6e44928de57c28a
data.vault	near_intents
data.token	ethereum:usdt
data.address	0x6fbe22d04a157972bfae7b94e6e44928de57c28a
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0x6fbe22d04a157972bfae7b94e6e44928de57c28a
evidence.group.to_addr	0x6fbe22d04a157972bfae7b94e6e44928de57c28a
evidence.within	24h
evidence.steps	[{"step": "test_payout", "tx": "0x953a57163095068526b82d53eea4c73f28c4d81ef2fd4ded2e4c19e2b5558fbe", "ts": "2026-10-19T12:47:23Z", "amount": "1"}, {"step": "large_payout", "tx": "0x87cf6ddd8478356f9d253cb748ac84c4ac517146116e629809f22a336deb241a", "ts": "2026-10-19T16:36:59Z", "amount": "110000"}]
evidence.first_step_age	3:49:36
evidence.prior_events	[{"step": "test_payout", "tx": "0x953a57163095068526b82d53eea4c73f28c4d81ef2fd4ded2e4c19e2b5558fbe", "ts": "2026-10-19T12:47:23Z", "amount": "1"}]
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdt in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	address

2026-10-20 21:19:23

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

503,902.16 usdt to 0x6c081d736eb5dbbc8124f6ea559d95dda3176f88, first seen 0s ago (payout)

0x52e4cff9...d2a9

Click a field to copy its value.

timestamp	2026-10-20T21:19:23Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x52e4cff96710d3a80e803d49d03f329353f7dbac6c276b45ec6a579f50a3d2a9
data.block	26236441
data.ts	2026-10-20T21:19:23Z
data.chain	ethereum
data.kind	payout
data.amount	503902.161641
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x6c081d736eb5dbbc8124f6ea559d95dda3176f88
data.vault	near_intents
data.token	ethereum:usdt
data.address	0x6c081d736eb5dbbc8124f6ea559d95dda3176f88
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0x6c081d736eb5dbbc8124f6ea559d95dda3176f88
evidence.address	0x6c081d736eb5dbbc8124f6ea559d95dda3176f88
evidence.first_seen	2026-10-20T21:19:23Z
evidence.first_seen_tx	0x52e4cff96710d3a80e803d49d03f329353f7dbac6c276b45ec6a579f50a3d2a9
evidence.first_seen_kind	payout
evidence.age	0:00:00
evidence.max_age	7d
evidence.history_start	2026-10-01T16:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=503902.161641 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-10-21 00:39:47

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

899,907.90 usdt to 0x3ff8ed1f8df120742879faeca8bf2842f0c46b04, first seen 39m 48s ago (payout)

0xcbace562...0cc0

Click a field to copy its value.

timestamp	2026-10-21T00:39:47Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0xcbace5620eda0f5e8abdaa28bc644ab75dc2edb723583fe4b05e611721010cc0
data.block	26237439
data.ts	2026-10-21T00:39:47Z
data.chain	ethereum
data.kind	payout
data.amount	899907.90018
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x3ff8ed1f8df120742879faeca8bf2842f0c46b04
data.vault	near_intents
data.token	ethereum:usdt
data.address	0x3ff8ed1f8df120742879faeca8bf2842f0c46b04
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0x3ff8ed1f8df120742879faeca8bf2842f0c46b04
evidence.address	0x3ff8ed1f8df120742879faeca8bf2842f0c46b04
evidence.first_seen	2026-10-20T23:59:59Z
evidence.first_seen_tx	0x73039ec0b03ac706bbe2449361bbad05859a2d5e19dfd999c385b835cb9e4209
evidence.first_seen_kind	payout
evidence.age	0:39:48
evidence.max_age	7d
evidence.history_start	2026-10-01T16:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=899907.90018 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-10-21 00:55:47

Ethereum

R10_RECIPIENT_PAYOUT_BURSTTreasury drain

near_intents on ethereum paid 0x3ff8ed1f8df120742879faeca8bf2842f0c46b04 3 times over $250K in 55m 48s (2,299,764.50 usdt), 0 such payouts in the 7d before

0xb139b602...165a

Click a field to copy its value.

timestamp	2026-10-21T00:55:47Z
rule.id	R10_RECIPIENT_PAYOUT_BURST
rule.level	8
rule.severity	medium
rule.description	Burst of large treasury payouts to one new counterparty
rule.groups	evm, treasury, payout, frequency
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0xb139b6026f4d77fec458811361e3c71e78f03e1e37a2311881695bfc6a0d165a
data.block	26237519
data.ts	2026-10-21T00:55:47Z
data.chain	ethereum
data.kind	payout
data.amount	899907.90018
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x3ff8ed1f8df120742879faeca8bf2842f0c46b04
data.vault	near_intents
data.token	ethereum:usdt
data.address	0x3ff8ed1f8df120742879faeca8bf2842f0c46b04
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0x3ff8ed1f8df120742879faeca8bf2842f0c46b04
evidence.group.chain	ethereum
evidence.group.vault	near_intents
evidence.group.to_addr	0x3ff8ed1f8df120742879faeca8bf2842f0c46b04
evidence.count	3
evidence.min_count	3
evidence.within	2h
evidence.window_sum	2299764.50046
evidence.burst_txs	0x73039ec0b03ac706bbe2449361bbad05859a2d5e19dfd999c385b835cb9e4209, 0xcbace5620eda0f5e8abdaa28bc644ab75dc2edb723583fe4b05e611721010cc0, 0xb139b6026f4d77fec458811361e3c71e78f03e1e37a2311881695bfc6a0d165a
evidence.burst_started	2026-10-20T23:59:59Z
evidence.burst_span	0:55:48
evidence.prior_events	0
evidence.max_prior	3
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdt in ['usdt', 'usdc']
matched[3]	amount_usd=899907.90018 gt 250000
shield.capability	flag_observation
shield.scope	chain, bridge, token, address

2026-10-21 00:55:47

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

899,907.90 usdt to 0x3ff8ed1f8df120742879faeca8bf2842f0c46b04, first seen 55m 48s ago (payout)

0xb139b602...165a

Click a field to copy its value.

timestamp	2026-10-21T00:55:47Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0xb139b6026f4d77fec458811361e3c71e78f03e1e37a2311881695bfc6a0d165a
data.block	26237519
data.ts	2026-10-21T00:55:47Z
data.chain	ethereum
data.kind	payout
data.amount	899907.90018
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x3ff8ed1f8df120742879faeca8bf2842f0c46b04
data.vault	near_intents
data.token	ethereum:usdt
data.address	0x3ff8ed1f8df120742879faeca8bf2842f0c46b04
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0x3ff8ed1f8df120742879faeca8bf2842f0c46b04
evidence.address	0x3ff8ed1f8df120742879faeca8bf2842f0c46b04
evidence.first_seen	2026-10-20T23:59:59Z
evidence.first_seen_tx	0x73039ec0b03ac706bbe2449361bbad05859a2d5e19dfd999c385b835cb9e4209
evidence.first_seen_kind	payout
evidence.age	0:55:48
evidence.max_age	7d
evidence.history_start	2026-10-01T16:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=899907.90018 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-10-21 01:02:11

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

799,918.10 usdt to 0x3ff8ed1f8df120742879faeca8bf2842f0c46b04, first seen 1h 2m ago (payout)

0xa236bd4e...b1a1

Click a field to copy its value.

timestamp	2026-10-21T01:02:11Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0xa236bd4e4b826bc0632621cbcceabd540d6cc43f4ad8dfab07b5310922a4b1a1
data.block	26237551
data.ts	2026-10-21T01:02:11Z
data.chain	ethereum
data.kind	payout
data.amount	799918.10016
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x3ff8ed1f8df120742879faeca8bf2842f0c46b04
data.vault	near_intents
data.token	ethereum:usdt
data.address	0x3ff8ed1f8df120742879faeca8bf2842f0c46b04
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0x3ff8ed1f8df120742879faeca8bf2842f0c46b04
evidence.address	0x3ff8ed1f8df120742879faeca8bf2842f0c46b04
evidence.first_seen	2026-10-20T23:59:59Z
evidence.first_seen_tx	0x73039ec0b03ac706bbe2449361bbad05859a2d5e19dfd999c385b835cb9e4209
evidence.first_seen_kind	payout
evidence.age	1:02:12
evidence.max_age	7d
evidence.history_start	2026-10-01T16:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=799918.10016 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-10-21 01:08:47

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

599,737.52 usdt to 0x3ff8ed1f8df120742879faeca8bf2842f0c46b04, first seen 1h 8m ago (payout)

0x41860df5...1212

Click a field to copy its value.

timestamp	2026-10-21T01:08:47Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x41860df508e3e3a18d94948974705eca735760ed1a7139cd58427ad424d21212
data.block	26237584
data.ts	2026-10-21T01:08:47Z
data.chain	ethereum
data.kind	payout
data.amount	599737.520621
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x3ff8ed1f8df120742879faeca8bf2842f0c46b04
data.vault	near_intents
data.token	ethereum:usdt
data.address	0x3ff8ed1f8df120742879faeca8bf2842f0c46b04
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0x3ff8ed1f8df120742879faeca8bf2842f0c46b04
evidence.address	0x3ff8ed1f8df120742879faeca8bf2842f0c46b04
evidence.first_seen	2026-10-20T23:59:59Z
evidence.first_seen_tx	0x73039ec0b03ac706bbe2449361bbad05859a2d5e19dfd999c385b835cb9e4209
evidence.first_seen_kind	payout
evidence.age	1:08:48
evidence.max_age	7d
evidence.history_start	2026-10-01T16:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=599737.520621 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-10-21 01:31:35

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

799,918.10 usdt to 0x3ff8ed1f8df120742879faeca8bf2842f0c46b04, first seen 1h 31m ago (payout)

0x20f1058f...cdbd

Click a field to copy its value.

timestamp	2026-10-21T01:31:35Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x20f1058fb2b4e480b8856b7d1a199e5103736e73ca1d5d0d9166dc46374bcdbd
data.block	26237698
data.ts	2026-10-21T01:31:35Z
data.chain	ethereum
data.kind	payout
data.amount	799918.10016
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x3ff8ed1f8df120742879faeca8bf2842f0c46b04
data.vault	near_intents
data.token	ethereum:usdt
data.address	0x3ff8ed1f8df120742879faeca8bf2842f0c46b04
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0x3ff8ed1f8df120742879faeca8bf2842f0c46b04
evidence.address	0x3ff8ed1f8df120742879faeca8bf2842f0c46b04
evidence.first_seen	2026-10-20T23:59:59Z
evidence.first_seen_tx	0x73039ec0b03ac706bbe2449361bbad05859a2d5e19dfd999c385b835cb9e4209
evidence.first_seen_kind	payout
evidence.age	1:31:36
evidence.max_age	7d
evidence.history_start	2026-10-01T16:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=799918.10016 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-10-21 01:44:47

Ethereum

R10_RECIPIENT_PAYOUT_BURSTTreasury drain

near_intents on ethereum paid 0xc3e2eff18260d9cd6eacd3632e24f70f5e15ded1 3 times over $250K in 21m 48s (1,399,856.30 usdt), 0 such payouts in the 7d before

0x60d7cb37...df8c

Click a field to copy its value.

timestamp	2026-10-21T01:44:47Z
rule.id	R10_RECIPIENT_PAYOUT_BURST
rule.level	8
rule.severity	medium
rule.description	Burst of large treasury payouts to one new counterparty
rule.groups	evm, treasury, payout, frequency
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x60d7cb37de40dd45f530ce9a92b3f34a52c307a39c8fd8c1384db3abf5aadf8c
data.block	26237764
data.ts	2026-10-21T01:44:47Z
data.chain	ethereum
data.kind	payout
data.amount	399958.90008
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0xc3e2eff18260d9cd6eacd3632e24f70f5e15ded1
data.vault	near_intents
data.token	ethereum:usdt
data.address	0xc3e2eff18260d9cd6eacd3632e24f70f5e15ded1
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0xc3e2eff18260d9cd6eacd3632e24f70f5e15ded1
evidence.group.chain	ethereum
evidence.group.vault	near_intents
evidence.group.to_addr	0xc3e2eff18260d9cd6eacd3632e24f70f5e15ded1
evidence.count	3
evidence.min_count	3
evidence.within	2h
evidence.window_sum	1399856.30028
evidence.burst_txs	0x119c7f71e3c0c93271e1b135ddc6daca71e9c1124bfcf8c4c562fdc1f13003b3, 0x02cb3a37357fe8db70a983f3572d5db0fed66aec99eac78c63029617dbd2a25d, 0x60d7cb37de40dd45f530ce9a92b3f34a52c307a39c8fd8c1384db3abf5aadf8c
evidence.burst_started	2026-10-21T01:22:59Z
evidence.burst_span	0:21:48
evidence.prior_events	0
evidence.max_prior	3
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdt in ['usdt', 'usdc']
matched[3]	amount_usd=399958.90008 gt 250000
shield.capability	flag_observation
shield.scope	chain, bridge, token, address

2026-10-21 01:49:47

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

599,938.50 usdt to 0xc3e2eff18260d9cd6eacd3632e24f70f5e15ded1, first seen 26m 48s ago (payout)

0x612d84c1...95e5

Click a field to copy its value.

timestamp	2026-10-21T01:49:47Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x612d84c1fa9b4551b9f5dbef004c284ab364316f84bae4ec7a210aaa7a8595e5
data.block	26237789
data.ts	2026-10-21T01:49:47Z
data.chain	ethereum
data.kind	payout
data.amount	599938.50012
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0xc3e2eff18260d9cd6eacd3632e24f70f5e15ded1
data.vault	near_intents
data.token	ethereum:usdt
data.address	0xc3e2eff18260d9cd6eacd3632e24f70f5e15ded1
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0xc3e2eff18260d9cd6eacd3632e24f70f5e15ded1
evidence.address	0xc3e2eff18260d9cd6eacd3632e24f70f5e15ded1
evidence.first_seen	2026-10-21T01:22:59Z
evidence.first_seen_tx	0x119c7f71e3c0c93271e1b135ddc6daca71e9c1124bfcf8c4c562fdc1f13003b3
evidence.first_seen_kind	payout
evidence.age	0:26:48
evidence.max_age	7d
evidence.history_start	2026-10-01T16:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=599938.50012 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-10-21 02:16:11

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

512,786.50 usdt to 0xc3e2eff18260d9cd6eacd3632e24f70f5e15ded1, first seen 53m 12s ago (payout)

0xd65f2903...dbe1

Click a field to copy its value.

timestamp	2026-10-21T02:16:11Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0xd65f2903ea2f4670a0d459f46a7756e2819d664da420e5bed0cf1315dff6dbe1
data.block	26237921
data.ts	2026-10-21T02:16:11Z
data.chain	ethereum
data.kind	payout
data.amount	512786.500597
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0xc3e2eff18260d9cd6eacd3632e24f70f5e15ded1
data.vault	near_intents
data.token	ethereum:usdt
data.address	0xc3e2eff18260d9cd6eacd3632e24f70f5e15ded1
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0xc3e2eff18260d9cd6eacd3632e24f70f5e15ded1
evidence.address	0xc3e2eff18260d9cd6eacd3632e24f70f5e15ded1
evidence.first_seen	2026-10-21T01:22:59Z
evidence.first_seen_tx	0x119c7f71e3c0c93271e1b135ddc6daca71e9c1124bfcf8c4c562fdc1f13003b3
evidence.first_seen_kind	payout
evidence.age	0:53:12
evidence.max_age	7d
evidence.history_start	2026-10-01T16:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=512786.500597 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-10-21 13:33:11

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

599,813.51 usdt to 0x021feb656b15693d33c140ace673230fc97a87e9, first seen 3h 19m ago (payout)

0xab78efd4...3dc3

Click a field to copy its value.

timestamp	2026-10-21T13:33:11Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0xab78efd48a2720ce705c59db4e482963c8381acce470b13d9fc231ba70183dc3
data.block	26241298
data.ts	2026-10-21T13:33:11Z
data.chain	ethereum
data.kind	payout
data.amount	599813.512869
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x021feb656b15693d33c140ace673230fc97a87e9
data.vault	near_intents
data.token	ethereum:usdt
data.address	0x021feb656b15693d33c140ace673230fc97a87e9
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0x021feb656b15693d33c140ace673230fc97a87e9
evidence.address	0x021feb656b15693d33c140ace673230fc97a87e9
evidence.first_seen	2026-10-21T10:14:11Z
evidence.first_seen_tx	0x378d0fcf13af8974b8a065dd096646484079cf1e4bcff6cc66bb405ab74b4358
evidence.first_seen_kind	payout
evidence.age	3:19:00
evidence.max_age	7d
evidence.history_start	2026-10-01T16:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=599813.512869 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-10-21 14:51:56

BNB Chain

R1_VAULT_PAYOUT_SPIKETreasury drain

bsc hot_bridge paid 109,842.76 usdt to 0x4ca9b21e134ebbfa6dc407d59ea6dfb0d5856bbb: 4.43x the 48h max of 24,788.47

0x3e30a913...400a

Click a field to copy its value.

timestamp	2026-10-21T14:51:56Z
rule.id	R1_VAULT_PAYOUT_SPIKE
rule.level	8
rule.severity	medium
rule.description	Treasury payout far above recent maximum
rule.groups	evm, treasury, payout, spike
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x3e30a913fcc5d9a48b02f3f2720a0adc748a0a8616ec32abc7a5e18c7752400a
data.block	128957188
data.ts	2026-10-21T14:51:56Z
data.chain	bsc
data.kind	payout
data.amount	109842.764352106170990182
data.symbol	usdt
data.from	0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to	0x4ca9b21e134ebbfa6dc407d59ea6dfb0d5856bbb
data.tx_submitter	0xcf495cea699b8beca4073279eda66882ccfa273c
data.vault	hot_bridge
data.token	bsc:usdt
data.address	0x4ca9b21e134ebbfa6dc407d59ea6dfb0d5856bbb
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
scope.address	0x4ca9b21e134ebbfa6dc407d59ea6dfb0d5856bbb
evidence.value_field	amount_usd
evidence.value	109842.764352106170990182
evidence.baseline_max	24788.467772438604667542
evidence.baseline_tx	0x1c6a568db7fc6e18a987dd16e08fbed4aed6456ea83c37e06d8badc3114d370c
evidence.baseline_ts	2026-10-21T14:42:08Z
evidence.baseline_window	48h
evidence.baseline_events	16
evidence.ratio	4.43
evidence.factor	2.0
evidence.min_value	50000
matched[0]	kind=payout eq payout
matched[1]	vault=hot_bridge in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdt in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	chain, bridge, token

2026-10-22 07:05:47

Ethereum

R10_RECIPIENT_PAYOUT_BURSTTreasury drain

near_intents on ethereum paid 0xb9ce48a3e00f9d3655a22b623599f20befaf6283 3 times over $250K in 1h 24m (1,599,825.90 usdt), 0 such payouts in the 7d before

0xa162bdff...64e0

Click a field to copy its value.

timestamp	2026-10-22T07:05:47Z
rule.id	R10_RECIPIENT_PAYOUT_BURST
rule.level	8
rule.severity	medium
rule.description	Burst of large treasury payouts to one new counterparty
rule.groups	evm, treasury, payout, frequency
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0xa162bdff0e71db08b0c13d0781ec32a4ea6693bf00f62e5b2806cbe3b6d564e0
data.block	26246550
data.ts	2026-10-22T07:05:47Z
data.chain	ethereum
data.kind	payout
data.amount	599928.501139
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0xb9ce48a3e00f9d3655a22b623599f20befaf6283
data.vault	near_intents
data.token	ethereum:usdt
data.address	0xb9ce48a3e00f9d3655a22b623599f20befaf6283
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0xb9ce48a3e00f9d3655a22b623599f20befaf6283
evidence.group.chain	ethereum
evidence.group.vault	near_intents
evidence.group.to_addr	0xb9ce48a3e00f9d3655a22b623599f20befaf6283
evidence.count	3
evidence.min_count	3
evidence.within	2h
evidence.window_sum	1599825.901339
evidence.burst_txs	0xd47dae0fba1b494e5c38bd1ba51d232e5b3c73bf32306cb219fc362146db1b4c, 0x7fea238402ba5d938265c6ff8992d2142a3e3cebb7d2a5e9d68e075110d3188c, 0xa162bdff0e71db08b0c13d0781ec32a4ea6693bf00f62e5b2806cbe3b6d564e0
evidence.burst_started	2026-10-22T05:41:11Z
evidence.burst_span	1:24:36
evidence.prior_events	0
evidence.max_prior	3
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdt in ['usdt', 'usdc']
matched[3]	amount_usd=599928.501139 gt 250000
shield.capability	flag_observation
shield.scope	chain, bridge, token, address

2026-10-22 07:05:47

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

599,928.50 usdt to 0xb9ce48a3e00f9d3655a22b623599f20befaf6283, first seen 1h 24m ago (payout)

0xa162bdff...64e0

Click a field to copy its value.

timestamp	2026-10-22T07:05:47Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0xa162bdff0e71db08b0c13d0781ec32a4ea6693bf00f62e5b2806cbe3b6d564e0
data.block	26246550
data.ts	2026-10-22T07:05:47Z
data.chain	ethereum
data.kind	payout
data.amount	599928.501139
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0xb9ce48a3e00f9d3655a22b623599f20befaf6283
data.vault	near_intents
data.token	ethereum:usdt
data.address	0xb9ce48a3e00f9d3655a22b623599f20befaf6283
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0xb9ce48a3e00f9d3655a22b623599f20befaf6283
evidence.address	0xb9ce48a3e00f9d3655a22b623599f20befaf6283
evidence.first_seen	2026-10-22T05:41:11Z
evidence.first_seen_tx	0xd47dae0fba1b494e5c38bd1ba51d232e5b3c73bf32306cb219fc362146db1b4c
evidence.first_seen_kind	payout
evidence.age	1:24:36
evidence.max_age	7d
evidence.history_start	2026-10-01T16:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=599928.501139 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-10-23 10:51:58

BNB Chain

R1_VAULT_PAYOUT_SPIKETreasury drain

bsc hot_bridge paid 280,000 usdt to 0xc565b3db8527fe7f7f89b630886ec348ae1eb994: 2.32x the 48h max of 120,877.24

0x4afc209f...3bbe

Click a field to copy its value.

timestamp	2026-10-23T10:51:58Z
rule.id	R1_VAULT_PAYOUT_SPIKE
rule.level	8
rule.severity	medium
rule.description	Treasury payout far above recent maximum
rule.groups	evm, treasury, payout, spike
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x4afc209f8313f45a1b77e41e5e24be94e514766e53d436b19b3f0b7c431a3bbe
data.block	129309058
data.ts	2026-10-23T10:51:58Z
data.chain	bsc
data.kind	payout
data.amount	280000
data.symbol	usdt
data.from	0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to	0xc565b3db8527fe7f7f89b630886ec348ae1eb994
data.tx_submitter	0xec4b57d230516a4f3406c9c235963593160b5efe
data.vault	hot_bridge
data.token	bsc:usdt
data.address	0xc565b3db8527fe7f7f89b630886ec348ae1eb994
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
scope.address	0xc565b3db8527fe7f7f89b630886ec348ae1eb994
evidence.value_field	amount_usd
evidence.value	280000
evidence.baseline_max	120877.237624
evidence.baseline_tx	0xca83b1949288d330c82ae6fa6b5e39a1ef5d9393bb45ad20132f411651cb48c5
evidence.baseline_ts	2026-10-23T09:58:19Z
evidence.baseline_window	48h
evidence.baseline_events	211
evidence.ratio	2.32
evidence.factor	2.0
evidence.min_value	50000
matched[0]	kind=payout eq payout
matched[1]	vault=hot_bridge in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdt in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	chain, bridge, token

2026-10-23 15:18:47

Ethereum

R3_TEST_THEN_DRAINTreasury drain

0xd65299186614d6a2d29b9f966234d0d8b4b5a0ed received a test payout 2h 20m before this 111,645.20 usdt payout

0xa2332e7a...8825

Click a field to copy its value.

timestamp	2026-10-23T15:18:47Z
rule.id	R3_TEST_THEN_DRAIN
rule.level	8
rule.severity	medium
rule.description	Small test payout followed by a large payout to the same recipient
rule.groups	evm, treasury, payout, sequence
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0xa2332e7a1cc19d014f705dc85344fa827e5430dfd1a5ebb94053d5053b9c8825
data.block	26256175
data.ts	2026-10-23T15:18:47Z
data.chain	ethereum
data.kind	payout
data.amount	111645.199779
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0xd65299186614d6a2d29b9f966234d0d8b4b5a0ed
data.vault	near_intents
data.token	ethereum:usdt
data.address	0xd65299186614d6a2d29b9f966234d0d8b4b5a0ed
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0xd65299186614d6a2d29b9f966234d0d8b4b5a0ed
evidence.group.to_addr	0xd65299186614d6a2d29b9f966234d0d8b4b5a0ed
evidence.within	24h
evidence.steps	[{"step": "test_payout", "tx": "0x33bbc6e1965bb2541e5e2cc390236e30b945ecc8318f5af1a3998866f5e2795a", "ts": "2026-10-23T12:57:59Z", "amount": "66.186515"}, {"step": "large_payout", "tx": "0xa2332e7a1cc19d014f705dc85344fa827e5430dfd1a5ebb94053d5053b9c8825", "ts": "2026-10-23T15:18:47Z", "amount": "111645.199779"}]
evidence.first_step_age	2:20:48
evidence.prior_events	[{"step": "test_payout", "tx": "0x33bbc6e1965bb2541e5e2cc390236e30b945ecc8318f5af1a3998866f5e2795a", "ts": "2026-10-23T12:57:59Z", "amount": "66.186515"}]
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdt in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	address

2026-10-25 06:45:06

BNB Chain

R1_VAULT_PAYOUT_SPIKETreasury drain

bsc hot_bridge paid 320,978.48 usdt to 0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758: 2.66x the 48h max of 120,877.24

0xded3fc97...f7f3

Click a field to copy its value.

timestamp	2026-10-25T06:45:06Z
rule.id	R1_VAULT_PAYOUT_SPIKE
rule.level	8
rule.severity	medium
rule.description	Treasury payout far above recent maximum
rule.groups	evm, treasury, payout, spike
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0xded3fc9775eb7733be7638b1528290e52c1be05b18bfd34a6f74306bef9ff7f3
data.block	129659984
data.ts	2026-10-25T06:45:06Z
data.chain	bsc
data.kind	payout
data.amount	320978.483399
data.symbol	usdt
data.from	0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
data.tx_submitter	0xcf495cea699b8beca4073279eda66882ccfa273c
data.vault	hot_bridge
data.token	bsc:usdt
data.address	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
scope.address	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
evidence.value_field	amount_usd
evidence.value	320978.483399
evidence.baseline_max	120877.237624
evidence.baseline_tx	0xca83b1949288d330c82ae6fa6b5e39a1ef5d9393bb45ad20132f411651cb48c5
evidence.baseline_ts	2026-10-23T09:58:19Z
evidence.baseline_window	48h
evidence.baseline_events	337
evidence.ratio	2.66
evidence.factor	2.0
evidence.min_value	50000
matched[0]	kind=payout eq payout
matched[1]	vault=hot_bridge in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdt in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	chain, bridge, token

2026-10-25 09:19:11

Ethereum

R3_TEST_THEN_DRAINTreasury drain

0x3a3c2bfe279f9d92fa5da609e9b3ff439384fa3f received a test payout 10m 36s before this 299,961.20 usdt payout

0xa0823f57...961e

Click a field to copy its value.

timestamp	2026-10-25T09:19:11Z
rule.id	R3_TEST_THEN_DRAIN
rule.level	8
rule.severity	medium
rule.description	Small test payout followed by a large payout to the same recipient
rule.groups	evm, treasury, payout, sequence
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0xa0823f57736c509018b67fe34018ba6ae46bf9daeb4ca73fa02d563e89a3961e
data.block	26268749
data.ts	2026-10-25T09:19:11Z
data.chain	ethereum
data.kind	payout
data.amount	299961.200058
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x3a3c2bfe279f9d92fa5da609e9b3ff439384fa3f
data.vault	near_intents
data.token	ethereum:usdt
data.address	0x3a3c2bfe279f9d92fa5da609e9b3ff439384fa3f
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0x3a3c2bfe279f9d92fa5da609e9b3ff439384fa3f
evidence.group.to_addr	0x3a3c2bfe279f9d92fa5da609e9b3ff439384fa3f
evidence.within	24h
evidence.steps	[{"step": "test_payout", "tx": "0x8b5d61883957984beab6bd0ae4ec8aa96c8b417e8c2f86619b36e3fe74f859ed", "ts": "2026-10-25T09:08:35Z", "amount": "7"}, {"step": "large_payout", "tx": "0xa0823f57736c509018b67fe34018ba6ae46bf9daeb4ca73fa02d563e89a3961e", "ts": "2026-10-25T09:19:11Z", "amount": "299961.200058"}]
evidence.first_step_age	0:10:36
evidence.prior_events	[{"step": "test_payout", "tx": "0x8b5d61883957984beab6bd0ae4ec8aa96c8b417e8c2f86619b36e3fe74f859ed", "ts": "2026-10-25T09:08:35Z", "amount": "7"}]
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdt in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	address

Incidents

15 incidents with alerts in the window, highest mode first. Each is SHIELD-shaped (intentwatch.incident/v1, unofficial: SHIELD's Incident API is partner-only). Alerts sharing an asset or address within 24h are one incident; two high alerts on different transactions within 2h escalate it to under_attack, unless all of them come from a rate rule (R2), which moves it onto the route and stops at paranoid.

On NEAR: incidents at paranoid or above are written to the IntentWatch incident registry registry.surs51.testnet (testnet, deployed) by a detector that holds only a function-call key limited to report_incident with a 0.25 NEAR gas allowance (read from chain 2026-10-31 19:05:23 UTC: least privilege ok). No model is connected: the summary module is ready to connect and has recorded nothing for this replay.

Agent guard wallet on testnet

The contract (contracts/agent_guard, Rust near-sdk) holds an AI agent's funds. Its only key for the agent is a function-call key limited to request_transfer (read from chain 2026-11-04 15:47:30 UTC: least privilege ok). It enforces 0.1 NEAR per transfer and 0.5 NEAR per day, then asks the incident registry about the route the agent declares and the account the money really goes to: under_attack or a paused destination is refused, paranoid is held for 60 min and re-checked, and any trouble reaching the registry is a refusal. Deployed at guard.surs51.testnet (tx). Code upgraded 2026-11-01 16:37:35 UTC (tx); a receipt recorded before that is an answer of the earlier build. Code upgraded 2026-11-04 15:46:26 UTC (tx); a receipt recorded before that is an answer of the earlier build. The "Contract answers" column comes from a mirror of the contract logic, tested against the contracts with shared vectors, assuming the detector reported each escalation as it happened; the receipts column is what the deployed contract answered on testnet, and intentwatch guard verify reads those back from chain. The chain, bridge and token are what the agent declares: an agent that lies about them and pays an account nobody has flagged is bounded by the limits only, unless the owner has set an allowlist of receivers, which the contract checks first, along with the owner's stop switch and hourly cap. Click a row for the exact call the agent signs.

Moment (UTC)	Agent asks	Declared route and real receiver	Contract answers	Testnet receipt
2026-10-21 01:04	Payment on the route, once it is paranoid 0.01 NEAR	ethereum/near_intents/usdt 0x3ff8ed1f...6b04 really pays supplier.t...tnet	held route is paranoid (incident IW-20261020-211923-48ebc3): held until the delay ends	needs an earlier report
The `request_transfer` call the agent signs { "args": { "amount": "10000000000000000000000", "receiver_id": "supplier.testnet", "route": { "address": "0x3ff8ed1f8df120742879faeca8bf2842f0c46b04", "bridge": "near_intents", "chain": "ethereum", "token": "usdt" } }, "deposit": "0", "gas_tgas": 100, "method": "request_transfer", "receiver_id": "guard.surs51.testnet" }
2026-10-21 02:05	Payment on the route, now under_attack 0.01 NEAR	ethereum/near_intents/usdt 0x3ff8ed1f...6b04 really pays surs51.testnet	refused route is under_attack (incident IW-20261020-211923-48ebc3)	refused 8FghMZpmKa...He9Y
The `request_transfer` call the agent signs { "args": { "amount": "10000000000000000000000", "receiver_id": "surs51.testnet", "route": { "address": "0x00000000000000000000000000000000000a11ce", "bridge": "hot", "chain": "bsc", "token": "usdt" } }, "deposit": "0", "gas_tgas": 100, "method": "request_transfer", "receiver_id": "guard.surs51.testnet" }
2026-10-21 02:05	The same payment on a route nothing covers 0.01 NEAR	bsc/hot/usdc 0x00000000...11ce really pays surs51.testnet	sent route clear, within limits	sent 4DSpDZagW7...bzCA
The `request_transfer` call the agent signs { "args": { "amount": "10000000000000000000000", "receiver_id": "surs51.testnet", "route": { "address": "0x00000000000000000000000000000000000a11ce", "bridge": "near_intents", "chain": "ethereum", "token": "usdc" } }, "deposit": "0", "gas_tgas": 100, "method": "request_transfer", "receiver_id": "guard.surs51.testnet" }
2026-10-21 02:05	A payment over the per-transfer limit 0.2 NEAR	bsc/hot/usdc 0x00000000...11ce really pays surs51.testnet	refused amount exceeds the per-transfer limit	refused 2LXCMG3o2K...zUdG
The `request_transfer` call the agent signs { "args": { "amount": "200000000000000000000000", "receiver_id": "surs51.testnet", "route": { "address": "0x00000000000000000000000000000000000a11ce", "bridge": "near_intents", "chain": "ethereum", "token": "usdc" } }, "deposit": "0", "gas_tgas": 100, "method": "request_transfer", "receiver_id": "guard.surs51.testnet" }
2026-10-21 02:05	A payment to a fresh account, with the owner's allowlist on 0.01 NEAR	bsc/hot/usdc 0x00000000...11ce really pays 5fd214f06a...f46a owner allows only surs51.testnet	refused the receiver is not on the owner's allowlist	refused FvmP6yX4y7...Emq5
The `request_transfer` call the agent signs { "args": { "amount": "10000000000000000000000", "receiver_id": "5fd214f06a0de3e6bcdf6f325ab29b494f9904f491c24e1db62c9069fdb0f46a", "route": { "address": "0x00000000000000000000000000000000000a11ce", "bridge": "near_intents", "chain": "ethereum", "token": "usdc" } }, "deposit": "0", "gas_tgas": 100, "method": "request_transfer", "receiver_id": "guard.surs51.testnet" }

under attack IW-20261020-211923-48ebc3 high 15 alerts · score 23.5 · Ethereum · opened 2026-10-20 21:19:23 UTC · active 33h 46m show ▾hide ▴

normal

10-20 21:19

paranoid

10-21 01:04

under attack

10-21 02:05

Recommended capability: raise_mode
Scope: chain: ethereumbridge: near_intentstoken: anyaddress: any
Opened by: R5_NEW_RECIPIENT_LARGE_PAYOUT
Flagged stablecoin payouts: 13 totalling 7,716,619.78 USD

On-chain record not recorded

No recorded report for this incident. Incident hash 3982369271f8c84b...9331 (sha256 of the canonical incident JSON; intentwatch registry hashes recomputes it).

The report_incident call the detector would sign

{
  "args": {
    "report": {
      "alerts": 15,
      "attestation_hash": null,
      "capability": "raise_mode",
      "incident_hash": "3982369271f8c84b7c01ad5a8b6149db133ff72ed3e61a1e2c5641fae4499331",
      "incident_id": "IW-20261020-211923-48ebc3",
      "mode": "under_attack",
      "opened_at_ms": 1792531163000,
      "paused_destinations": [],
      "scope": {
        "address": null,
        "bridge": "near_intents",
        "chain": "ethereum",
        "token": null
      },
      "summary_hash": null
    }
  },
  "deposit": "0",
  "gas_tgas": 10,
  "method": "report_incident",
  "receiver_id": "registry.surs51.testnet"
}

Model-written summary none recorded

Not recorded for this replay. intentwatch triage record asks a NEAR-hosted TEE model for a summary and stores the evidence (response signature, Intel TDX quote and collateral, NVIDIA GPU verdict) that the replay then re-verifies offline. It needs a NEAR AI Cloud key.

Rules in this incident

12R2_VAULT_OUTFLOW_VELOCITY×28R5_NEW_RECIPIENT_LARGE_PAYOUT×108R10_RECIPIENT_PAYOUT_BURST×3

Mode changes and actions click a row for the alerts that led to it

Time (UTC)	Change	Reason
2026-10-20 21:19:23	normal	1 observation(s)
2026-10-21 01:04:11	paranoid	high alert R2_VAULT_OUTFLOW_VELOCITY
2026-10-21 02:05:23	under attack	high alerts on 2 transactions within 2h (R2_VAULT_OUTFLOW_VELOCITY)

Raw incident JSON (alert evidence omitted: see Events, or incidents.jsonl)

{
  "schema": "intentwatch.incident/v1 (shield-compatible, unofficial)",
  "incident_id": "IW-20261020-211923-48ebc3",
  "opened_at": "2026-10-20T21:19:23Z",
  "updated_at": "2026-10-22T07:05:47Z",
  "recommended_mode": "under_attack",
  "capability": "raise_mode",
  "scope": {
    "chain": "ethereum",
    "bridge": "near_intents",
    "token": null,
    "address": null
  },
  "score": 23.5,
  "max_severity": "high",
  "mode_history": [
    {
      "ts": "2026-10-20T21:19:23Z",
      "mode": "normal",
      "capability": "flag_observation",
      "scope": {
        "chain": "ethereum",
        "bridge": "near_intents",
        "token": "usdt",
        "address": "0x6c081d736eb5dbbc8124f6ea559d95dda3176f88"
      },
      "reason": "1 observation(s)",
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:1f5f9ceab2a2"
    },
    {
      "ts": "2026-10-21T01:04:11Z",
      "mode": "paranoid",
      "capability": "raise_mode",
      "scope": {
        "chain": "ethereum",
        "bridge": "near_intents",
        "token": "usdt",
        "address": "0x3ff8ed1f8df120742879faeca8bf2842f0c46b04"
      },
      "reason": "high alert R2_VAULT_OUTFLOW_VELOCITY",
      "alert_id": "R2_VAULT_OUTFLOW_VELOCITY:2f8dac398ff1"
    },
    {
      "ts": "2026-10-21T02:05:23Z",
      "mode": "under_attack",
      "capability": "raise_mode",
      "scope": {
        "chain": "ethereum",
        "bridge": "near_intents",
        "token": null,
        "address": null
      },
      "reason": "high alerts on 2 transactions within 2h (R2_VAULT_OUTFLOW_VELOCITY)",
      "alert_id": "R2_VAULT_OUTFLOW_VELOCITY:3e90ca341ed5"
    }
  ],
  "recommended_actions": [],
  "alerts": [
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:1f5f9ceab2a2",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-10-20T21:19:23Z",
      "tx": "0x52e4cff96710d3a80e803d49d03f329353f7dbac6c276b45ec6a579f50a3d2a9"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:bd324cbdea00",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-10-21T00:39:47Z",
      "tx": "0xcbace5620eda0f5e8abdaa28bc644ab75dc2edb723583fe4b05e611721010cc0"
    },
    {
      "alert_id": "R10_RECIPIENT_PAYOUT_BURST:989bbc0eeb73",
      "rule": "R10_RECIPIENT_PAYOUT_BURST",
      "severity": "medium",
      "ts": "2026-10-21T00:55:47Z",
      "tx": "0xb139b6026f4d77fec458811361e3c71e78f03e1e37a2311881695bfc6a0d165a"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:54949828de60",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-10-21T00:55:47Z",
      "tx": "0xb139b6026f4d77fec458811361e3c71e78f03e1e37a2311881695bfc6a0d165a"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:587d61f493f6",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-10-21T01:02:11Z",
      "tx": "0xa236bd4e4b826bc0632621cbcceabd540d6cc43f4ad8dfab07b5310922a4b1a1"
    },
    {
      "alert_id": "R2_VAULT_OUTFLOW_VELOCITY:2f8dac398ff1",
      "rule": "R2_VAULT_OUTFLOW_VELOCITY",
      "severity": "high",
      "ts": "2026-10-21T01:04:11Z",
      "tx": "0x980b77d395af3a5933efc5143b35349b44134cbdd926b14fee0b89d62b783d2e"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:660e164c6fa2",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-10-21T01:08:47Z",
      "tx": "0x41860df508e3e3a18d94948974705eca735760ed1a7139cd58427ad424d21212"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:b94f972181ce",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-10-21T01:31:35Z",
      "tx": "0x20f1058fb2b4e480b8856b7d1a199e5103736e73ca1d5d0d9166dc46374bcdbd"
    },
    {
      "alert_id": "R10_RECIPIENT_PAYOUT_BURST:5c7d15abebb8",
      "rule": "R10_RECIPIENT_PAYOUT_BURST",
      "severity": "medium",
      "ts": "2026-10-21T01:44:47Z",
      "tx": "0x60d7cb37de40dd45f530ce9a92b3f34a52c307a39c8fd8c1384db3abf5aadf8c"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:823bb5605141",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-10-21T01:49:47Z",
      "tx": "0x612d84c1fa9b4551b9f5dbef004c284ab364316f84bae4ec7a210aaa7a8595e5"
    },
    {
      "alert_id": "R2_VAULT_OUTFLOW_VELOCITY:3e90ca341ed5",
      "rule": "R2_VAULT_OUTFLOW_VELOCITY",
      "severity": "high",
      "ts": "2026-10-21T02:05:23Z",
      "tx": "0xe08943a13ba0e9963518e4dc74410526e4801578733d99ff3567732034f4a363"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:e9f9413b5332",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-10-21T02:16:11Z",
      "tx": "0xd65f2903ea2f4670a0d459f46a7756e2819d664da420e5bed0cf1315dff6dbe1"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:e7fa49ee04c2",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-10-21T13:33:11Z",
      "tx": "0xab78efd48a2720ce705c59db4e482963c8381acce470b13d9fc231ba70183dc3"
    },
    {
      "alert_id": "R10_RECIPIENT_PAYOUT_BURST:22ff1a83f52c",
      "rule": "R10_RECIPIENT_PAYOUT_BURST",
      "severity": "medium",
      "ts": "2026-10-22T07:05:47Z",
      "tx": "0xa162bdff0e71db08b0c13d0781ec32a4ea6693bf00f62e5b2806cbe3b6d564e0"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:30b1bfbc1393",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-10-22T07:05:47Z",
      "tx": "0xa162bdff0e71db08b0c13d0781ec32a4ea6693bf00f62e5b2806cbe3b6d564e0"
    }
  ],
  "summary": "15 alerts (R10_RECIPIENT_PAYOUT_BURST, R2_VAULT_OUTFLOW_VELOCITY, R5_NEW_RECIPIENT_LARGE_PAYOUT) on ethereum; opened 2026-10-20T21:19:23Z by R5_NEW_RECIPIENT_LARGE_PAYOUT; mode under_attack; 13 flagged stablecoin payouts totalling 7,716,619.78 USD."
}

paranoid IW-20261008-161947-96e649 high 16 alerts · score 26.0 · Ethereum · opened 2026-10-08 16:19:47 UTC · active 38h 56m show ▾hide ▴

normal

10-08 16:19

paranoid

10-10 07:16

under attack

Recommended capability: raise_mode
Scope: chain: ethereumbridge: near_intentstoken: usdtaddress: 0x4117ffb9...9879
Opened by: R5_NEW_RECIPIENT_LARGE_PAYOUT
Flagged stablecoin payouts: 12 totalling 10,209,869.09 USD

On-chain record not recorded

No recorded report for this incident. Incident hash d3fd635256ca52cb...9ce8 (sha256 of the canonical incident JSON; intentwatch registry hashes recomputes it).

The report_incident call the detector would sign

{
  "args": {
    "report": {
      "alerts": 16,
      "attestation_hash": null,
      "capability": "raise_mode",
      "incident_hash": "d3fd635256ca52cb43352bd25d95b97b207dd17660ca20fbe95cca0aa0569ce8",
      "incident_id": "IW-20261008-161947-96e649",
      "mode": "paranoid",
      "opened_at_ms": 1791476387000,
      "paused_destinations": [],
      "scope": {
        "address": "0x4117ffb93a592865e37f8e3d5de77053de7f9879",
        "bridge": "near_intents",
        "chain": "ethereum",
        "token": "usdt"
      },
      "summary_hash": null
    }
  },
  "deposit": "0",
  "gas_tgas": 10,
  "method": "report_incident",
  "receiver_id": "registry.surs51.testnet"
}

Model-written summary none recorded

Rules in this incident

12R1B_PAYOUT_SPIKE_TO_NEW_RECIPIENT×112R2_VAULT_OUTFLOW_VELOCITY×18R5_NEW_RECIPIENT_LARGE_PAYOUT×128R10_RECIPIENT_PAYOUT_BURST×18R1_VAULT_PAYOUT_SPIKE×1

Mode changes and actions click a row for the alerts that led to it

Time (UTC)	Change	Reason
2026-10-08 16:19:47	normal	1 observation(s)
2026-10-10 07:16:11	paranoid	high alert R1B_PAYOUT_SPIKE_TO_NEW_RECIPIENT

Raw incident JSON (alert evidence omitted: see Events, or incidents.jsonl)

{
  "schema": "intentwatch.incident/v1 (shield-compatible, unofficial)",
  "incident_id": "IW-20261008-161947-96e649",
  "opened_at": "2026-10-08T16:19:47Z",
  "updated_at": "2026-10-10T07:16:11Z",
  "recommended_mode": "paranoid",
  "capability": "raise_mode",
  "scope": {
    "chain": "ethereum",
    "bridge": "near_intents",
    "token": "usdt",
    "address": "0x4117ffb93a592865e37f8e3d5de77053de7f9879"
  },
  "score": 26.0,
  "max_severity": "high",
  "mode_history": [
    {
      "ts": "2026-10-08T16:19:47Z",
      "mode": "normal",
      "capability": "flag_observation",
      "scope": {
        "chain": "ethereum",
        "bridge": "near_intents",
        "token": "usdt",
        "address": "0x4f53b552fd08c83c169974105a3801b3db7c3a05"
      },
      "reason": "1 observation(s)",
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:d7011ad15510"
    },
    {
      "ts": "2026-10-10T07:16:11Z",
      "mode": "paranoid",
      "capability": "raise_mode",
      "scope": {
        "chain": "ethereum",
        "bridge": "near_intents",
        "token": "usdt",
        "address": "0x4117ffb93a592865e37f8e3d5de77053de7f9879"
      },
      "reason": "high alert R1B_PAYOUT_SPIKE_TO_NEW_RECIPIENT",
      "alert_id": "R1B_PAYOUT_SPIKE_TO_NEW_RECIPIENT:4e007433b06a"
    }
  ],
  "recommended_actions": [],
  "alerts": [
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:d7011ad15510",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-10-08T16:19:47Z",
      "tx": "0xab1ce27bbbe14cfa7fdb9d5428818d50664f0c04afcb1739106a7d303f50b949"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:5c6491473fce",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-10-09T08:06:47Z",
      "tx": "0x7524a4a643e835daf3b2c5dba7be630c8e9e6692608bf14d6e1ae2ea621bdf10"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:22c9a9662dd4",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-10-09T10:17:35Z",
      "tx": "0xf3cbf8a115872d979bd7dc185601b8f1cf54a14d10b0bc89722ecd6df4946371"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:c4c3c467268b",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-10-09T23:35:35Z",
      "tx": "0x6d3ec0464f69e41437509266695e8175a7a5b42e5c917cdc43c17154b4487793"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:999f17e98df4",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-10-10T00:11:47Z",
      "tx": "0x684399edced702bd17597abd50e22d0ccb3af4a0f6489d34b394ee31cc766b20"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:7f68e287cd6b",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-10-10T02:46:47Z",
      "tx": "0xc98f24b1b6fc94ff3be543239391b19e7b25eec5628cfe1e3640dd50de9e77aa"
    },
    {
      "alert_id": "R10_RECIPIENT_PAYOUT_BURST:7bfa62ab73c5",
      "rule": "R10_RECIPIENT_PAYOUT_BURST",
      "severity": "medium",
      "ts": "2026-10-10T04:20:11Z",
      "tx": "0x4f03f6c239af2568947901e647d56cd19745d0a3a1682b2ed06a24035c0fcdbf"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:8fb596fe199c",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-10-10T04:20:11Z",
      "tx": "0x4f03f6c239af2568947901e647d56cd19745d0a3a1682b2ed06a24035c0fcdbf"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:f2b880ac83c5",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-10-10T05:04:59Z",
      "tx": "0x75d5421b920389201fa1305434d41412dc4c4218887a2fc59f2737f430cccae9"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:d8fc009c78e3",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-10-10T05:23:35Z",
      "tx": "0x89285d8de095f5b6b8c05205dd2e57c9aafa9c831d618f1fc273607c18a10878"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:52b5733a7471",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-10-10T06:04:23Z",
      "tx": "0x379af70652dc8cc7c7656717cf5dc3b5869c32b22b4e89d61619336fe605ecc2"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:1ceb87e12093",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-10-10T06:05:11Z",
      "tx": "0xf02d6465fca9746cdd0c46c4b3045850f90b4b0ea9a37614ea619a208b924478"
    },
    {
      "alert_id": "R1B_PAYOUT_SPIKE_TO_NEW_RECIPIENT:4e007433b06a",
      "rule": "R1B_PAYOUT_SPIKE_TO_NEW_RECIPIENT",
      "severity": "high",
      "ts": "2026-10-10T07:16:11Z",
      "tx": "0x2d0e5d4094e798c710abc3dd03b73eb92f14830e4ef6b14e093808d0bea78230"
    },
    {
      "alert_id": "R1_VAULT_PAYOUT_SPIKE:dd1560b6b370",
      "rule": "R1_VAULT_PAYOUT_SPIKE",
      "severity": "medium",
      "ts": "2026-10-10T07:16:11Z",
      "tx": "0x2d0e5d4094e798c710abc3dd03b73eb92f14830e4ef6b14e093808d0bea78230"
    },
    {
      "alert_id": "R2_VAULT_OUTFLOW_VELOCITY:9ae124354359",
      "rule": "R2_VAULT_OUTFLOW_VELOCITY",
      "severity": "high",
      "ts": "2026-10-10T07:16:11Z",
      "tx": "0x2d0e5d4094e798c710abc3dd03b73eb92f14830e4ef6b14e093808d0bea78230"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:7939ea8ff167",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-10-10T07:16:11Z",
      "tx": "0x2d0e5d4094e798c710abc3dd03b73eb92f14830e4ef6b14e093808d0bea78230"
    }
  ],
  "summary": "16 alerts (R10_RECIPIENT_PAYOUT_BURST, R1B_PAYOUT_SPIKE_TO_NEW_RECIPIENT, R1_VAULT_PAYOUT_SPIKE, R2_VAULT_OUTFLOW_VELOCITY, R5_NEW_RECIPIENT_LARGE_PAYOUT) on ethereum; opened 2026-10-08T16:19:47Z by R5_NEW_RECIPIENT_LARGE_PAYOUT; mode paranoid; 12 flagged stablecoin payouts totalling 10,209,869.09 USD."
}

paranoid IW-20261008-124216-3d129a high 12 alerts · score 18.5 · BNB Chain · opened 2026-10-08 12:42:16 UTC · active 50h 41m show ▾hide ▴

normal

10-08 12:42

paranoid

10-09 12:00

under attack

Recommended capability: raise_mode
Scope: chain: bscbridge: hottoken: usdtaddress: 0x88bbcaee...e758
Opened by: R1_VAULT_PAYOUT_SPIKE
Flagged stablecoin payouts: 11 totalling 3,221,568.34 USD

On-chain record not recorded

No recorded report for this incident. Incident hash e146f765bfd17906...9b0a (sha256 of the canonical incident JSON; intentwatch registry hashes recomputes it).

The report_incident call the detector would sign

{
  "args": {
    "report": {
      "alerts": 12,
      "attestation_hash": null,
      "capability": "raise_mode",
      "incident_hash": "e146f765bfd179061b82d0232f8b878391e00addad17450c41a3f441e18d9b0a",
      "incident_id": "IW-20261008-124216-3d129a",
      "mode": "paranoid",
      "opened_at_ms": 1791463336000,
      "paused_destinations": [],
      "scope": {
        "address": "0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758",
        "bridge": "hot",
        "chain": "bsc",
        "token": "usdt"
      },
      "summary_hash": null
    }
  },
  "deposit": "0",
  "gas_tgas": 10,
  "method": "report_incident",
  "receiver_id": "registry.surs51.testnet"
}

Model-written summary none recorded

Rules in this incident

12R2_VAULT_OUTFLOW_VELOCITY×18R1_VAULT_PAYOUT_SPIKE×11

Mode changes and actions click a row for the alerts that led to it

Time (UTC)	Change	Reason
2026-10-08 12:42:16	normal	1 observation(s)
2026-10-09 12:00:39	paranoid	high alert R2_VAULT_OUTFLOW_VELOCITY

Raw incident JSON (alert evidence omitted: see Events, or incidents.jsonl)

{
  "schema": "intentwatch.incident/v1 (shield-compatible, unofficial)",
  "incident_id": "IW-20261008-124216-3d129a",
  "opened_at": "2026-10-08T12:42:16Z",
  "updated_at": "2026-10-10T15:24:06Z",
  "recommended_mode": "paranoid",
  "capability": "raise_mode",
  "scope": {
    "chain": "bsc",
    "bridge": "hot",
    "token": "usdt",
    "address": "0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758"
  },
  "score": 18.5,
  "max_severity": "high",
  "mode_history": [
    {
      "ts": "2026-10-08T12:42:16Z",
      "mode": "normal",
      "capability": "flag_observation",
      "scope": {
        "chain": "bsc",
        "bridge": "hot",
        "token": "usdt",
        "address": "0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758"
      },
      "reason": "1 observation(s)",
      "alert_id": "R1_VAULT_PAYOUT_SPIKE:16d74f7093a2"
    },
    {
      "ts": "2026-10-09T12:00:39Z",
      "mode": "paranoid",
      "capability": "raise_mode",
      "scope": {
        "chain": "bsc",
        "bridge": "hot",
        "token": "usdt",
        "address": "0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758"
      },
      "reason": "high alert R2_VAULT_OUTFLOW_VELOCITY",
      "alert_id": "R2_VAULT_OUTFLOW_VELOCITY:4d3bb6abd688"
    }
  ],
  "recommended_actions": [],
  "alerts": [
    {
      "alert_id": "R1_VAULT_PAYOUT_SPIKE:16d74f7093a2",
      "rule": "R1_VAULT_PAYOUT_SPIKE",
      "severity": "medium",
      "ts": "2026-10-08T12:42:16Z",
      "tx": "0xd99c26b4711a8f509eb1343cd6ef0beb2ba3d25394d5489cbf0d225460d9c58c"
    },
    {
      "alert_id": "R1_VAULT_PAYOUT_SPIKE:9c5ac268a73d",
      "rule": "R1_VAULT_PAYOUT_SPIKE",
      "severity": "medium",
      "ts": "2026-10-08T15:33:56Z",
      "tx": "0x09c78a7307e008a8195f964b7af8e3c6e1355c80b3ef8cd7e7c172d6bdb7089c"
    },
    {
      "alert_id": "R1_VAULT_PAYOUT_SPIKE:ee5c0a4015cf",
      "rule": "R1_VAULT_PAYOUT_SPIKE",
      "severity": "medium",
      "ts": "2026-10-09T06:51:09Z",
      "tx": "0xf2ad83496734bc977fd0812e1d69b54f86f0de6757b292b448ec6f3dffd95b1a"
    },
    {
      "alert_id": "R1_VAULT_PAYOUT_SPIKE:dc9ac0decc8e",
      "rule": "R1_VAULT_PAYOUT_SPIKE",
      "severity": "medium",
      "ts": "2026-10-09T12:00:10Z",
      "tx": "0x0d2ef07a76b656bca8bc267ca5b1e2a72fc4caaee3a04ab80e0e3ca9423cf526"
    },
    {
      "alert_id": "R1_VAULT_PAYOUT_SPIKE:66a2a377ed55",
      "rule": "R1_VAULT_PAYOUT_SPIKE",
      "severity": "medium",
      "ts": "2026-10-09T12:00:39Z",
      "tx": "0xd33084d3841e54a42b485f5c2f9d718f7d1b56bc07918fd45bca4165224b3887"
    },
    {
      "alert_id": "R2_VAULT_OUTFLOW_VELOCITY:4d3bb6abd688",
      "rule": "R2_VAULT_OUTFLOW_VELOCITY",
      "severity": "high",
      "ts": "2026-10-09T12:00:39Z",
      "tx": "0xd33084d3841e54a42b485f5c2f9d718f7d1b56bc07918fd45bca4165224b3887"
    },
    {
      "alert_id": "R1_VAULT_PAYOUT_SPIKE:a6ba7b088930",
      "rule": "R1_VAULT_PAYOUT_SPIKE",
      "severity": "medium",
      "ts": "2026-10-09T14:18:35Z",
      "tx": "0x13655bc5e88ec7de302f3aabf4fae687e76cbd3fe73b7ec9efe219a297f4c68b"
    },
    {
      "alert_id": "R1_VAULT_PAYOUT_SPIKE:883c19e21b3e",
      "rule": "R1_VAULT_PAYOUT_SPIKE",
      "severity": "medium",
      "ts": "2026-10-09T22:39:08Z",
      "tx": "0x9fcd48cce13deda85b885d55831f4bc0eeb8cb48befda7e3d3855621e5cd5591"
    },
    {
      "alert_id": "R1_VAULT_PAYOUT_SPIKE:c3492b11fec2",
      "rule": "R1_VAULT_PAYOUT_SPIKE",
      "severity": "medium",
      "ts": "2026-10-09T22:57:22Z",
      "tx": "0x0d29f2fcbbe8cb91de274fb93ca1282320418bad08a7ffc569c27b30bda65a17"
    },
    {
      "alert_id": "R1_VAULT_PAYOUT_SPIKE:ec031e1cef27",
      "rule": "R1_VAULT_PAYOUT_SPIKE",
      "severity": "medium",
      "ts": "2026-10-09T23:21:09Z",
      "tx": "0xc84d3ebadaa553e1bb974557496220b9b671ba401a14b8ac08cd4d0c423f9585"
    },
    {
      "alert_id": "R1_VAULT_PAYOUT_SPIKE:7095b2330263",
      "rule": "R1_VAULT_PAYOUT_SPIKE",
      "severity": "medium",
      "ts": "2026-10-10T08:00:24Z",
      "tx": "0x9b9727796433f972ac380ab626282822a6c3b889e077d6e0c88d7d4e06d1a284"
    },
    {
      "alert_id": "R1_VAULT_PAYOUT_SPIKE:04d77ee4cbb1",
      "rule": "R1_VAULT_PAYOUT_SPIKE",
      "severity": "medium",
      "ts": "2026-10-10T15:24:06Z",
      "tx": "0xb04d1fa3bf29c4820699deabca3850a32fc4a3202d0f70966ac7f9b15378664d"
    }
  ],
  "summary": "12 alerts (R1_VAULT_PAYOUT_SPIKE, R2_VAULT_OUTFLOW_VELOCITY) on bsc; opened 2026-10-08T12:42:16Z by R1_VAULT_PAYOUT_SPIKE; mode paranoid; 11 flagged stablecoin payouts totalling 3,221,568.34 USD."
}

normal IW-20261012-014735-d5be16 medium 5 alerts · score 7.5 · Ethereum · opened 2026-10-12 01:47:35 UTC · active 35h 40m show ▾hide ▴

normal

10-12 01:47

paranoid

under attack

Recommended capability: flag_observation
Scope: chain: ethereumbridge: near_intentstoken: usdtaddress: 0x2db35030...e74c
Opened by: R3_TEST_THEN_DRAIN
Flagged stablecoin payouts: 5 totalling 1,800,764.15 USD

On-chain record below paranoid

Only incidents at paranoid or above go on chain. Incident hash a73a21d1881d1d53...a0f2.

Model-written summary none recorded

Summaries are written for incidents at paranoid or above.

Rules in this incident

8R3_TEST_THEN_DRAIN×48R5_NEW_RECIPIENT_LARGE_PAYOUT×1

Mode changes and actions click a row for the alerts that led to it

Time (UTC)	Change	Reason
2026-10-12 01:47:35	normal	1 observation(s)

Raw incident JSON (alert evidence omitted: see Events, or incidents.jsonl)

{
  "schema": "intentwatch.incident/v1 (shield-compatible, unofficial)",
  "incident_id": "IW-20261012-014735-d5be16",
  "opened_at": "2026-10-12T01:47:35Z",
  "updated_at": "2026-10-13T13:28:11Z",
  "recommended_mode": "normal",
  "capability": "flag_observation",
  "scope": {
    "chain": "ethereum",
    "bridge": "near_intents",
    "token": "usdt",
    "address": "0x2db35030bf4c8c360610b3b54865f71234a8e74c"
  },
  "score": 7.5,
  "max_severity": "medium",
  "mode_history": [
    {
      "ts": "2026-10-12T01:47:35Z",
      "mode": "normal",
      "capability": "flag_observation",
      "scope": {
        "chain": "ethereum",
        "bridge": "near_intents",
        "token": "usdt",
        "address": "0x2db35030bf4c8c360610b3b54865f71234a8e74c"
      },
      "reason": "1 observation(s)",
      "alert_id": "R3_TEST_THEN_DRAIN:5cf23020464a"
    }
  ],
  "recommended_actions": [],
  "alerts": [
    {
      "alert_id": "R3_TEST_THEN_DRAIN:5cf23020464a",
      "rule": "R3_TEST_THEN_DRAIN",
      "severity": "medium",
      "ts": "2026-10-12T01:47:35Z",
      "tx": "0x506923e0f36bf98421a6040eee6233bf99d39f761e0b31c12660c29741ff7e32"
    },
    {
      "alert_id": "R3_TEST_THEN_DRAIN:49e7db5ea0a1",
      "rule": "R3_TEST_THEN_DRAIN",
      "severity": "medium",
      "ts": "2026-10-12T02:08:47Z",
      "tx": "0x6a094b32d99667be4fd437f9984d2bfef4583b3c1e0c70766c28ebcd59380269"
    },
    {
      "alert_id": "R3_TEST_THEN_DRAIN:906547b8d0cd",
      "rule": "R3_TEST_THEN_DRAIN",
      "severity": "medium",
      "ts": "2026-10-12T02:13:35Z",
      "tx": "0xa4aa32ad2ce49f61dee531176b088e68c24dc774a905abf9477f688a666ac5ca"
    },
    {
      "alert_id": "R3_TEST_THEN_DRAIN:b712d3d33703",
      "rule": "R3_TEST_THEN_DRAIN",
      "severity": "medium",
      "ts": "2026-10-12T14:04:23Z",
      "tx": "0xcb86855d0f5dca22304f0cbc324a52c55a0903e1e9c0ab9d585709f30ac6c380"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:c963e67985eb",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-10-13T13:28:11Z",
      "tx": "0x4e066aeb0cea44389022db66aaf3557a06ac1b478c489e7baebaecc9ad24e88d"
    }
  ],
  "summary": "5 alerts (R3_TEST_THEN_DRAIN, R5_NEW_RECIPIENT_LARGE_PAYOUT) on ethereum; opened 2026-10-12T01:47:35Z by R3_TEST_THEN_DRAIN; mode normal; 5 flagged stablecoin payouts totalling 1,800,764.15 USD."
}

normal IW-20261016-184759-087102 medium 5 alerts · score 7.5 · Ethereum · opened 2026-10-16 18:47:59 UTC · active 29h 49m show ▾hide ▴

normal

10-16 18:47

paranoid

under attack

Recommended capability: flag_observation
Scope: chain: ethereumbridge: near_intentstoken: usdcaddress: 0x4e065029...47fb
Opened by: R10_RECIPIENT_PAYOUT_BURST
Flagged stablecoin payouts: 4 totalling 2,005,870.69 USD

On-chain record below paranoid

Only incidents at paranoid or above go on chain. Incident hash 11a2d57d9e3bec57...50b5.

Model-written summary none recorded

Summaries are written for incidents at paranoid or above.

Rules in this incident

8R10_RECIPIENT_PAYOUT_BURST×28R3_TEST_THEN_DRAIN×18R5_NEW_RECIPIENT_LARGE_PAYOUT×2

Mode changes and actions click a row for the alerts that led to it

Time (UTC)	Change	Reason
2026-10-16 18:47:59	normal	1 observation(s)

Raw incident JSON (alert evidence omitted: see Events, or incidents.jsonl)

{
  "schema": "intentwatch.incident/v1 (shield-compatible, unofficial)",
  "incident_id": "IW-20261016-184759-087102",
  "opened_at": "2026-10-16T18:47:59Z",
  "updated_at": "2026-10-18T00:37:11Z",
  "recommended_mode": "normal",
  "capability": "flag_observation",
  "scope": {
    "chain": "ethereum",
    "bridge": "near_intents",
    "token": "usdc",
    "address": "0x4e0650291a7099e39bae36a63dde1c36c55847fb"
  },
  "score": 7.5,
  "max_severity": "medium",
  "mode_history": [
    {
      "ts": "2026-10-16T18:47:59Z",
      "mode": "normal",
      "capability": "flag_observation",
      "scope": {
        "chain": "ethereum",
        "bridge": "near_intents",
        "token": "usdc",
        "address": "0x4e0650291a7099e39bae36a63dde1c36c55847fb"
      },
      "reason": "1 observation(s)",
      "alert_id": "R10_RECIPIENT_PAYOUT_BURST:ee045eb0628e"
    }
  ],
  "recommended_actions": [],
  "alerts": [
    {
      "alert_id": "R10_RECIPIENT_PAYOUT_BURST:ee045eb0628e",
      "rule": "R10_RECIPIENT_PAYOUT_BURST",
      "severity": "medium",
      "ts": "2026-10-16T18:47:59Z",
      "tx": "0xece137ac7909d82cb8a3d3a36a352c394fd937c044d5be0af290cfdb63630ffb"
    },
    {
      "alert_id": "R3_TEST_THEN_DRAIN:4efb22c5e592",
      "rule": "R3_TEST_THEN_DRAIN",
      "severity": "medium",
      "ts": "2026-10-16T19:32:23Z",
      "tx": "0x669784ef9cf773a0d204cafc7d14c667fa28a6b4696cac682122a2cda7c22855"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:4bb512ffa6bd",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-10-16T19:32:23Z",
      "tx": "0x669784ef9cf773a0d204cafc7d14c667fa28a6b4696cac682122a2cda7c22855"
    },
    {
      "alert_id": "R10_RECIPIENT_PAYOUT_BURST:1cba49a7e936",
      "rule": "R10_RECIPIENT_PAYOUT_BURST",
      "severity": "medium",
      "ts": "2026-10-17T17:51:11Z",
      "tx": "0x8f1bb5fbd4ad11a27be0924844b7740e4962765188365f0208469896064ef779"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:bd5670d414a8",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-10-18T00:37:11Z",
      "tx": "0x5629e44f8c97453784d71ad35ffe9a218b1b01e9125c5d7cb4979ac826117e39"
    }
  ],
  "summary": "5 alerts (R10_RECIPIENT_PAYOUT_BURST, R3_TEST_THEN_DRAIN, R5_NEW_RECIPIENT_LARGE_PAYOUT) on ethereum; opened 2026-10-16T18:47:59Z by R10_RECIPIENT_PAYOUT_BURST; mode normal; 4 flagged stablecoin payouts totalling 2,005,870.69 USD."
}

normal IW-20261019-141747-9b84eb medium 2 alerts · score 3.0 · Ethereum · opened 2026-10-19 14:17:47 UTC · active 2h 19m show ▾hide ▴

normal

10-19 14:17

paranoid

under attack

Recommended capability: flag_observation
Scope: chain: ethereumbridge: near_intentstoken: usdtaddress: 0x87238f88...1003
Opened by: R3_TEST_THEN_DRAIN
Flagged stablecoin payouts: 2 totalling 245,000 USD

On-chain record below paranoid

Only incidents at paranoid or above go on chain. Incident hash c38ac8ad258ce815...beca.

Model-written summary none recorded

Summaries are written for incidents at paranoid or above.

Rules in this incident

8R3_TEST_THEN_DRAIN×2

Mode changes and actions click a row for the alerts that led to it

Time (UTC)	Change	Reason
2026-10-19 14:17:47	normal	1 observation(s)

Raw incident JSON (alert evidence omitted: see Events, or incidents.jsonl)

{
  "schema": "intentwatch.incident/v1 (shield-compatible, unofficial)",
  "incident_id": "IW-20261019-141747-9b84eb",
  "opened_at": "2026-10-19T14:17:47Z",
  "updated_at": "2026-10-19T16:36:59Z",
  "recommended_mode": "normal",
  "capability": "flag_observation",
  "scope": {
    "chain": "ethereum",
    "bridge": "near_intents",
    "token": "usdt",
    "address": "0x87238f8889d7b9226059cbc0e9888c4da5661003"
  },
  "score": 3.0,
  "max_severity": "medium",
  "mode_history": [
    {
      "ts": "2026-10-19T14:17:47Z",
      "mode": "normal",
      "capability": "flag_observation",
      "scope": {
        "chain": "ethereum",
        "bridge": "near_intents",
        "token": "usdt",
        "address": "0x87238f8889d7b9226059cbc0e9888c4da5661003"
      },
      "reason": "1 observation(s)",
      "alert_id": "R3_TEST_THEN_DRAIN:018df84439c5"
    }
  ],
  "recommended_actions": [],
  "alerts": [
    {
      "alert_id": "R3_TEST_THEN_DRAIN:018df84439c5",
      "rule": "R3_TEST_THEN_DRAIN",
      "severity": "medium",
      "ts": "2026-10-19T14:17:47Z",
      "tx": "0x40d415ae919e2888639ce5b2d6062d8b2d18a810566c28c9ad04370040d104be"
    },
    {
      "alert_id": "R3_TEST_THEN_DRAIN:d83658a18627",
      "rule": "R3_TEST_THEN_DRAIN",
      "severity": "medium",
      "ts": "2026-10-19T16:36:59Z",
      "tx": "0x87cf6ddd8478356f9d253cb748ac84c4ac517146116e629809f22a336deb241a"
    }
  ],
  "summary": "2 alerts (R3_TEST_THEN_DRAIN) on ethereum; opened 2026-10-19T14:17:47Z by R3_TEST_THEN_DRAIN; mode normal; 2 flagged stablecoin payouts totalling 245,000 USD."
}

normal IW-20261012-051159-4ed7b5 medium 1 alert · score 1.5 · Ethereum · opened 2026-10-12 05:11:59 UTC · active 0s show ▾hide ▴

normal

10-12 05:11

paranoid

under attack

Recommended capability: flag_observation
Scope: chain: ethereumbridge: near_intentstoken: usdcaddress: 0x601dcf2b...b8fa
Opened by: R3_TEST_THEN_DRAIN
Flagged stablecoin payouts: 1 totalling 282,799.40 USD

On-chain record below paranoid

Only incidents at paranoid or above go on chain. Incident hash 5eeaef2c568a0f8b...e474.

Model-written summary none recorded

Summaries are written for incidents at paranoid or above.

Rules in this incident

8R3_TEST_THEN_DRAIN×1

Mode changes and actions click a row for the alerts that led to it

Time (UTC)	Change	Reason
2026-10-12 05:11:59	normal	1 observation(s)

Raw incident JSON (alert evidence omitted: see Events, or incidents.jsonl)

{
  "schema": "intentwatch.incident/v1 (shield-compatible, unofficial)",
  "incident_id": "IW-20261012-051159-4ed7b5",
  "opened_at": "2026-10-12T05:11:59Z",
  "updated_at": "2026-10-12T05:11:59Z",
  "recommended_mode": "normal",
  "capability": "flag_observation",
  "scope": {
    "chain": "ethereum",
    "bridge": "near_intents",
    "token": "usdc",
    "address": "0x601dcf2b971f30272fbe76cbdaec30b9a6f9b8fa"
  },
  "score": 1.5,
  "max_severity": "medium",
  "mode_history": [
    {
      "ts": "2026-10-12T05:11:59Z",
      "mode": "normal",
      "capability": "flag_observation",
      "scope": {
        "chain": "ethereum",
        "bridge": "near_intents",
        "token": "usdc",
        "address": "0x601dcf2b971f30272fbe76cbdaec30b9a6f9b8fa"
      },
      "reason": "1 observation(s)",
      "alert_id": "R3_TEST_THEN_DRAIN:a96ac72fed18"
    }
  ],
  "recommended_actions": [],
  "alerts": [
    {
      "alert_id": "R3_TEST_THEN_DRAIN:a96ac72fed18",
      "rule": "R3_TEST_THEN_DRAIN",
      "severity": "medium",
      "ts": "2026-10-12T05:11:59Z",
      "tx": "0x8e7a258a67389649b52be029108db7eb7612855a5a0163bd0ffc3efc9efa04b4"
    }
  ],
  "summary": "1 alerts (R3_TEST_THEN_DRAIN) on ethereum; opened 2026-10-12T05:11:59Z by R3_TEST_THEN_DRAIN; mode normal; 1 flagged stablecoin payouts totalling 282,799.40 USD."
}

normal IW-20261013-221515-d5baa1 medium 1 alert · score 1.5 · BNB Chain · opened 2026-10-13 22:15:15 UTC · active 0s show ▾hide ▴

normal

10-13 22:15

paranoid

under attack

Recommended capability: flag_observation
Scope: chain: bscbridge: hottoken: usdcaddress: 0x5a8e12d1...c354
Opened by: R1_VAULT_PAYOUT_SPIKE
Flagged stablecoin payouts: 1 totalling 203,643.96 USD

On-chain record below paranoid

Only incidents at paranoid or above go on chain. Incident hash 7fee2f5aa17059a9...04f0.

Model-written summary none recorded

Summaries are written for incidents at paranoid or above.

Rules in this incident

8R1_VAULT_PAYOUT_SPIKE×1

Mode changes and actions click a row for the alerts that led to it

Time (UTC)	Change	Reason
2026-10-13 22:15:15	normal	1 observation(s)

Raw incident JSON (alert evidence omitted: see Events, or incidents.jsonl)

{
  "schema": "intentwatch.incident/v1 (shield-compatible, unofficial)",
  "incident_id": "IW-20261013-221515-d5baa1",
  "opened_at": "2026-10-13T22:15:15Z",
  "updated_at": "2026-10-13T22:15:15Z",
  "recommended_mode": "normal",
  "capability": "flag_observation",
  "scope": {
    "chain": "bsc",
    "bridge": "hot",
    "token": "usdc",
    "address": "0x5a8e12d1f7148886fe35f6fa04f5a2c2b60ac354"
  },
  "score": 1.5,
  "max_severity": "medium",
  "mode_history": [
    {
      "ts": "2026-10-13T22:15:15Z",
      "mode": "normal",
      "capability": "flag_observation",
      "scope": {
        "chain": "bsc",
        "bridge": "hot",
        "token": "usdc",
        "address": "0x5a8e12d1f7148886fe35f6fa04f5a2c2b60ac354"
      },
      "reason": "1 observation(s)",
      "alert_id": "R1_VAULT_PAYOUT_SPIKE:61c0e14aa554"
    }
  ],
  "recommended_actions": [],
  "alerts": [
    {
      "alert_id": "R1_VAULT_PAYOUT_SPIKE:61c0e14aa554",
      "rule": "R1_VAULT_PAYOUT_SPIKE",
      "severity": "medium",
      "ts": "2026-10-13T22:15:15Z",
      "tx": "0xfab2f66919736fdb7bf248af4adffa8be016b04718b2ae574109057de1e60f88"
    }
  ],
  "summary": "1 alerts (R1_VAULT_PAYOUT_SPIKE) on bsc; opened 2026-10-13T22:15:15Z by R1_VAULT_PAYOUT_SPIKE; mode normal; 1 flagged stablecoin payouts totalling 203,643.96 USD."
}

normal IW-20261015-054059-997391 medium 1 alert · score 1.5 · Ethereum · opened 2026-10-15 05:40:59 UTC · active 0s show ▾hide ▴

normal

10-15 05:40

paranoid

under attack

Recommended capability: flag_observation
Scope: chain: ethereumbridge: near_intentstoken: usdcaddress: 0x444dd61e...a58f
Opened by: R5_NEW_RECIPIENT_LARGE_PAYOUT
Flagged stablecoin payouts: 1 totalling 727,403.60 USD

On-chain record below paranoid

Only incidents at paranoid or above go on chain. Incident hash d15439e4a154da63...316a.

Model-written summary none recorded

Summaries are written for incidents at paranoid or above.

Rules in this incident

8R5_NEW_RECIPIENT_LARGE_PAYOUT×1

Mode changes and actions click a row for the alerts that led to it

Time (UTC)	Change	Reason
2026-10-15 05:40:59	normal	1 observation(s)

Raw incident JSON (alert evidence omitted: see Events, or incidents.jsonl)

{
  "schema": "intentwatch.incident/v1 (shield-compatible, unofficial)",
  "incident_id": "IW-20261015-054059-997391",
  "opened_at": "2026-10-15T05:40:59Z",
  "updated_at": "2026-10-15T05:40:59Z",
  "recommended_mode": "normal",
  "capability": "flag_observation",
  "scope": {
    "chain": "ethereum",
    "bridge": "near_intents",
    "token": "usdc",
    "address": "0x444dd61eb498438d1aac297bed8678af5caba58f"
  },
  "score": 1.5,
  "max_severity": "medium",
  "mode_history": [
    {
      "ts": "2026-10-15T05:40:59Z",
      "mode": "normal",
      "capability": "flag_observation",
      "scope": {
        "chain": "ethereum",
        "bridge": "near_intents",
        "token": "usdc",
        "address": "0x444dd61eb498438d1aac297bed8678af5caba58f"
      },
      "reason": "1 observation(s)",
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:b85b5ed9e457"
    }
  ],
  "recommended_actions": [],
  "alerts": [
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:b85b5ed9e457",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-10-15T05:40:59Z",
      "tx": "0x22e56ca40c57335299811434f3a1b6c44485b9bfee73158413f4e695962b9d83"
    }
  ],
  "summary": "1 alerts (R5_NEW_RECIPIENT_LARGE_PAYOUT) on ethereum; opened 2026-10-15T05:40:59Z by R5_NEW_RECIPIENT_LARGE_PAYOUT; mode normal; 1 flagged stablecoin payouts totalling 727,403.60 USD."
}

normal IW-20261018-122135-dc6cbf medium 1 alert · score 1.5 · Ethereum · opened 2026-10-18 12:21:35 UTC · active 0s show ▾hide ▴

normal

10-18 12:21

paranoid

under attack

Recommended capability: flag_observation
Scope: chain: ethereumbridge: near_intentstoken: usdtaddress: 0x3a3c2bfe...fa3f
Opened by: R3_TEST_THEN_DRAIN
Flagged stablecoin payouts: 1 totalling 109,982.58 USD

On-chain record below paranoid

Only incidents at paranoid or above go on chain. Incident hash 07b76703d3b151fa...d0e3.

Model-written summary none recorded

Summaries are written for incidents at paranoid or above.

Rules in this incident

8R3_TEST_THEN_DRAIN×1

Mode changes and actions click a row for the alerts that led to it

Time (UTC)	Change	Reason
2026-10-18 12:21:35	normal	1 observation(s)

Raw incident JSON (alert evidence omitted: see Events, or incidents.jsonl)

{
  "schema": "intentwatch.incident/v1 (shield-compatible, unofficial)",
  "incident_id": "IW-20261018-122135-dc6cbf",
  "opened_at": "2026-10-18T12:21:35Z",
  "updated_at": "2026-10-18T12:21:35Z",
  "recommended_mode": "normal",
  "capability": "flag_observation",
  "scope": {
    "chain": "ethereum",
    "bridge": "near_intents",
    "token": "usdt",
    "address": "0x3a3c2bfe279f9d92fa5da609e9b3ff439384fa3f"
  },
  "score": 1.5,
  "max_severity": "medium",
  "mode_history": [
    {
      "ts": "2026-10-18T12:21:35Z",
      "mode": "normal",
      "capability": "flag_observation",
      "scope": {
        "chain": "ethereum",
        "bridge": "near_intents",
        "token": "usdt",
        "address": "0x3a3c2bfe279f9d92fa5da609e9b3ff439384fa3f"
      },
      "reason": "1 observation(s)",
      "alert_id": "R3_TEST_THEN_DRAIN:8d997e41c948"
    }
  ],
  "recommended_actions": [],
  "alerts": [
    {
      "alert_id": "R3_TEST_THEN_DRAIN:8d997e41c948",
      "rule": "R3_TEST_THEN_DRAIN",
      "severity": "medium",
      "ts": "2026-10-18T12:21:35Z",
      "tx": "0xc43a358ceceaa79000f1cc3c09214f7833bb1c017c2dea05c1cd5f005647b995"
    }
  ],
  "summary": "1 alerts (R3_TEST_THEN_DRAIN) on ethereum; opened 2026-10-18T12:21:35Z by R3_TEST_THEN_DRAIN; mode normal; 1 flagged stablecoin payouts totalling 109,982.58 USD."
}

normal IW-20261021-145156-b4b2c9 medium 1 alert · score 1.5 · BNB Chain · opened 2026-10-21 14:51:56 UTC · active 0s show ▾hide ▴

normal

10-21 14:51

paranoid

under attack

Recommended capability: flag_observation
Scope: chain: bscbridge: hottoken: usdtaddress: 0x4ca9b21e...6bbb
Opened by: R1_VAULT_PAYOUT_SPIKE
Flagged stablecoin payouts: 1 totalling 109,842.76 USD

On-chain record below paranoid

Only incidents at paranoid or above go on chain. Incident hash 8c5a8fbde2f0e9ff...f18a.

Model-written summary none recorded

Summaries are written for incidents at paranoid or above.

Rules in this incident

8R1_VAULT_PAYOUT_SPIKE×1

Mode changes and actions click a row for the alerts that led to it

Time (UTC)	Change	Reason
2026-10-21 14:51:56	normal	1 observation(s)

Raw incident JSON (alert evidence omitted: see Events, or incidents.jsonl)

{
  "schema": "intentwatch.incident/v1 (shield-compatible, unofficial)",
  "incident_id": "IW-20261021-145156-b4b2c9",
  "opened_at": "2026-10-21T14:51:56Z",
  "updated_at": "2026-10-21T14:51:56Z",
  "recommended_mode": "normal",
  "capability": "flag_observation",
  "scope": {
    "chain": "bsc",
    "bridge": "hot",
    "token": "usdt",
    "address": "0x4ca9b21e134ebbfa6dc407d59ea6dfb0d5856bbb"
  },
  "score": 1.5,
  "max_severity": "medium",
  "mode_history": [
    {
      "ts": "2026-10-21T14:51:56Z",
      "mode": "normal",
      "capability": "flag_observation",
      "scope": {
        "chain": "bsc",
        "bridge": "hot",
        "token": "usdt",
        "address": "0x4ca9b21e134ebbfa6dc407d59ea6dfb0d5856bbb"
      },
      "reason": "1 observation(s)",
      "alert_id": "R1_VAULT_PAYOUT_SPIKE:62880351944b"
    }
  ],
  "recommended_actions": [],
  "alerts": [
    {
      "alert_id": "R1_VAULT_PAYOUT_SPIKE:62880351944b",
      "rule": "R1_VAULT_PAYOUT_SPIKE",
      "severity": "medium",
      "ts": "2026-10-21T14:51:56Z",
      "tx": "0x3e30a913fcc5d9a48b02f3f2720a0adc748a0a8616ec32abc7a5e18c7752400a"
    }
  ],
  "summary": "1 alerts (R1_VAULT_PAYOUT_SPIKE) on bsc; opened 2026-10-21T14:51:56Z by R1_VAULT_PAYOUT_SPIKE; mode normal; 1 flagged stablecoin payouts totalling 109,842.76 USD."
}

normal IW-20261023-105158-197c6d medium 1 alert · score 1.5 · BNB Chain · opened 2026-10-23 10:51:58 UTC · active 0s show ▾hide ▴

normal

10-23 10:51

paranoid

under attack

Recommended capability: flag_observation
Scope: chain: bscbridge: hottoken: usdtaddress: 0xc565b3db...b994
Opened by: R1_VAULT_PAYOUT_SPIKE
Flagged stablecoin payouts: 1 totalling 280,000 USD

On-chain record below paranoid

Only incidents at paranoid or above go on chain. Incident hash 54fcddd1f6ff75e8...eda6.

Model-written summary none recorded

Summaries are written for incidents at paranoid or above.

Rules in this incident

8R1_VAULT_PAYOUT_SPIKE×1

Mode changes and actions click a row for the alerts that led to it

Time (UTC)	Change	Reason
2026-10-23 10:51:58	normal	1 observation(s)

Raw incident JSON (alert evidence omitted: see Events, or incidents.jsonl)

{
  "schema": "intentwatch.incident/v1 (shield-compatible, unofficial)",
  "incident_id": "IW-20261023-105158-197c6d",
  "opened_at": "2026-10-23T10:51:58Z",
  "updated_at": "2026-10-23T10:51:58Z",
  "recommended_mode": "normal",
  "capability": "flag_observation",
  "scope": {
    "chain": "bsc",
    "bridge": "hot",
    "token": "usdt",
    "address": "0xc565b3db8527fe7f7f89b630886ec348ae1eb994"
  },
  "score": 1.5,
  "max_severity": "medium",
  "mode_history": [
    {
      "ts": "2026-10-23T10:51:58Z",
      "mode": "normal",
      "capability": "flag_observation",
      "scope": {
        "chain": "bsc",
        "bridge": "hot",
        "token": "usdt",
        "address": "0xc565b3db8527fe7f7f89b630886ec348ae1eb994"
      },
      "reason": "1 observation(s)",
      "alert_id": "R1_VAULT_PAYOUT_SPIKE:fc4a9a654c79"
    }
  ],
  "recommended_actions": [],
  "alerts": [
    {
      "alert_id": "R1_VAULT_PAYOUT_SPIKE:fc4a9a654c79",
      "rule": "R1_VAULT_PAYOUT_SPIKE",
      "severity": "medium",
      "ts": "2026-10-23T10:51:58Z",
      "tx": "0x4afc209f8313f45a1b77e41e5e24be94e514766e53d436b19b3f0b7c431a3bbe"
    }
  ],
  "summary": "1 alerts (R1_VAULT_PAYOUT_SPIKE) on bsc; opened 2026-10-23T10:51:58Z by R1_VAULT_PAYOUT_SPIKE; mode normal; 1 flagged stablecoin payouts totalling 280,000 USD."
}

normal IW-20261023-151847-7303fd medium 1 alert · score 1.5 · Ethereum · opened 2026-10-23 15:18:47 UTC · active 0s show ▾hide ▴

normal

10-23 15:18

paranoid

under attack

Recommended capability: flag_observation
Scope: chain: ethereumbridge: near_intentstoken: usdtaddress: 0xd6529918...a0ed
Opened by: R3_TEST_THEN_DRAIN
Flagged stablecoin payouts: 1 totalling 111,645.20 USD

On-chain record below paranoid

Only incidents at paranoid or above go on chain. Incident hash 3c3ce3404451e5d2...0b02.

Model-written summary none recorded

Summaries are written for incidents at paranoid or above.

Rules in this incident

8R3_TEST_THEN_DRAIN×1

Mode changes and actions click a row for the alerts that led to it

Time (UTC)	Change	Reason
2026-10-23 15:18:47	normal	1 observation(s)

Raw incident JSON (alert evidence omitted: see Events, or incidents.jsonl)

{
  "schema": "intentwatch.incident/v1 (shield-compatible, unofficial)",
  "incident_id": "IW-20261023-151847-7303fd",
  "opened_at": "2026-10-23T15:18:47Z",
  "updated_at": "2026-10-23T15:18:47Z",
  "recommended_mode": "normal",
  "capability": "flag_observation",
  "scope": {
    "chain": "ethereum",
    "bridge": "near_intents",
    "token": "usdt",
    "address": "0xd65299186614d6a2d29b9f966234d0d8b4b5a0ed"
  },
  "score": 1.5,
  "max_severity": "medium",
  "mode_history": [
    {
      "ts": "2026-10-23T15:18:47Z",
      "mode": "normal",
      "capability": "flag_observation",
      "scope": {
        "chain": "ethereum",
        "bridge": "near_intents",
        "token": "usdt",
        "address": "0xd65299186614d6a2d29b9f966234d0d8b4b5a0ed"
      },
      "reason": "1 observation(s)",
      "alert_id": "R3_TEST_THEN_DRAIN:619148b2662d"
    }
  ],
  "recommended_actions": [],
  "alerts": [
    {
      "alert_id": "R3_TEST_THEN_DRAIN:619148b2662d",
      "rule": "R3_TEST_THEN_DRAIN",
      "severity": "medium",
      "ts": "2026-10-23T15:18:47Z",
      "tx": "0xa2332e7a1cc19d014f705dc85344fa827e5430dfd1a5ebb94053d5053b9c8825"
    }
  ],
  "summary": "1 alerts (R3_TEST_THEN_DRAIN) on ethereum; opened 2026-10-23T15:18:47Z by R3_TEST_THEN_DRAIN; mode normal; 1 flagged stablecoin payouts totalling 111,645.20 USD."
}

normal IW-20261025-064506-124e4a medium 1 alert · score 1.5 · BNB Chain · opened 2026-10-25 06:45:06 UTC · active 0s show ▾hide ▴

normal

10-25 06:45

paranoid

under attack

Recommended capability: flag_observation
Scope: chain: bscbridge: hottoken: usdtaddress: 0x88bbcaee...e758
Opened by: R1_VAULT_PAYOUT_SPIKE
Flagged stablecoin payouts: 1 totalling 320,978.48 USD

On-chain record below paranoid

Only incidents at paranoid or above go on chain. Incident hash cd28881ad234c3ba...fa9a.

Model-written summary none recorded

Summaries are written for incidents at paranoid or above.

Rules in this incident

8R1_VAULT_PAYOUT_SPIKE×1

Mode changes and actions click a row for the alerts that led to it

Time (UTC)	Change	Reason
2026-10-25 06:45:06	normal	1 observation(s)

Raw incident JSON (alert evidence omitted: see Events, or incidents.jsonl)

{
  "schema": "intentwatch.incident/v1 (shield-compatible, unofficial)",
  "incident_id": "IW-20261025-064506-124e4a",
  "opened_at": "2026-10-25T06:45:06Z",
  "updated_at": "2026-10-25T06:45:06Z",
  "recommended_mode": "normal",
  "capability": "flag_observation",
  "scope": {
    "chain": "bsc",
    "bridge": "hot",
    "token": "usdt",
    "address": "0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758"
  },
  "score": 1.5,
  "max_severity": "medium",
  "mode_history": [
    {
      "ts": "2026-10-25T06:45:06Z",
      "mode": "normal",
      "capability": "flag_observation",
      "scope": {
        "chain": "bsc",
        "bridge": "hot",
        "token": "usdt",
        "address": "0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758"
      },
      "reason": "1 observation(s)",
      "alert_id": "R1_VAULT_PAYOUT_SPIKE:3ef0c6b3ba31"
    }
  ],
  "recommended_actions": [],
  "alerts": [
    {
      "alert_id": "R1_VAULT_PAYOUT_SPIKE:3ef0c6b3ba31",
      "rule": "R1_VAULT_PAYOUT_SPIKE",
      "severity": "medium",
      "ts": "2026-10-25T06:45:06Z",
      "tx": "0xded3fc9775eb7733be7638b1528290e52c1be05b18bfd34a6f74306bef9ff7f3"
    }
  ],
  "summary": "1 alerts (R1_VAULT_PAYOUT_SPIKE) on bsc; opened 2026-10-25T06:45:06Z by R1_VAULT_PAYOUT_SPIKE; mode normal; 1 flagged stablecoin payouts totalling 320,978.48 USD."
}

normal IW-20261025-091911-3fe22e medium 1 alert · score 1.5 · Ethereum · opened 2026-10-25 09:19:11 UTC · active 0s show ▾hide ▴

normal

10-25 09:19

paranoid

under attack

Recommended capability: flag_observation
Scope: chain: ethereumbridge: near_intentstoken: usdtaddress: 0x3a3c2bfe...fa3f
Opened by: R3_TEST_THEN_DRAIN
Flagged stablecoin payouts: 1 totalling 299,961.20 USD

On-chain record below paranoid

Only incidents at paranoid or above go on chain. Incident hash 861cae4a66420811...14ec.

Model-written summary none recorded

Summaries are written for incidents at paranoid or above.

Rules in this incident

8R3_TEST_THEN_DRAIN×1

Mode changes and actions click a row for the alerts that led to it

Time (UTC)	Change	Reason
2026-10-25 09:19:11	normal	1 observation(s)

Raw incident JSON (alert evidence omitted: see Events, or incidents.jsonl)

{
  "schema": "intentwatch.incident/v1 (shield-compatible, unofficial)",
  "incident_id": "IW-20261025-091911-3fe22e",
  "opened_at": "2026-10-25T09:19:11Z",
  "updated_at": "2026-10-25T09:19:11Z",
  "recommended_mode": "normal",
  "capability": "flag_observation",
  "scope": {
    "chain": "ethereum",
    "bridge": "near_intents",
    "token": "usdt",
    "address": "0x3a3c2bfe279f9d92fa5da609e9b3ff439384fa3f"
  },
  "score": 1.5,
  "max_severity": "medium",
  "mode_history": [
    {
      "ts": "2026-10-25T09:19:11Z",
      "mode": "normal",
      "capability": "flag_observation",
      "scope": {
        "chain": "ethereum",
        "bridge": "near_intents",
        "token": "usdt",
        "address": "0x3a3c2bfe279f9d92fa5da609e9b3ff439384fa3f"
      },
      "reason": "1 observation(s)",
      "alert_id": "R3_TEST_THEN_DRAIN:2bbb24db512b"
    }
  ],
  "recommended_actions": [],
  "alerts": [
    {
      "alert_id": "R3_TEST_THEN_DRAIN:2bbb24db512b",
      "rule": "R3_TEST_THEN_DRAIN",
      "severity": "medium",
      "ts": "2026-10-25T09:19:11Z",
      "tx": "0xa0823f57736c509018b67fe34018ba6ae46bf9daeb4ca73fa02d563e89a3961e"
    }
  ],
  "summary": "1 alerts (R3_TEST_THEN_DRAIN) on ethereum; opened 2026-10-25T09:19:11Z by R3_TEST_THEN_DRAIN; mode normal; 1 flagged stablecoin payouts totalling 299,961.20 USD."
}

Rules

Ruleset config/rules + local/rules; YAML, explainable and deterministic; click a rule for its logic

Level	Rule	Description	Stage	Groups	In window	Baseline / day
8	R1_VAULT_PAYOUT_SPIKER1_vault_payout_spike.yaml	Treasury payout far above recent maximumA single stablecoin payout from a bridge treasury is more than `factor` times the largest payout of the same (chain, vault, token) over the trailing 48h. Payouts that fired this rule are kept out of the baseline, so a drain cannot raise its own threshold. On the September BNB Chain baseline this fired ~1/day, mostly for recurring large recipients (ratios 2.05-6.1x, W1 was 2.38x), so it is medium on its own; R1B escalates spikes to new recipients.	Treasury drain	evmtreasurypayoutspike	14	0.808
{ "source": "evm.erc20_transfer", "match": { "kind": "payout", "vault": [ "hot_bridge", "near_intents" ], "symbol": [ "usdt", "usdc" ] }, "condition": { "type": "ratio_to_rolling_max", "group_by": [ "chain", "vault", "token" ], "window": "48h", "factor": 2.0, "min_value": 50000, "value_field": "amount_usd" }, "shield": { "capability": "flag_observation", "scope": [ "chain", "bridge", "token" ] } }
12	R1B_PAYOUT_SPIKE_TO_NEW_RECIPIENTR1_vault_payout_spike.yaml	Treasury payout spike to a recipient first seen less than 7 days agoComposite (Wazuh-style): R1 (payout > 2x the 48h max) and R5 (recipient first seen < 7 days ago, payout > $500K) fire on the same payout.	Treasury drain	evmtreasurypayoutspikecomposite	1	0.058
{ "source": "evm.*", "match": { "kind": "payout" }, "if_all": [ "R1_VAULT_PAYOUT_SPIKE", "R5_NEW_RECIPIENT_LARGE_PAYOUT" ], "shield": { "mode": "paranoid", "capability": "raise_mode", "scope": [ "chain", "bridge", "token", "address" ] } }
12	R2_VAULT_OUTFLOW_VELOCITYR2_vault_outflow_velocity.yaml (rate rule: cannot escalate alone)	Treasury outflow velocity above its 7-day p99The trailing 1h stablecoin outflow of a (chain, vault, token) exceeds 2x the p99 of hourly outflow over the trailing 7 days (empty hours count as zero), and at least $1M. Throttled to one alert per hour per group. Velocity is about the treasury, so it never taints the recipient of the last payout. A rolling sum fires on the flow: its transaction is only where the sum crossed the line, so two alerts are one flow measured twice, and it cannot escalate alone.	Treasury drain	evmtreasurypayoutvelocity	4	0.231
{ "source": "evm.erc20_transfer", "match": { "kind": "payout", "vault": [ "hot_bridge", "near_intents" ], "symbol": [ "usdt", "usdc" ] }, "condition": { "type": "rolling_sum_vs_percentile", "group_by": [ "chain", "vault", "token" ], "window": "1h", "bucket": "1h", "baseline": "7d", "percentile": 99, "factor": 2.0, "min_value": 1000000, "min_buckets": 72, "value_field": "amount_usd" }, "ignore": "1h", "ignore_key": [ "chain", "vault", "token" ], "shield": { "mode": "paranoid", "capability": "raise_mode", "scope": [ "chain", "bridge", "token" ] } }
8	R3_TEST_THEN_DRAINR3_test_then_drain.yaml	Small test payout followed by a large payout to the same recipientThe same recipient gets at least one payout under $100 and then, within 24h, a payout over $100K from a treasury, and had at most 3 payouts in the 7 days before. Honest users test too: on the September Ethereum baseline this fired ~1/day even after excluding established counterparties, so it is medium on its own; R3B escalates it when the recipient also submitted the payout itself.	Treasury drain	evmtreasurypayoutsequence	11	0.635
{ "source": "evm.erc20_transfer", "match": { "kind": "payout", "vault": [ "hot_bridge", "near_intents" ], "symbol": [ "usdt", "usdc" ] }, "condition": { "type": "sequence", "group_by": [ "to_addr" ], "within": "24h", "max_prior": { "count": 3, "within": "7d" }, "steps": [ { "name": "test_payout", "match": { "amount_usd": { "lt": 100 } } }, { "name": "large_payout", "match": { "amount_usd": { "gt": 100000 } } } ] }, "shield": { "capability": "flag_observation", "scope": [ "address" ] } }
12	R3B_SELF_SUBMITTED_TEST_THEN_DRAINR3_test_then_drain.yaml	Test-then-drain payout that the recipient submitted itselfComposite (Wazuh-style): R3 and R4 fire on the same payout. A fresh recipient that tested with a small payout and then pulled a large one by submitting the payout tx itself.	Treasury drain	evmtreasurypayoutsequencecomposite	0	0.0
No alerts in this window. { "source": "evm.erc20_transfer", "match": { "kind": "payout" }, "if_all": [ "R3_TEST_THEN_DRAIN", "R4_SELF_SUBMITTED_LARGE_PAYOUT" ], "shield": { "mode": "paranoid", "capability": "raise_mode", "scope": [ "chain", "bridge", "token", "address" ] } }
5	R4_SELF_SUBMITTED_LARGE_PAYOUTR4_self_submitted_large_payout.yaml (score only)	Large payout submitted by its own recipientThe payout tx was sent by the recipient itself (tx.from == transfer.to) instead of a relayer. HOT's design allows self-submission, so this is a weak signal: score only, it never opens an incident by itself.	Treasury drain	evmtreasurypayoutsubmitter	0	0.0
No alerts in this window. { "source": "evm.erc20_transfer", "match": { "kind": "payout", "vault": [ "hot_bridge", "near_intents" ], "amount_usd": { "gt": 100000 }, "extra.tx_submitter": { "eq_field": "to_addr" } } }
8	R5_NEW_RECIPIENT_LARGE_PAYOUTR5_new_recipient_large_payout.yaml	Payout over $500K to a recipient first seen less than 7 days agoThe recipient's first interaction with any watched treasury (as sender or receiver, any chain) is less than 7 days old. Needs 7 days of observed history before it can fire.	Treasury drain	evmtreasurypayoutnew_address	26	1.5
{ "source": "evm.*", "match": { "kind": "payout", "vault": [ "hot_bridge", "near_intents" ], "amount_usd": { "gt": 500000 } }, "condition": { "type": "first_seen", "field": "to_addr", "track": [ "from_addr", "to_addr" ], "max_age": "7d", "observe": { "vault": { "exists": true } } }, "shield": { "capability": "flag_observation", "scope": [ "address" ] } }
12	R6_INTENTS_CALLBACK_ANOMALYR6_intents_callback_anomaly.yaml	Abnormal resolve callback or oversized event on intents.nearOn the Verifier contract: a failed resolve callback (e.g. mt_resolve_deposit), a log that was rejected for exceeding NEAR's 16,384-byte limit or is close to it, or a single event entry carrying more than 32 token/amount pairs.	Ledger tampering	nearverifiercallback	0	sample: 0
No alerts in this window. { "source": [ "near.receipt", "near.nep245", "near.dip4" ], "match": { "contract": "intents.near", "any": [ { "kind": "callback_failure", "extra.methods": { "regex": "resolve" } }, { "extra.rejected_log_size": { "gt": 15000 } }, { "extra.max_log_size": { "gt": 15000 } }, { "extra.n_token_pairs": { "gt": 32 } } ] }, "shield": { "mode": "paranoid", "capability": "raise_mode", "scope": [ "chain", "bridge", "token" ] } }
8	R6B_TOKEN_ID_LENGTH_OUTLIERR6B_token_id_length_outlier.yaml	Token id length above the p99.9 of observed Verifier eventsThe longest token id in a Verifier multi-token event is longer than 99.9% of token ids seen so far (needs 2,000 samples first). Unusually long ids inflate event logs.	Probing	nearverifiertoken_id	0	sample: 0
No alerts in this window. { "source": "near.nep245", "match": { "contract": "intents.near" }, "condition": { "type": "percentile_outlier", "field": "extra.max_token_id_len", "percentile": 99.9, "min_samples": 2000 } }
8	R6C_EXTREME_TOKEN_AMOUNTR6C_extreme_token_amount.yaml	Token amount near the u128 limit on intents.near or the HOT omni contractA multi-token event moves more than 2^120 raw units of one token (within 2^8 of u128::MAX). No real token supply comes close (wNEAR, with 24 decimals, has ~1.2e33 raw units in total), so such amounts are crafted values that probe overflow, accounting or log-size limits. One alert per token per day. Medium on its own: it says nothing about whether the value was credited.	Probing	nearverifieramount	0	sample: 0
No alerts in this window. { "source": "near.nep245", "match": { "contract": [ "intents.near", "v2_1.omni.hot.tg" ], "amount_raw": { "gt": 1329227995784915872903807060280344576 } }, "ignore": "24h", "ignore_key": [ "token" ], "shield": { "capability": "flag_observation", "scope": [ "chain", "bridge", "token" ] } }
12	R7_TAINTED_REENTRYR7_tainted_reentry.yaml	Address tainted by a flagged payout deposits into a treasuryAn address that received a payout flagged by R1B/R3B/R9B (or got funds from such an address, one hop) later deposits into any NEAR Intents / HOT treasury on any EVM chain.	Fund movement	evmtreasurydeposittaint	0	0.0
No alerts in this window. { "source": "evm.*", "match": { "kind": "deposit", "vault": { "exists": true } }, "condition": { "type": "tainted", "taint_from": [ "R1B_PAYOUT_SPIKE_TO_NEW_RECIPIENT", "R3B_SELF_SUBMITTED_TEST_THEN_DRAIN", "R9B_PAYOUT_FROM_FLAGGED_NEAR_ACCOUNT" ], "taint_field": "address", "hops": 1, "check": [ "from_addr" ] }, "shield": { "mode": "paranoid", "capability": "raise_mode", "scope": [ "chain", "bridge", "address" ] } }
12	R7B_TAINTED_PAYOUTR7_tainted_reentry.yaml	Treasury pays an address tainted by a flagged payout on another chain or vaultAfter R1B/R3B/R9B flag a payout, any other treasury (or the same treasury on another chain) pays that recipient. EVM addresses are the same across chains, so taint follows them.	Fund movement	evmtreasurypayouttaint	0	0.0
No alerts in this window. { "source": "evm.*", "match": { "kind": "payout", "vault": { "exists": true } }, "condition": { "type": "tainted", "taint_from": [ "R1B_PAYOUT_SPIKE_TO_NEW_RECIPIENT", "R3B_SELF_SUBMITTED_TEST_THEN_DRAIN", "R9B_PAYOUT_FROM_FLAGGED_NEAR_ACCOUNT" ], "taint_field": "address", "hops": 1, "check": [ "to_addr" ], "cross_only": true }, "shield": { "mode": "paranoid", "capability": "pause_destination", "scope": [ "address" ] } }
15	R8_DEPOSIT_LEDGER_MISMATCHR8_deposit_ledger_mismatch.yaml	Verifier credited a deposit that the token contract refundedShadow ledger at transaction granularity. For one NEAR tx and token, intents.near's internal balance change (mt_mint - mt_burn) must not exceed what it actually kept on the token contract (deposited - refunded). Evaluated when the token contract emits the refund.	Ledger tampering	nearverifierledger	0	sample: 0
No alerts in this window. { "source": "near.nep245", "condition": { "type": "deposit_ledger_mismatch", "verifier": "intents.near", "token_contracts": [ "v2_1.omni.hot.tg" ] }, "shield": { "mode": "under_attack", "capability": "raise_mode", "scope": [ "chain", "bridge", "token" ] } }
15	R8B_UNBACKED_CREDIT_WITHDRAWNR8_deposit_ledger_mismatch.yaml	Account withdraws from intents.near after receiving an unbacked creditFollow-up to R8. The Verifier accounts that received a credit the token contract refunded (R8 evidence `credited_accounts`), or an account they moved funds to inside the Verifier (one hop), withdraw from intents.near. This is the step where an unbacked balance leaves the Verifier, before any treasury on another chain pays it out.	Withdrawal	nearverifierledgerwithdrawaltaint	0	sample: 0
No alerts in this window. { "source": "near.nep245", "match": { "contract": "intents.near", "kind": "withdrawal", "status": "success" }, "condition": { "type": "tainted", "taint_from": [ "R8_DEPOSIT_LEDGER_MISMATCH" ], "taint_field": "evidence.credited_accounts", "hops": 1, "check": [ "from_addr" ], "observe": { "chain": "near", "contract": "intents.near" } }, "shield": { "mode": "under_attack", "capability": "raise_mode", "scope": [ "chain", "bridge", "token" ] } }
12	R9B_PAYOUT_FROM_FLAGGED_NEAR_ACCOUNTR9_withdrawal_link.yaml	Treasury payout authorized by a NEAR account that NEAR rules flaggedCross-chain link. A HOT treasury payout's calldata nonce equals the memo of the HOT omni mt_burn on NEAR that authorized it. If the NEAR account that burned was involved in an R6 or R8 alert (or received funds from such an account, one hop), the EVM payout inherits the flag and its recipient is tainted for R7 / R7B.	Treasury drain	evmtreasurypayoutxchain	0	sample: 0
No alerts in this window. { "source": [ "evm.erc20_transfer", "near.nep245", "near.dip4" ], "match": { "kind": "payout", "vault": "hot_bridge", "extra.withdraw_nonce": { "exists": true } }, "condition": { "type": "withdrawal_link", "mode": "tainted_origin", "taint_from": [ "R6_INTENTS_CALLBACK_ANOMALY", "R8_DEPOSIT_LEDGER_MISMATCH" ], "hops": 1 }, "shield": { "mode": "paranoid", "capability": "pause_destination", "scope": [ "address" ] } }
8	R10_RECIPIENT_PAYOUT_BURSTR10_recipient_payout_burst.yaml	Burst of large treasury payouts to one new counterpartyWazuh-style frequency rule: three or more stablecoin payouts over $250K from the same treasury to the same recipient within 2h, where the recipient had at most 3 such payouts in the 7 days before the burst. Regular counterparties of the NEAR Intents Ethereum treasury receive bursts like this every day; `max_prior` keeps those regular counterparties out. Splitting a drain into several payouts below the R1 / R5 thresholds still trips it. One alert per recipient per 6h.	Treasury drain	evmtreasurypayoutfrequency	6	0.346
{ "source": "evm.erc20_transfer", "match": { "kind": "payout", "vault": [ "hot_bridge", "near_intents" ], "symbol": [ "usdt", "usdc" ], "amount_usd": { "gt": 250000 } }, "condition": { "type": "frequency", "group_by": [ "chain", "vault", "to_addr" ], "count": 3, "within": "2h", "max_prior": { "count": 3, "within": "7d" } }, "ignore": "6h", "ignore_key": [ "chain", "vault", "to_addr" ], "shield": { "capability": "flag_observation", "scope": [ "chain", "bridge", "token", "address" ] } }
15	R9_UNMATCHED_HOT_PAYOUTR9_withdrawal_link.yaml (disabled)	HOT treasury payout without a matching NEAR burnReconciliation. Every HOT treasury payout should match a HOT omni mt_burn on NEAR with the same nonce, token and amount. Disabled by default: it needs complete NEAR coverage of the HOT omni contract (live mode). The replay holds sampled NEAR blocks, where most honest payouts would look unmatched.	Treasury drain	evmtreasurypayoutxchainreconciliation	0	-
No alerts in this window. { "source": [ "evm.erc20_transfer", "near.nep245" ], "match": { "kind": "payout", "vault": "hot_bridge", "extra.withdraw_nonce": { "exists": true } }, "condition": { "type": "withdrawal_link", "mode": "unmatched" }, "shield": { "mode": "under_attack", "capability": "raise_mode", "scope": [ "chain", "bridge", "token" ] } }
5	R100_ROUND_AMOUNT_PAYOUTR100_round_amount_payout.yaml (disabled) (score only)	Large payout of an exact round amountExample of a local extension. Exact round amounts above $100K are a weak signal; score only.	Treasury drain	localevmpayout	0	-
No alerts in this window. { "source": "evm.erc20_transfer", "match": { "kind": "payout", "vault": { "exists": true } }, "condition": { "type": "round_amount", "step": 100000, "min_value": 100000 } }

Baseline false positives 2026-10-08 to 2026-10-26, 17.33 days, same rules and thresholds, no known incident

Payouts in window

35,437

Ethereum 30,949BNB Chain 4,488

Alerts

all severities

High / critical per day

0.288

5 in total

Incidents opened

12 normal1 paranoid1 under attack

Escalated to under attack

the number that would pause a bridge

Out of sample: this data played no part in writing or tuning the rules, which were frozen before it was replayed. Events in window: Ethereum 30,949, BNB Chain 8,742, NEAR 2,394.
NEAR rules have no rate here. They read 436 of about 2,513,578 NEAR blocks in this window (0.0173%, about 4.3 minutes of chain time), all from seeded random windows: 342 Verifier transactions, 0 NEAR alerts. Zero alerts in so few blocks only bounds the rate below 0.88% of Verifier transactions, or about 998 alerts a day (95%, rule of three).
An ordinary payment, asked hourly: ethereum/near_intents/usdc allow 87.26% (0 h delay, 53 h pause); ethereum/near_intents/usdt allow 87.26% (0 h delay, 53 h pause); every other route allow 100% of 416 hours.

Data & provenance

Fixtures recorded public chain data

61,697 normalized events replayed (whole replay window 01 Oct - 26 Oct 2026). Recorded 2026-11-01T14:03:59.976668Z with intentwatch fetch-fixtures --scenario oct-oos into tests/fixtures/oct_oos.

Part	Range	Records
Ethereumrange via etherscan	2026-10-01T16:00 → 2026-10-26T00:00 blocks 26098521-26273136 (out)	46,192
Manifest entry { "chain": "ethereum", "collector": "etherscan", "directions": [ "out" ], "from_block": 26098521, "from_ts": "2026-10-01T16:00:00Z", "kind": "range", "native": false, "records": 46192, "to_block": 26273136, "to_ts": "2026-10-26T00:00:00Z" }
BNB Chainrange via evm_rpc	2026-10-01T16:00 → 2026-10-26T00:00 blocks 125128703-129797837 (out+in)	11,029
Manifest entry { "chain": "bsc", "collector": "evm_rpc", "directions": [ "out", "in" ], "from_block": 125128703, "from_ts": "2026-10-01T16:00:00Z", "kind": "range", "native": false, "records": 11029, "to_block": 129797837, "to_ts": "2026-10-26T00:00:00Z" }
NEARsample	2026-10-01T16:00 → 2026-10-26T00:00 40 random windows of 20 blocks, seed 20261101	796
Manifest entry { "blocks": 796, "blocks_per_window": 20, "chain": "near", "from_block": 218078295, "from_ts": "2026-10-01T16:00:00Z", "kind": "sample", "seed": 20261101, "to_block": 221609942, "to_ts": "2026-10-26T00:00:00Z", "window_starts": [ 218085355, 218114055, 218216495, 218231255, 218305835, 218342655, 218391455, 218555275, 218555515, 218619835, 218649315, 218685295, 218735095, 218792915, 218823135, 218898615, 219037835, 219055815, 219227435, 219331175, 219373855, 219518435, 219638815, 219689655, 219784995, 219805035, 219808475, 219865695, 219931975, 220112435, 220144415, 220242555, 220418795, 220639675, 220656515, 220678615, 221016015, 221350595, 221377635, 221492735 ] }

Blind spots and caveats

Confidential Intents (private shard): only entry and exit are visible.
HOT / MPC off-chain entitlement accounting: not visible; only its on-chain effects are.
Non-EVM treasuries (BTC, SOL, TON, Stellar, ...) are not collected; native BNB flows on BNB Chain are not either.
NEAR is sampled: the incident replay holds the blocks around the attacker's own NEAR transactions, which were picked by hand from the post-mortem, plus about a minute of benign context. A live run has no such list.
Hindsight: rules were designed after the post-mortem and tuned with the replay at hand, so timing on the incident is a best case. The out-of-sample scenario is the real test.
Detection, not prevention: nothing here submits to SHIELD or blocks anything on NEAR Intents or HOT.

Sources: https://docs.near-intents.org/security-compliance/treasury-addresses

IntentWatch · external, read-only detection over public on-chain data · incidents are SHIELD-shaped but unofficial · built at NEAR HACKATHON