Incident replay

NEAR Intents / HOT Bridge drain, 30 Sep - 1 Oct 2026

HOT Bridge treasury on BNB Chain paid 3,865,000 USDT in five withdrawals over ~6 hours to one address; on NEAR, deposits into intents.near whose mt_resolve_deposit callback failed on the 16,384-byte log limit preceded them. First public statement: 1 Oct 12:53 UTC.

scenario oct1 window 2.2 days chains Ethereum, BNB Chain, NEAR rules 16 enabled events in window 23,337 generated 2026-11-04T22:12:10Z

Dashboard

Total alerts

133

45 critical61 high23 medium4 low

Level 12 or above

106

on 54 transactions

Incidents

1 under attack3 normal

Highest SHIELD mode

under attack

recommended by any incident in the window

Events analyzed

23,337

Ethereum 15,935BNB Chain 4,273NEAR 3,129

Detection timing first high-severity alert in the incident the drain ended up in

Lead vs first public statement

44h 38m

statement at 2026-10-01 12:53:00 UTC

First high alert

2026-09-29 16:14

R6_INTENTS_CALLBACK_ANOMALY on NEAR

vs first large payout (W1)

31h 40m before

payout at 2026-09-30 23:54:30 UTC

Malicious payouts after the alert

3,865,000 USDT

5 of 5 withdrawals (exposure, not savings)

View	First high alert (UTC)	vs first payout ≥ $100K	Before first public statement	Malicious payouts after it
All rules	2026-09-29 16:14:20R6_INTENTS_CALLBACK_ANOMALY on NEAR	-31h 40m	44h 38m	5 (3,865,000 USDT)
First alert on an EVM chain	2026-09-30 18:57:07R9B_PAYOUT_FROM_FLAGGED_NEAR_ACCOUNT on BNB Chain	-4h 57m	17h 55m	5 (3,865,000 USDT)
EVM payout rules only (R1-R5)	2026-09-30 23:54:30R1B_PAYOUT_SPIKE_TO_NEW_RECIPIENT on BNB Chain	0s	12h 58m	4 (3,065,000 USDT)

Timeline everything on one time axis (UTC); each payout lane has its own scale

Alert severity criticalhighmediumlow payout, no alert SHIELD mode normal paranoid under attack reference event Hover a mark for details, click it to drill down

Kill chain alerts by stage of a bridge drain, rules ranked by alerts (IntentWatch's own taxonomy, loosely after MITRE ATT&CK tactics)

Stage 1 Probing 1alert first 29 Sep 16:09
Stage 2 Ledger tampering 69alerts first 29 Sep 16:14
Stage 3 Withdrawal 22alerts first 29 Sep 23:30
Stage 4 Treasury drain 39alerts first 29 Sep 18:08
Stage 5 Fund movement 2alerts first 01 Oct 01:15

Level	Rule	What it detects	Alerts in window	First (UTC)
1. Probing1 alert · silent: R6B
8	R6C	Token amount near the u128 limit on intents.near or the HOT omni contract	1	29 Sep 16:09
2. Ledger tampering69 alerts
12	R6	Abnormal resolve callback or oversized event on intents.near	46	29 Sep 16:14
15	R8	Verifier credited a deposit that the token contract refunded	23	29 Sep 16:14
3. Withdrawal22 alerts
15	R8B	Account withdraws from intents.near after receiving an unbacked credit	22	29 Sep 23:30
4. Treasury drain39 alerts
8	R5	Payout over $500K to a recipient first seen less than 7 days ago	12	29 Sep 18:08
12	R9B	Treasury payout authorized by a NEAR account that NEAR rules flagged	7	30 Sep 18:57
8	R1	Treasury payout far above recent maximum	4	30 Sep 17:15
5	R4	Large payout submitted by its own recipient (score only)	4	30 Sep 23:54
12	R1B	Treasury payout spike to a recipient first seen less than 7 days ago	3	30 Sep 23:54
8	R3	Small test payout followed by a large payout to the same recipient	3	30 Sep 22:18
8	R10	Burst of large treasury payouts to one new counterparty	3	30 Sep 06:46
12	R3B	Test-then-drain payout that the recipient submitted itself	2	30 Sep 23:54
12	R2	Treasury outflow velocity above its 7-day p99	1	01 Oct 00:24
5. Fund movement2 alerts · silent: R7
12	R7B	Treasury pays an address tainted by a flagged payout on another chain or vault	2	01 Oct 01:15

Malicious withdrawals and what a SHIELD consumer would have answered

Recipient of every row: 0x09fd1f5d...ad37, exploit wallet (BscScan label: Near Intents Exploiter 1). Decisions come from the mock consumer (incidents/shield.py) for a request on the payout's chain and token: at the payout (incidents that existed before it), and one minute later for the same recipient. No locker queries SHIELD; this shows what the signal would have said, not what would have happened. Click a row for its alerts (a row without alerts opens the tx in the explorer), a rule for that alert, a decision for the incident behind it.

Label	Time (UTC)	Amount	Tx	Alerts on this tx	At the payout	1 min later
W1	2026-09-30 23:54:30	800,000 USDT	0x9fe58e03...6c4c	R1BR1R3BR3R4R5R9B	pause	pause
W2	2026-10-01 00:24:02	1,200,000 USDT	0x0381265d...8220	R1BR1R2R3BR3R4R5R9B	pause	pause
W3	2026-10-01 00:50:42	1,500,000 USDT	0x69d1c68c...cceb	R10R1BR1R4R5R9B	pause	pause
W4	2026-10-01 01:46:20	330,000 USDT	0x9c10b967...003a	R4R9B	pause	pause
W5	2026-10-01 06:08:26	35,000 USDT	0x16ddfa69...0c02	R9B	pause	pause
ETH 85.74	2026-10-01 01:15:35	85.74 ETH	0x383ee254...8c6f	R7B	pause	pause
ETH 99.79	2026-10-01 01:26:11	99.79 ETH	0x1b589df1...73c9	R7B	pause	pause

Events

Security events 133 alerts in the window (228 in the whole replay), most severe first; click a column header to sort, a row for the full document

133 hits

2026-09-29 16:14:22

NEAR

R8_DEPOSIT_LEDGER_MISMATCHLedger tampering

tx 3k91uDpUiezxUe7hBgAR7kc3TBkToMZKGAiv6GqbtKiC: intents.near kept a credit of 10 usdt that v2_1.omni.hot.tg refunded (2 token(s))

3k91uDpUie...tKiC

Click a field to copy its value.

timestamp	2026-09-29T16:14:22.056408Z
rule.id	R8_DEPOSIT_LEDGER_MISMATCH
rule.level	15
rule.severity	critical
rule.description	Verifier credited a deposit that the token contract refunded
rule.groups	near, verifier, ledger
rule.tactic	Ledger tampering
rule.weight	4.0
data.tx	3k91uDpUiezxUe7hBgAR7kc3TBkToMZKGAiv6GqbtKiC
data.block	217799506
data.ts	2026-09-29T16:14:22.056408Z
data.chain	near
data.kind	refund
data.amount	10
data.symbol	usdt
data.from	intents.near
data.to	20e6bfe4685d99004fc2095d3a0fc6158cd810ce8f801196141e183ed6e19d65
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	20e6bfe4685d99004fc2095d3a0fc6158cd810ce8f801196141e183ed6e19d65
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
evidence.verifier	intents.near
evidence.token_contract	v2_1.omni.hot.tg
evidence.mismatched_tokens	2
evidence.mismatches	[{"token": "nep245:v2_1.omni.hot.tg:4444119_EnfNtEaQwr1AZTRgmH3dEhqGy1rqBWAU8gbAP1eKhErvrNk3cQQ7ConB8nnW9mhdHwm14Haihc5QwzhnJWLodt3ZVa3TY", "deposited_raw": "97", "minted_raw": "97", "burned_raw": "0", "refunded_raw": "97", "excess_credit_raw": "97"}, {"token": "nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g", "deposited_raw": "10000000000000000000", "minted_raw": "10000000000000000000", "burned_raw": "0", "refunded_raw": "10000000000000000000", "excess_credit_raw": "10000000000000000000", "symbol": "usdt"}]
evidence.headline_excess	10 usdt
evidence.credited_accounts	dd1fe58ec316ada5b673b88c14fe2fa2b7ede82080440901dfbd64b994241757
evidence.invariant	minted - burned <= deposited - refunded (per tx, per token)
shield.mode	under_attack
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-29 17:02:34

NEAR

R8_DEPOSIT_LEDGER_MISMATCHLedger tampering

tx 41Xh35y2ZpGNBzwcDzJDfF5NzJxPfM8dx2A25gzZAd52: intents.near kept a credit of 20 usdt that v2_1.omni.hot.tg refunded (2 token(s))

41Xh35y2Zp...Ad52

Click a field to copy its value.

timestamp	2026-09-29T17:02:34.146789Z
rule.id	R8_DEPOSIT_LEDGER_MISMATCH
rule.level	15
rule.severity	critical
rule.description	Verifier credited a deposit that the token contract refunded
rule.groups	near, verifier, ledger
rule.tactic	Ledger tampering
rule.weight	4.0
data.tx	41Xh35y2ZpGNBzwcDzJDfF5NzJxPfM8dx2A25gzZAd52
data.block	217804368
data.ts	2026-09-29T17:02:34.146789Z
data.chain	near
data.kind	refund
data.amount	20
data.symbol	usdt
data.from	intents.near
data.to	20e6bfe4685d99004fc2095d3a0fc6158cd810ce8f801196141e183ed6e19d65
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	20e6bfe4685d99004fc2095d3a0fc6158cd810ce8f801196141e183ed6e19d65
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
evidence.verifier	intents.near
evidence.token_contract	v2_1.omni.hot.tg
evidence.mismatched_tokens	2
evidence.mismatches	[{"token": "nep245:v2_1.omni.hot.tg:4444119_EnfNtEaQwr1AZTRgmH3dEhqGy1rqBWAU8gbAP1eKhErvrNk3cQQ7ConB8nnW9mhdHwm14Haihc5QwzhnJWLodt3ZVa3TY", "deposited_raw": "97", "minted_raw": "97", "burned_raw": "0", "refunded_raw": "97", "excess_credit_raw": "97"}, {"token": "nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g", "deposited_raw": "20000000000000000000", "minted_raw": "20000000000000000000", "burned_raw": "0", "refunded_raw": "20000000000000000000", "excess_credit_raw": "20000000000000000000", "symbol": "usdt"}]
evidence.headline_excess	20 usdt
evidence.credited_accounts	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
evidence.invariant	minted - burned <= deposited - refunded (per tx, per token)
shield.mode	under_attack
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-29 23:30:41

NEAR

R8B_UNBACKED_CREDIT_WITHDRAWNWithdrawal

873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e withdrew 20 usdt (nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g) from intents.near, 6h 28m after R8_DEPOSIT_LEDGER_MISMATCH credited it (tx 41Xh35y2ZpGNBzwcDzJDfF5NzJxPfM8dx2A25gzZAd52)

83XUi7kEqV...Wsyg

Click a field to copy its value.

timestamp	2026-09-29T23:30:41.848414Z
rule.id	R8B_UNBACKED_CREDIT_WITHDRAWN
rule.level	15
rule.severity	critical
rule.description	Account withdraws from intents.near after receiving an unbacked credit
rule.groups	near, verifier, ledger, withdrawal, taint
rule.tactic	Withdrawal
rule.weight	4.0
data.tx	83XUi7kEqVXQERUJSZTVS2PNk4YtdG2QR1tr8hScWsyg
data.block	217842429
data.ts	2026-09-29T23:30:41.848414Z
data.chain	near
data.kind	withdrawal
data.amount	20
data.symbol	usdt
data.from	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
evidence.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
evidence.hop	0
evidence.tainted_at	2026-09-29T17:02:34.146789Z
evidence.tainted_by_rule	R8_DEPOSIT_LEDGER_MISMATCH
evidence.tainted_by_tx	41Xh35y2ZpGNBzwcDzJDfF5NzJxPfM8dx2A25gzZAd52
evidence.tainted_on_chain	near
evidence.matched_field	from_addr
evidence.since_taint	6:28:07.701625
matched[0]	contract=intents.near eq intents.near
matched[1]	kind=withdrawal eq withdrawal
matched[2]	status=success eq success
shield.mode	under_attack
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-30 00:04:16

NEAR

R8_DEPOSIT_LEDGER_MISMATCHLedger tampering

tx Hjtr43MGF1t3KRDx9hPcGkSo3CGLdnY46iQKzM5X7Nk2: intents.near kept a credit of 40 usdt that v2_1.omni.hot.tg refunded (2 token(s))

Hjtr43MGF1...7Nk2

Click a field to copy its value.

timestamp	2026-09-30T00:04:16.056645Z
rule.id	R8_DEPOSIT_LEDGER_MISMATCH
rule.level	15
rule.severity	critical
rule.description	Verifier credited a deposit that the token contract refunded
rule.groups	near, verifier, ledger
rule.tactic	Ledger tampering
rule.weight	4.0
data.tx	Hjtr43MGF1t3KRDx9hPcGkSo3CGLdnY46iQKzM5X7Nk2
data.block	217845835
data.ts	2026-09-30T00:04:16.056645Z
data.chain	near
data.kind	refund
data.amount	40
data.symbol	usdt
data.from	intents.near
data.to	20e6bfe4685d99004fc2095d3a0fc6158cd810ce8f801196141e183ed6e19d65
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	20e6bfe4685d99004fc2095d3a0fc6158cd810ce8f801196141e183ed6e19d65
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
evidence.verifier	intents.near
evidence.token_contract	v2_1.omni.hot.tg
evidence.mismatched_tokens	2
evidence.mismatches	[{"token": "nep245:v2_1.omni.hot.tg:4444119_EnfNtEaQwr1AZTRgmH3dEhqGy1rqBWAU8gbAP1eKhErvrNk3cQQ7ConB8nnW9mhdHwm14Haihc5QwzhnJWLodt3ZVa3TY", "deposited_raw": "97", "minted_raw": "97", "burned_raw": "0", "refunded_raw": "97", "excess_credit_raw": "97"}, {"token": "nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g", "deposited_raw": "40000000000000000000", "minted_raw": "40000000000000000000", "burned_raw": "0", "refunded_raw": "40000000000000000000", "excess_credit_raw": "40000000000000000000", "symbol": "usdt"}]
evidence.headline_excess	40 usdt
evidence.credited_accounts	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
evidence.invariant	minted - burned <= deposited - refunded (per tx, per token)
shield.mode	under_attack
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-30 00:06:02

NEAR

R8B_UNBACKED_CREDIT_WITHDRAWNWithdrawal

873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e withdrew 40 usdt (nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g) from intents.near, 7h 3m after R8_DEPOSIT_LEDGER_MISMATCH credited it (tx 41Xh35y2ZpGNBzwcDzJDfF5NzJxPfM8dx2A25gzZAd52)

CHPN9RWFnh...pmgG

Click a field to copy its value.

timestamp	2026-09-30T00:06:02.189926Z
rule.id	R8B_UNBACKED_CREDIT_WITHDRAWN
rule.level	15
rule.severity	critical
rule.description	Account withdraws from intents.near after receiving an unbacked credit
rule.groups	near, verifier, ledger, withdrawal, taint
rule.tactic	Withdrawal
rule.weight	4.0
data.tx	CHPN9RWFnhFdD4WsPXYWJPfyWm7awZpEyJTH8CxCpmgG
data.block	217846017
data.ts	2026-09-30T00:06:02.189926Z
data.chain	near
data.kind	withdrawal
data.amount	40
data.symbol	usdt
data.from	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
evidence.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
evidence.hop	0
evidence.tainted_at	2026-09-29T17:02:34.146789Z
evidence.tainted_by_rule	R8_DEPOSIT_LEDGER_MISMATCH
evidence.tainted_by_tx	41Xh35y2ZpGNBzwcDzJDfF5NzJxPfM8dx2A25gzZAd52
evidence.tainted_on_chain	near
evidence.matched_field	from_addr
evidence.since_taint	7:03:28.043137
matched[0]	contract=intents.near eq intents.near
matched[1]	kind=withdrawal eq withdrawal
matched[2]	status=success eq success
shield.mode	under_attack
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-30 00:10:32

NEAR

R8_DEPOSIT_LEDGER_MISMATCHLedger tampering

tx AQcebAk5oayzLHjwFW7TSTVkv5xA1FTQ2pRYExCB5yAD: intents.near kept a credit of 80 usdt that v2_1.omni.hot.tg refunded (2 token(s))

AQcebAk5oa...5yAD

Click a field to copy its value.

timestamp	2026-09-30T00:10:32.452837Z
rule.id	R8_DEPOSIT_LEDGER_MISMATCH
rule.level	15
rule.severity	critical
rule.description	Verifier credited a deposit that the token contract refunded
rule.groups	near, verifier, ledger
rule.tactic	Ledger tampering
rule.weight	4.0
data.tx	AQcebAk5oayzLHjwFW7TSTVkv5xA1FTQ2pRYExCB5yAD
data.block	217846480
data.ts	2026-09-30T00:10:32.452837Z
data.chain	near
data.kind	refund
data.amount	80
data.symbol	usdt
data.from	intents.near
data.to	20e6bfe4685d99004fc2095d3a0fc6158cd810ce8f801196141e183ed6e19d65
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	20e6bfe4685d99004fc2095d3a0fc6158cd810ce8f801196141e183ed6e19d65
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
evidence.verifier	intents.near
evidence.token_contract	v2_1.omni.hot.tg
evidence.mismatched_tokens	2
evidence.mismatches	[{"token": "nep245:v2_1.omni.hot.tg:4444119_EnfNtEaQwr1AZTRgmH3dEhqGy1rqBWAU8gbAP1eKhErvrNk3cQQ7ConB8nnW9mhdHwm14Haihc5QwzhnJWLodt3ZVa3TY", "deposited_raw": "97", "minted_raw": "97", "burned_raw": "0", "refunded_raw": "97", "excess_credit_raw": "97"}, {"token": "nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g", "deposited_raw": "80000000000000000000", "minted_raw": "80000000000000000000", "burned_raw": "0", "refunded_raw": "80000000000000000000", "excess_credit_raw": "80000000000000000000", "symbol": "usdt"}]
evidence.headline_excess	80 usdt
evidence.credited_accounts	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
evidence.invariant	minted - burned <= deposited - refunded (per tx, per token)
shield.mode	under_attack
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-30 00:12:22

NEAR

R8B_UNBACKED_CREDIT_WITHDRAWNWithdrawal

873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e withdrew 80 usdt (nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g) from intents.near, 7h 9m after R8_DEPOSIT_LEDGER_MISMATCH credited it (tx 41Xh35y2ZpGNBzwcDzJDfF5NzJxPfM8dx2A25gzZAd52)

8RkKNzQWrT...fcZj

Click a field to copy its value.

timestamp	2026-09-30T00:12:22.098975Z
rule.id	R8B_UNBACKED_CREDIT_WITHDRAWN
rule.level	15
rule.severity	critical
rule.description	Account withdraws from intents.near after receiving an unbacked credit
rule.groups	near, verifier, ledger, withdrawal, taint
rule.tactic	Withdrawal
rule.weight	4.0
data.tx	8RkKNzQWrTPf8Vgkbpi9yiBSHHDagFHzQsj5raykfcZj
data.block	217846667
data.ts	2026-09-30T00:12:22.098975Z
data.chain	near
data.kind	withdrawal
data.amount	80
data.symbol	usdt
data.from	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
evidence.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
evidence.hop	0
evidence.tainted_at	2026-09-29T17:02:34.146789Z
evidence.tainted_by_rule	R8_DEPOSIT_LEDGER_MISMATCH
evidence.tainted_by_tx	41Xh35y2ZpGNBzwcDzJDfF5NzJxPfM8dx2A25gzZAd52
evidence.tainted_on_chain	near
evidence.matched_field	from_addr
evidence.since_taint	7:09:47.952186
matched[0]	contract=intents.near eq intents.near
matched[1]	kind=withdrawal eq withdrawal
matched[2]	status=success eq success
shield.mode	under_attack
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-30 00:16:47

NEAR

R8_DEPOSIT_LEDGER_MISMATCHLedger tampering

tx GE3bQobJVsiCHftwDhH7AMQAjDGRUAMenFVpnaYXF68B: intents.near kept a credit of 160 usdt that v2_1.omni.hot.tg refunded (2 token(s))

GE3bQobJVs...F68B

Click a field to copy its value.

timestamp	2026-09-30T00:16:47.380962Z
rule.id	R8_DEPOSIT_LEDGER_MISMATCH
rule.level	15
rule.severity	critical
rule.description	Verifier credited a deposit that the token contract refunded
rule.groups	near, verifier, ledger
rule.tactic	Ledger tampering
rule.weight	4.0
data.tx	GE3bQobJVsiCHftwDhH7AMQAjDGRUAMenFVpnaYXF68B
data.block	217847120
data.ts	2026-09-30T00:16:47.380962Z
data.chain	near
data.kind	refund
data.amount	160
data.symbol	usdt
data.from	intents.near
data.to	20e6bfe4685d99004fc2095d3a0fc6158cd810ce8f801196141e183ed6e19d65
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	20e6bfe4685d99004fc2095d3a0fc6158cd810ce8f801196141e183ed6e19d65
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
evidence.verifier	intents.near
evidence.token_contract	v2_1.omni.hot.tg
evidence.mismatched_tokens	2
evidence.mismatches	[{"token": "nep245:v2_1.omni.hot.tg:4444119_EnfNtEaQwr1AZTRgmH3dEhqGy1rqBWAU8gbAP1eKhErvrNk3cQQ7ConB8nnW9mhdHwm14Haihc5QwzhnJWLodt3ZVa3TY", "deposited_raw": "97", "minted_raw": "97", "burned_raw": "0", "refunded_raw": "97", "excess_credit_raw": "97"}, {"token": "nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g", "deposited_raw": "160000000000000000000", "minted_raw": "160000000000000000000", "burned_raw": "0", "refunded_raw": "160000000000000000000", "excess_credit_raw": "160000000000000000000", "symbol": "usdt"}]
evidence.headline_excess	160 usdt
evidence.credited_accounts	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
evidence.invariant	minted - burned <= deposited - refunded (per tx, per token)
shield.mode	under_attack
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-30 00:18:43

NEAR

R8B_UNBACKED_CREDIT_WITHDRAWNWithdrawal

873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e withdrew 160 usdt (nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g) from intents.near, 7h 16m after R8_DEPOSIT_LEDGER_MISMATCH credited it (tx 41Xh35y2ZpGNBzwcDzJDfF5NzJxPfM8dx2A25gzZAd52)

AReNEihDz9...fREY

Click a field to copy its value.

timestamp	2026-09-30T00:18:43.181179Z
rule.id	R8B_UNBACKED_CREDIT_WITHDRAWN
rule.level	15
rule.severity	critical
rule.description	Account withdraws from intents.near after receiving an unbacked credit
rule.groups	near, verifier, ledger, withdrawal, taint
rule.tactic	Withdrawal
rule.weight	4.0
data.tx	AReNEihDz9tUEPRfQ1771SXthkCNynxHWUTUBz67fREY
data.block	217847317
data.ts	2026-09-30T00:18:43.181179Z
data.chain	near
data.kind	withdrawal
data.amount	160
data.symbol	usdt
data.from	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
evidence.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
evidence.hop	0
evidence.tainted_at	2026-09-29T17:02:34.146789Z
evidence.tainted_by_rule	R8_DEPOSIT_LEDGER_MISMATCH
evidence.tainted_by_tx	41Xh35y2ZpGNBzwcDzJDfF5NzJxPfM8dx2A25gzZAd52
evidence.tainted_on_chain	near
evidence.matched_field	from_addr
evidence.since_taint	7:16:09.034390
matched[0]	contract=intents.near eq intents.near
matched[1]	kind=withdrawal eq withdrawal
matched[2]	status=success eq success
shield.mode	under_attack
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-30 00:26:10

NEAR

R8_DEPOSIT_LEDGER_MISMATCHLedger tampering

tx Gai9wo8FFQRdLdS6DjqZf1NCPZDLkCB6dk3Fv2H6VdGX: intents.near kept a credit of 320 usdt that v2_1.omni.hot.tg refunded (2 token(s))

Gai9wo8FFQ...VdGX

Click a field to copy its value.

timestamp	2026-09-30T00:26:10.893193Z
rule.id	R8_DEPOSIT_LEDGER_MISMATCH
rule.level	15
rule.severity	critical
rule.description	Verifier credited a deposit that the token contract refunded
rule.groups	near, verifier, ledger
rule.tactic	Ledger tampering
rule.weight	4.0
data.tx	Gai9wo8FFQRdLdS6DjqZf1NCPZDLkCB6dk3Fv2H6VdGX
data.block	217848081
data.ts	2026-09-30T00:26:10.893193Z
data.chain	near
data.kind	refund
data.amount	320
data.symbol	usdt
data.from	intents.near
data.to	20e6bfe4685d99004fc2095d3a0fc6158cd810ce8f801196141e183ed6e19d65
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	20e6bfe4685d99004fc2095d3a0fc6158cd810ce8f801196141e183ed6e19d65
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
evidence.verifier	intents.near
evidence.token_contract	v2_1.omni.hot.tg
evidence.mismatched_tokens	2
evidence.mismatches	[{"token": "nep245:v2_1.omni.hot.tg:4444119_EnfNtEaQwr1AZTRgmH3dEhqGy1rqBWAU8gbAP1eKhErvrNk3cQQ7ConB8nnW9mhdHwm14Haihc5QwzhnJWLodt3ZVa3TY", "deposited_raw": "97", "minted_raw": "97", "burned_raw": "0", "refunded_raw": "97", "excess_credit_raw": "97"}, {"token": "nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g", "deposited_raw": "320000000000000000000", "minted_raw": "320000000000000000000", "burned_raw": "0", "refunded_raw": "320000000000000000000", "excess_credit_raw": "320000000000000000000", "symbol": "usdt"}]
evidence.headline_excess	320 usdt
evidence.credited_accounts	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
evidence.invariant	minted - burned <= deposited - refunded (per tx, per token)
shield.mode	under_attack
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-30 00:28:38

NEAR

R8B_UNBACKED_CREDIT_WITHDRAWNWithdrawal

873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e withdrew 320 usdt (nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g) from intents.near, 7h 26m after R8_DEPOSIT_LEDGER_MISMATCH credited it (tx 41Xh35y2ZpGNBzwcDzJDfF5NzJxPfM8dx2A25gzZAd52)

AxbQpdbdGC...WGMu

Click a field to copy its value.

timestamp	2026-09-30T00:28:38.786158Z
rule.id	R8B_UNBACKED_CREDIT_WITHDRAWN
rule.level	15
rule.severity	critical
rule.description	Account withdraws from intents.near after receiving an unbacked credit
rule.groups	near, verifier, ledger, withdrawal, taint
rule.tactic	Withdrawal
rule.weight	4.0
data.tx	AxbQpdbdGC9pXh9H4f5qNwN1Fj3ctneQ3pmyRZ6AWGMu
data.block	217848332
data.ts	2026-09-30T00:28:38.786158Z
data.chain	near
data.kind	withdrawal
data.amount	320
data.symbol	usdt
data.from	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
evidence.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
evidence.hop	0
evidence.tainted_at	2026-09-29T17:02:34.146789Z
evidence.tainted_by_rule	R8_DEPOSIT_LEDGER_MISMATCH
evidence.tainted_by_tx	41Xh35y2ZpGNBzwcDzJDfF5NzJxPfM8dx2A25gzZAd52
evidence.tainted_on_chain	near
evidence.matched_field	from_addr
evidence.since_taint	7:26:04.639369
matched[0]	contract=intents.near eq intents.near
matched[1]	kind=withdrawal eq withdrawal
matched[2]	status=success eq success
shield.mode	under_attack
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-30 00:32:34

NEAR

R8_DEPOSIT_LEDGER_MISMATCHLedger tampering

tx 7Ay6C2g5oK8HpkfvEbiez6BnSTrktvAytVmdUCL8fCKq: intents.near kept a credit of 640 usdt that v2_1.omni.hot.tg refunded (2 token(s))

7Ay6C2g5oK...fCKq

Click a field to copy its value.

timestamp	2026-09-30T00:32:34.694199Z
rule.id	R8_DEPOSIT_LEDGER_MISMATCH
rule.level	15
rule.severity	critical
rule.description	Verifier credited a deposit that the token contract refunded
rule.groups	near, verifier, ledger
rule.tactic	Ledger tampering
rule.weight	4.0
data.tx	7Ay6C2g5oK8HpkfvEbiez6BnSTrktvAytVmdUCL8fCKq
data.block	217848728
data.ts	2026-09-30T00:32:34.694199Z
data.chain	near
data.kind	refund
data.amount	640
data.symbol	usdt
data.from	intents.near
data.to	20e6bfe4685d99004fc2095d3a0fc6158cd810ce8f801196141e183ed6e19d65
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	20e6bfe4685d99004fc2095d3a0fc6158cd810ce8f801196141e183ed6e19d65
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
evidence.verifier	intents.near
evidence.token_contract	v2_1.omni.hot.tg
evidence.mismatched_tokens	2
evidence.mismatches	[{"token": "nep245:v2_1.omni.hot.tg:4444119_EnfNtEaQwr1AZTRgmH3dEhqGy1rqBWAU8gbAP1eKhErvrNk3cQQ7ConB8nnW9mhdHwm14Haihc5QwzhnJWLodt3ZVa3TY", "deposited_raw": "97", "minted_raw": "97", "burned_raw": "0", "refunded_raw": "97", "excess_credit_raw": "97"}, {"token": "nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g", "deposited_raw": "640000000000000000000", "minted_raw": "640000000000000000000", "burned_raw": "0", "refunded_raw": "640000000000000000000", "excess_credit_raw": "640000000000000000000", "symbol": "usdt"}]
evidence.headline_excess	640 usdt
evidence.credited_accounts	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
evidence.invariant	minted - burned <= deposited - refunded (per tx, per token)
shield.mode	under_attack
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-30 00:34:43

NEAR

R8B_UNBACKED_CREDIT_WITHDRAWNWithdrawal

873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e withdrew 640 usdt (nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g) from intents.near, 7h 32m after R8_DEPOSIT_LEDGER_MISMATCH credited it (tx 41Xh35y2ZpGNBzwcDzJDfF5NzJxPfM8dx2A25gzZAd52)

3hmhHHm1jy...4BPt

Click a field to copy its value.

timestamp	2026-09-30T00:34:43.390342Z
rule.id	R8B_UNBACKED_CREDIT_WITHDRAWN
rule.level	15
rule.severity	critical
rule.description	Account withdraws from intents.near after receiving an unbacked credit
rule.groups	near, verifier, ledger, withdrawal, taint
rule.tactic	Withdrawal
rule.weight	4.0
data.tx	3hmhHHm1jyYFfnWAMFVpCSGNGUPsSAqBEZGeMWfJ4BPt
data.block	217848942
data.ts	2026-09-30T00:34:43.390342Z
data.chain	near
data.kind	withdrawal
data.amount	640
data.symbol	usdt
data.from	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
evidence.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
evidence.hop	0
evidence.tainted_at	2026-09-29T17:02:34.146789Z
evidence.tainted_by_rule	R8_DEPOSIT_LEDGER_MISMATCH
evidence.tainted_by_tx	41Xh35y2ZpGNBzwcDzJDfF5NzJxPfM8dx2A25gzZAd52
evidence.tainted_on_chain	near
evidence.matched_field	from_addr
evidence.since_taint	7:32:09.243553
matched[0]	contract=intents.near eq intents.near
matched[1]	kind=withdrawal eq withdrawal
matched[2]	status=success eq success
shield.mode	under_attack
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-30 00:38:35

NEAR

R8_DEPOSIT_LEDGER_MISMATCHLedger tampering

tx 2GQ2zQzCzDefNf1czyJYQUwHAjcHYTYPYZicLbdLqVWb: intents.near kept a credit of 1,280 usdt that v2_1.omni.hot.tg refunded (2 token(s))

2GQ2zQzCzD...qVWb

Click a field to copy its value.

timestamp	2026-09-30T00:38:35.837685Z
rule.id	R8_DEPOSIT_LEDGER_MISMATCH
rule.level	15
rule.severity	critical
rule.description	Verifier credited a deposit that the token contract refunded
rule.groups	near, verifier, ledger
rule.tactic	Ledger tampering
rule.weight	4.0
data.tx	2GQ2zQzCzDefNf1czyJYQUwHAjcHYTYPYZicLbdLqVWb
data.block	217849339
data.ts	2026-09-30T00:38:35.837685Z
data.chain	near
data.kind	refund
data.amount	1280
data.symbol	usdt
data.from	intents.near
data.to	20e6bfe4685d99004fc2095d3a0fc6158cd810ce8f801196141e183ed6e19d65
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	20e6bfe4685d99004fc2095d3a0fc6158cd810ce8f801196141e183ed6e19d65
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
evidence.verifier	intents.near
evidence.token_contract	v2_1.omni.hot.tg
evidence.mismatched_tokens	2
evidence.mismatches	[{"token": "nep245:v2_1.omni.hot.tg:4444119_EnfNtEaQwr1AZTRgmH3dEhqGy1rqBWAU8gbAP1eKhErvrNk3cQQ7ConB8nnW9mhdHwm14Haihc5QwzhnJWLodt3ZVa3TY", "deposited_raw": "97", "minted_raw": "97", "burned_raw": "0", "refunded_raw": "97", "excess_credit_raw": "97"}, {"token": "nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g", "deposited_raw": "1280000000000000000000", "minted_raw": "1280000000000000000000", "burned_raw": "0", "refunded_raw": "1280000000000000000000", "excess_credit_raw": "1280000000000000000000", "symbol": "usdt"}]
evidence.headline_excess	1,280 usdt
evidence.credited_accounts	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
evidence.invariant	minted - burned <= deposited - refunded (per tx, per token)
shield.mode	under_attack
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-30 01:19:15

NEAR

R8B_UNBACKED_CREDIT_WITHDRAWNWithdrawal

873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e withdrew 1,280 usdt (nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g) from intents.near, 8h 16m after R8_DEPOSIT_LEDGER_MISMATCH credited it (tx 41Xh35y2ZpGNBzwcDzJDfF5NzJxPfM8dx2A25gzZAd52)

F2ZsMS5ojX...gnph

Click a field to copy its value.

timestamp	2026-09-30T01:19:15.803850Z
rule.id	R8B_UNBACKED_CREDIT_WITHDRAWN
rule.level	15
rule.severity	critical
rule.description	Account withdraws from intents.near after receiving an unbacked credit
rule.groups	near, verifier, ledger, withdrawal, taint
rule.tactic	Withdrawal
rule.weight	4.0
data.tx	F2ZsMS5ojXSeEvdTPNNbLSXHkrweZoN4PntaDCjCgnph
data.block	217853468
data.ts	2026-09-30T01:19:15.803850Z
data.chain	near
data.kind	withdrawal
data.amount	1280
data.symbol	usdt
data.from	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
evidence.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
evidence.hop	0
evidence.tainted_at	2026-09-29T17:02:34.146789Z
evidence.tainted_by_rule	R8_DEPOSIT_LEDGER_MISMATCH
evidence.tainted_by_tx	41Xh35y2ZpGNBzwcDzJDfF5NzJxPfM8dx2A25gzZAd52
evidence.tainted_on_chain	near
evidence.matched_field	from_addr
evidence.since_taint	8:16:41.657061
matched[0]	contract=intents.near eq intents.near
matched[1]	kind=withdrawal eq withdrawal
matched[2]	status=success eq success
shield.mode	under_attack
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-30 20:15:33

NEAR

R8_DEPOSIT_LEDGER_MISMATCHLedger tampering

tx B8qntq8eHyL7wgXcEjS1iPHDDnG86xpC1nqKH5FgRt3U: intents.near kept a credit of 2,539 usdt that v2_1.omni.hot.tg refunded (2 token(s))

B8qntq8eHy...Rt3U

Click a field to copy its value.

timestamp	2026-09-30T20:15:33.203504Z
rule.id	R8_DEPOSIT_LEDGER_MISMATCH
rule.level	15
rule.severity	critical
rule.description	Verifier credited a deposit that the token contract refunded
rule.groups	near, verifier, ledger
rule.tactic	Ledger tampering
rule.weight	4.0
data.tx	B8qntq8eHyL7wgXcEjS1iPHDDnG86xpC1nqKH5FgRt3U
data.block	217962137
data.ts	2026-09-30T20:15:33.203504Z
data.chain	near
data.kind	refund
data.amount	2539
data.symbol	usdt
data.from	intents.near
data.to	20e6bfe4685d99004fc2095d3a0fc6158cd810ce8f801196141e183ed6e19d65
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	20e6bfe4685d99004fc2095d3a0fc6158cd810ce8f801196141e183ed6e19d65
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
evidence.verifier	intents.near
evidence.token_contract	v2_1.omni.hot.tg
evidence.mismatched_tokens	2
evidence.mismatches	[{"token": "nep245:v2_1.omni.hot.tg:4444119_EnfNtEaQwr1AZTRgmH3dEhqGy1rqBWAU8gbAP1eKhErvrNk3cQQ7ConB8nnW9mhdHwm14Haihc5QwzhnJWLodt3ZVa3TY", "deposited_raw": "97", "minted_raw": "97", "burned_raw": "0", "refunded_raw": "97", "excess_credit_raw": "97"}, {"token": "nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g", "deposited_raw": "2539000000000000000000", "minted_raw": "2539000000000000000000", "burned_raw": "0", "refunded_raw": "2539000000000000000000", "excess_credit_raw": "2539000000000000000000", "symbol": "usdt"}]
evidence.headline_excess	2,539 usdt
evidence.credited_accounts	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
evidence.invariant	minted - burned <= deposited - refunded (per tx, per token)
shield.mode	under_attack
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-30 20:17:57

NEAR

R8B_UNBACKED_CREDIT_WITHDRAWNWithdrawal

873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e withdrew 2,539 usdt (nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g) from intents.near, 27h 15m after R8_DEPOSIT_LEDGER_MISMATCH credited it (tx 41Xh35y2ZpGNBzwcDzJDfF5NzJxPfM8dx2A25gzZAd52)

BAheBBV6Ud...s8yB

Click a field to copy its value.

timestamp	2026-09-30T20:17:57.083156Z
rule.id	R8B_UNBACKED_CREDIT_WITHDRAWN
rule.level	15
rule.severity	critical
rule.description	Account withdraws from intents.near after receiving an unbacked credit
rule.groups	near, verifier, ledger, withdrawal, taint
rule.tactic	Withdrawal
rule.weight	4.0
data.tx	BAheBBV6UdpgVo2Nw7tcgrygNkUVbgiEq4iKcXmps8yB
data.block	217962383
data.ts	2026-09-30T20:17:57.083156Z
data.chain	near
data.kind	withdrawal
data.amount	2539
data.symbol	usdt
data.from	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
evidence.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
evidence.hop	0
evidence.tainted_at	2026-09-29T17:02:34.146789Z
evidence.tainted_by_rule	R8_DEPOSIT_LEDGER_MISMATCH
evidence.tainted_by_tx	41Xh35y2ZpGNBzwcDzJDfF5NzJxPfM8dx2A25gzZAd52
evidence.tainted_on_chain	near
evidence.matched_field	from_addr
evidence.since_taint	1 day, 3:15:22.936367
matched[0]	contract=intents.near eq intents.near
matched[1]	kind=withdrawal eq withdrawal
matched[2]	status=success eq success
shield.mode	under_attack
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-30 22:45:09

NEAR

R8_DEPOSIT_LEDGER_MISMATCHLedger tampering

tx GHM8RaBBrSWPmvoWZwewboYcYdQwkrQ3UMrFJqNjrGN3: intents.near kept a credit of 5,078 usdt that v2_1.omni.hot.tg refunded (2 token(s))

GHM8RaBBrS...rGN3

Click a field to copy its value.

timestamp	2026-09-30T22:45:09.508442Z
rule.id	R8_DEPOSIT_LEDGER_MISMATCH
rule.level	15
rule.severity	critical
rule.description	Verifier credited a deposit that the token contract refunded
rule.groups	near, verifier, ledger
rule.tactic	Ledger tampering
rule.weight	4.0
data.tx	GHM8RaBBrSWPmvoWZwewboYcYdQwkrQ3UMrFJqNjrGN3
data.block	217977371
data.ts	2026-09-30T22:45:09.508442Z
data.chain	near
data.kind	refund
data.amount	5078
data.symbol	usdt
data.from	intents.near
data.to	20e6bfe4685d99004fc2095d3a0fc6158cd810ce8f801196141e183ed6e19d65
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	20e6bfe4685d99004fc2095d3a0fc6158cd810ce8f801196141e183ed6e19d65
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
evidence.verifier	intents.near
evidence.token_contract	v2_1.omni.hot.tg
evidence.mismatched_tokens	2
evidence.mismatches	[{"token": "nep245:v2_1.omni.hot.tg:4444119_EnfNtEaQwr1AZTRgmH3dEhqGy1rqBWAU8gbAP1eKhErvrNk3cQQ7ConB8nnW9mhdHwm14Haihc5QwzhnJWLodt3ZVa3TY", "deposited_raw": "97", "minted_raw": "97", "burned_raw": "0", "refunded_raw": "97", "excess_credit_raw": "97"}, {"token": "nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g", "deposited_raw": "5078000000000000000000", "minted_raw": "5078000000000000000000", "burned_raw": "0", "refunded_raw": "5078000000000000000000", "excess_credit_raw": "5078000000000000000000", "symbol": "usdt"}]
evidence.headline_excess	5,078 usdt
evidence.credited_accounts	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
evidence.invariant	minted - burned <= deposited - refunded (per tx, per token)
shield.mode	under_attack
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-30 22:47:51

NEAR

R8B_UNBACKED_CREDIT_WITHDRAWNWithdrawal

873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e withdrew 5,078 usdt (nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g) from intents.near, 29h 45m after R8_DEPOSIT_LEDGER_MISMATCH credited it (tx 41Xh35y2ZpGNBzwcDzJDfF5NzJxPfM8dx2A25gzZAd52)

Dcv6DategD...MvNb

Click a field to copy its value.

timestamp	2026-09-30T22:47:51.534848Z
rule.id	R8B_UNBACKED_CREDIT_WITHDRAWN
rule.level	15
rule.severity	critical
rule.description	Account withdraws from intents.near after receiving an unbacked credit
rule.groups	near, verifier, ledger, withdrawal, taint
rule.tactic	Withdrawal
rule.weight	4.0
data.tx	Dcv6DategDyCmQ6tYUR15PwoampWV5pJGGnSEk9bMvNb
data.block	217977648
data.ts	2026-09-30T22:47:51.534848Z
data.chain	near
data.kind	withdrawal
data.amount	5078
data.symbol	usdt
data.from	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
evidence.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
evidence.hop	0
evidence.tainted_at	2026-09-29T17:02:34.146789Z
evidence.tainted_by_rule	R8_DEPOSIT_LEDGER_MISMATCH
evidence.tainted_by_tx	41Xh35y2ZpGNBzwcDzJDfF5NzJxPfM8dx2A25gzZAd52
evidence.tainted_on_chain	near
evidence.matched_field	from_addr
evidence.since_taint	1 day, 5:45:17.388059
matched[0]	contract=intents.near eq intents.near
matched[1]	kind=withdrawal eq withdrawal
matched[2]	status=success eq success
shield.mode	under_attack
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-30 22:51:19

NEAR

R8_DEPOSIT_LEDGER_MISMATCHLedger tampering

tx 8ehzw7rsNxXJLvfQLmmbmLagSNKfRE5V4vxcoPVCmx6g: intents.near kept a credit of 10,156 usdt that v2_1.omni.hot.tg refunded (2 token(s))

8ehzw7rsNx...mx6g

Click a field to copy its value.

timestamp	2026-09-30T22:51:19.750148Z
rule.id	R8_DEPOSIT_LEDGER_MISMATCH
rule.level	15
rule.severity	critical
rule.description	Verifier credited a deposit that the token contract refunded
rule.groups	near, verifier, ledger
rule.tactic	Ledger tampering
rule.weight	4.0
data.tx	8ehzw7rsNxXJLvfQLmmbmLagSNKfRE5V4vxcoPVCmx6g
data.block	217977991
data.ts	2026-09-30T22:51:19.750148Z
data.chain	near
data.kind	refund
data.amount	10156
data.symbol	usdt
data.from	intents.near
data.to	20e6bfe4685d99004fc2095d3a0fc6158cd810ce8f801196141e183ed6e19d65
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	20e6bfe4685d99004fc2095d3a0fc6158cd810ce8f801196141e183ed6e19d65
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
evidence.verifier	intents.near
evidence.token_contract	v2_1.omni.hot.tg
evidence.mismatched_tokens	2
evidence.mismatches	[{"token": "nep245:v2_1.omni.hot.tg:4444119_EnfNtEaQwr1AZTRgmH3dEhqGy1rqBWAU8gbAP1eKhErvrNk3cQQ7ConB8nnW9mhdHwm14Haihc5QwzhnJWLodt3ZVa3TY", "deposited_raw": "97", "minted_raw": "97", "burned_raw": "0", "refunded_raw": "97", "excess_credit_raw": "97"}, {"token": "nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g", "deposited_raw": "10156000000000000000000", "minted_raw": "10156000000000000000000", "burned_raw": "0", "refunded_raw": "10156000000000000000000", "excess_credit_raw": "10156000000000000000000", "symbol": "usdt"}]
evidence.headline_excess	10,156 usdt
evidence.credited_accounts	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
evidence.invariant	minted - burned <= deposited - refunded (per tx, per token)
shield.mode	under_attack
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-30 22:53:46

NEAR

R8B_UNBACKED_CREDIT_WITHDRAWNWithdrawal

873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e withdrew 10,156 usdt (nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g) from intents.near, 29h 51m after R8_DEPOSIT_LEDGER_MISMATCH credited it (tx 41Xh35y2ZpGNBzwcDzJDfF5NzJxPfM8dx2A25gzZAd52)

6z3oigyUV1...XTDX

Click a field to copy its value.

timestamp	2026-09-30T22:53:46.089850Z
rule.id	R8B_UNBACKED_CREDIT_WITHDRAWN
rule.level	15
rule.severity	critical
rule.description	Account withdraws from intents.near after receiving an unbacked credit
rule.groups	near, verifier, ledger, withdrawal, taint
rule.tactic	Withdrawal
rule.weight	4.0
data.tx	6z3oigyUV1YSQyY27exTGYYuQHfktaP3qL9peVU5XTDX
data.block	217978238
data.ts	2026-09-30T22:53:46.089850Z
data.chain	near
data.kind	withdrawal
data.amount	10156
data.symbol	usdt
data.from	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
evidence.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
evidence.hop	0
evidence.tainted_at	2026-09-29T17:02:34.146789Z
evidence.tainted_by_rule	R8_DEPOSIT_LEDGER_MISMATCH
evidence.tainted_by_tx	41Xh35y2ZpGNBzwcDzJDfF5NzJxPfM8dx2A25gzZAd52
evidence.tainted_on_chain	near
evidence.matched_field	from_addr
evidence.since_taint	1 day, 5:51:11.943061
matched[0]	contract=intents.near eq intents.near
matched[1]	kind=withdrawal eq withdrawal
matched[2]	status=success eq success
shield.mode	under_attack
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-30 22:59:59

NEAR

R8_DEPOSIT_LEDGER_MISMATCHLedger tampering

tx 8CteieSk8whDSERy5ceBx1L7LWMhaAx9eM7m6QUrmhYX: intents.near kept a credit of 20,312 usdt that v2_1.omni.hot.tg refunded (2 token(s))

8CteieSk8w...mhYX

Click a field to copy its value.

timestamp	2026-09-30T22:59:59.051113Z
rule.id	R8_DEPOSIT_LEDGER_MISMATCH
rule.level	15
rule.severity	critical
rule.description	Verifier credited a deposit that the token contract refunded
rule.groups	near, verifier, ledger
rule.tactic	Ledger tampering
rule.weight	4.0
data.tx	8CteieSk8whDSERy5ceBx1L7LWMhaAx9eM7m6QUrmhYX
data.block	217978867
data.ts	2026-09-30T22:59:59.051113Z
data.chain	near
data.kind	refund
data.amount	20312
data.symbol	usdt
data.from	intents.near
data.to	20e6bfe4685d99004fc2095d3a0fc6158cd810ce8f801196141e183ed6e19d65
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	20e6bfe4685d99004fc2095d3a0fc6158cd810ce8f801196141e183ed6e19d65
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
evidence.verifier	intents.near
evidence.token_contract	v2_1.omni.hot.tg
evidence.mismatched_tokens	2
evidence.mismatches	[{"token": "nep245:v2_1.omni.hot.tg:4444119_EnfNtEaQwr1AZTRgmH3dEhqGy1rqBWAU8gbAP1eKhErvrNk3cQQ7ConB8nnW9mhdHwm14Haihc5QwzhnJWLodt3ZVa3TY", "deposited_raw": "97", "minted_raw": "97", "burned_raw": "0", "refunded_raw": "97", "excess_credit_raw": "97"}, {"token": "nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g", "deposited_raw": "20312000000000000000000", "minted_raw": "20312000000000000000000", "burned_raw": "0", "refunded_raw": "20312000000000000000000", "excess_credit_raw": "20312000000000000000000", "symbol": "usdt"}]
evidence.headline_excess	20,312 usdt
evidence.credited_accounts	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
evidence.invariant	minted - burned <= deposited - refunded (per tx, per token)
shield.mode	under_attack
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-30 23:11:38

NEAR

R8B_UNBACKED_CREDIT_WITHDRAWNWithdrawal

873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e withdrew 20,312 usdt (nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g) from intents.near, 30h 9m after R8_DEPOSIT_LEDGER_MISMATCH credited it (tx 41Xh35y2ZpGNBzwcDzJDfF5NzJxPfM8dx2A25gzZAd52)

GppzthfzF1...d4sf

Click a field to copy its value.

timestamp	2026-09-30T23:11:38.867522Z
rule.id	R8B_UNBACKED_CREDIT_WITHDRAWN
rule.level	15
rule.severity	critical
rule.description	Account withdraws from intents.near after receiving an unbacked credit
rule.groups	near, verifier, ledger, withdrawal, taint
rule.tactic	Withdrawal
rule.weight	4.0
data.tx	GppzthfzF1iyyQmQrxMCcsrZMqN7W16vw2Pkjtnkd4sf
data.block	217980060
data.ts	2026-09-30T23:11:38.867522Z
data.chain	near
data.kind	withdrawal
data.amount	20312
data.symbol	usdt
data.from	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
evidence.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
evidence.hop	0
evidence.tainted_at	2026-09-29T17:02:34.146789Z
evidence.tainted_by_rule	R8_DEPOSIT_LEDGER_MISMATCH
evidence.tainted_by_tx	41Xh35y2ZpGNBzwcDzJDfF5NzJxPfM8dx2A25gzZAd52
evidence.tainted_on_chain	near
evidence.matched_field	from_addr
evidence.since_taint	1 day, 6:09:04.720733
matched[0]	contract=intents.near eq intents.near
matched[1]	kind=withdrawal eq withdrawal
matched[2]	status=success eq success
shield.mode	under_attack
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-30 23:16:01

NEAR

R8_DEPOSIT_LEDGER_MISMATCHLedger tampering

tx HWdeqqPagcdLcJaH7Lcc5mCnd1ZGp7rW2fHeRBNHC2hy: intents.near kept a credit of 40,624 usdt that v2_1.omni.hot.tg refunded (2 token(s))

HWdeqqPagc...C2hy

Click a field to copy its value.

timestamp	2026-09-30T23:16:01.624903Z
rule.id	R8_DEPOSIT_LEDGER_MISMATCH
rule.level	15
rule.severity	critical
rule.description	Verifier credited a deposit that the token contract refunded
rule.groups	near, verifier, ledger
rule.tactic	Ledger tampering
rule.weight	4.0
data.tx	HWdeqqPagcdLcJaH7Lcc5mCnd1ZGp7rW2fHeRBNHC2hy
data.block	217980510
data.ts	2026-09-30T23:16:01.624903Z
data.chain	near
data.kind	refund
data.amount	40624
data.symbol	usdt
data.from	intents.near
data.to	20e6bfe4685d99004fc2095d3a0fc6158cd810ce8f801196141e183ed6e19d65
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	20e6bfe4685d99004fc2095d3a0fc6158cd810ce8f801196141e183ed6e19d65
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
evidence.verifier	intents.near
evidence.token_contract	v2_1.omni.hot.tg
evidence.mismatched_tokens	2
evidence.mismatches	[{"token": "nep245:v2_1.omni.hot.tg:4444119_EnfNtEaQwr1AZTRgmH3dEhqGy1rqBWAU8gbAP1eKhErvrNk3cQQ7ConB8nnW9mhdHwm14Haihc5QwzhnJWLodt3ZVa3TY", "deposited_raw": "97", "minted_raw": "97", "burned_raw": "0", "refunded_raw": "97", "excess_credit_raw": "97"}, {"token": "nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g", "deposited_raw": "40624000000000000000000", "minted_raw": "40624000000000000000000", "burned_raw": "0", "refunded_raw": "40624000000000000000000", "excess_credit_raw": "40624000000000000000000", "symbol": "usdt"}]
evidence.headline_excess	40,624 usdt
evidence.credited_accounts	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
evidence.invariant	minted - burned <= deposited - refunded (per tx, per token)
shield.mode	under_attack
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-30 23:18:33

NEAR

R8B_UNBACKED_CREDIT_WITHDRAWNWithdrawal

873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e withdrew 40,624 usdt (nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g) from intents.near, 30h 15m after R8_DEPOSIT_LEDGER_MISMATCH credited it (tx 41Xh35y2ZpGNBzwcDzJDfF5NzJxPfM8dx2A25gzZAd52)

918cwzG6k6...sxtt

Click a field to copy its value.

timestamp	2026-09-30T23:18:33.004906Z
rule.id	R8B_UNBACKED_CREDIT_WITHDRAWN
rule.level	15
rule.severity	critical
rule.description	Account withdraws from intents.near after receiving an unbacked credit
rule.groups	near, verifier, ledger, withdrawal, taint
rule.tactic	Withdrawal
rule.weight	4.0
data.tx	918cwzG6k6CrrceWTZbbttFtGXtK6H5LCArYfTvcsxtt
data.block	217980769
data.ts	2026-09-30T23:18:33.004906Z
data.chain	near
data.kind	withdrawal
data.amount	40624
data.symbol	usdt
data.from	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
evidence.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
evidence.hop	0
evidence.tainted_at	2026-09-29T17:02:34.146789Z
evidence.tainted_by_rule	R8_DEPOSIT_LEDGER_MISMATCH
evidence.tainted_by_tx	41Xh35y2ZpGNBzwcDzJDfF5NzJxPfM8dx2A25gzZAd52
evidence.tainted_on_chain	near
evidence.matched_field	from_addr
evidence.since_taint	1 day, 6:15:58.858117
matched[0]	contract=intents.near eq intents.near
matched[1]	kind=withdrawal eq withdrawal
matched[2]	status=success eq success
shield.mode	under_attack
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-30 23:22:01

NEAR

R8_DEPOSIT_LEDGER_MISMATCHLedger tampering

tx 5UqKvRvRbAowDpQSS94YJs5YQPhjzHBodhBZA2UhRAQF: intents.near kept a credit of 81,248 usdt that v2_1.omni.hot.tg refunded (2 token(s))

5UqKvRvRbA...RAQF

Click a field to copy its value.

timestamp	2026-09-30T23:22:01.618068Z
rule.id	R8_DEPOSIT_LEDGER_MISMATCH
rule.level	15
rule.severity	critical
rule.description	Verifier credited a deposit that the token contract refunded
rule.groups	near, verifier, ledger
rule.tactic	Ledger tampering
rule.weight	4.0
data.tx	5UqKvRvRbAowDpQSS94YJs5YQPhjzHBodhBZA2UhRAQF
data.block	217981119
data.ts	2026-09-30T23:22:01.618068Z
data.chain	near
data.kind	refund
data.amount	81248
data.symbol	usdt
data.from	intents.near
data.to	20e6bfe4685d99004fc2095d3a0fc6158cd810ce8f801196141e183ed6e19d65
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	20e6bfe4685d99004fc2095d3a0fc6158cd810ce8f801196141e183ed6e19d65
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
evidence.verifier	intents.near
evidence.token_contract	v2_1.omni.hot.tg
evidence.mismatched_tokens	2
evidence.mismatches	[{"token": "nep245:v2_1.omni.hot.tg:4444119_EnfNtEaQwr1AZTRgmH3dEhqGy1rqBWAU8gbAP1eKhErvrNk3cQQ7ConB8nnW9mhdHwm14Haihc5QwzhnJWLodt3ZVa3TY", "deposited_raw": "97", "minted_raw": "97", "burned_raw": "0", "refunded_raw": "97", "excess_credit_raw": "97"}, {"token": "nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g", "deposited_raw": "81248000000000000000000", "minted_raw": "81248000000000000000000", "burned_raw": "0", "refunded_raw": "81248000000000000000000", "excess_credit_raw": "81248000000000000000000", "symbol": "usdt"}]
evidence.headline_excess	81,248 usdt
evidence.credited_accounts	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
evidence.invariant	minted - burned <= deposited - refunded (per tx, per token)
shield.mode	under_attack
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-30 23:24:38

NEAR

R8B_UNBACKED_CREDIT_WITHDRAWNWithdrawal

873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e withdrew 81,248 usdt (nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g) from intents.near, 30h 22m after R8_DEPOSIT_LEDGER_MISMATCH credited it (tx 41Xh35y2ZpGNBzwcDzJDfF5NzJxPfM8dx2A25gzZAd52)

FDTTHheF1b...suFS

Click a field to copy its value.

timestamp	2026-09-30T23:24:38.875584Z
rule.id	R8B_UNBACKED_CREDIT_WITHDRAWN
rule.level	15
rule.severity	critical
rule.description	Account withdraws from intents.near after receiving an unbacked credit
rule.groups	near, verifier, ledger, withdrawal, taint
rule.tactic	Withdrawal
rule.weight	4.0
data.tx	FDTTHheF1b48nzVdk33y2zEbPtnHqEY1zcLGL24qsuFS
data.block	217981388
data.ts	2026-09-30T23:24:38.875584Z
data.chain	near
data.kind	withdrawal
data.amount	81248
data.symbol	usdt
data.from	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
evidence.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
evidence.hop	0
evidence.tainted_at	2026-09-29T17:02:34.146789Z
evidence.tainted_by_rule	R8_DEPOSIT_LEDGER_MISMATCH
evidence.tainted_by_tx	41Xh35y2ZpGNBzwcDzJDfF5NzJxPfM8dx2A25gzZAd52
evidence.tainted_on_chain	near
evidence.matched_field	from_addr
evidence.since_taint	1 day, 6:22:04.728795
matched[0]	contract=intents.near eq intents.near
matched[1]	kind=withdrawal eq withdrawal
matched[2]	status=success eq success
shield.mode	under_attack
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-30 23:28:28

NEAR

R8_DEPOSIT_LEDGER_MISMATCHLedger tampering

tx 54KPopgLZUR3cG4RdJAxETEN8rMUFwJ8YfrUdAS2e4tH: intents.near kept a credit of 162,496 usdt that v2_1.omni.hot.tg refunded (2 token(s))

54KPopgLZU...e4tH

Click a field to copy its value.

timestamp	2026-09-30T23:28:28.917789Z
rule.id	R8_DEPOSIT_LEDGER_MISMATCH
rule.level	15
rule.severity	critical
rule.description	Verifier credited a deposit that the token contract refunded
rule.groups	near, verifier, ledger
rule.tactic	Ledger tampering
rule.weight	4.0
data.tx	54KPopgLZUR3cG4RdJAxETEN8rMUFwJ8YfrUdAS2e4tH
data.block	217981782
data.ts	2026-09-30T23:28:28.917789Z
data.chain	near
data.kind	refund
data.amount	162496
data.symbol	usdt
data.from	intents.near
data.to	20e6bfe4685d99004fc2095d3a0fc6158cd810ce8f801196141e183ed6e19d65
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	20e6bfe4685d99004fc2095d3a0fc6158cd810ce8f801196141e183ed6e19d65
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
evidence.verifier	intents.near
evidence.token_contract	v2_1.omni.hot.tg
evidence.mismatched_tokens	2
evidence.mismatches	[{"token": "nep245:v2_1.omni.hot.tg:4444119_EnfNtEaQwr1AZTRgmH3dEhqGy1rqBWAU8gbAP1eKhErvrNk3cQQ7ConB8nnW9mhdHwm14Haihc5QwzhnJWLodt3ZVa3TY", "deposited_raw": "97", "minted_raw": "97", "burned_raw": "0", "refunded_raw": "97", "excess_credit_raw": "97"}, {"token": "nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g", "deposited_raw": "162496000000000000000000", "minted_raw": "162496000000000000000000", "burned_raw": "0", "refunded_raw": "162496000000000000000000", "excess_credit_raw": "162496000000000000000000", "symbol": "usdt"}]
evidence.headline_excess	162,496 usdt
evidence.credited_accounts	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
evidence.invariant	minted - burned <= deposited - refunded (per tx, per token)
shield.mode	under_attack
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-30 23:31:06

NEAR

R8B_UNBACKED_CREDIT_WITHDRAWNWithdrawal

873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e withdrew 162,496 usdt (nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g) from intents.near, 30h 28m after R8_DEPOSIT_LEDGER_MISMATCH credited it (tx 41Xh35y2ZpGNBzwcDzJDfF5NzJxPfM8dx2A25gzZAd52)

4FNS8zEuaN...Q5pC

Click a field to copy its value.

timestamp	2026-09-30T23:31:06.881914Z
rule.id	R8B_UNBACKED_CREDIT_WITHDRAWN
rule.level	15
rule.severity	critical
rule.description	Account withdraws from intents.near after receiving an unbacked credit
rule.groups	near, verifier, ledger, withdrawal, taint
rule.tactic	Withdrawal
rule.weight	4.0
data.tx	4FNS8zEuaNqYYDsBWSfTXVFEDtRhsXY5FPQgL8p5Q5pC
data.block	217982045
data.ts	2026-09-30T23:31:06.881914Z
data.chain	near
data.kind	withdrawal
data.amount	162496
data.symbol	usdt
data.from	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
evidence.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
evidence.hop	0
evidence.tainted_at	2026-09-29T17:02:34.146789Z
evidence.tainted_by_rule	R8_DEPOSIT_LEDGER_MISMATCH
evidence.tainted_by_tx	41Xh35y2ZpGNBzwcDzJDfF5NzJxPfM8dx2A25gzZAd52
evidence.tainted_on_chain	near
evidence.matched_field	from_addr
evidence.since_taint	1 day, 6:28:32.735125
matched[0]	contract=intents.near eq intents.near
matched[1]	kind=withdrawal eq withdrawal
matched[2]	status=success eq success
shield.mode	under_attack
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-30 23:35:17

NEAR

R8_DEPOSIT_LEDGER_MISMATCHLedger tampering

tx 3pFTRxiJxr1eKvWx5aTC9qNkxRjjDLWbKF8RsLdxjveg: intents.near kept a credit of 324,992 usdt that v2_1.omni.hot.tg refunded (2 token(s))

3pFTRxiJxr...jveg

Click a field to copy its value.

timestamp	2026-09-30T23:35:17.683155Z
rule.id	R8_DEPOSIT_LEDGER_MISMATCH
rule.level	15
rule.severity	critical
rule.description	Verifier credited a deposit that the token contract refunded
rule.groups	near, verifier, ledger
rule.tactic	Ledger tampering
rule.weight	4.0
data.tx	3pFTRxiJxr1eKvWx5aTC9qNkxRjjDLWbKF8RsLdxjveg
data.block	217982469
data.ts	2026-09-30T23:35:17.683155Z
data.chain	near
data.kind	refund
data.amount	324992
data.symbol	usdt
data.from	intents.near
data.to	20e6bfe4685d99004fc2095d3a0fc6158cd810ce8f801196141e183ed6e19d65
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	20e6bfe4685d99004fc2095d3a0fc6158cd810ce8f801196141e183ed6e19d65
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
evidence.verifier	intents.near
evidence.token_contract	v2_1.omni.hot.tg
evidence.mismatched_tokens	2
evidence.mismatches	[{"token": "nep245:v2_1.omni.hot.tg:4444119_EnfNtEaQwr1AZTRgmH3dEhqGy1rqBWAU8gbAP1eKhErvrNk3cQQ7ConB8nnW9mhdHwm14Haihc5QwzhnJWLodt3ZVa3TY", "deposited_raw": "97", "minted_raw": "97", "burned_raw": "0", "refunded_raw": "97", "excess_credit_raw": "97"}, {"token": "nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g", "deposited_raw": "324992000000000000000000", "minted_raw": "324992000000000000000000", "burned_raw": "0", "refunded_raw": "324992000000000000000000", "excess_credit_raw": "324992000000000000000000", "symbol": "usdt"}]
evidence.headline_excess	324,992 usdt
evidence.credited_accounts	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
evidence.invariant	minted - burned <= deposited - refunded (per tx, per token)
shield.mode	under_attack
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-30 23:37:54

NEAR

R8B_UNBACKED_CREDIT_WITHDRAWNWithdrawal

873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e withdrew 324,992 usdt (nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g) from intents.near, 30h 35m after R8_DEPOSIT_LEDGER_MISMATCH credited it (tx 41Xh35y2ZpGNBzwcDzJDfF5NzJxPfM8dx2A25gzZAd52)

9PMKhUn8U8...Jgh8

Click a field to copy its value.

timestamp	2026-09-30T23:37:54.537486Z
rule.id	R8B_UNBACKED_CREDIT_WITHDRAWN
rule.level	15
rule.severity	critical
rule.description	Account withdraws from intents.near after receiving an unbacked credit
rule.groups	near, verifier, ledger, withdrawal, taint
rule.tactic	Withdrawal
rule.weight	4.0
data.tx	9PMKhUn8U8pvXnxrEBKdTiD5JoHA8qehwrm28FhsJgh8
data.block	217982731
data.ts	2026-09-30T23:37:54.537486Z
data.chain	near
data.kind	withdrawal
data.amount	324992
data.symbol	usdt
data.from	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
evidence.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
evidence.hop	0
evidence.tainted_at	2026-09-29T17:02:34.146789Z
evidence.tainted_by_rule	R8_DEPOSIT_LEDGER_MISMATCH
evidence.tainted_by_tx	41Xh35y2ZpGNBzwcDzJDfF5NzJxPfM8dx2A25gzZAd52
evidence.tainted_on_chain	near
evidence.matched_field	from_addr
evidence.since_taint	1 day, 6:35:20.390697
matched[0]	contract=intents.near eq intents.near
matched[1]	kind=withdrawal eq withdrawal
matched[2]	status=success eq success
shield.mode	under_attack
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-30 23:41:28

NEAR

R8_DEPOSIT_LEDGER_MISMATCHLedger tampering

tx 3mst2uZ32KPuCs7wc8rJqEtCrZqugCy4yDSZ3df8KPm3: intents.near kept a credit of 649,984 usdt that v2_1.omni.hot.tg refunded (2 token(s))

3mst2uZ32K...KPm3

Click a field to copy its value.

timestamp	2026-09-30T23:41:28.959504Z
rule.id	R8_DEPOSIT_LEDGER_MISMATCH
rule.level	15
rule.severity	critical
rule.description	Verifier credited a deposit that the token contract refunded
rule.groups	near, verifier, ledger
rule.tactic	Ledger tampering
rule.weight	4.0
data.tx	3mst2uZ32KPuCs7wc8rJqEtCrZqugCy4yDSZ3df8KPm3
data.block	217983091
data.ts	2026-09-30T23:41:28.959504Z
data.chain	near
data.kind	refund
data.amount	649984
data.symbol	usdt
data.from	intents.near
data.to	20e6bfe4685d99004fc2095d3a0fc6158cd810ce8f801196141e183ed6e19d65
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	20e6bfe4685d99004fc2095d3a0fc6158cd810ce8f801196141e183ed6e19d65
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
evidence.verifier	intents.near
evidence.token_contract	v2_1.omni.hot.tg
evidence.mismatched_tokens	2
evidence.mismatches	[{"token": "nep245:v2_1.omni.hot.tg:4444119_EnfNtEaQwr1AZTRgmH3dEhqGy1rqBWAU8gbAP1eKhErvrNk3cQQ7ConB8nnW9mhdHwm14Haihc5QwzhnJWLodt3ZVa3TY", "deposited_raw": "97", "minted_raw": "97", "burned_raw": "0", "refunded_raw": "97", "excess_credit_raw": "97"}, {"token": "nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g", "deposited_raw": "649984000000000000000000", "minted_raw": "649984000000000000000000", "burned_raw": "0", "refunded_raw": "649984000000000000000000", "excess_credit_raw": "649984000000000000000000", "symbol": "usdt"}]
evidence.headline_excess	649,984 usdt
evidence.credited_accounts	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
evidence.invariant	minted - burned <= deposited - refunded (per tx, per token)
shield.mode	under_attack
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-30 23:44:08

NEAR

R8B_UNBACKED_CREDIT_WITHDRAWNWithdrawal

873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e withdrew 649,984 usdt (nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g) from intents.near, 30h 41m after R8_DEPOSIT_LEDGER_MISMATCH credited it (tx 41Xh35y2ZpGNBzwcDzJDfF5NzJxPfM8dx2A25gzZAd52)

DEy5njwRaU...ub3T

Click a field to copy its value.

timestamp	2026-09-30T23:44:08.382602Z
rule.id	R8B_UNBACKED_CREDIT_WITHDRAWN
rule.level	15
rule.severity	critical
rule.description	Account withdraws from intents.near after receiving an unbacked credit
rule.groups	near, verifier, ledger, withdrawal, taint
rule.tactic	Withdrawal
rule.weight	4.0
data.tx	DEy5njwRaUYSyC7X5pnPWBhuiWUjJN4ZjrrJjzE3ub3T
data.block	217983358
data.ts	2026-09-30T23:44:08.382602Z
data.chain	near
data.kind	withdrawal
data.amount	649984
data.symbol	usdt
data.from	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
evidence.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
evidence.hop	0
evidence.tainted_at	2026-09-29T17:02:34.146789Z
evidence.tainted_by_rule	R8_DEPOSIT_LEDGER_MISMATCH
evidence.tainted_by_tx	41Xh35y2ZpGNBzwcDzJDfF5NzJxPfM8dx2A25gzZAd52
evidence.tainted_on_chain	near
evidence.matched_field	from_addr
evidence.since_taint	1 day, 6:41:34.235813
matched[0]	contract=intents.near eq intents.near
matched[1]	kind=withdrawal eq withdrawal
matched[2]	status=success eq success
shield.mode	under_attack
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-10-01 00:07:03

NEAR

R8_DEPOSIT_LEDGER_MISMATCHLedger tampering

tx GU5NC7V89yqAGjqRGS9QrUPFcRg9kPr4A3aEuNrn8jpP: intents.near kept a credit of 499,968 usdt that v2_1.omni.hot.tg refunded (2 token(s))

GU5NC7V89y...8jpP

Click a field to copy its value.

timestamp	2026-10-01T00:07:03.060291Z
rule.id	R8_DEPOSIT_LEDGER_MISMATCH
rule.level	15
rule.severity	critical
rule.description	Verifier credited a deposit that the token contract refunded
rule.groups	near, verifier, ledger
rule.tactic	Ledger tampering
rule.weight	4.0
data.tx	GU5NC7V89yqAGjqRGS9QrUPFcRg9kPr4A3aEuNrn8jpP
data.block	217985692
data.ts	2026-10-01T00:07:03.060291Z
data.chain	near
data.kind	refund
data.amount	499968
data.symbol	usdt
data.from	intents.near
data.to	20e6bfe4685d99004fc2095d3a0fc6158cd810ce8f801196141e183ed6e19d65
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	20e6bfe4685d99004fc2095d3a0fc6158cd810ce8f801196141e183ed6e19d65
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
evidence.verifier	intents.near
evidence.token_contract	v2_1.omni.hot.tg
evidence.mismatched_tokens	2
evidence.mismatches	[{"token": "nep245:v2_1.omni.hot.tg:4444119_EnfNtEaQwr1AZTRgmH3dEhqGy1rqBWAU8gbAP1eKhErvrNk3cQQ7ConB8nnW9mhdHwm14Haihc5QwzhnJWLodt3ZVa3TY", "deposited_raw": "97", "minted_raw": "97", "burned_raw": "0", "refunded_raw": "97", "excess_credit_raw": "97"}, {"token": "nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g", "deposited_raw": "499968000000000000000000", "minted_raw": "499968000000000000000000", "burned_raw": "0", "refunded_raw": "499968000000000000000000", "excess_credit_raw": "499968000000000000000000", "symbol": "usdt"}]
evidence.headline_excess	499,968 usdt
evidence.credited_accounts	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
evidence.invariant	minted - burned <= deposited - refunded (per tx, per token)
shield.mode	under_attack
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-10-01 00:09:19

NEAR

R8B_UNBACKED_CREDIT_WITHDRAWNWithdrawal

873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e withdrew 499,968 usdt (nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g) from intents.near, 31h 6m after R8_DEPOSIT_LEDGER_MISMATCH credited it (tx 41Xh35y2ZpGNBzwcDzJDfF5NzJxPfM8dx2A25gzZAd52)

Cjsnx1re3D...sEnd

Click a field to copy its value.

timestamp	2026-10-01T00:09:19.957139Z
rule.id	R8B_UNBACKED_CREDIT_WITHDRAWN
rule.level	15
rule.severity	critical
rule.description	Account withdraws from intents.near after receiving an unbacked credit
rule.groups	near, verifier, ledger, withdrawal, taint
rule.tactic	Withdrawal
rule.weight	4.0
data.tx	Cjsnx1re3DEES4GBvsiSS7V4fvQGmgh5S7t46n4DsEnd
data.block	217985927
data.ts	2026-10-01T00:09:19.957139Z
data.chain	near
data.kind	withdrawal
data.amount	499968
data.symbol	usdt
data.from	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
evidence.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
evidence.hop	0
evidence.tainted_at	2026-09-29T17:02:34.146789Z
evidence.tainted_by_rule	R8_DEPOSIT_LEDGER_MISMATCH
evidence.tainted_by_tx	41Xh35y2ZpGNBzwcDzJDfF5NzJxPfM8dx2A25gzZAd52
evidence.tainted_on_chain	near
evidence.matched_field	from_addr
evidence.since_taint	1 day, 7:06:45.810350
matched[0]	contract=intents.near eq intents.near
matched[1]	kind=withdrawal eq withdrawal
matched[2]	status=success eq success
shield.mode	under_attack
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-10-01 00:12:39

NEAR

R8_DEPOSIT_LEDGER_MISMATCHLedger tampering

tx 6Rgww9eZ5AhwkTLDvfyBNFUBJCec97ExR4Wa8aW4U1ic: intents.near kept a credit of 999,936 usdt that v2_1.omni.hot.tg refunded (2 token(s))

6Rgww9eZ5A...U1ic

Click a field to copy its value.

timestamp	2026-10-01T00:12:39.827235Z
rule.id	R8_DEPOSIT_LEDGER_MISMATCH
rule.level	15
rule.severity	critical
rule.description	Verifier credited a deposit that the token contract refunded
rule.groups	near, verifier, ledger
rule.tactic	Ledger tampering
rule.weight	4.0
data.tx	6Rgww9eZ5AhwkTLDvfyBNFUBJCec97ExR4Wa8aW4U1ic
data.block	217986270
data.ts	2026-10-01T00:12:39.827235Z
data.chain	near
data.kind	refund
data.amount	999936
data.symbol	usdt
data.from	intents.near
data.to	20e6bfe4685d99004fc2095d3a0fc6158cd810ce8f801196141e183ed6e19d65
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	20e6bfe4685d99004fc2095d3a0fc6158cd810ce8f801196141e183ed6e19d65
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
evidence.verifier	intents.near
evidence.token_contract	v2_1.omni.hot.tg
evidence.mismatched_tokens	2
evidence.mismatches	[{"token": "nep245:v2_1.omni.hot.tg:4444119_EnfNtEaQwr1AZTRgmH3dEhqGy1rqBWAU8gbAP1eKhErvrNk3cQQ7ConB8nnW9mhdHwm14Haihc5QwzhnJWLodt3ZVa3TY", "deposited_raw": "97", "minted_raw": "97", "burned_raw": "0", "refunded_raw": "97", "excess_credit_raw": "97"}, {"token": "nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g", "deposited_raw": "999936000000000000000000", "minted_raw": "999936000000000000000000", "burned_raw": "0", "refunded_raw": "999936000000000000000000", "excess_credit_raw": "999936000000000000000000", "symbol": "usdt"}]
evidence.headline_excess	999,936 usdt
evidence.credited_accounts	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
evidence.invariant	minted - burned <= deposited - refunded (per tx, per token)
shield.mode	under_attack
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-10-01 00:15:09

NEAR

R8B_UNBACKED_CREDIT_WITHDRAWNWithdrawal

873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e withdrew 999,936 usdt (nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g) from intents.near, 31h 12m after R8_DEPOSIT_LEDGER_MISMATCH credited it (tx 41Xh35y2ZpGNBzwcDzJDfF5NzJxPfM8dx2A25gzZAd52)

EjKTER1fan...ksK7

Click a field to copy its value.

timestamp	2026-10-01T00:15:09.382079Z
rule.id	R8B_UNBACKED_CREDIT_WITHDRAWN
rule.level	15
rule.severity	critical
rule.description	Account withdraws from intents.near after receiving an unbacked credit
rule.groups	near, verifier, ledger, withdrawal, taint
rule.tactic	Withdrawal
rule.weight	4.0
data.tx	EjKTER1fanv6U6LgLe59VgbWqLQbuyuQWhgephP5ksK7
data.block	217986524
data.ts	2026-10-01T00:15:09.382079Z
data.chain	near
data.kind	withdrawal
data.amount	999936
data.symbol	usdt
data.from	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
evidence.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
evidence.hop	0
evidence.tainted_at	2026-09-29T17:02:34.146789Z
evidence.tainted_by_rule	R8_DEPOSIT_LEDGER_MISMATCH
evidence.tainted_by_tx	41Xh35y2ZpGNBzwcDzJDfF5NzJxPfM8dx2A25gzZAd52
evidence.tainted_on_chain	near
evidence.matched_field	from_addr
evidence.since_taint	1 day, 7:12:35.235290
matched[0]	contract=intents.near eq intents.near
matched[1]	kind=withdrawal eq withdrawal
matched[2]	status=success eq success
shield.mode	under_attack
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-10-01 00:35:50

NEAR

R8_DEPOSIT_LEDGER_MISMATCHLedger tampering

tx GdCwdzdNkfP6LAnnym5Vgam4YYNM7XWgteRNAKNA2ViL: intents.near kept a credit of 799,872 usdt that v2_1.omni.hot.tg refunded (2 token(s))

GdCwdzdNkf...2ViL

Click a field to copy its value.

timestamp	2026-10-01T00:35:50.888245Z
rule.id	R8_DEPOSIT_LEDGER_MISMATCH
rule.level	15
rule.severity	critical
rule.description	Verifier credited a deposit that the token contract refunded
rule.groups	near, verifier, ledger
rule.tactic	Ledger tampering
rule.weight	4.0
data.tx	GdCwdzdNkfP6LAnnym5Vgam4YYNM7XWgteRNAKNA2ViL
data.block	217988641
data.ts	2026-10-01T00:35:50.888245Z
data.chain	near
data.kind	refund
data.amount	799872
data.symbol	usdt
data.from	intents.near
data.to	20e6bfe4685d99004fc2095d3a0fc6158cd810ce8f801196141e183ed6e19d65
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	20e6bfe4685d99004fc2095d3a0fc6158cd810ce8f801196141e183ed6e19d65
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
evidence.verifier	intents.near
evidence.token_contract	v2_1.omni.hot.tg
evidence.mismatched_tokens	2
evidence.mismatches	[{"token": "nep245:v2_1.omni.hot.tg:4444119_EnfNtEaQwr1AZTRgmH3dEhqGy1rqBWAU8gbAP1eKhErvrNk3cQQ7ConB8nnW9mhdHwm14Haihc5QwzhnJWLodt3ZVa3TY", "deposited_raw": "97", "minted_raw": "97", "burned_raw": "0", "refunded_raw": "97", "excess_credit_raw": "97"}, {"token": "nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g", "deposited_raw": "799872000000000000000000", "minted_raw": "799872000000000000000000", "burned_raw": "0", "refunded_raw": "799872000000000000000000", "excess_credit_raw": "799872000000000000000000", "symbol": "usdt"}]
evidence.headline_excess	799,872 usdt
evidence.credited_accounts	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
evidence.invariant	minted - burned <= deposited - refunded (per tx, per token)
shield.mode	under_attack
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-10-01 00:41:35

NEAR

R8B_UNBACKED_CREDIT_WITHDRAWNWithdrawal

873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e withdrew 799,872 usdt (nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g) from intents.near, 31h 39m after R8_DEPOSIT_LEDGER_MISMATCH credited it (tx 41Xh35y2ZpGNBzwcDzJDfF5NzJxPfM8dx2A25gzZAd52)

AbVeLUkZhd...gVWq

Click a field to copy its value.

timestamp	2026-10-01T00:41:35.442770Z
rule.id	R8B_UNBACKED_CREDIT_WITHDRAWN
rule.level	15
rule.severity	critical
rule.description	Account withdraws from intents.near after receiving an unbacked credit
rule.groups	near, verifier, ledger, withdrawal, taint
rule.tactic	Withdrawal
rule.weight	4.0
data.tx	AbVeLUkZhdhbzbkyqTaiyLmNRhHFbjHsxmXry1tCgVWq
data.block	217989236
data.ts	2026-10-01T00:41:35.442770Z
data.chain	near
data.kind	withdrawal
data.amount	799872
data.symbol	usdt
data.from	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
evidence.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
evidence.hop	0
evidence.tainted_at	2026-09-29T17:02:34.146789Z
evidence.tainted_by_rule	R8_DEPOSIT_LEDGER_MISMATCH
evidence.tainted_by_tx	41Xh35y2ZpGNBzwcDzJDfF5NzJxPfM8dx2A25gzZAd52
evidence.tainted_on_chain	near
evidence.matched_field	from_addr
evidence.since_taint	1 day, 7:39:01.295981
matched[0]	contract=intents.near eq intents.near
matched[1]	kind=withdrawal eq withdrawal
matched[2]	status=success eq success
shield.mode	under_attack
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-10-01 01:22:47

NEAR

R8_DEPOSIT_LEDGER_MISMATCHLedger tampering

tx bMdkzhZf7tQZbXNnXcAnuJaLyTxaCq8W9BnTh28EaDr: intents.near kept a credit of 99,744 usdt that v2_1.omni.hot.tg refunded (2 token(s))

bMdkzhZf7t...EaDr

Click a field to copy its value.

timestamp	2026-10-01T01:22:47.637206Z
rule.id	R8_DEPOSIT_LEDGER_MISMATCH
rule.level	15
rule.severity	critical
rule.description	Verifier credited a deposit that the token contract refunded
rule.groups	near, verifier, ledger
rule.tactic	Ledger tampering
rule.weight	4.0
data.tx	bMdkzhZf7tQZbXNnXcAnuJaLyTxaCq8W9BnTh28EaDr
data.block	217993458
data.ts	2026-10-01T01:22:47.637206Z
data.chain	near
data.kind	refund
data.amount	99744
data.symbol	usdt
data.from	intents.near
data.to	20e6bfe4685d99004fc2095d3a0fc6158cd810ce8f801196141e183ed6e19d65
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	20e6bfe4685d99004fc2095d3a0fc6158cd810ce8f801196141e183ed6e19d65
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
evidence.verifier	intents.near
evidence.token_contract	v2_1.omni.hot.tg
evidence.mismatched_tokens	2
evidence.mismatches	[{"token": "nep245:v2_1.omni.hot.tg:4444119_EnfNtEaQwr1AZTRgmH3dEhqGy1rqBWAU8gbAP1eKhErvrNk3cQQ7ConB8nnW9mhdHwm14Haihc5QwzhnJWLodt3ZVa3TY", "deposited_raw": "97", "minted_raw": "97", "burned_raw": "0", "refunded_raw": "97", "excess_credit_raw": "97"}, {"token": "nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g", "deposited_raw": "99744000000000000000000", "minted_raw": "99744000000000000000000", "burned_raw": "0", "refunded_raw": "99744000000000000000000", "excess_credit_raw": "99744000000000000000000", "symbol": "usdt"}]
evidence.headline_excess	99,744 usdt
evidence.credited_accounts	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
evidence.invariant	minted - burned <= deposited - refunded (per tx, per token)
shield.mode	under_attack
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-10-01 01:25:27

NEAR

R8B_UNBACKED_CREDIT_WITHDRAWNWithdrawal

873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e withdrew 99,744 usdt (nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g) from intents.near, 32h 22m after R8_DEPOSIT_LEDGER_MISMATCH credited it (tx 41Xh35y2ZpGNBzwcDzJDfF5NzJxPfM8dx2A25gzZAd52)

7rFoxyXGSM...NVti

Click a field to copy its value.

timestamp	2026-10-01T01:25:27.184488Z
rule.id	R8B_UNBACKED_CREDIT_WITHDRAWN
rule.level	15
rule.severity	critical
rule.description	Account withdraws from intents.near after receiving an unbacked credit
rule.groups	near, verifier, ledger, withdrawal, taint
rule.tactic	Withdrawal
rule.weight	4.0
data.tx	7rFoxyXGSMTgGCUhE3xwho26YJwpRAJg8BeMhz7KNVti
data.block	217993732
data.ts	2026-10-01T01:25:27.184488Z
data.chain	near
data.kind	withdrawal
data.amount	99744
data.symbol	usdt
data.from	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
evidence.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
evidence.hop	0
evidence.tainted_at	2026-09-29T17:02:34.146789Z
evidence.tainted_by_rule	R8_DEPOSIT_LEDGER_MISMATCH
evidence.tainted_by_tx	41Xh35y2ZpGNBzwcDzJDfF5NzJxPfM8dx2A25gzZAd52
evidence.tainted_on_chain	near
evidence.matched_field	from_addr
evidence.since_taint	1 day, 8:22:53.037699
matched[0]	contract=intents.near eq intents.near
matched[1]	kind=withdrawal eq withdrawal
matched[2]	status=success eq success
shield.mode	under_attack
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-10-01 01:29:28

NEAR

R8_DEPOSIT_LEDGER_MISMATCHLedger tampering

tx CWhtCr8ziTJJ4qbXGtZ3bBwzWtVa6rRAp7Q8ARgAfoDg: intents.near kept a credit of 149,296.65 usdt that v2_1.omni.hot.tg refunded (2 token(s))

CWhtCr8ziT...foDg

Click a field to copy its value.

timestamp	2026-10-01T01:29:28.189016Z
rule.id	R8_DEPOSIT_LEDGER_MISMATCH
rule.level	15
rule.severity	critical
rule.description	Verifier credited a deposit that the token contract refunded
rule.groups	near, verifier, ledger
rule.tactic	Ledger tampering
rule.weight	4.0
data.tx	CWhtCr8ziTJJ4qbXGtZ3bBwzWtVa6rRAp7Q8ARgAfoDg
data.block	217994145
data.ts	2026-10-01T01:29:28.189016Z
data.chain	near
data.kind	refund
data.amount	149296.651709224182698138
data.symbol	usdt
data.from	intents.near
data.to	20e6bfe4685d99004fc2095d3a0fc6158cd810ce8f801196141e183ed6e19d65
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	20e6bfe4685d99004fc2095d3a0fc6158cd810ce8f801196141e183ed6e19d65
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
evidence.verifier	intents.near
evidence.token_contract	v2_1.omni.hot.tg
evidence.mismatched_tokens	2
evidence.mismatches	[{"token": "nep245:v2_1.omni.hot.tg:4444119_EnfNtEaQwr1AZTRgmH3dEhqGy1rqBWAU8gbAP1eKhErvrNk3cQQ7ConB8nnW9mhdHwm14Haihc5QwzhnJWLodt3ZVa3TY", "deposited_raw": "97", "minted_raw": "97", "burned_raw": "0", "refunded_raw": "97", "excess_credit_raw": "97"}, {"token": "nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g", "deposited_raw": "149296651709224182698138", "minted_raw": "149296651709224182698138", "burned_raw": "0", "refunded_raw": "149296651709224182698138", "excess_credit_raw": "149296651709224182698138", "symbol": "usdt"}]
evidence.headline_excess	149,296.65 usdt
evidence.credited_accounts	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
evidence.invariant	minted - burned <= deposited - refunded (per tx, per token)
shield.mode	under_attack
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-10-01 01:32:35

NEAR

R8B_UNBACKED_CREDIT_WITHDRAWNWithdrawal

873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e withdrew 149,296.65 usdt (nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g) from intents.near, 32h 30m after R8_DEPOSIT_LEDGER_MISMATCH credited it (tx 41Xh35y2ZpGNBzwcDzJDfF5NzJxPfM8dx2A25gzZAd52)

Fn51iWKQtU...cEit

Click a field to copy its value.

timestamp	2026-10-01T01:32:35.870516Z
rule.id	R8B_UNBACKED_CREDIT_WITHDRAWN
rule.level	15
rule.severity	critical
rule.description	Account withdraws from intents.near after receiving an unbacked credit
rule.groups	near, verifier, ledger, withdrawal, taint
rule.tactic	Withdrawal
rule.weight	4.0
data.tx	Fn51iWKQtU41UWfYLECoYe9V2AkcN53p2DJS54uhcEit
data.block	217994457
data.ts	2026-10-01T01:32:35.870516Z
data.chain	near
data.kind	withdrawal
data.amount	149296.651709224182698138
data.symbol	usdt
data.from	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
evidence.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
evidence.hop	0
evidence.tainted_at	2026-09-29T17:02:34.146789Z
evidence.tainted_by_rule	R8_DEPOSIT_LEDGER_MISMATCH
evidence.tainted_by_tx	41Xh35y2ZpGNBzwcDzJDfF5NzJxPfM8dx2A25gzZAd52
evidence.tainted_on_chain	near
evidence.matched_field	from_addr
evidence.since_taint	1 day, 8:30:01.723727
matched[0]	contract=intents.near eq intents.near
matched[1]	kind=withdrawal eq withdrawal
matched[2]	status=success eq success
shield.mode	under_attack
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-10-01 05:47:30

NEAR

R8_DEPOSIT_LEDGER_MISMATCHLedger tampering

tx GAQKwHdTaLPyvvAMCGfmcyPcR8rptuXu1mCRwz7UCQEG: intents.near kept a credit of 18,080.08 usdt that v2_1.omni.hot.tg refunded (2 token(s))

GAQKwHdTaL...CQEG

Click a field to copy its value.

timestamp	2026-10-01T05:47:30.239711Z
rule.id	R8_DEPOSIT_LEDGER_MISMATCH
rule.level	15
rule.severity	critical
rule.description	Verifier credited a deposit that the token contract refunded
rule.groups	near, verifier, ledger
rule.tactic	Ledger tampering
rule.weight	4.0
data.tx	GAQKwHdTaLPyvvAMCGfmcyPcR8rptuXu1mCRwz7UCQEG
data.block	218020377
data.ts	2026-10-01T05:47:30.239711Z
data.chain	near
data.kind	refund
data.amount	18080.082660383136740355
data.symbol	usdt
data.from	intents.near
data.to	20e6bfe4685d99004fc2095d3a0fc6158cd810ce8f801196141e183ed6e19d65
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	20e6bfe4685d99004fc2095d3a0fc6158cd810ce8f801196141e183ed6e19d65
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
evidence.verifier	intents.near
evidence.token_contract	v2_1.omni.hot.tg
evidence.mismatched_tokens	2
evidence.mismatches	[{"token": "nep245:v2_1.omni.hot.tg:4444119_EnfNtEaQwr1AZTRgmH3dEhqGy1rqBWAU8gbAP1eKhErvrNk3cQQ7ConB8nnW9mhdHwm14Haihc5QwzhnJWLodt3ZVa3TY", "deposited_raw": "97", "minted_raw": "97", "burned_raw": "0", "refunded_raw": "97", "excess_credit_raw": "97"}, {"token": "nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g", "deposited_raw": "18080082660383136740355", "minted_raw": "18080082660383136740355", "burned_raw": "0", "refunded_raw": "18080082660383136740355", "excess_credit_raw": "18080082660383136740355", "symbol": "usdt"}]
evidence.headline_excess	18,080.08 usdt
evidence.credited_accounts	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
evidence.invariant	minted - burned <= deposited - refunded (per tx, per token)
shield.mode	under_attack
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-10-01 05:54:40

NEAR

R8B_UNBACKED_CREDIT_WITHDRAWNWithdrawal

873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e withdrew 18,080.08 usdt (nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g) from intents.near, 36h 52m after R8_DEPOSIT_LEDGER_MISMATCH credited it (tx 41Xh35y2ZpGNBzwcDzJDfF5NzJxPfM8dx2A25gzZAd52)

5d1VV4tyFh...3j3o

Click a field to copy its value.

timestamp	2026-10-01T05:54:40.283501Z
rule.id	R8B_UNBACKED_CREDIT_WITHDRAWN
rule.level	15
rule.severity	critical
rule.description	Account withdraws from intents.near after receiving an unbacked credit
rule.groups	near, verifier, ledger, withdrawal, taint
rule.tactic	Withdrawal
rule.weight	4.0
data.tx	5d1VV4tyFh3xWomy2tWJbG9qfLDaRdbksjedUZ3A3j3o
data.block	218021111
data.ts	2026-10-01T05:54:40.283501Z
data.chain	near
data.kind	withdrawal
data.amount	18080.082660383136740355
data.symbol	usdt
data.from	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
evidence.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
evidence.hop	0
evidence.tainted_at	2026-09-29T17:02:34.146789Z
evidence.tainted_by_rule	R8_DEPOSIT_LEDGER_MISMATCH
evidence.tainted_by_tx	41Xh35y2ZpGNBzwcDzJDfF5NzJxPfM8dx2A25gzZAd52
evidence.tainted_on_chain	near
evidence.matched_field	from_addr
evidence.since_taint	1 day, 12:52:06.136712
matched[0]	contract=intents.near eq intents.near
matched[1]	kind=withdrawal eq withdrawal
matched[2]	status=success eq success
shield.mode	under_attack
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-29 16:14:20

NEAR

R6_INTENTS_CALLBACK_ANOMALYLedger tampering

intents.near deposit (mt_on_transfer) in tx 3k91uDpUiezxUe7hBgAR7kc3TBkToMZKGAiv6GqbtKiC: contract=intents.near eq intents.near; extra.n_token_pairs=98 gt 32

3k91uDpUie...tKiC

Click a field to copy its value.

timestamp	2026-09-29T16:14:20.346572Z
rule.id	R6_INTENTS_CALLBACK_ANOMALY
rule.level	12
rule.severity	high
rule.description	Abnormal resolve callback or oversized event on intents.near
rule.groups	near, verifier, callback
rule.tactic	Ledger tampering
rule.weight	2.0
data.tx	3k91uDpUiezxUe7hBgAR7kc3TBkToMZKGAiv6GqbtKiC
data.block	217799503
data.ts	2026-09-29T16:14:20.346572Z
data.chain	near
data.kind	deposit
data.amount	10
data.symbol	usdt
data.to	dd1fe58ec316ada5b673b88c14fe2fa2b7ede82080440901dfbd64b994241757
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	dd1fe58ec316ada5b673b88c14fe2fa2b7ede82080440901dfbd64b994241757
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
matched[0]	contract=intents.near eq intents.near
matched[1]	extra.n_token_pairs=98 gt 32
shield.mode	paranoid
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-29 16:14:21

NEAR

R6_INTENTS_CALLBACK_ANOMALYLedger tampering

intents.near callback_failure (mt_resolve_deposit) in tx 3k91uDpUiezxUe7hBgAR7kc3TBkToMZKGAiv6GqbtKiC: contract=intents.near eq intents.near; kind=callback_failure eq callback_failure; extra.methods=<list len=1> regex resolve; extra.rejected_log_size=16495 gt 15000

3k91uDpUie...tKiC

Click a field to copy its value.

timestamp	2026-09-29T16:14:21.562861Z
rule.id	R6_INTENTS_CALLBACK_ANOMALY
rule.level	12
rule.severity	high
rule.description	Abnormal resolve callback or oversized event on intents.near
rule.groups	near, verifier, callback
rule.tactic	Ledger tampering
rule.weight	2.0
data.tx	3k91uDpUiezxUe7hBgAR7kc3TBkToMZKGAiv6GqbtKiC
data.block	217799505
data.ts	2026-09-29T16:14:21.562861Z
data.chain	near
data.kind	callback_failure
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
matched[0]	contract=intents.near eq intents.near
matched[1]	kind=callback_failure eq callback_failure
matched[2]	extra.methods=<list len=1> regex resolve
matched[3]	extra.rejected_log_size=16495 gt 15000
shield.mode	paranoid
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-29 17:02:32

NEAR

R6_INTENTS_CALLBACK_ANOMALYLedger tampering

intents.near deposit (mt_on_transfer) in tx 41Xh35y2ZpGNBzwcDzJDfF5NzJxPfM8dx2A25gzZAd52: contract=intents.near eq intents.near; extra.n_token_pairs=98 gt 32

41Xh35y2Zp...Ad52

Click a field to copy its value.

timestamp	2026-09-29T17:02:32.262974Z
rule.id	R6_INTENTS_CALLBACK_ANOMALY
rule.level	12
rule.severity	high
rule.description	Abnormal resolve callback or oversized event on intents.near
rule.groups	near, verifier, callback
rule.tactic	Ledger tampering
rule.weight	2.0
data.tx	41Xh35y2ZpGNBzwcDzJDfF5NzJxPfM8dx2A25gzZAd52
data.block	217804365
data.ts	2026-09-29T17:02:32.262974Z
data.chain	near
data.kind	deposit
data.amount	20
data.symbol	usdt
data.to	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
matched[0]	contract=intents.near eq intents.near
matched[1]	extra.n_token_pairs=98 gt 32
shield.mode	paranoid
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-29 17:02:33

NEAR

R6_INTENTS_CALLBACK_ANOMALYLedger tampering

intents.near callback_failure (mt_resolve_deposit) in tx 41Xh35y2ZpGNBzwcDzJDfF5NzJxPfM8dx2A25gzZAd52: contract=intents.near eq intents.near; kind=callback_failure eq callback_failure; extra.methods=<list len=1> regex resolve; extra.rejected_log_size=16495 gt 15000

41Xh35y2Zp...Ad52

Click a field to copy its value.

timestamp	2026-09-29T17:02:33.752140Z
rule.id	R6_INTENTS_CALLBACK_ANOMALY
rule.level	12
rule.severity	high
rule.description	Abnormal resolve callback or oversized event on intents.near
rule.groups	near, verifier, callback
rule.tactic	Ledger tampering
rule.weight	2.0
data.tx	41Xh35y2ZpGNBzwcDzJDfF5NzJxPfM8dx2A25gzZAd52
data.block	217804367
data.ts	2026-09-29T17:02:33.752140Z
data.chain	near
data.kind	callback_failure
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
matched[0]	contract=intents.near eq intents.near
matched[1]	kind=callback_failure eq callback_failure
matched[2]	extra.methods=<list len=1> regex resolve
matched[3]	extra.rejected_log_size=16495 gt 15000
shield.mode	paranoid
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-30 00:04:14

NEAR

R6_INTENTS_CALLBACK_ANOMALYLedger tampering

intents.near deposit (mt_on_transfer) in tx Hjtr43MGF1t3KRDx9hPcGkSo3CGLdnY46iQKzM5X7Nk2: contract=intents.near eq intents.near; extra.n_token_pairs=98 gt 32

Hjtr43MGF1...7Nk2

Click a field to copy its value.

timestamp	2026-09-30T00:04:14.433899Z
rule.id	R6_INTENTS_CALLBACK_ANOMALY
rule.level	12
rule.severity	high
rule.description	Abnormal resolve callback or oversized event on intents.near
rule.groups	near, verifier, callback
rule.tactic	Ledger tampering
rule.weight	2.0
data.tx	Hjtr43MGF1t3KRDx9hPcGkSo3CGLdnY46iQKzM5X7Nk2
data.block	217845832
data.ts	2026-09-30T00:04:14.433899Z
data.chain	near
data.kind	deposit
data.amount	40
data.symbol	usdt
data.to	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
matched[0]	contract=intents.near eq intents.near
matched[1]	extra.n_token_pairs=98 gt 32
shield.mode	paranoid
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-30 00:04:15

NEAR

R6_INTENTS_CALLBACK_ANOMALYLedger tampering

intents.near callback_failure (mt_resolve_deposit) in tx Hjtr43MGF1t3KRDx9hPcGkSo3CGLdnY46iQKzM5X7Nk2: contract=intents.near eq intents.near; kind=callback_failure eq callback_failure; extra.methods=<list len=1> regex resolve; extra.rejected_log_size=16495 gt 15000

Hjtr43MGF1...7Nk2

Click a field to copy its value.

timestamp	2026-09-30T00:04:15.422172Z
rule.id	R6_INTENTS_CALLBACK_ANOMALY
rule.level	12
rule.severity	high
rule.description	Abnormal resolve callback or oversized event on intents.near
rule.groups	near, verifier, callback
rule.tactic	Ledger tampering
rule.weight	2.0
data.tx	Hjtr43MGF1t3KRDx9hPcGkSo3CGLdnY46iQKzM5X7Nk2
data.block	217845834
data.ts	2026-09-30T00:04:15.422172Z
data.chain	near
data.kind	callback_failure
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
matched[0]	contract=intents.near eq intents.near
matched[1]	kind=callback_failure eq callback_failure
matched[2]	extra.methods=<list len=1> regex resolve
matched[3]	extra.rejected_log_size=16495 gt 15000
shield.mode	paranoid
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-30 00:10:30

NEAR

R6_INTENTS_CALLBACK_ANOMALYLedger tampering

intents.near deposit (mt_on_transfer) in tx AQcebAk5oayzLHjwFW7TSTVkv5xA1FTQ2pRYExCB5yAD: contract=intents.near eq intents.near; extra.n_token_pairs=98 gt 32

AQcebAk5oa...5yAD

Click a field to copy its value.

timestamp	2026-09-30T00:10:30.585479Z
rule.id	R6_INTENTS_CALLBACK_ANOMALY
rule.level	12
rule.severity	high
rule.description	Abnormal resolve callback or oversized event on intents.near
rule.groups	near, verifier, callback
rule.tactic	Ledger tampering
rule.weight	2.0
data.tx	AQcebAk5oayzLHjwFW7TSTVkv5xA1FTQ2pRYExCB5yAD
data.block	217846477
data.ts	2026-09-30T00:10:30.585479Z
data.chain	near
data.kind	deposit
data.amount	80
data.symbol	usdt
data.to	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
matched[0]	contract=intents.near eq intents.near
matched[1]	extra.n_token_pairs=98 gt 32
shield.mode	paranoid
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-30 00:10:31

NEAR

R6_INTENTS_CALLBACK_ANOMALYLedger tampering

intents.near callback_failure (mt_resolve_deposit) in tx AQcebAk5oayzLHjwFW7TSTVkv5xA1FTQ2pRYExCB5yAD: contract=intents.near eq intents.near; kind=callback_failure eq callback_failure; extra.methods=<list len=1> regex resolve; extra.rejected_log_size=16495 gt 15000

AQcebAk5oa...5yAD

Click a field to copy its value.

timestamp	2026-09-30T00:10:31.781623Z
rule.id	R6_INTENTS_CALLBACK_ANOMALY
rule.level	12
rule.severity	high
rule.description	Abnormal resolve callback or oversized event on intents.near
rule.groups	near, verifier, callback
rule.tactic	Ledger tampering
rule.weight	2.0
data.tx	AQcebAk5oayzLHjwFW7TSTVkv5xA1FTQ2pRYExCB5yAD
data.block	217846479
data.ts	2026-09-30T00:10:31.781623Z
data.chain	near
data.kind	callback_failure
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
matched[0]	contract=intents.near eq intents.near
matched[1]	kind=callback_failure eq callback_failure
matched[2]	extra.methods=<list len=1> regex resolve
matched[3]	extra.rejected_log_size=16495 gt 15000
shield.mode	paranoid
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-30 00:16:45

NEAR

R6_INTENTS_CALLBACK_ANOMALYLedger tampering

intents.near deposit (mt_on_transfer) in tx GE3bQobJVsiCHftwDhH7AMQAjDGRUAMenFVpnaYXF68B: contract=intents.near eq intents.near; extra.n_token_pairs=98 gt 32

GE3bQobJVs...F68B

Click a field to copy its value.

timestamp	2026-09-30T00:16:45.474899Z
rule.id	R6_INTENTS_CALLBACK_ANOMALY
rule.level	12
rule.severity	high
rule.description	Abnormal resolve callback or oversized event on intents.near
rule.groups	near, verifier, callback
rule.tactic	Ledger tampering
rule.weight	2.0
data.tx	GE3bQobJVsiCHftwDhH7AMQAjDGRUAMenFVpnaYXF68B
data.block	217847117
data.ts	2026-09-30T00:16:45.474899Z
data.chain	near
data.kind	deposit
data.amount	160
data.symbol	usdt
data.to	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
matched[0]	contract=intents.near eq intents.near
matched[1]	extra.n_token_pairs=98 gt 32
shield.mode	paranoid
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-30 00:16:47

NEAR

R6_INTENTS_CALLBACK_ANOMALYLedger tampering

intents.near callback_failure (mt_resolve_deposit) in tx GE3bQobJVsiCHftwDhH7AMQAjDGRUAMenFVpnaYXF68B: contract=intents.near eq intents.near; kind=callback_failure eq callback_failure; extra.methods=<list len=1> regex resolve; extra.rejected_log_size=16495 gt 15000

GE3bQobJVs...F68B

Click a field to copy its value.

timestamp	2026-09-30T00:16:47.061902Z
rule.id	R6_INTENTS_CALLBACK_ANOMALY
rule.level	12
rule.severity	high
rule.description	Abnormal resolve callback or oversized event on intents.near
rule.groups	near, verifier, callback
rule.tactic	Ledger tampering
rule.weight	2.0
data.tx	GE3bQobJVsiCHftwDhH7AMQAjDGRUAMenFVpnaYXF68B
data.block	217847119
data.ts	2026-09-30T00:16:47.061902Z
data.chain	near
data.kind	callback_failure
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
matched[0]	contract=intents.near eq intents.near
matched[1]	kind=callback_failure eq callback_failure
matched[2]	extra.methods=<list len=1> regex resolve
matched[3]	extra.rejected_log_size=16495 gt 15000
shield.mode	paranoid
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-30 00:26:09

NEAR

R6_INTENTS_CALLBACK_ANOMALYLedger tampering

intents.near deposit (mt_on_transfer) in tx Gai9wo8FFQRdLdS6DjqZf1NCPZDLkCB6dk3Fv2H6VdGX: contract=intents.near eq intents.near; extra.n_token_pairs=98 gt 32

Gai9wo8FFQ...VdGX

Click a field to copy its value.

timestamp	2026-09-30T00:26:09.383211Z
rule.id	R6_INTENTS_CALLBACK_ANOMALY
rule.level	12
rule.severity	high
rule.description	Abnormal resolve callback or oversized event on intents.near
rule.groups	near, verifier, callback
rule.tactic	Ledger tampering
rule.weight	2.0
data.tx	Gai9wo8FFQRdLdS6DjqZf1NCPZDLkCB6dk3Fv2H6VdGX
data.block	217848078
data.ts	2026-09-30T00:26:09.383211Z
data.chain	near
data.kind	deposit
data.amount	320
data.symbol	usdt
data.to	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
matched[0]	contract=intents.near eq intents.near
matched[1]	extra.n_token_pairs=98 gt 32
shield.mode	paranoid
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-30 00:26:10

NEAR

R6_INTENTS_CALLBACK_ANOMALYLedger tampering

intents.near callback_failure (mt_resolve_deposit) in tx Gai9wo8FFQRdLdS6DjqZf1NCPZDLkCB6dk3Fv2H6VdGX: contract=intents.near eq intents.near; kind=callback_failure eq callback_failure; extra.methods=<list len=1> regex resolve; extra.rejected_log_size=16495 gt 15000

Gai9wo8FFQ...VdGX

Click a field to copy its value.

timestamp	2026-09-30T00:26:10.272942Z
rule.id	R6_INTENTS_CALLBACK_ANOMALY
rule.level	12
rule.severity	high
rule.description	Abnormal resolve callback or oversized event on intents.near
rule.groups	near, verifier, callback
rule.tactic	Ledger tampering
rule.weight	2.0
data.tx	Gai9wo8FFQRdLdS6DjqZf1NCPZDLkCB6dk3Fv2H6VdGX
data.block	217848080
data.ts	2026-09-30T00:26:10.272942Z
data.chain	near
data.kind	callback_failure
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
matched[0]	contract=intents.near eq intents.near
matched[1]	kind=callback_failure eq callback_failure
matched[2]	extra.methods=<list len=1> regex resolve
matched[3]	extra.rejected_log_size=16495 gt 15000
shield.mode	paranoid
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-30 00:32:32

NEAR

R6_INTENTS_CALLBACK_ANOMALYLedger tampering

intents.near deposit (mt_on_transfer) in tx 7Ay6C2g5oK8HpkfvEbiez6BnSTrktvAytVmdUCL8fCKq: contract=intents.near eq intents.near; extra.n_token_pairs=98 gt 32

7Ay6C2g5oK...fCKq

Click a field to copy its value.

timestamp	2026-09-30T00:32:32.789238Z
rule.id	R6_INTENTS_CALLBACK_ANOMALY
rule.level	12
rule.severity	high
rule.description	Abnormal resolve callback or oversized event on intents.near
rule.groups	near, verifier, callback
rule.tactic	Ledger tampering
rule.weight	2.0
data.tx	7Ay6C2g5oK8HpkfvEbiez6BnSTrktvAytVmdUCL8fCKq
data.block	217848725
data.ts	2026-09-30T00:32:32.789238Z
data.chain	near
data.kind	deposit
data.amount	640
data.symbol	usdt
data.to	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
matched[0]	contract=intents.near eq intents.near
matched[1]	extra.n_token_pairs=98 gt 32
shield.mode	paranoid
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-30 00:32:34

NEAR

R6_INTENTS_CALLBACK_ANOMALYLedger tampering

intents.near callback_failure (mt_resolve_deposit) in tx 7Ay6C2g5oK8HpkfvEbiez6BnSTrktvAytVmdUCL8fCKq: contract=intents.near eq intents.near; kind=callback_failure eq callback_failure; extra.methods=<list len=1> regex resolve; extra.rejected_log_size=16495 gt 15000

7Ay6C2g5oK...fCKq

Click a field to copy its value.

timestamp	2026-09-30T00:32:34.102117Z
rule.id	R6_INTENTS_CALLBACK_ANOMALY
rule.level	12
rule.severity	high
rule.description	Abnormal resolve callback or oversized event on intents.near
rule.groups	near, verifier, callback
rule.tactic	Ledger tampering
rule.weight	2.0
data.tx	7Ay6C2g5oK8HpkfvEbiez6BnSTrktvAytVmdUCL8fCKq
data.block	217848727
data.ts	2026-09-30T00:32:34.102117Z
data.chain	near
data.kind	callback_failure
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
matched[0]	contract=intents.near eq intents.near
matched[1]	kind=callback_failure eq callback_failure
matched[2]	extra.methods=<list len=1> regex resolve
matched[3]	extra.rejected_log_size=16495 gt 15000
shield.mode	paranoid
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-30 00:38:34

NEAR

R6_INTENTS_CALLBACK_ANOMALYLedger tampering

intents.near deposit (mt_on_transfer) in tx 2GQ2zQzCzDefNf1czyJYQUwHAjcHYTYPYZicLbdLqVWb: contract=intents.near eq intents.near; extra.n_token_pairs=98 gt 32

2GQ2zQzCzD...qVWb

Click a field to copy its value.

timestamp	2026-09-30T00:38:34.057208Z
rule.id	R6_INTENTS_CALLBACK_ANOMALY
rule.level	12
rule.severity	high
rule.description	Abnormal resolve callback or oversized event on intents.near
rule.groups	near, verifier, callback
rule.tactic	Ledger tampering
rule.weight	2.0
data.tx	2GQ2zQzCzDefNf1czyJYQUwHAjcHYTYPYZicLbdLqVWb
data.block	217849336
data.ts	2026-09-30T00:38:34.057208Z
data.chain	near
data.kind	deposit
data.amount	1280
data.symbol	usdt
data.to	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
matched[0]	contract=intents.near eq intents.near
matched[1]	extra.n_token_pairs=98 gt 32
shield.mode	paranoid
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-30 00:38:35

NEAR

R6_INTENTS_CALLBACK_ANOMALYLedger tampering

intents.near callback_failure (mt_resolve_deposit) in tx 2GQ2zQzCzDefNf1czyJYQUwHAjcHYTYPYZicLbdLqVWb: contract=intents.near eq intents.near; kind=callback_failure eq callback_failure; extra.methods=<list len=1> regex resolve; extra.rejected_log_size=16495 gt 15000

2GQ2zQzCzD...qVWb

Click a field to copy its value.

timestamp	2026-09-30T00:38:35.307839Z
rule.id	R6_INTENTS_CALLBACK_ANOMALY
rule.level	12
rule.severity	high
rule.description	Abnormal resolve callback or oversized event on intents.near
rule.groups	near, verifier, callback
rule.tactic	Ledger tampering
rule.weight	2.0
data.tx	2GQ2zQzCzDefNf1czyJYQUwHAjcHYTYPYZicLbdLqVWb
data.block	217849338
data.ts	2026-09-30T00:38:35.307839Z
data.chain	near
data.kind	callback_failure
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
matched[0]	contract=intents.near eq intents.near
matched[1]	kind=callback_failure eq callback_failure
matched[2]	extra.methods=<list len=1> regex resolve
matched[3]	extra.rejected_log_size=16495 gt 15000
shield.mode	paranoid
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-30 18:57:07

BNB Chain

R9B_PAYOUT_FROM_FLAGGED_NEAR_ACCOUNTTreasury drain

10 usdt payout to 0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37 was burned on NEAR by 20e6bfe4685d99004fc2095d3a0fc6158cd810ce8f801196141e183ed6e19d65, flagged by R8_DEPOSIT_LEDGER_MISMATCH 26h 42m earlier exploit wallet (BscScan label: Near Intents Exploiter 1)

0x4f426e23...28d5

Click a field to copy its value.

timestamp	2026-09-30T18:57:07Z
rule.id	R9B_PAYOUT_FROM_FLAGGED_NEAR_ACCOUNT
rule.level	12
rule.severity	high
rule.description	Treasury payout authorized by a NEAR account that NEAR rules flagged
rule.groups	evm, treasury, payout, xchain
rule.tactic	Treasury drain
rule.weight	3.0
data.tx	0x4f426e23cda7ab58fd146f4f81489575563770c5d25b49d156870dc1dc1428d5
data.block	124960379
data.ts	2026-09-30T18:57:07Z
data.chain	bsc
data.kind	payout
data.amount	10
data.symbol	usdt
data.from	0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
data.tx_submitter	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
data.vault	hot_bridge
data.token	bsc:usdt
data.address	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
scope.address	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
evidence.nonce	1790783187000001814475
evidence.near_burn_tx	ApKLiZpY5LpyWFDLqV6yMWf5BqaQ8zaUN6dBxeAW8qSu
evidence.near_burn_ts	2026-09-30T15:46:27.918821Z
evidence.near_account	20e6bfe4685d99004fc2095d3a0fc6158cd810ce8f801196141e183ed6e19d65
evidence.near_account_hop	0
evidence.tainted_by_rule	R8_DEPOSIT_LEDGER_MISMATCH
evidence.tainted_by_tx	3k91uDpUiezxUe7hBgAR7kc3TBkToMZKGAiv6GqbtKiC
evidence.tainted_at	2026-09-29T16:14:22.056408Z
evidence.since_taint	1 day, 2:42:44.943592
evidence.token_matches	True
evidence.amount_matches	True
matched[0]	kind=payout eq payout
matched[1]	vault=hot_bridge eq hot_bridge
matched[2]	extra.withdraw_nonce=1790783187000001814475 exists True
shield.mode	paranoid
shield.capability	pause_destination
shield.scope	address

2026-09-30 20:05:24

BNB Chain

R9B_PAYOUT_FROM_FLAGGED_NEAR_ACCOUNTTreasury drain

11 usdt payout to 0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37 was burned on NEAR by 20e6bfe4685d99004fc2095d3a0fc6158cd810ce8f801196141e183ed6e19d65, flagged by R8_DEPOSIT_LEDGER_MISMATCH 27h 51m earlier exploit wallet (BscScan label: Near Intents Exploiter 1)

0xc002bd17...fdbf

Click a field to copy its value.

timestamp	2026-09-30T20:05:24Z
rule.id	R9B_PAYOUT_FROM_FLAGGED_NEAR_ACCOUNT
rule.level	12
rule.severity	high
rule.description	Treasury payout authorized by a NEAR account that NEAR rules flagged
rule.groups	evm, treasury, payout, xchain
rule.tactic	Treasury drain
rule.weight	3.0
data.tx	0xc002bd17fb1d46833088c4deb2e05949fc33bdbd9f95ff53295af0c8f68bfdbf
data.block	124969481
data.ts	2026-09-30T20:05:24Z
data.chain	bsc
data.kind	payout
data.amount	11
data.symbol	usdt
data.from	0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
data.tx_submitter	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
data.vault	hot_bridge
data.token	bsc:usdt
data.address	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
scope.address	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
evidence.nonce	1790795776000001815187
evidence.near_burn_tx	dybbrA1vLoYsoqwMKj6qevwXvvn3PaRAFYQ6rAKhi58
evidence.near_burn_ts	2026-09-30T19:16:16.731873Z
evidence.near_account	20e6bfe4685d99004fc2095d3a0fc6158cd810ce8f801196141e183ed6e19d65
evidence.near_account_hop	0
evidence.tainted_by_rule	R8_DEPOSIT_LEDGER_MISMATCH
evidence.tainted_by_tx	3k91uDpUiezxUe7hBgAR7kc3TBkToMZKGAiv6GqbtKiC
evidence.tainted_at	2026-09-29T16:14:22.056408Z
evidence.since_taint	1 day, 3:51:01.943592
evidence.token_matches	True
evidence.amount_matches	True
matched[0]	kind=payout eq payout
matched[1]	vault=hot_bridge eq hot_bridge
matched[2]	extra.withdraw_nonce=1790795776000001815187 exists True
shield.mode	paranoid
shield.capability	pause_destination
shield.scope	address

2026-09-30 20:15:31

NEAR

R6_INTENTS_CALLBACK_ANOMALYLedger tampering

intents.near deposit (mt_on_transfer) in tx B8qntq8eHyL7wgXcEjS1iPHDDnG86xpC1nqKH5FgRt3U: contract=intents.near eq intents.near; extra.n_token_pairs=98 gt 32

B8qntq8eHy...Rt3U

Click a field to copy its value.

timestamp	2026-09-30T20:15:31.436731Z
rule.id	R6_INTENTS_CALLBACK_ANOMALY
rule.level	12
rule.severity	high
rule.description	Abnormal resolve callback or oversized event on intents.near
rule.groups	near, verifier, callback
rule.tactic	Ledger tampering
rule.weight	2.0
data.tx	B8qntq8eHyL7wgXcEjS1iPHDDnG86xpC1nqKH5FgRt3U
data.block	217962134
data.ts	2026-09-30T20:15:31.436731Z
data.chain	near
data.kind	deposit
data.amount	2539
data.symbol	usdt
data.to	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
matched[0]	contract=intents.near eq intents.near
matched[1]	extra.n_token_pairs=98 gt 32
shield.mode	paranoid
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-30 20:15:32

NEAR

R6_INTENTS_CALLBACK_ANOMALYLedger tampering

intents.near callback_failure (mt_resolve_deposit) in tx B8qntq8eHyL7wgXcEjS1iPHDDnG86xpC1nqKH5FgRt3U: contract=intents.near eq intents.near; kind=callback_failure eq callback_failure; extra.methods=<list len=1> regex resolve; extra.rejected_log_size=16495 gt 15000

B8qntq8eHy...Rt3U

Click a field to copy its value.

timestamp	2026-09-30T20:15:32.641435Z
rule.id	R6_INTENTS_CALLBACK_ANOMALY
rule.level	12
rule.severity	high
rule.description	Abnormal resolve callback or oversized event on intents.near
rule.groups	near, verifier, callback
rule.tactic	Ledger tampering
rule.weight	2.0
data.tx	B8qntq8eHyL7wgXcEjS1iPHDDnG86xpC1nqKH5FgRt3U
data.block	217962136
data.ts	2026-09-30T20:15:32.641435Z
data.chain	near
data.kind	callback_failure
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
matched[0]	contract=intents.near eq intents.near
matched[1]	kind=callback_failure eq callback_failure
matched[2]	extra.methods=<list len=1> regex resolve
matched[3]	extra.rejected_log_size=16495 gt 15000
shield.mode	paranoid
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-30 22:45:07

NEAR

R6_INTENTS_CALLBACK_ANOMALYLedger tampering

intents.near deposit (mt_on_transfer) in tx GHM8RaBBrSWPmvoWZwewboYcYdQwkrQ3UMrFJqNjrGN3: contract=intents.near eq intents.near; extra.n_token_pairs=98 gt 32

GHM8RaBBrS...rGN3

Click a field to copy its value.

timestamp	2026-09-30T22:45:07.635694Z
rule.id	R6_INTENTS_CALLBACK_ANOMALY
rule.level	12
rule.severity	high
rule.description	Abnormal resolve callback or oversized event on intents.near
rule.groups	near, verifier, callback
rule.tactic	Ledger tampering
rule.weight	2.0
data.tx	GHM8RaBBrSWPmvoWZwewboYcYdQwkrQ3UMrFJqNjrGN3
data.block	217977368
data.ts	2026-09-30T22:45:07.635694Z
data.chain	near
data.kind	deposit
data.amount	5078
data.symbol	usdt
data.to	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
matched[0]	contract=intents.near eq intents.near
matched[1]	extra.n_token_pairs=98 gt 32
shield.mode	paranoid
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-30 22:45:08

NEAR

R6_INTENTS_CALLBACK_ANOMALYLedger tampering

intents.near callback_failure (mt_resolve_deposit) in tx GHM8RaBBrSWPmvoWZwewboYcYdQwkrQ3UMrFJqNjrGN3: contract=intents.near eq intents.near; kind=callback_failure eq callback_failure; extra.methods=<list len=1> regex resolve; extra.rejected_log_size=16495 gt 15000

GHM8RaBBrS...rGN3

Click a field to copy its value.

timestamp	2026-09-30T22:45:08.859185Z
rule.id	R6_INTENTS_CALLBACK_ANOMALY
rule.level	12
rule.severity	high
rule.description	Abnormal resolve callback or oversized event on intents.near
rule.groups	near, verifier, callback
rule.tactic	Ledger tampering
rule.weight	2.0
data.tx	GHM8RaBBrSWPmvoWZwewboYcYdQwkrQ3UMrFJqNjrGN3
data.block	217977370
data.ts	2026-09-30T22:45:08.859185Z
data.chain	near
data.kind	callback_failure
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
matched[0]	contract=intents.near eq intents.near
matched[1]	kind=callback_failure eq callback_failure
matched[2]	extra.methods=<list len=1> regex resolve
matched[3]	extra.rejected_log_size=16495 gt 15000
shield.mode	paranoid
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-30 22:51:18

NEAR

R6_INTENTS_CALLBACK_ANOMALYLedger tampering

intents.near deposit (mt_on_transfer) in tx 8ehzw7rsNxXJLvfQLmmbmLagSNKfRE5V4vxcoPVCmx6g: contract=intents.near eq intents.near; extra.n_token_pairs=98 gt 32

8ehzw7rsNx...mx6g

Click a field to copy its value.

timestamp	2026-09-30T22:51:18.085023Z
rule.id	R6_INTENTS_CALLBACK_ANOMALY
rule.level	12
rule.severity	high
rule.description	Abnormal resolve callback or oversized event on intents.near
rule.groups	near, verifier, callback
rule.tactic	Ledger tampering
rule.weight	2.0
data.tx	8ehzw7rsNxXJLvfQLmmbmLagSNKfRE5V4vxcoPVCmx6g
data.block	217977988
data.ts	2026-09-30T22:51:18.085023Z
data.chain	near
data.kind	deposit
data.amount	10156
data.symbol	usdt
data.to	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
matched[0]	contract=intents.near eq intents.near
matched[1]	extra.n_token_pairs=98 gt 32
shield.mode	paranoid
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-30 22:51:19

NEAR

R6_INTENTS_CALLBACK_ANOMALYLedger tampering

intents.near callback_failure (mt_resolve_deposit) in tx 8ehzw7rsNxXJLvfQLmmbmLagSNKfRE5V4vxcoPVCmx6g: contract=intents.near eq intents.near; kind=callback_failure eq callback_failure; extra.methods=<list len=1> regex resolve; extra.rejected_log_size=16495 gt 15000

8ehzw7rsNx...mx6g

Click a field to copy its value.

timestamp	2026-09-30T22:51:19.181039Z
rule.id	R6_INTENTS_CALLBACK_ANOMALY
rule.level	12
rule.severity	high
rule.description	Abnormal resolve callback or oversized event on intents.near
rule.groups	near, verifier, callback
rule.tactic	Ledger tampering
rule.weight	2.0
data.tx	8ehzw7rsNxXJLvfQLmmbmLagSNKfRE5V4vxcoPVCmx6g
data.block	217977990
data.ts	2026-09-30T22:51:19.181039Z
data.chain	near
data.kind	callback_failure
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
matched[0]	contract=intents.near eq intents.near
matched[1]	kind=callback_failure eq callback_failure
matched[2]	extra.methods=<list len=1> regex resolve
matched[3]	extra.rejected_log_size=16495 gt 15000
shield.mode	paranoid
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-30 22:59:57

NEAR

R6_INTENTS_CALLBACK_ANOMALYLedger tampering

intents.near deposit (mt_on_transfer) in tx 8CteieSk8whDSERy5ceBx1L7LWMhaAx9eM7m6QUrmhYX: contract=intents.near eq intents.near; extra.n_token_pairs=98 gt 32

8CteieSk8w...mhYX

Click a field to copy its value.

timestamp	2026-09-30T22:59:57.239758Z
rule.id	R6_INTENTS_CALLBACK_ANOMALY
rule.level	12
rule.severity	high
rule.description	Abnormal resolve callback or oversized event on intents.near
rule.groups	near, verifier, callback
rule.tactic	Ledger tampering
rule.weight	2.0
data.tx	8CteieSk8whDSERy5ceBx1L7LWMhaAx9eM7m6QUrmhYX
data.block	217978864
data.ts	2026-09-30T22:59:57.239758Z
data.chain	near
data.kind	deposit
data.amount	20312
data.symbol	usdt
data.to	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
matched[0]	contract=intents.near eq intents.near
matched[1]	extra.n_token_pairs=98 gt 32
shield.mode	paranoid
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-30 22:59:58

NEAR

R6_INTENTS_CALLBACK_ANOMALYLedger tampering

intents.near callback_failure (mt_resolve_deposit) in tx 8CteieSk8whDSERy5ceBx1L7LWMhaAx9eM7m6QUrmhYX: contract=intents.near eq intents.near; kind=callback_failure eq callback_failure; extra.methods=<list len=1> regex resolve; extra.rejected_log_size=16495 gt 15000

8CteieSk8w...mhYX

Click a field to copy its value.

timestamp	2026-09-30T22:59:58.369538Z
rule.id	R6_INTENTS_CALLBACK_ANOMALY
rule.level	12
rule.severity	high
rule.description	Abnormal resolve callback or oversized event on intents.near
rule.groups	near, verifier, callback
rule.tactic	Ledger tampering
rule.weight	2.0
data.tx	8CteieSk8whDSERy5ceBx1L7LWMhaAx9eM7m6QUrmhYX
data.block	217978866
data.ts	2026-09-30T22:59:58.369538Z
data.chain	near
data.kind	callback_failure
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
matched[0]	contract=intents.near eq intents.near
matched[1]	kind=callback_failure eq callback_failure
matched[2]	extra.methods=<list len=1> regex resolve
matched[3]	extra.rejected_log_size=16495 gt 15000
shield.mode	paranoid
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-30 23:15:59

NEAR

R6_INTENTS_CALLBACK_ANOMALYLedger tampering

intents.near deposit (mt_on_transfer) in tx HWdeqqPagcdLcJaH7Lcc5mCnd1ZGp7rW2fHeRBNHC2hy: contract=intents.near eq intents.near; extra.n_token_pairs=98 gt 32

HWdeqqPagc...C2hy

Click a field to copy its value.

timestamp	2026-09-30T23:15:59.742381Z
rule.id	R6_INTENTS_CALLBACK_ANOMALY
rule.level	12
rule.severity	high
rule.description	Abnormal resolve callback or oversized event on intents.near
rule.groups	near, verifier, callback
rule.tactic	Ledger tampering
rule.weight	2.0
data.tx	HWdeqqPagcdLcJaH7Lcc5mCnd1ZGp7rW2fHeRBNHC2hy
data.block	217980507
data.ts	2026-09-30T23:15:59.742381Z
data.chain	near
data.kind	deposit
data.amount	40624
data.symbol	usdt
data.to	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
matched[0]	contract=intents.near eq intents.near
matched[1]	extra.n_token_pairs=98 gt 32
shield.mode	paranoid
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-30 23:16:00

NEAR

R6_INTENTS_CALLBACK_ANOMALYLedger tampering

intents.near callback_failure (mt_resolve_deposit) in tx HWdeqqPagcdLcJaH7Lcc5mCnd1ZGp7rW2fHeRBNHC2hy: contract=intents.near eq intents.near; kind=callback_failure eq callback_failure; extra.methods=<list len=1> regex resolve; extra.rejected_log_size=16495 gt 15000

HWdeqqPagc...C2hy

Click a field to copy its value.

timestamp	2026-09-30T23:16:00.884890Z
rule.id	R6_INTENTS_CALLBACK_ANOMALY
rule.level	12
rule.severity	high
rule.description	Abnormal resolve callback or oversized event on intents.near
rule.groups	near, verifier, callback
rule.tactic	Ledger tampering
rule.weight	2.0
data.tx	HWdeqqPagcdLcJaH7Lcc5mCnd1ZGp7rW2fHeRBNHC2hy
data.block	217980509
data.ts	2026-09-30T23:16:00.884890Z
data.chain	near
data.kind	callback_failure
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
matched[0]	contract=intents.near eq intents.near
matched[1]	kind=callback_failure eq callback_failure
matched[2]	extra.methods=<list len=1> regex resolve
matched[3]	extra.rejected_log_size=16495 gt 15000
shield.mode	paranoid
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-30 23:21:59

NEAR

R6_INTENTS_CALLBACK_ANOMALYLedger tampering

intents.near deposit (mt_on_transfer) in tx 5UqKvRvRbAowDpQSS94YJs5YQPhjzHBodhBZA2UhRAQF: contract=intents.near eq intents.near; extra.n_token_pairs=98 gt 32

5UqKvRvRbA...RAQF

Click a field to copy its value.

timestamp	2026-09-30T23:21:59.615898Z
rule.id	R6_INTENTS_CALLBACK_ANOMALY
rule.level	12
rule.severity	high
rule.description	Abnormal resolve callback or oversized event on intents.near
rule.groups	near, verifier, callback
rule.tactic	Ledger tampering
rule.weight	2.0
data.tx	5UqKvRvRbAowDpQSS94YJs5YQPhjzHBodhBZA2UhRAQF
data.block	217981116
data.ts	2026-09-30T23:21:59.615898Z
data.chain	near
data.kind	deposit
data.amount	81248
data.symbol	usdt
data.to	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
matched[0]	contract=intents.near eq intents.near
matched[1]	extra.n_token_pairs=98 gt 32
shield.mode	paranoid
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-30 23:22:00

NEAR

R6_INTENTS_CALLBACK_ANOMALYLedger tampering

intents.near callback_failure (mt_resolve_deposit) in tx 5UqKvRvRbAowDpQSS94YJs5YQPhjzHBodhBZA2UhRAQF: contract=intents.near eq intents.near; kind=callback_failure eq callback_failure; extra.methods=<list len=1> regex resolve; extra.rejected_log_size=16495 gt 15000

5UqKvRvRbA...RAQF

Click a field to copy its value.

timestamp	2026-09-30T23:22:00.921139Z
rule.id	R6_INTENTS_CALLBACK_ANOMALY
rule.level	12
rule.severity	high
rule.description	Abnormal resolve callback or oversized event on intents.near
rule.groups	near, verifier, callback
rule.tactic	Ledger tampering
rule.weight	2.0
data.tx	5UqKvRvRbAowDpQSS94YJs5YQPhjzHBodhBZA2UhRAQF
data.block	217981118
data.ts	2026-09-30T23:22:00.921139Z
data.chain	near
data.kind	callback_failure
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
matched[0]	contract=intents.near eq intents.near
matched[1]	kind=callback_failure eq callback_failure
matched[2]	extra.methods=<list len=1> regex resolve
matched[3]	extra.rejected_log_size=16495 gt 15000
shield.mode	paranoid
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-30 23:28:26

NEAR

R6_INTENTS_CALLBACK_ANOMALYLedger tampering

intents.near deposit (mt_on_transfer) in tx 54KPopgLZUR3cG4RdJAxETEN8rMUFwJ8YfrUdAS2e4tH: contract=intents.near eq intents.near; extra.n_token_pairs=98 gt 32

54KPopgLZU...e4tH

Click a field to copy its value.

timestamp	2026-09-30T23:28:26.978012Z
rule.id	R6_INTENTS_CALLBACK_ANOMALY
rule.level	12
rule.severity	high
rule.description	Abnormal resolve callback or oversized event on intents.near
rule.groups	near, verifier, callback
rule.tactic	Ledger tampering
rule.weight	2.0
data.tx	54KPopgLZUR3cG4RdJAxETEN8rMUFwJ8YfrUdAS2e4tH
data.block	217981779
data.ts	2026-09-30T23:28:26.978012Z
data.chain	near
data.kind	deposit
data.amount	162496
data.symbol	usdt
data.to	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
matched[0]	contract=intents.near eq intents.near
matched[1]	extra.n_token_pairs=98 gt 32
shield.mode	paranoid
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-30 23:28:28

NEAR

R6_INTENTS_CALLBACK_ANOMALYLedger tampering

intents.near callback_failure (mt_resolve_deposit) in tx 54KPopgLZUR3cG4RdJAxETEN8rMUFwJ8YfrUdAS2e4tH: contract=intents.near eq intents.near; kind=callback_failure eq callback_failure; extra.methods=<list len=1> regex resolve; extra.rejected_log_size=16495 gt 15000

54KPopgLZU...e4tH

Click a field to copy its value.

timestamp	2026-09-30T23:28:28.277182Z
rule.id	R6_INTENTS_CALLBACK_ANOMALY
rule.level	12
rule.severity	high
rule.description	Abnormal resolve callback or oversized event on intents.near
rule.groups	near, verifier, callback
rule.tactic	Ledger tampering
rule.weight	2.0
data.tx	54KPopgLZUR3cG4RdJAxETEN8rMUFwJ8YfrUdAS2e4tH
data.block	217981781
data.ts	2026-09-30T23:28:28.277182Z
data.chain	near
data.kind	callback_failure
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
matched[0]	contract=intents.near eq intents.near
matched[1]	kind=callback_failure eq callback_failure
matched[2]	extra.methods=<list len=1> regex resolve
matched[3]	extra.rejected_log_size=16495 gt 15000
shield.mode	paranoid
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-30 23:35:15

NEAR

R6_INTENTS_CALLBACK_ANOMALYLedger tampering

intents.near deposit (mt_on_transfer) in tx 3pFTRxiJxr1eKvWx5aTC9qNkxRjjDLWbKF8RsLdxjveg: contract=intents.near eq intents.near; extra.n_token_pairs=98 gt 32

3pFTRxiJxr...jveg

Click a field to copy its value.

timestamp	2026-09-30T23:35:15.879165Z
rule.id	R6_INTENTS_CALLBACK_ANOMALY
rule.level	12
rule.severity	high
rule.description	Abnormal resolve callback or oversized event on intents.near
rule.groups	near, verifier, callback
rule.tactic	Ledger tampering
rule.weight	2.0
data.tx	3pFTRxiJxr1eKvWx5aTC9qNkxRjjDLWbKF8RsLdxjveg
data.block	217982466
data.ts	2026-09-30T23:35:15.879165Z
data.chain	near
data.kind	deposit
data.amount	324992
data.symbol	usdt
data.to	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
matched[0]	contract=intents.near eq intents.near
matched[1]	extra.n_token_pairs=98 gt 32
shield.mode	paranoid
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-30 23:35:17

NEAR

R6_INTENTS_CALLBACK_ANOMALYLedger tampering

intents.near callback_failure (mt_resolve_deposit) in tx 3pFTRxiJxr1eKvWx5aTC9qNkxRjjDLWbKF8RsLdxjveg: contract=intents.near eq intents.near; kind=callback_failure eq callback_failure; extra.methods=<list len=1> regex resolve; extra.rejected_log_size=16495 gt 15000

3pFTRxiJxr...jveg

Click a field to copy its value.

timestamp	2026-09-30T23:35:17.049892Z
rule.id	R6_INTENTS_CALLBACK_ANOMALY
rule.level	12
rule.severity	high
rule.description	Abnormal resolve callback or oversized event on intents.near
rule.groups	near, verifier, callback
rule.tactic	Ledger tampering
rule.weight	2.0
data.tx	3pFTRxiJxr1eKvWx5aTC9qNkxRjjDLWbKF8RsLdxjveg
data.block	217982468
data.ts	2026-09-30T23:35:17.049892Z
data.chain	near
data.kind	callback_failure
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
matched[0]	contract=intents.near eq intents.near
matched[1]	kind=callback_failure eq callback_failure
matched[2]	extra.methods=<list len=1> regex resolve
matched[3]	extra.rejected_log_size=16495 gt 15000
shield.mode	paranoid
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-30 23:41:27

NEAR

R6_INTENTS_CALLBACK_ANOMALYLedger tampering

intents.near deposit (mt_on_transfer) in tx 3mst2uZ32KPuCs7wc8rJqEtCrZqugCy4yDSZ3df8KPm3: contract=intents.near eq intents.near; extra.n_token_pairs=98 gt 32

3mst2uZ32K...KPm3

Click a field to copy its value.

timestamp	2026-09-30T23:41:27.233199Z
rule.id	R6_INTENTS_CALLBACK_ANOMALY
rule.level	12
rule.severity	high
rule.description	Abnormal resolve callback or oversized event on intents.near
rule.groups	near, verifier, callback
rule.tactic	Ledger tampering
rule.weight	2.0
data.tx	3mst2uZ32KPuCs7wc8rJqEtCrZqugCy4yDSZ3df8KPm3
data.block	217983088
data.ts	2026-09-30T23:41:27.233199Z
data.chain	near
data.kind	deposit
data.amount	649984
data.symbol	usdt
data.to	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
matched[0]	contract=intents.near eq intents.near
matched[1]	extra.n_token_pairs=98 gt 32
shield.mode	paranoid
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-30 23:41:28

NEAR

R6_INTENTS_CALLBACK_ANOMALYLedger tampering

intents.near callback_failure (mt_resolve_deposit) in tx 3mst2uZ32KPuCs7wc8rJqEtCrZqugCy4yDSZ3df8KPm3: contract=intents.near eq intents.near; kind=callback_failure eq callback_failure; extra.methods=<list len=1> regex resolve; extra.rejected_log_size=16495 gt 15000

3mst2uZ32K...KPm3

Click a field to copy its value.

timestamp	2026-09-30T23:41:28.395579Z
rule.id	R6_INTENTS_CALLBACK_ANOMALY
rule.level	12
rule.severity	high
rule.description	Abnormal resolve callback or oversized event on intents.near
rule.groups	near, verifier, callback
rule.tactic	Ledger tampering
rule.weight	2.0
data.tx	3mst2uZ32KPuCs7wc8rJqEtCrZqugCy4yDSZ3df8KPm3
data.block	217983090
data.ts	2026-09-30T23:41:28.395579Z
data.chain	near
data.kind	callback_failure
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
matched[0]	contract=intents.near eq intents.near
matched[1]	kind=callback_failure eq callback_failure
matched[2]	extra.methods=<list len=1> regex resolve
matched[3]	extra.rejected_log_size=16495 gt 15000
shield.mode	paranoid
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-30 23:54:30

BNB Chain

R1B_PAYOUT_SPIKE_TO_NEW_RECIPIENTTreasury drain

bsc hot_bridge paid 800,000 usdt to 0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37: 2.38x the 48h max of 336,749.37, recipient first seen 4h 57m ago exploit wallet (BscScan label: Near Intents Exploiter 1)

0x9fe58e03...6c4c

Click a field to copy its value.

timestamp	2026-09-30T23:54:30Z
rule.id	R1B_PAYOUT_SPIKE_TO_NEW_RECIPIENT
rule.level	12
rule.severity	high
rule.description	Treasury payout spike to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, spike, composite
rule.tactic	Treasury drain
rule.weight	3.0
data.tx	0x9fe58e031f73bbd880c782bc9e7446bcda32cadb304a729209871a4a81856c4c
data.block	125000023
data.ts	2026-09-30T23:54:30Z
data.chain	bsc
data.kind	payout
data.amount	800000
data.symbol	usdt
data.from	0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
data.tx_submitter	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
data.vault	hot_bridge
data.token	bsc:usdt
data.address	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
scope.address	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
evidence.value_field	amount_usd
evidence.value	800000
evidence.baseline_max	336749.365465541220672818
evidence.baseline_tx	0xbd6f7cc786d59a1b0f6cc2cc01e2b235c81bda44cbec12f2a6d56b2b1e2575df
evidence.baseline_ts	2026-09-30T13:36:11Z
evidence.baseline_window	48h
evidence.baseline_events	2034
evidence.ratio	2.38
evidence.factor	2.0
evidence.min_value	50000
evidence.address	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
evidence.first_seen	2026-09-30T18:57:07Z
evidence.first_seen_tx	0x4f426e23cda7ab58fd146f4f81489575563770c5d25b49d156870dc1dc1428d5
evidence.first_seen_kind	payout
evidence.age	4:57:23
evidence.max_age	7d
evidence.history_start	2026-09-01T00:00:14Z
evidence.parents	R1_VAULT_PAYOUT_SPIKE, R5_NEW_RECIPIENT_LARGE_PAYOUT
matched[0]	kind=payout eq payout
shield.mode	paranoid
shield.capability	raise_mode
shield.scope	chain, bridge, token, address

2026-09-30 23:54:30

BNB Chain

R3B_SELF_SUBMITTED_TEST_THEN_DRAINTreasury drain

0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37 got a test payout 4h 57m earlier, then submitted this 800,000 usdt payout itself exploit wallet (BscScan label: Near Intents Exploiter 1)

0x9fe58e03...6c4c

Click a field to copy its value.

timestamp	2026-09-30T23:54:30Z
rule.id	R3B_SELF_SUBMITTED_TEST_THEN_DRAIN
rule.level	12
rule.severity	high
rule.description	Test-then-drain payout that the recipient submitted itself
rule.groups	evm, treasury, payout, sequence, composite
rule.tactic	Treasury drain
rule.weight	2.0
data.tx	0x9fe58e031f73bbd880c782bc9e7446bcda32cadb304a729209871a4a81856c4c
data.block	125000023
data.ts	2026-09-30T23:54:30Z
data.chain	bsc
data.kind	payout
data.amount	800000
data.symbol	usdt
data.from	0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
data.tx_submitter	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
data.vault	hot_bridge
data.token	bsc:usdt
data.address	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
scope.address	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
evidence.group.to_addr	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
evidence.within	24h
evidence.steps	[{"step": "test_payout", "tx": "0x4f426e23cda7ab58fd146f4f81489575563770c5d25b49d156870dc1dc1428d5", "ts": "2026-09-30T18:57:07Z", "amount": "10"}, {"step": "large_payout", "tx": "0x9fe58e031f73bbd880c782bc9e7446bcda32cadb304a729209871a4a81856c4c", "ts": "2026-09-30T23:54:30Z", "amount": "800000"}]
evidence.first_step_age	4:57:23
evidence.prior_events	[{"step": "test_payout", "tx": "0x4f426e23cda7ab58fd146f4f81489575563770c5d25b49d156870dc1dc1428d5", "ts": "2026-09-30T18:57:07Z", "amount": "10"}]
evidence.parents	R3_TEST_THEN_DRAIN, R4_SELF_SUBMITTED_LARGE_PAYOUT
matched[0]	kind=payout eq payout
shield.mode	paranoid
shield.capability	raise_mode
shield.scope	chain, bridge, token, address

2026-09-30 23:54:30

BNB Chain

R9B_PAYOUT_FROM_FLAGGED_NEAR_ACCOUNTTreasury drain

800,000 usdt payout to 0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37 was burned on NEAR by 20e6bfe4685d99004fc2095d3a0fc6158cd810ce8f801196141e183ed6e19d65, flagged by R8_DEPOSIT_LEDGER_MISMATCH 31h 40m earlier exploit wallet (BscScan label: Near Intents Exploiter 1)

0x9fe58e03...6c4c

Click a field to copy its value.

timestamp	2026-09-30T23:54:30Z
rule.id	R9B_PAYOUT_FROM_FLAGGED_NEAR_ACCOUNT
rule.level	12
rule.severity	high
rule.description	Treasury payout authorized by a NEAR account that NEAR rules flagged
rule.groups	evm, treasury, payout, xchain
rule.tactic	Treasury drain
rule.weight	3.0
data.tx	0x9fe58e031f73bbd880c782bc9e7446bcda32cadb304a729209871a4a81856c4c
data.block	125000023
data.ts	2026-09-30T23:54:30Z
data.chain	bsc
data.kind	payout
data.amount	800000
data.symbol	usdt
data.from	0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
data.tx_submitter	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
data.vault	hot_bridge
data.token	bsc:usdt
data.address	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
scope.address	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
evidence.nonce	1790812232000001815791
evidence.near_burn_tx	A1tNAg5w3NVrDGheG9zTNmrXeWd4249nYyVLF8ekK3Xh
evidence.near_burn_ts	2026-09-30T23:50:32.174631Z
evidence.near_account	20e6bfe4685d99004fc2095d3a0fc6158cd810ce8f801196141e183ed6e19d65
evidence.near_account_hop	0
evidence.tainted_by_rule	R8_DEPOSIT_LEDGER_MISMATCH
evidence.tainted_by_tx	3k91uDpUiezxUe7hBgAR7kc3TBkToMZKGAiv6GqbtKiC
evidence.tainted_at	2026-09-29T16:14:22.056408Z
evidence.since_taint	1 day, 7:40:07.943592
evidence.token_matches	True
evidence.amount_matches	True
matched[0]	kind=payout eq payout
matched[1]	vault=hot_bridge eq hot_bridge
matched[2]	extra.withdraw_nonce=1790812232000001815791 exists True
shield.mode	paranoid
shield.capability	pause_destination
shield.scope	address

2026-10-01 00:07:01

NEAR

R6_INTENTS_CALLBACK_ANOMALYLedger tampering

intents.near deposit (mt_on_transfer) in tx GU5NC7V89yqAGjqRGS9QrUPFcRg9kPr4A3aEuNrn8jpP: contract=intents.near eq intents.near; extra.n_token_pairs=98 gt 32

GU5NC7V89y...8jpP

Click a field to copy its value.

timestamp	2026-10-01T00:07:01.087892Z
rule.id	R6_INTENTS_CALLBACK_ANOMALY
rule.level	12
rule.severity	high
rule.description	Abnormal resolve callback or oversized event on intents.near
rule.groups	near, verifier, callback
rule.tactic	Ledger tampering
rule.weight	2.0
data.tx	GU5NC7V89yqAGjqRGS9QrUPFcRg9kPr4A3aEuNrn8jpP
data.block	217985689
data.ts	2026-10-01T00:07:01.087892Z
data.chain	near
data.kind	deposit
data.amount	499968
data.symbol	usdt
data.to	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
matched[0]	contract=intents.near eq intents.near
matched[1]	extra.n_token_pairs=98 gt 32
shield.mode	paranoid
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-10-01 00:07:02

NEAR

R6_INTENTS_CALLBACK_ANOMALYLedger tampering

intents.near callback_failure (mt_resolve_deposit) in tx GU5NC7V89yqAGjqRGS9QrUPFcRg9kPr4A3aEuNrn8jpP: contract=intents.near eq intents.near; kind=callback_failure eq callback_failure; extra.methods=<list len=1> regex resolve; extra.rejected_log_size=16495 gt 15000

GU5NC7V89y...8jpP

Click a field to copy its value.

timestamp	2026-10-01T00:07:02.362202Z
rule.id	R6_INTENTS_CALLBACK_ANOMALY
rule.level	12
rule.severity	high
rule.description	Abnormal resolve callback or oversized event on intents.near
rule.groups	near, verifier, callback
rule.tactic	Ledger tampering
rule.weight	2.0
data.tx	GU5NC7V89yqAGjqRGS9QrUPFcRg9kPr4A3aEuNrn8jpP
data.block	217985691
data.ts	2026-10-01T00:07:02.362202Z
data.chain	near
data.kind	callback_failure
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
matched[0]	contract=intents.near eq intents.near
matched[1]	kind=callback_failure eq callback_failure
matched[2]	extra.methods=<list len=1> regex resolve
matched[3]	extra.rejected_log_size=16495 gt 15000
shield.mode	paranoid
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-10-01 00:12:38

NEAR

R6_INTENTS_CALLBACK_ANOMALYLedger tampering

intents.near deposit (mt_on_transfer) in tx 6Rgww9eZ5AhwkTLDvfyBNFUBJCec97ExR4Wa8aW4U1ic: contract=intents.near eq intents.near; extra.n_token_pairs=98 gt 32

6Rgww9eZ5A...U1ic

Click a field to copy its value.

timestamp	2026-10-01T00:12:38.117014Z
rule.id	R6_INTENTS_CALLBACK_ANOMALY
rule.level	12
rule.severity	high
rule.description	Abnormal resolve callback or oversized event on intents.near
rule.groups	near, verifier, callback
rule.tactic	Ledger tampering
rule.weight	2.0
data.tx	6Rgww9eZ5AhwkTLDvfyBNFUBJCec97ExR4Wa8aW4U1ic
data.block	217986267
data.ts	2026-10-01T00:12:38.117014Z
data.chain	near
data.kind	deposit
data.amount	999936
data.symbol	usdt
data.to	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
matched[0]	contract=intents.near eq intents.near
matched[1]	extra.n_token_pairs=98 gt 32
shield.mode	paranoid
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-10-01 00:12:39

NEAR

R6_INTENTS_CALLBACK_ANOMALYLedger tampering

intents.near callback_failure (mt_resolve_deposit) in tx 6Rgww9eZ5AhwkTLDvfyBNFUBJCec97ExR4Wa8aW4U1ic: contract=intents.near eq intents.near; kind=callback_failure eq callback_failure; extra.methods=<list len=1> regex resolve; extra.rejected_log_size=16495 gt 15000

6Rgww9eZ5A...U1ic

Click a field to copy its value.

timestamp	2026-10-01T00:12:39.370800Z
rule.id	R6_INTENTS_CALLBACK_ANOMALY
rule.level	12
rule.severity	high
rule.description	Abnormal resolve callback or oversized event on intents.near
rule.groups	near, verifier, callback
rule.tactic	Ledger tampering
rule.weight	2.0
data.tx	6Rgww9eZ5AhwkTLDvfyBNFUBJCec97ExR4Wa8aW4U1ic
data.block	217986269
data.ts	2026-10-01T00:12:39.370800Z
data.chain	near
data.kind	callback_failure
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
matched[0]	contract=intents.near eq intents.near
matched[1]	kind=callback_failure eq callback_failure
matched[2]	extra.methods=<list len=1> regex resolve
matched[3]	extra.rejected_log_size=16495 gt 15000
shield.mode	paranoid
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-10-01 00:24:02

BNB Chain

R1B_PAYOUT_SPIKE_TO_NEW_RECIPIENTTreasury drain

bsc hot_bridge paid 1,200,000 usdt to 0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37: 3.56x the 48h max of 336,749.37, recipient first seen 5h 26m ago exploit wallet (BscScan label: Near Intents Exploiter 1)

0x0381265d...8220

Click a field to copy its value.

timestamp	2026-10-01T00:24:02Z
rule.id	R1B_PAYOUT_SPIKE_TO_NEW_RECIPIENT
rule.level	12
rule.severity	high
rule.description	Treasury payout spike to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, spike, composite
rule.tactic	Treasury drain
rule.weight	3.0
data.tx	0x0381265d6a1bb09de899f49f410a8b907cd548358a7e3c91076c3a52656b8220
data.block	125003957
data.ts	2026-10-01T00:24:02Z
data.chain	bsc
data.kind	payout
data.amount	1200000
data.symbol	usdt
data.from	0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
data.tx_submitter	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
data.vault	hot_bridge
data.token	bsc:usdt
data.address	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
scope.address	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
evidence.value_field	amount_usd
evidence.value	1200000
evidence.baseline_max	336749.365465541220672818
evidence.baseline_tx	0xbd6f7cc786d59a1b0f6cc2cc01e2b235c81bda44cbec12f2a6d56b2b1e2575df
evidence.baseline_ts	2026-09-30T13:36:11Z
evidence.baseline_window	48h
evidence.baseline_events	2021
evidence.ratio	3.56
evidence.factor	2.0
evidence.min_value	50000
evidence.address	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
evidence.first_seen	2026-09-30T18:57:07Z
evidence.first_seen_tx	0x4f426e23cda7ab58fd146f4f81489575563770c5d25b49d156870dc1dc1428d5
evidence.first_seen_kind	payout
evidence.age	5:26:55
evidence.max_age	7d
evidence.history_start	2026-09-01T00:00:14Z
evidence.parents	R1_VAULT_PAYOUT_SPIKE, R5_NEW_RECIPIENT_LARGE_PAYOUT
matched[0]	kind=payout eq payout
shield.mode	paranoid
shield.capability	raise_mode
shield.scope	chain, bridge, token, address

2026-10-01 00:24:02

BNB Chain

R2_VAULT_OUTFLOW_VELOCITYTreasury drain

bsc hot_bridge usdt outflow 2,038,175.28 in 1h vs 7d hourly p99 938,034.56 exploit wallet (BscScan label: Near Intents Exploiter 1)

0x0381265d...8220

Click a field to copy its value.

timestamp	2026-10-01T00:24:02Z
rule.id	R2_VAULT_OUTFLOW_VELOCITY
rule.level	12
rule.severity	high
rule.description	Treasury outflow velocity above its 7-day p99
rule.groups	evm, treasury, payout, velocity
rule.tactic	Treasury drain
rule.weight	2.0
data.tx	0x0381265d6a1bb09de899f49f410a8b907cd548358a7e3c91076c3a52656b8220
data.block	125003957
data.ts	2026-10-01T00:24:02Z
data.chain	bsc
data.kind	payout
data.amount	1200000
data.symbol	usdt
data.from	0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
data.tx_submitter	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
data.vault	hot_bridge
data.token	bsc:usdt
data.address	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
scope.address	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
evidence.value_field	amount_usd
evidence.window_sum	2038175.275419578708164517
evidence.window	1h
evidence.baseline_percentile	99.0
evidence.baseline_value	938034.56293151500515187077
evidence.baseline_buckets	168
evidence.baseline_horizon	7d
evidence.factor	2.0
evidence.threshold	1876069.12586303001030374154
evidence.window_txs	0x2acba65ea5e2b8128c0d7001cebe4c0ab8ddbf6065437e231476698a2bc5dd65, 0x75ad8cde2aac352469ebcbbbf5beab171ed341dd358831430093dacebd355ca8, 0x0f9613d32062794d3ce260b8c1aa8b824ebb69a1612aed32722fb86b142f2786, 0x1e3cfdcc29673e5884eab73acdcb505fc302b9cb583f2141ea0b56167a33bb5d, 0xc001e458ec0dc7f22dea5e004971b40f56de4428c941a31c6774cc0f71b2b1a0, 0xcc38e68fb5179a3d14a4092d290591788bcca120f82a0af8e70b5b74f2baaed0, 0x51bda420f1de61b0f099598996b46dae6d68381a8635805a5a015b160916e734, 0x0ab4aa952a772e9d6840dfbbb8800643fecb3d433c7bda1de9af077f7f2b8c39, 0x71f60a8d3c622c30cf0079d582ee236c793263796254ec78e904a7d5ea8ee361, 0xec8966de82c4151fb6d387cca0d8ff4a2d67cf67a504425efbaca0f2e2cd677e, 0x4a87708361485cd7bc1fea5030fa84cc19843196c132de386eb70f8c06f38e79, 0x2f7fde9c2cb43a2b652174cf1c670789a13c5ea028f7701d93a68d5759110007, 0x4b65de13b893ddaea62ab486e3916430c19f2e6fc323e4a086cd36a4df65209a, 0x6a6e933697af8c4bf61b71d656538e637452b05c176bd1906da74d2f9b191d04, 0x26c9128bca587298d2e85ae43f2af941521369f85df553f82448893f9c8f8e4f, 0x9fe58e031f73bbd880c782bc9e7446bcda32cadb304a729209871a4a81856c4c, 0x5f8fd558030e909d049cf81b52ea744767eb83c0195cf5a269922d958e9e80f1, 0x86cdf875bf8ae377e261cb16b8f9cc45c13b04383da6df639ed2f8aa649001c9, 0xdc7feeebb9d35a8b5f3fdd6702aee865c60c757f6ad8a52de84c58100bd59c1a, 0x0381265d6a1bb09de899f49f410a8b907cd548358a7e3c91076c3a52656b8220
evidence.window_tx_count	21
matched[0]	kind=payout eq payout
matched[1]	vault=hot_bridge in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdt in ['usdt', 'usdc']
shield.mode	paranoid
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-10-01 00:24:02

BNB Chain

R3B_SELF_SUBMITTED_TEST_THEN_DRAINTreasury drain

0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37 got a test payout 5h 26m earlier, then submitted this 1,200,000 usdt payout itself exploit wallet (BscScan label: Near Intents Exploiter 1)

0x0381265d...8220

Click a field to copy its value.

timestamp	2026-10-01T00:24:02Z
rule.id	R3B_SELF_SUBMITTED_TEST_THEN_DRAIN
rule.level	12
rule.severity	high
rule.description	Test-then-drain payout that the recipient submitted itself
rule.groups	evm, treasury, payout, sequence, composite
rule.tactic	Treasury drain
rule.weight	2.0
data.tx	0x0381265d6a1bb09de899f49f410a8b907cd548358a7e3c91076c3a52656b8220
data.block	125003957
data.ts	2026-10-01T00:24:02Z
data.chain	bsc
data.kind	payout
data.amount	1200000
data.symbol	usdt
data.from	0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
data.tx_submitter	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
data.vault	hot_bridge
data.token	bsc:usdt
data.address	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
scope.address	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
evidence.group.to_addr	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
evidence.within	24h
evidence.steps	[{"step": "test_payout", "tx": "0x4f426e23cda7ab58fd146f4f81489575563770c5d25b49d156870dc1dc1428d5", "ts": "2026-09-30T18:57:07Z", "amount": "10"}, {"step": "large_payout", "tx": "0x0381265d6a1bb09de899f49f410a8b907cd548358a7e3c91076c3a52656b8220", "ts": "2026-10-01T00:24:02Z", "amount": "1200000"}]
evidence.first_step_age	5:26:55
evidence.prior_events	[{"step": "test_payout", "tx": "0x4f426e23cda7ab58fd146f4f81489575563770c5d25b49d156870dc1dc1428d5", "ts": "2026-09-30T18:57:07Z", "amount": "10"}]
evidence.parents	R3_TEST_THEN_DRAIN, R4_SELF_SUBMITTED_LARGE_PAYOUT
matched[0]	kind=payout eq payout
shield.mode	paranoid
shield.capability	raise_mode
shield.scope	chain, bridge, token, address

2026-10-01 00:24:02

BNB Chain

R9B_PAYOUT_FROM_FLAGGED_NEAR_ACCOUNTTreasury drain

1,200,000 usdt payout to 0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37 was burned on NEAR by 20e6bfe4685d99004fc2095d3a0fc6158cd810ce8f801196141e183ed6e19d65, flagged by R8_DEPOSIT_LEDGER_MISMATCH 32h 9m earlier exploit wallet (BscScan label: Near Intents Exploiter 1)

0x0381265d...8220

Click a field to copy its value.

timestamp	2026-10-01T00:24:02Z
rule.id	R9B_PAYOUT_FROM_FLAGGED_NEAR_ACCOUNT
rule.level	12
rule.severity	high
rule.description	Treasury payout authorized by a NEAR account that NEAR rules flagged
rule.groups	evm, treasury, payout, xchain
rule.tactic	Treasury drain
rule.weight	3.0
data.tx	0x0381265d6a1bb09de899f49f410a8b907cd548358a7e3c91076c3a52656b8220
data.block	125003957
data.ts	2026-10-01T00:24:02Z
data.chain	bsc
data.kind	payout
data.amount	1200000
data.symbol	usdt
data.from	0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
data.tx_submitter	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
data.vault	hot_bridge
data.token	bsc:usdt
data.address	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
scope.address	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
evidence.nonce	1790814029000001815831
evidence.near_burn_tx	799TeaBfrtCcmJ5dMT6fqupqLHyZQAqm2ksKoEfyMj7J
evidence.near_burn_ts	2026-10-01T00:20:29.285171Z
evidence.near_account	20e6bfe4685d99004fc2095d3a0fc6158cd810ce8f801196141e183ed6e19d65
evidence.near_account_hop	0
evidence.tainted_by_rule	R8_DEPOSIT_LEDGER_MISMATCH
evidence.tainted_by_tx	3k91uDpUiezxUe7hBgAR7kc3TBkToMZKGAiv6GqbtKiC
evidence.tainted_at	2026-09-29T16:14:22.056408Z
evidence.since_taint	1 day, 8:09:39.943592
evidence.token_matches	True
evidence.amount_matches	True
matched[0]	kind=payout eq payout
matched[1]	vault=hot_bridge eq hot_bridge
matched[2]	extra.withdraw_nonce=1790814029000001815831 exists True
shield.mode	paranoid
shield.capability	pause_destination
shield.scope	address

2026-10-01 00:35:49

NEAR

R6_INTENTS_CALLBACK_ANOMALYLedger tampering

intents.near deposit (mt_on_transfer) in tx GdCwdzdNkfP6LAnnym5Vgam4YYNM7XWgteRNAKNA2ViL: contract=intents.near eq intents.near; extra.n_token_pairs=98 gt 32

GdCwdzdNkf...2ViL

Click a field to copy its value.

timestamp	2026-10-01T00:35:49.016451Z
rule.id	R6_INTENTS_CALLBACK_ANOMALY
rule.level	12
rule.severity	high
rule.description	Abnormal resolve callback or oversized event on intents.near
rule.groups	near, verifier, callback
rule.tactic	Ledger tampering
rule.weight	2.0
data.tx	GdCwdzdNkfP6LAnnym5Vgam4YYNM7XWgteRNAKNA2ViL
data.block	217988638
data.ts	2026-10-01T00:35:49.016451Z
data.chain	near
data.kind	deposit
data.amount	799872
data.symbol	usdt
data.to	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
matched[0]	contract=intents.near eq intents.near
matched[1]	extra.n_token_pairs=98 gt 32
shield.mode	paranoid
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-10-01 00:35:50

NEAR

R6_INTENTS_CALLBACK_ANOMALYLedger tampering

intents.near callback_failure (mt_resolve_deposit) in tx GdCwdzdNkfP6LAnnym5Vgam4YYNM7XWgteRNAKNA2ViL: contract=intents.near eq intents.near; kind=callback_failure eq callback_failure; extra.methods=<list len=1> regex resolve; extra.rejected_log_size=16495 gt 15000

GdCwdzdNkf...2ViL

Click a field to copy its value.

timestamp	2026-10-01T00:35:50.225956Z
rule.id	R6_INTENTS_CALLBACK_ANOMALY
rule.level	12
rule.severity	high
rule.description	Abnormal resolve callback or oversized event on intents.near
rule.groups	near, verifier, callback
rule.tactic	Ledger tampering
rule.weight	2.0
data.tx	GdCwdzdNkfP6LAnnym5Vgam4YYNM7XWgteRNAKNA2ViL
data.block	217988640
data.ts	2026-10-01T00:35:50.225956Z
data.chain	near
data.kind	callback_failure
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
matched[0]	contract=intents.near eq intents.near
matched[1]	kind=callback_failure eq callback_failure
matched[2]	extra.methods=<list len=1> regex resolve
matched[3]	extra.rejected_log_size=16495 gt 15000
shield.mode	paranoid
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-10-01 00:50:42

BNB Chain

R1B_PAYOUT_SPIKE_TO_NEW_RECIPIENTTreasury drain

bsc hot_bridge paid 1,500,000 usdt to 0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37: 4.45x the 48h max of 336,749.37, recipient first seen 5h 53m ago exploit wallet (BscScan label: Near Intents Exploiter 1)

0x69d1c68c...cceb

Click a field to copy its value.

timestamp	2026-10-01T00:50:42Z
rule.id	R1B_PAYOUT_SPIKE_TO_NEW_RECIPIENT
rule.level	12
rule.severity	high
rule.description	Treasury payout spike to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, spike, composite
rule.tactic	Treasury drain
rule.weight	3.0
data.tx	0x69d1c68c7e961a0199d3c9f3b6a31cb168ed775ef34b51a42762253ac1efcceb
data.block	125007511
data.ts	2026-10-01T00:50:42Z
data.chain	bsc
data.kind	payout
data.amount	1500000
data.symbol	usdt
data.from	0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
data.tx_submitter	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
data.vault	hot_bridge
data.token	bsc:usdt
data.address	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
scope.address	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
evidence.value_field	amount_usd
evidence.value	1500000
evidence.baseline_max	336749.365465541220672818
evidence.baseline_tx	0xbd6f7cc786d59a1b0f6cc2cc01e2b235c81bda44cbec12f2a6d56b2b1e2575df
evidence.baseline_ts	2026-09-30T13:36:11Z
evidence.baseline_window	48h
evidence.baseline_events	2015
evidence.ratio	4.45
evidence.factor	2.0
evidence.min_value	50000
evidence.address	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
evidence.first_seen	2026-09-30T18:57:07Z
evidence.first_seen_tx	0x4f426e23cda7ab58fd146f4f81489575563770c5d25b49d156870dc1dc1428d5
evidence.first_seen_kind	payout
evidence.age	5:53:35
evidence.max_age	7d
evidence.history_start	2026-09-01T00:00:14Z
evidence.parents	R1_VAULT_PAYOUT_SPIKE, R5_NEW_RECIPIENT_LARGE_PAYOUT
matched[0]	kind=payout eq payout
shield.mode	paranoid
shield.capability	raise_mode
shield.scope	chain, bridge, token, address

2026-10-01 00:50:42

BNB Chain

R9B_PAYOUT_FROM_FLAGGED_NEAR_ACCOUNTTreasury drain

1,500,000 usdt payout to 0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37 was burned on NEAR by 20e6bfe4685d99004fc2095d3a0fc6158cd810ce8f801196141e183ed6e19d65, flagged by R8_DEPOSIT_LEDGER_MISMATCH 32h 36m earlier exploit wallet (BscScan label: Near Intents Exploiter 1)

0x69d1c68c...cceb

Click a field to copy its value.

timestamp	2026-10-01T00:50:42Z
rule.id	R9B_PAYOUT_FROM_FLAGGED_NEAR_ACCOUNT
rule.level	12
rule.severity	high
rule.description	Treasury payout authorized by a NEAR account that NEAR rules flagged
rule.groups	evm, treasury, payout, xchain
rule.tactic	Treasury drain
rule.weight	3.0
data.tx	0x69d1c68c7e961a0199d3c9f3b6a31cb168ed775ef34b51a42762253ac1efcceb
data.block	125007511
data.ts	2026-10-01T00:50:42Z
data.chain	bsc
data.kind	payout
data.amount	1500000
data.symbol	usdt
data.from	0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
data.tx_submitter	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
data.vault	hot_bridge
data.token	bsc:usdt
data.address	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
scope.address	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
evidence.nonce	1790815605000001815863
evidence.near_burn_tx	GJ65AKDXN9ov7DTFgmgvbykNww1B5J7jK42A4QfbHgon
evidence.near_burn_ts	2026-10-01T00:46:45.938846Z
evidence.near_account	20e6bfe4685d99004fc2095d3a0fc6158cd810ce8f801196141e183ed6e19d65
evidence.near_account_hop	0
evidence.tainted_by_rule	R8_DEPOSIT_LEDGER_MISMATCH
evidence.tainted_by_tx	3k91uDpUiezxUe7hBgAR7kc3TBkToMZKGAiv6GqbtKiC
evidence.tainted_at	2026-09-29T16:14:22.056408Z
evidence.since_taint	1 day, 8:36:19.943592
evidence.token_matches	True
evidence.amount_matches	True
matched[0]	kind=payout eq payout
matched[1]	vault=hot_bridge eq hot_bridge
matched[2]	extra.withdraw_nonce=1790815605000001815863 exists True
shield.mode	paranoid
shield.capability	pause_destination
shield.scope	address

2026-10-01 01:15:35

Ethereum

R7B_TAINTED_PAYOUTFund movement

near_intents on ethereum paid 85.74 eth to tainted 0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37 (tainted 6h 18m earlier on bsc) exploit wallet (BscScan label: Near Intents Exploiter 1)

0x383ee254...8c6f

Click a field to copy its value.

timestamp	2026-10-01T01:15:35Z
rule.id	R7B_TAINTED_PAYOUT
rule.level	12
rule.severity	high
rule.description	Treasury pays an address tainted by a flagged payout on another chain or vault
rule.groups	evm, treasury, payout, taint
rule.tactic	Fund movement
rule.weight	2.0
data.tx	0x383ee25422cba1e5b47ee511760a395259bfdb8a7f35df9be7eb0560495f8c6f
data.block	26094114
data.ts	2026-10-01T01:15:35Z
data.chain	ethereum
data.kind	payout
data.amount	85.736797478412988516
data.symbol	eth
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
data.tx_submitter	0x2cff890f0378a11913b6129b2e97417a2c302680
data.vault	near_intents
data.token	ethereum:eth
data.address	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
scope.chain	ethereum
scope.bridge	near_intents
scope.token	eth
scope.address	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
evidence.address	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
evidence.hop	0
evidence.tainted_at	2026-09-30T18:57:07Z
evidence.tainted_by_rule	R9B_PAYOUT_FROM_FLAGGED_NEAR_ACCOUNT
evidence.tainted_by_tx	0x4f426e23cda7ab58fd146f4f81489575563770c5d25b49d156870dc1dc1428d5
evidence.tainted_on_chain	bsc
evidence.tainted_on_vault	hot_bridge
evidence.matched_field	to_addr
evidence.since_taint	6:18:28
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents exists True
shield.mode	paranoid
shield.capability	pause_destination
shield.scope	address

2026-10-01 01:22:45

NEAR

R6_INTENTS_CALLBACK_ANOMALYLedger tampering

intents.near deposit (mt_on_transfer) in tx bMdkzhZf7tQZbXNnXcAnuJaLyTxaCq8W9BnTh28EaDr: contract=intents.near eq intents.near; extra.n_token_pairs=98 gt 32

bMdkzhZf7t...EaDr

Click a field to copy its value.

timestamp	2026-10-01T01:22:45.680986Z
rule.id	R6_INTENTS_CALLBACK_ANOMALY
rule.level	12
rule.severity	high
rule.description	Abnormal resolve callback or oversized event on intents.near
rule.groups	near, verifier, callback
rule.tactic	Ledger tampering
rule.weight	2.0
data.tx	bMdkzhZf7tQZbXNnXcAnuJaLyTxaCq8W9BnTh28EaDr
data.block	217993455
data.ts	2026-10-01T01:22:45.680986Z
data.chain	near
data.kind	deposit
data.amount	99744
data.symbol	usdt
data.to	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
matched[0]	contract=intents.near eq intents.near
matched[1]	extra.n_token_pairs=98 gt 32
shield.mode	paranoid
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-10-01 01:22:46

NEAR

R6_INTENTS_CALLBACK_ANOMALYLedger tampering

intents.near callback_failure (mt_resolve_deposit) in tx bMdkzhZf7tQZbXNnXcAnuJaLyTxaCq8W9BnTh28EaDr: contract=intents.near eq intents.near; kind=callback_failure eq callback_failure; extra.methods=<list len=1> regex resolve; extra.rejected_log_size=16495 gt 15000

bMdkzhZf7t...EaDr

Click a field to copy its value.

timestamp	2026-10-01T01:22:46.953797Z
rule.id	R6_INTENTS_CALLBACK_ANOMALY
rule.level	12
rule.severity	high
rule.description	Abnormal resolve callback or oversized event on intents.near
rule.groups	near, verifier, callback
rule.tactic	Ledger tampering
rule.weight	2.0
data.tx	bMdkzhZf7tQZbXNnXcAnuJaLyTxaCq8W9BnTh28EaDr
data.block	217993457
data.ts	2026-10-01T01:22:46.953797Z
data.chain	near
data.kind	callback_failure
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
matched[0]	contract=intents.near eq intents.near
matched[1]	kind=callback_failure eq callback_failure
matched[2]	extra.methods=<list len=1> regex resolve
matched[3]	extra.rejected_log_size=16495 gt 15000
shield.mode	paranoid
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-10-01 01:26:11

Ethereum

R7B_TAINTED_PAYOUTFund movement

near_intents on ethereum paid 99.79 eth to tainted 0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37 (tainted 6h 29m earlier on bsc) exploit wallet (BscScan label: Near Intents Exploiter 1)

0x1b589df1...73c9

Click a field to copy its value.

timestamp	2026-10-01T01:26:11Z
rule.id	R7B_TAINTED_PAYOUT
rule.level	12
rule.severity	high
rule.description	Treasury pays an address tainted by a flagged payout on another chain or vault
rule.groups	evm, treasury, payout, taint
rule.tactic	Fund movement
rule.weight	2.0
data.tx	0x1b589df14968199ed8b2d3e6efe8514a9b32484c5cdc18ea8498ed48e64873c9
data.block	26094167
data.ts	2026-10-01T01:26:11Z
data.chain	ethereum
data.kind	payout
data.amount	99.789350845439803605
data.symbol	eth
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
data.tx_submitter	0x2cff890f0378a11913b6129b2e97417a2c302680
data.vault	near_intents
data.token	ethereum:eth
data.address	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
scope.chain	ethereum
scope.bridge	near_intents
scope.token	eth
scope.address	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
evidence.address	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
evidence.hop	0
evidence.tainted_at	2026-09-30T18:57:07Z
evidence.tainted_by_rule	R9B_PAYOUT_FROM_FLAGGED_NEAR_ACCOUNT
evidence.tainted_by_tx	0x4f426e23cda7ab58fd146f4f81489575563770c5d25b49d156870dc1dc1428d5
evidence.tainted_on_chain	bsc
evidence.tainted_on_vault	hot_bridge
evidence.matched_field	to_addr
evidence.since_taint	6:29:04
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents exists True
shield.mode	paranoid
shield.capability	pause_destination
shield.scope	address

2026-10-01 01:29:26

NEAR

R6_INTENTS_CALLBACK_ANOMALYLedger tampering

intents.near deposit (mt_on_transfer) in tx CWhtCr8ziTJJ4qbXGtZ3bBwzWtVa6rRAp7Q8ARgAfoDg: contract=intents.near eq intents.near; extra.n_token_pairs=98 gt 32

CWhtCr8ziT...foDg

Click a field to copy its value.

timestamp	2026-10-01T01:29:26.511282Z
rule.id	R6_INTENTS_CALLBACK_ANOMALY
rule.level	12
rule.severity	high
rule.description	Abnormal resolve callback or oversized event on intents.near
rule.groups	near, verifier, callback
rule.tactic	Ledger tampering
rule.weight	2.0
data.tx	CWhtCr8ziTJJ4qbXGtZ3bBwzWtVa6rRAp7Q8ARgAfoDg
data.block	217994142
data.ts	2026-10-01T01:29:26.511282Z
data.chain	near
data.kind	deposit
data.amount	149296.651709224182698138
data.symbol	usdt
data.to	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
matched[0]	contract=intents.near eq intents.near
matched[1]	extra.n_token_pairs=98 gt 32
shield.mode	paranoid
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-10-01 01:29:27

NEAR

R6_INTENTS_CALLBACK_ANOMALYLedger tampering

intents.near callback_failure (mt_resolve_deposit) in tx CWhtCr8ziTJJ4qbXGtZ3bBwzWtVa6rRAp7Q8ARgAfoDg: contract=intents.near eq intents.near; kind=callback_failure eq callback_failure; extra.methods=<list len=1> regex resolve; extra.rejected_log_size=16495 gt 15000

CWhtCr8ziT...foDg

Click a field to copy its value.

timestamp	2026-10-01T01:29:27.579827Z
rule.id	R6_INTENTS_CALLBACK_ANOMALY
rule.level	12
rule.severity	high
rule.description	Abnormal resolve callback or oversized event on intents.near
rule.groups	near, verifier, callback
rule.tactic	Ledger tampering
rule.weight	2.0
data.tx	CWhtCr8ziTJJ4qbXGtZ3bBwzWtVa6rRAp7Q8ARgAfoDg
data.block	217994144
data.ts	2026-10-01T01:29:27.579827Z
data.chain	near
data.kind	callback_failure
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
matched[0]	contract=intents.near eq intents.near
matched[1]	kind=callback_failure eq callback_failure
matched[2]	extra.methods=<list len=1> regex resolve
matched[3]	extra.rejected_log_size=16495 gt 15000
shield.mode	paranoid
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-10-01 01:46:20

BNB Chain

R9B_PAYOUT_FROM_FLAGGED_NEAR_ACCOUNTTreasury drain

330,000 usdt payout to 0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37 was burned on NEAR by 20e6bfe4685d99004fc2095d3a0fc6158cd810ce8f801196141e183ed6e19d65, flagged by R8_DEPOSIT_LEDGER_MISMATCH 33h 31m earlier exploit wallet (BscScan label: Near Intents Exploiter 1)

0x9c10b967...003a

Click a field to copy its value.

timestamp	2026-10-01T01:46:20Z
rule.id	R9B_PAYOUT_FROM_FLAGGED_NEAR_ACCOUNT
rule.level	12
rule.severity	high
rule.description	Treasury payout authorized by a NEAR account that NEAR rules flagged
rule.groups	evm, treasury, payout, xchain
rule.tactic	Treasury drain
rule.weight	3.0
data.tx	0x9c10b967da0c85631ec105e3b322c0a851fcd01b69ff390ff58f860e5cce003a
data.block	125014927
data.ts	2026-10-01T01:46:20Z
data.chain	bsc
data.kind	payout
data.amount	330000
data.symbol	usdt
data.from	0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
data.tx_submitter	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
data.vault	hot_bridge
data.token	bsc:usdt
data.address	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
scope.address	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
evidence.nonce	1790818830000001815949
evidence.near_burn_tx	E4gEvzNSPjeiah5c6pvUWTXkUmiiwjkbWr2zzQWsz6it
evidence.near_burn_ts	2026-10-01T01:40:30.063963Z
evidence.near_account	20e6bfe4685d99004fc2095d3a0fc6158cd810ce8f801196141e183ed6e19d65
evidence.near_account_hop	0
evidence.tainted_by_rule	R8_DEPOSIT_LEDGER_MISMATCH
evidence.tainted_by_tx	3k91uDpUiezxUe7hBgAR7kc3TBkToMZKGAiv6GqbtKiC
evidence.tainted_at	2026-09-29T16:14:22.056408Z
evidence.since_taint	1 day, 9:31:57.943592
evidence.token_matches	True
evidence.amount_matches	True
matched[0]	kind=payout eq payout
matched[1]	vault=hot_bridge eq hot_bridge
matched[2]	extra.withdraw_nonce=1790818830000001815949 exists True
shield.mode	paranoid
shield.capability	pause_destination
shield.scope	address

2026-10-01 05:47:28

NEAR

R6_INTENTS_CALLBACK_ANOMALYLedger tampering

intents.near deposit (mt_on_transfer) in tx GAQKwHdTaLPyvvAMCGfmcyPcR8rptuXu1mCRwz7UCQEG: contract=intents.near eq intents.near; extra.n_token_pairs=98 gt 32

GAQKwHdTaL...CQEG

Click a field to copy its value.

timestamp	2026-10-01T05:47:28.529593Z
rule.id	R6_INTENTS_CALLBACK_ANOMALY
rule.level	12
rule.severity	high
rule.description	Abnormal resolve callback or oversized event on intents.near
rule.groups	near, verifier, callback
rule.tactic	Ledger tampering
rule.weight	2.0
data.tx	GAQKwHdTaLPyvvAMCGfmcyPcR8rptuXu1mCRwz7UCQEG
data.block	218020374
data.ts	2026-10-01T05:47:28.529593Z
data.chain	near
data.kind	deposit
data.amount	18080.082660383136740355
data.symbol	usdt
data.to	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
data.token	nep245:v2_1.omni.hot.tg:56_2CMMyVTGZkeyNZTSvS5sarzfir6g
data.address	873518f0f5cf120d7a8e2a416337bba16d7ae622e91f7da3862f07e89dc2ba9e
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
matched[0]	contract=intents.near eq intents.near
matched[1]	extra.n_token_pairs=98 gt 32
shield.mode	paranoid
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-10-01 05:47:29

NEAR

R6_INTENTS_CALLBACK_ANOMALYLedger tampering

intents.near callback_failure (mt_resolve_deposit) in tx GAQKwHdTaLPyvvAMCGfmcyPcR8rptuXu1mCRwz7UCQEG: contract=intents.near eq intents.near; kind=callback_failure eq callback_failure; extra.methods=<list len=1> regex resolve; extra.rejected_log_size=16495 gt 15000

GAQKwHdTaL...CQEG

Click a field to copy its value.

timestamp	2026-10-01T05:47:29.723373Z
rule.id	R6_INTENTS_CALLBACK_ANOMALY
rule.level	12
rule.severity	high
rule.description	Abnormal resolve callback or oversized event on intents.near
rule.groups	near, verifier, callback
rule.tactic	Ledger tampering
rule.weight	2.0
data.tx	GAQKwHdTaLPyvvAMCGfmcyPcR8rptuXu1mCRwz7UCQEG
data.block	218020376
data.ts	2026-10-01T05:47:29.723373Z
data.chain	near
data.kind	callback_failure
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
matched[0]	contract=intents.near eq intents.near
matched[1]	kind=callback_failure eq callback_failure
matched[2]	extra.methods=<list len=1> regex resolve
matched[3]	extra.rejected_log_size=16495 gt 15000
shield.mode	paranoid
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-10-01 06:08:26

BNB Chain

R9B_PAYOUT_FROM_FLAGGED_NEAR_ACCOUNTTreasury drain

35,000 usdt payout to 0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37 was burned on NEAR by 20e6bfe4685d99004fc2095d3a0fc6158cd810ce8f801196141e183ed6e19d65, flagged by R8_DEPOSIT_LEDGER_MISMATCH 37h 54m earlier exploit wallet (BscScan label: Near Intents Exploiter 1)

0x16ddfa69...0c02

Click a field to copy its value.

timestamp	2026-10-01T06:08:26Z
rule.id	R9B_PAYOUT_FROM_FLAGGED_NEAR_ACCOUNT
rule.level	12
rule.severity	high
rule.description	Treasury payout authorized by a NEAR account that NEAR rules flagged
rule.groups	evm, treasury, payout, xchain
rule.tactic	Treasury drain
rule.weight	3.0
data.tx	0x16ddfa695b9525662b8e57c35723f44af89b4e7fc2dedc3634f730caf8b90c02
data.block	125049861
data.ts	2026-10-01T06:08:26Z
data.chain	bsc
data.kind	payout
data.amount	35000
data.symbol	usdt
data.from	0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
data.tx_submitter	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
data.vault	hot_bridge
data.token	bsc:usdt
data.address	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
scope.address	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
evidence.nonce	1790834650000001816530
evidence.near_burn_tx	Avf5qSFyndojAP7aYYMw2sCUZj2JSHUxYhK8CVGisy8B
evidence.near_burn_ts	2026-10-01T06:04:10.419139Z
evidence.near_account	20e6bfe4685d99004fc2095d3a0fc6158cd810ce8f801196141e183ed6e19d65
evidence.near_account_hop	0
evidence.tainted_by_rule	R8_DEPOSIT_LEDGER_MISMATCH
evidence.tainted_by_tx	3k91uDpUiezxUe7hBgAR7kc3TBkToMZKGAiv6GqbtKiC
evidence.tainted_at	2026-09-29T16:14:22.056408Z
evidence.since_taint	1 day, 13:54:03.943592
evidence.token_matches	True
evidence.amount_matches	True
matched[0]	kind=payout eq payout
matched[1]	vault=hot_bridge eq hot_bridge
matched[2]	extra.withdraw_nonce=1790834650000001816530 exists True
shield.mode	paranoid
shield.capability	pause_destination
shield.scope	address

2026-09-29 16:09:35

NEAR

R6C_EXTREME_TOKEN_AMOUNTProbing

v2_1.omni.hot.tg mint of 97000000000000000000000000000000000097 raw units of nep245:v2_1.omni.hot.tg:4444119_EnfNtEaQwr1AZTRgmH3dEhqGy1rqBWAU8gbAP1eKhErvrNk3cQQ7ConB8nnW9mhdHwm14Haihc5QwzhnJWLodt3ZVa3TY (> 2^120)

FmwaoRNDU6...ZZi3

Click a field to copy its value.

timestamp	2026-09-29T16:09:35.349391Z
rule.id	R6C_EXTREME_TOKEN_AMOUNT
rule.level	8
rule.severity	medium
rule.description	Token amount near the u128 limit on intents.near or the HOT omni contract
rule.groups	near, verifier, amount
rule.tactic	Probing
rule.weight	1.0
data.tx	FmwaoRNDU6BubkHZFy3ucSPpXVUrGUWkRVQwJAiJZZi3
data.block	217799017
data.ts	2026-09-29T16:09:35.349391Z
data.chain	near
data.kind	mint
data.to	20e6bfe4685d99004fc2095d3a0fc6158cd810ce8f801196141e183ed6e19d65
data.token	nep245:v2_1.omni.hot.tg:4444119_EnfNtEaQwr1AZTRgmH3dEhqGy1rqBWAU8gbAP1eKhErvrNk3cQQ7ConB8nnW9mhdHwm14Haihc5QwzhnJWLodt3ZVa3TY
data.address	20e6bfe4685d99004fc2095d3a0fc6158cd810ce8f801196141e183ed6e19d65
scope.chain	near
matched[0]	contract=v2_1.omni.hot.tg in ['intents.near', 'v2_1.omni.hot.tg']
matched[1]	amount_raw=97000000000000000000000000000000000097 gt 1329227995784915872903807060280344576
shield.capability	flag_observation
shield.scope	chain, bridge, token

2026-09-29 18:08:11

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

1,137,452.62 usdt to 0x0eefc49ddd5c6d14ddaa833c613a47cf89de60cd, first seen 0s ago (payout)

0x219c15e2...c189

Click a field to copy its value.

timestamp	2026-09-29T18:08:11Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x219c15e22daa74ab5cedd64a12fdb62b7328058eb953fe0d4b50c2f03a0dc189
data.block	26084815
data.ts	2026-09-29T18:08:11Z
data.chain	ethereum
data.kind	payout
data.amount	1137452.615371
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x0eefc49ddd5c6d14ddaa833c613a47cf89de60cd
data.vault	near_intents
data.token	ethereum:usdt
data.address	0x0eefc49ddd5c6d14ddaa833c613a47cf89de60cd
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0x0eefc49ddd5c6d14ddaa833c613a47cf89de60cd
evidence.address	0x0eefc49ddd5c6d14ddaa833c613a47cf89de60cd
evidence.first_seen	2026-09-29T18:08:11Z
evidence.first_seen_tx	0x219c15e22daa74ab5cedd64a12fdb62b7328058eb953fe0d4b50c2f03a0dc189
evidence.first_seen_kind	payout
evidence.age	0:00:00
evidence.max_age	7d
evidence.history_start	2026-09-01T00:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=1137452.615371 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-09-30 01:03:59

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

942,206.02 usdt to 0xf444e59e66edcadc69fa1163d081a5585348d438, first seen 0s ago (payout)

0x39ec91ac...7532

Click a field to copy its value.

timestamp	2026-09-30T01:03:59Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x39ec91acdb973ab2ead9106cfe79add1846ea67612a5dbf968469a56ab947532
data.block	26086887
data.ts	2026-09-30T01:03:59Z
data.chain	ethereum
data.kind	payout
data.amount	942206.018072
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0xf444e59e66edcadc69fa1163d081a5585348d438
data.vault	near_intents
data.token	ethereum:usdt
data.address	0xf444e59e66edcadc69fa1163d081a5585348d438
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0xf444e59e66edcadc69fa1163d081a5585348d438
evidence.address	0xf444e59e66edcadc69fa1163d081a5585348d438
evidence.first_seen	2026-09-30T01:03:59Z
evidence.first_seen_tx	0x39ec91acdb973ab2ead9106cfe79add1846ea67612a5dbf968469a56ab947532
evidence.first_seen_kind	payout
evidence.age	0:00:00
evidence.max_age	7d
evidence.history_start	2026-09-01T00:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=942206.018072 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-09-30 06:46:35

Ethereum

R10_RECIPIENT_PAYOUT_BURSTTreasury drain

near_intents on ethereum paid 0x790f788cd9d247c2a2f18e4106fbb7563676fe82 3 times over $250K in 38m 24s (841,532.22 usdc), 0 such payouts in the 7d before

0x64d49af4...ab9a

Click a field to copy its value.

timestamp	2026-09-30T06:46:35Z
rule.id	R10_RECIPIENT_PAYOUT_BURST
rule.level	8
rule.severity	medium
rule.description	Burst of large treasury payouts to one new counterparty
rule.groups	evm, treasury, payout, frequency
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x64d49af44912c9f6a7b6b39704104d1e5be8b960c98b15cb0f5e63b8032fab9a
data.block	26088593
data.ts	2026-09-30T06:46:35Z
data.chain	ethereum
data.kind	payout
data.amount	285222.524626
data.symbol	usdc
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x790f788cd9d247c2a2f18e4106fbb7563676fe82
data.vault	near_intents
data.token	ethereum:usdc
data.address	0x790f788cd9d247c2a2f18e4106fbb7563676fe82
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdc
scope.address	0x790f788cd9d247c2a2f18e4106fbb7563676fe82
evidence.group.chain	ethereum
evidence.group.vault	near_intents
evidence.group.to_addr	0x790f788cd9d247c2a2f18e4106fbb7563676fe82
evidence.count	3
evidence.min_count	3
evidence.within	2h
evidence.window_sum	841532.218363
evidence.burst_txs	0x17f63225e4fab3f7365838dfc8a32c120b76889bf4cefbedb3f67119036683db, 0xe687ca097ad30d3418a80c5409ae5edaa4e28c064b27ffca59ae455eaf429253, 0x64d49af44912c9f6a7b6b39704104d1e5be8b960c98b15cb0f5e63b8032fab9a
evidence.burst_started	2026-09-30T06:08:11Z
evidence.burst_span	0:38:24
evidence.prior_events	0
evidence.max_prior	3
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdc in ['usdt', 'usdc']
matched[3]	amount_usd=285222.524626 gt 250000
shield.capability	flag_observation
shield.scope	chain, bridge, token, address

2026-09-30 12:13:59

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

506,494.33 usdt to 0x2f80e0b969d64c3fc8ac536c690ed61012b76a53, first seen 0s ago (payout)

0x8f4ddfed...b236

Click a field to copy its value.

timestamp	2026-09-30T12:13:59Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x8f4ddfedc6091824d445907ae527e0f9457d9e1b7906d375ed747f760df7b236
data.block	26090224
data.ts	2026-09-30T12:13:59Z
data.chain	ethereum
data.kind	payout
data.amount	506494.326544
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x2f80e0b969d64c3fc8ac536c690ed61012b76a53
data.vault	near_intents
data.token	ethereum:usdt
data.address	0x2f80e0b969d64c3fc8ac536c690ed61012b76a53
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0x2f80e0b969d64c3fc8ac536c690ed61012b76a53
evidence.address	0x2f80e0b969d64c3fc8ac536c690ed61012b76a53
evidence.first_seen	2026-09-30T12:13:59Z
evidence.first_seen_tx	0x8f4ddfedc6091824d445907ae527e0f9457d9e1b7906d375ed747f760df7b236
evidence.first_seen_kind	payout
evidence.age	0:00:00
evidence.max_age	7d
evidence.history_start	2026-09-01T00:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=506494.326544 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-09-30 17:15:24

BNB Chain

R1_VAULT_PAYOUT_SPIKETreasury drain

bsc hot_bridge paid 389,711.36 usdc to 0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758: 4.2x the 48h max of 92,716.32

0x190847c3...99b0

Click a field to copy its value.

timestamp	2026-09-30T17:15:24Z
rule.id	R1_VAULT_PAYOUT_SPIKE
rule.level	8
rule.severity	medium
rule.description	Treasury payout far above recent maximum
rule.groups	evm, treasury, payout, spike
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x190847c3ed8eb4f03027c10110f5a75fb5f1788d37ab45434620626f4a9599b0
data.block	124946822
data.ts	2026-09-30T17:15:24Z
data.chain	bsc
data.kind	payout
data.amount	389711.361532653134280498
data.symbol	usdc
data.from	0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
data.tx_submitter	0xcf495cea699b8beca4073279eda66882ccfa273c
data.vault	hot_bridge
data.token	bsc:usdc
data.address	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
scope.chain	bsc
scope.bridge	hot
scope.token	usdc
scope.address	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
evidence.value_field	amount_usd
evidence.value	389711.361532653134280498
evidence.baseline_max	92716.319803512490893345
evidence.baseline_tx	0xae21f43ce6282d7b51688616c5bda0305a14d1ea0072728e643e1c43509fe044
evidence.baseline_ts	2026-09-30T15:15:06Z
evidence.baseline_window	48h
evidence.baseline_events	172
evidence.ratio	4.2
evidence.factor	2.0
evidence.min_value	50000
matched[0]	kind=payout eq payout
matched[1]	vault=hot_bridge in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdc in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	chain, bridge, token

2026-09-30 22:18:47

Ethereum

R3_TEST_THEN_DRAINTreasury drain

0xca21339782321b6256108f92685fc2f32c265c4a received a test payout 20m 24s before this 134,072.53 usdc payout

0x6adc61b4...2659

Click a field to copy its value.

timestamp	2026-09-30T22:18:47Z
rule.id	R3_TEST_THEN_DRAIN
rule.level	8
rule.severity	medium
rule.description	Small test payout followed by a large payout to the same recipient
rule.groups	evm, treasury, payout, sequence
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x6adc61b4d205af000fbf6dadd95204da696d949162926dd255b070c90c862659
data.block	26093234
data.ts	2026-09-30T22:18:47Z
data.chain	ethereum
data.kind	payout
data.amount	134072.527276
data.symbol	usdc
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0xca21339782321b6256108f92685fc2f32c265c4a
data.vault	near_intents
data.token	ethereum:usdc
data.address	0xca21339782321b6256108f92685fc2f32c265c4a
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdc
scope.address	0xca21339782321b6256108f92685fc2f32c265c4a
evidence.group.to_addr	0xca21339782321b6256108f92685fc2f32c265c4a
evidence.within	24h
evidence.steps	[{"step": "test_payout", "tx": "0x13bceac0e98ff950bbf9feba80e573b7f87d3ff1f40ba40f2597eda540bb9872", "ts": "2026-09-30T21:58:23Z", "amount": "27.87096"}, {"step": "large_payout", "tx": "0x6adc61b4d205af000fbf6dadd95204da696d949162926dd255b070c90c862659", "ts": "2026-09-30T22:18:47Z", "amount": "134072.527276"}]
evidence.first_step_age	0:20:24
evidence.prior_events	[{"step": "test_payout", "tx": "0x13bceac0e98ff950bbf9feba80e573b7f87d3ff1f40ba40f2597eda540bb9872", "ts": "2026-09-30T21:58:23Z", "amount": "27.87096"}]
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdc in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	address

2026-09-30 23:54:30

BNB Chain

R1_VAULT_PAYOUT_SPIKETreasury drain

bsc hot_bridge paid 800,000 usdt to 0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37: 2.38x the 48h max of 336,749.37 exploit wallet (BscScan label: Near Intents Exploiter 1)

0x9fe58e03...6c4c

Click a field to copy its value.

timestamp	2026-09-30T23:54:30Z
rule.id	R1_VAULT_PAYOUT_SPIKE
rule.level	8
rule.severity	medium
rule.description	Treasury payout far above recent maximum
rule.groups	evm, treasury, payout, spike
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x9fe58e031f73bbd880c782bc9e7446bcda32cadb304a729209871a4a81856c4c
data.block	125000023
data.ts	2026-09-30T23:54:30Z
data.chain	bsc
data.kind	payout
data.amount	800000
data.symbol	usdt
data.from	0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
data.tx_submitter	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
data.vault	hot_bridge
data.token	bsc:usdt
data.address	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
scope.address	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
evidence.value_field	amount_usd
evidence.value	800000
evidence.baseline_max	336749.365465541220672818
evidence.baseline_tx	0xbd6f7cc786d59a1b0f6cc2cc01e2b235c81bda44cbec12f2a6d56b2b1e2575df
evidence.baseline_ts	2026-09-30T13:36:11Z
evidence.baseline_window	48h
evidence.baseline_events	2034
evidence.ratio	2.38
evidence.factor	2.0
evidence.min_value	50000
matched[0]	kind=payout eq payout
matched[1]	vault=hot_bridge in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdt in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	chain, bridge, token

2026-09-30 23:54:30

BNB Chain

R3_TEST_THEN_DRAINTreasury drain

0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37 received a test payout 4h 57m before this 800,000 usdt payout exploit wallet (BscScan label: Near Intents Exploiter 1)

0x9fe58e03...6c4c

Click a field to copy its value.

timestamp	2026-09-30T23:54:30Z
rule.id	R3_TEST_THEN_DRAIN
rule.level	8
rule.severity	medium
rule.description	Small test payout followed by a large payout to the same recipient
rule.groups	evm, treasury, payout, sequence
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x9fe58e031f73bbd880c782bc9e7446bcda32cadb304a729209871a4a81856c4c
data.block	125000023
data.ts	2026-09-30T23:54:30Z
data.chain	bsc
data.kind	payout
data.amount	800000
data.symbol	usdt
data.from	0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
data.tx_submitter	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
data.vault	hot_bridge
data.token	bsc:usdt
data.address	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
scope.address	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
evidence.group.to_addr	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
evidence.within	24h
evidence.steps	[{"step": "test_payout", "tx": "0x4f426e23cda7ab58fd146f4f81489575563770c5d25b49d156870dc1dc1428d5", "ts": "2026-09-30T18:57:07Z", "amount": "10"}, {"step": "large_payout", "tx": "0x9fe58e031f73bbd880c782bc9e7446bcda32cadb304a729209871a4a81856c4c", "ts": "2026-09-30T23:54:30Z", "amount": "800000"}]
evidence.first_step_age	4:57:23
evidence.prior_events	[{"step": "test_payout", "tx": "0x4f426e23cda7ab58fd146f4f81489575563770c5d25b49d156870dc1dc1428d5", "ts": "2026-09-30T18:57:07Z", "amount": "10"}]
matched[0]	kind=payout eq payout
matched[1]	vault=hot_bridge in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdt in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	address

2026-09-30 23:54:30

BNB Chain

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

800,000 usdt to 0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37, first seen 4h 57m ago (payout) exploit wallet (BscScan label: Near Intents Exploiter 1)

0x9fe58e03...6c4c

Click a field to copy its value.

timestamp	2026-09-30T23:54:30Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x9fe58e031f73bbd880c782bc9e7446bcda32cadb304a729209871a4a81856c4c
data.block	125000023
data.ts	2026-09-30T23:54:30Z
data.chain	bsc
data.kind	payout
data.amount	800000
data.symbol	usdt
data.from	0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
data.tx_submitter	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
data.vault	hot_bridge
data.token	bsc:usdt
data.address	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
scope.address	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
evidence.address	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
evidence.first_seen	2026-09-30T18:57:07Z
evidence.first_seen_tx	0x4f426e23cda7ab58fd146f4f81489575563770c5d25b49d156870dc1dc1428d5
evidence.first_seen_kind	payout
evidence.age	4:57:23
evidence.max_age	7d
evidence.history_start	2026-09-01T00:00:14Z
matched[0]	kind=payout eq payout
matched[1]	vault=hot_bridge in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=800000 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-09-30 23:54:47

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

899,907.90 usdt to 0xdfcad9c8b6006e019b96f6fb557a5da585e42446, first seen 6h 0m ago (payout)

0xc815d456...2e55

Click a field to copy its value.

timestamp	2026-09-30T23:54:47Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0xc815d45607e85b25eddd7167783b57bf5a3604d1cd496449d59fe67dc5e62e55
data.block	26093711
data.ts	2026-09-30T23:54:47Z
data.chain	ethereum
data.kind	payout
data.amount	899907.90018
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0xdfcad9c8b6006e019b96f6fb557a5da585e42446
data.vault	near_intents
data.token	ethereum:usdt
data.address	0xdfcad9c8b6006e019b96f6fb557a5da585e42446
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0xdfcad9c8b6006e019b96f6fb557a5da585e42446
evidence.address	0xdfcad9c8b6006e019b96f6fb557a5da585e42446
evidence.first_seen	2026-09-30T17:54:23Z
evidence.first_seen_tx	0xb8b10954d448be6388f8d2e463c50da54a83761073022d9591185b3af94f0bc5
evidence.first_seen_kind	payout
evidence.age	6:00:24
evidence.max_age	7d
evidence.history_start	2026-09-01T00:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=899907.90018 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-10-01 00:01:59

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

899,907.90 usdt to 0xdfcad9c8b6006e019b96f6fb557a5da585e42446, first seen 6h 7m ago (payout)

0x364d9494...016d

Click a field to copy its value.

timestamp	2026-10-01T00:01:59Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x364d9494b46507d90b44651b34255a2128be011778586c4d0b7298ae8626016d
data.block	26093747
data.ts	2026-10-01T00:01:59Z
data.chain	ethereum
data.kind	payout
data.amount	899907.90018
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0xdfcad9c8b6006e019b96f6fb557a5da585e42446
data.vault	near_intents
data.token	ethereum:usdt
data.address	0xdfcad9c8b6006e019b96f6fb557a5da585e42446
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0xdfcad9c8b6006e019b96f6fb557a5da585e42446
evidence.address	0xdfcad9c8b6006e019b96f6fb557a5da585e42446
evidence.first_seen	2026-09-30T17:54:23Z
evidence.first_seen_tx	0xb8b10954d448be6388f8d2e463c50da54a83761073022d9591185b3af94f0bc5
evidence.first_seen_kind	payout
evidence.age	6:07:36
evidence.max_age	7d
evidence.history_start	2026-09-01T00:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=899907.90018 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-10-01 00:06:47

Ethereum

R10_RECIPIENT_PAYOUT_BURSTTreasury drain

near_intents on ethereum paid 0xdfcad9c8b6006e019b96f6fb557a5da585e42446 3 times over $250K in 12m 0s (2,499,744.10 usdt), 0 such payouts in the 7d before

0xb53480ef...3676

Click a field to copy its value.

timestamp	2026-10-01T00:06:47Z
rule.id	R10_RECIPIENT_PAYOUT_BURST
rule.level	8
rule.severity	medium
rule.description	Burst of large treasury payouts to one new counterparty
rule.groups	evm, treasury, payout, frequency
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0xb53480efe758077e3cb468df5014d9ec3b944e66e139b12b4fe59b225d1a3676
data.block	26093771
data.ts	2026-10-01T00:06:47Z
data.chain	ethereum
data.kind	payout
data.amount	699928.30014
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0xdfcad9c8b6006e019b96f6fb557a5da585e42446
data.vault	near_intents
data.token	ethereum:usdt
data.address	0xdfcad9c8b6006e019b96f6fb557a5da585e42446
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0xdfcad9c8b6006e019b96f6fb557a5da585e42446
evidence.group.chain	ethereum
evidence.group.vault	near_intents
evidence.group.to_addr	0xdfcad9c8b6006e019b96f6fb557a5da585e42446
evidence.count	3
evidence.min_count	3
evidence.within	2h
evidence.window_sum	2499744.1005
evidence.burst_txs	0xc815d45607e85b25eddd7167783b57bf5a3604d1cd496449d59fe67dc5e62e55, 0x364d9494b46507d90b44651b34255a2128be011778586c4d0b7298ae8626016d, 0xb53480efe758077e3cb468df5014d9ec3b944e66e139b12b4fe59b225d1a3676
evidence.burst_started	2026-09-30T23:54:47Z
evidence.burst_span	0:12:00
evidence.prior_events	0
evidence.max_prior	3
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdt in ['usdt', 'usdc']
matched[3]	amount_usd=699928.30014 gt 250000
shield.capability	flag_observation
shield.scope	chain, bridge, token, address

2026-10-01 00:06:47

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

699,928.30 usdt to 0xdfcad9c8b6006e019b96f6fb557a5da585e42446, first seen 6h 12m ago (payout)

0xb53480ef...3676

Click a field to copy its value.

timestamp	2026-10-01T00:06:47Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0xb53480efe758077e3cb468df5014d9ec3b944e66e139b12b4fe59b225d1a3676
data.block	26093771
data.ts	2026-10-01T00:06:47Z
data.chain	ethereum
data.kind	payout
data.amount	699928.30014
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0xdfcad9c8b6006e019b96f6fb557a5da585e42446
data.vault	near_intents
data.token	ethereum:usdt
data.address	0xdfcad9c8b6006e019b96f6fb557a5da585e42446
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0xdfcad9c8b6006e019b96f6fb557a5da585e42446
evidence.address	0xdfcad9c8b6006e019b96f6fb557a5da585e42446
evidence.first_seen	2026-09-30T17:54:23Z
evidence.first_seen_tx	0xb8b10954d448be6388f8d2e463c50da54a83761073022d9591185b3af94f0bc5
evidence.first_seen_kind	payout
evidence.age	6:12:24
evidence.max_age	7d
evidence.history_start	2026-09-01T00:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=699928.30014 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-10-01 00:12:59

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

599,938.50 usdt to 0xdfcad9c8b6006e019b96f6fb557a5da585e42446, first seen 6h 18m ago (payout)

0xf8542b86...4ad0

Click a field to copy its value.

timestamp	2026-10-01T00:12:59Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0xf8542b861e48e882bf6909db53332929634d8d33be67b0d6d694b7a4a5a64ad0
data.block	26093802
data.ts	2026-10-01T00:12:59Z
data.chain	ethereum
data.kind	payout
data.amount	599938.50012
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0xdfcad9c8b6006e019b96f6fb557a5da585e42446
data.vault	near_intents
data.token	ethereum:usdt
data.address	0xdfcad9c8b6006e019b96f6fb557a5da585e42446
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0xdfcad9c8b6006e019b96f6fb557a5da585e42446
evidence.address	0xdfcad9c8b6006e019b96f6fb557a5da585e42446
evidence.first_seen	2026-09-30T17:54:23Z
evidence.first_seen_tx	0xb8b10954d448be6388f8d2e463c50da54a83761073022d9591185b3af94f0bc5
evidence.first_seen_kind	payout
evidence.age	6:18:36
evidence.max_age	7d
evidence.history_start	2026-09-01T00:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=599938.50012 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-10-01 00:24:02

BNB Chain

R1_VAULT_PAYOUT_SPIKETreasury drain

bsc hot_bridge paid 1,200,000 usdt to 0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37: 3.56x the 48h max of 336,749.37 exploit wallet (BscScan label: Near Intents Exploiter 1)

0x0381265d...8220

Click a field to copy its value.

timestamp	2026-10-01T00:24:02Z
rule.id	R1_VAULT_PAYOUT_SPIKE
rule.level	8
rule.severity	medium
rule.description	Treasury payout far above recent maximum
rule.groups	evm, treasury, payout, spike
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x0381265d6a1bb09de899f49f410a8b907cd548358a7e3c91076c3a52656b8220
data.block	125003957
data.ts	2026-10-01T00:24:02Z
data.chain	bsc
data.kind	payout
data.amount	1200000
data.symbol	usdt
data.from	0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
data.tx_submitter	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
data.vault	hot_bridge
data.token	bsc:usdt
data.address	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
scope.address	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
evidence.value_field	amount_usd
evidence.value	1200000
evidence.baseline_max	336749.365465541220672818
evidence.baseline_tx	0xbd6f7cc786d59a1b0f6cc2cc01e2b235c81bda44cbec12f2a6d56b2b1e2575df
evidence.baseline_ts	2026-09-30T13:36:11Z
evidence.baseline_window	48h
evidence.baseline_events	2021
evidence.ratio	3.56
evidence.factor	2.0
evidence.min_value	50000
matched[0]	kind=payout eq payout
matched[1]	vault=hot_bridge in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdt in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	chain, bridge, token

2026-10-01 00:24:02

BNB Chain

R3_TEST_THEN_DRAINTreasury drain

0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37 received a test payout 5h 26m before this 1,200,000 usdt payout exploit wallet (BscScan label: Near Intents Exploiter 1)

0x0381265d...8220

Click a field to copy its value.

timestamp	2026-10-01T00:24:02Z
rule.id	R3_TEST_THEN_DRAIN
rule.level	8
rule.severity	medium
rule.description	Small test payout followed by a large payout to the same recipient
rule.groups	evm, treasury, payout, sequence
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x0381265d6a1bb09de899f49f410a8b907cd548358a7e3c91076c3a52656b8220
data.block	125003957
data.ts	2026-10-01T00:24:02Z
data.chain	bsc
data.kind	payout
data.amount	1200000
data.symbol	usdt
data.from	0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
data.tx_submitter	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
data.vault	hot_bridge
data.token	bsc:usdt
data.address	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
scope.address	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
evidence.group.to_addr	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
evidence.within	24h
evidence.steps	[{"step": "test_payout", "tx": "0x4f426e23cda7ab58fd146f4f81489575563770c5d25b49d156870dc1dc1428d5", "ts": "2026-09-30T18:57:07Z", "amount": "10"}, {"step": "large_payout", "tx": "0x0381265d6a1bb09de899f49f410a8b907cd548358a7e3c91076c3a52656b8220", "ts": "2026-10-01T00:24:02Z", "amount": "1200000"}]
evidence.first_step_age	5:26:55
evidence.prior_events	[{"step": "test_payout", "tx": "0x4f426e23cda7ab58fd146f4f81489575563770c5d25b49d156870dc1dc1428d5", "ts": "2026-09-30T18:57:07Z", "amount": "10"}]
matched[0]	kind=payout eq payout
matched[1]	vault=hot_bridge in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdt in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	address

2026-10-01 00:24:02

BNB Chain

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

1,200,000 usdt to 0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37, first seen 5h 26m ago (payout) exploit wallet (BscScan label: Near Intents Exploiter 1)

0x0381265d...8220

Click a field to copy its value.

timestamp	2026-10-01T00:24:02Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x0381265d6a1bb09de899f49f410a8b907cd548358a7e3c91076c3a52656b8220
data.block	125003957
data.ts	2026-10-01T00:24:02Z
data.chain	bsc
data.kind	payout
data.amount	1200000
data.symbol	usdt
data.from	0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
data.tx_submitter	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
data.vault	hot_bridge
data.token	bsc:usdt
data.address	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
scope.address	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
evidence.address	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
evidence.first_seen	2026-09-30T18:57:07Z
evidence.first_seen_tx	0x4f426e23cda7ab58fd146f4f81489575563770c5d25b49d156870dc1dc1428d5
evidence.first_seen_kind	payout
evidence.age	5:26:55
evidence.max_age	7d
evidence.history_start	2026-09-01T00:00:14Z
matched[0]	kind=payout eq payout
matched[1]	vault=hot_bridge in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=1200000 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-10-01 00:50:42

BNB Chain

R10_RECIPIENT_PAYOUT_BURSTTreasury drain

hot_bridge on bsc paid 0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37 3 times over $250K in 56m 12s (3,500,000 usdt), 0 such payouts in the 7d before exploit wallet (BscScan label: Near Intents Exploiter 1)

0x69d1c68c...cceb

Click a field to copy its value.

timestamp	2026-10-01T00:50:42Z
rule.id	R10_RECIPIENT_PAYOUT_BURST
rule.level	8
rule.severity	medium
rule.description	Burst of large treasury payouts to one new counterparty
rule.groups	evm, treasury, payout, frequency
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x69d1c68c7e961a0199d3c9f3b6a31cb168ed775ef34b51a42762253ac1efcceb
data.block	125007511
data.ts	2026-10-01T00:50:42Z
data.chain	bsc
data.kind	payout
data.amount	1500000
data.symbol	usdt
data.from	0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
data.tx_submitter	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
data.vault	hot_bridge
data.token	bsc:usdt
data.address	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
scope.address	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
evidence.group.chain	bsc
evidence.group.vault	hot_bridge
evidence.group.to_addr	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
evidence.count	3
evidence.min_count	3
evidence.within	2h
evidence.window_sum	3500000
evidence.burst_txs	0x9fe58e031f73bbd880c782bc9e7446bcda32cadb304a729209871a4a81856c4c, 0x0381265d6a1bb09de899f49f410a8b907cd548358a7e3c91076c3a52656b8220, 0x69d1c68c7e961a0199d3c9f3b6a31cb168ed775ef34b51a42762253ac1efcceb
evidence.burst_started	2026-09-30T23:54:30Z
evidence.burst_span	0:56:12
evidence.prior_events	0
evidence.max_prior	3
matched[0]	kind=payout eq payout
matched[1]	vault=hot_bridge in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdt in ['usdt', 'usdc']
matched[3]	amount_usd=1500000 gt 250000
shield.capability	flag_observation
shield.scope	chain, bridge, token, address

2026-10-01 00:50:42

BNB Chain

R1_VAULT_PAYOUT_SPIKETreasury drain

bsc hot_bridge paid 1,500,000 usdt to 0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37: 4.45x the 48h max of 336,749.37 exploit wallet (BscScan label: Near Intents Exploiter 1)

0x69d1c68c...cceb

Click a field to copy its value.

timestamp	2026-10-01T00:50:42Z
rule.id	R1_VAULT_PAYOUT_SPIKE
rule.level	8
rule.severity	medium
rule.description	Treasury payout far above recent maximum
rule.groups	evm, treasury, payout, spike
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x69d1c68c7e961a0199d3c9f3b6a31cb168ed775ef34b51a42762253ac1efcceb
data.block	125007511
data.ts	2026-10-01T00:50:42Z
data.chain	bsc
data.kind	payout
data.amount	1500000
data.symbol	usdt
data.from	0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
data.tx_submitter	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
data.vault	hot_bridge
data.token	bsc:usdt
data.address	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
scope.address	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
evidence.value_field	amount_usd
evidence.value	1500000
evidence.baseline_max	336749.365465541220672818
evidence.baseline_tx	0xbd6f7cc786d59a1b0f6cc2cc01e2b235c81bda44cbec12f2a6d56b2b1e2575df
evidence.baseline_ts	2026-09-30T13:36:11Z
evidence.baseline_window	48h
evidence.baseline_events	2015
evidence.ratio	4.45
evidence.factor	2.0
evidence.min_value	50000
matched[0]	kind=payout eq payout
matched[1]	vault=hot_bridge in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdt in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	chain, bridge, token

2026-10-01 00:50:42

BNB Chain

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

1,500,000 usdt to 0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37, first seen 5h 53m ago (payout) exploit wallet (BscScan label: Near Intents Exploiter 1)

0x69d1c68c...cceb

Click a field to copy its value.

timestamp	2026-10-01T00:50:42Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x69d1c68c7e961a0199d3c9f3b6a31cb168ed775ef34b51a42762253ac1efcceb
data.block	125007511
data.ts	2026-10-01T00:50:42Z
data.chain	bsc
data.kind	payout
data.amount	1500000
data.symbol	usdt
data.from	0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
data.tx_submitter	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
data.vault	hot_bridge
data.token	bsc:usdt
data.address	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
scope.address	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
evidence.address	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
evidence.first_seen	2026-09-30T18:57:07Z
evidence.first_seen_tx	0x4f426e23cda7ab58fd146f4f81489575563770c5d25b49d156870dc1dc1428d5
evidence.first_seen_kind	payout
evidence.age	5:53:35
evidence.max_age	7d
evidence.history_start	2026-09-01T00:00:14Z
matched[0]	kind=payout eq payout
matched[1]	vault=hot_bridge in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=1500000 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-10-01 01:16:35

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

699,928.30 usdt to 0xdfcad9c8b6006e019b96f6fb557a5da585e42446, first seen 7h 22m ago (payout)

0xd2ec14b0...db41

Click a field to copy its value.

timestamp	2026-10-01T01:16:35Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0xd2ec14b0bfd107b132b2ad1e2883635293ea93655995768f5063a0c50cd7db41
data.block	26094119
data.ts	2026-10-01T01:16:35Z
data.chain	ethereum
data.kind	payout
data.amount	699928.30014
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0xdfcad9c8b6006e019b96f6fb557a5da585e42446
data.vault	near_intents
data.token	ethereum:usdt
data.address	0xdfcad9c8b6006e019b96f6fb557a5da585e42446
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0xdfcad9c8b6006e019b96f6fb557a5da585e42446
evidence.address	0xdfcad9c8b6006e019b96f6fb557a5da585e42446
evidence.first_seen	2026-09-30T17:54:23Z
evidence.first_seen_tx	0xb8b10954d448be6388f8d2e463c50da54a83761073022d9591185b3af94f0bc5
evidence.first_seen_kind	payout
evidence.age	7:22:12
evidence.max_age	7d
evidence.history_start	2026-09-01T00:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=699928.30014 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-10-01 01:36:59

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

629,934.58 usdt to 0xdfcad9c8b6006e019b96f6fb557a5da585e42446, first seen 7h 42m ago (payout)

0x649148e9...6234

Click a field to copy its value.

timestamp	2026-10-01T01:36:59Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x649148e94d9bb693d6c4c2deddb00b550c1e9cbfa4a51e582a815f3ebd9b6234
data.block	26094221
data.ts	2026-10-01T01:36:59Z
data.chain	ethereum
data.kind	payout
data.amount	629934.580432
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0xdfcad9c8b6006e019b96f6fb557a5da585e42446
data.vault	near_intents
data.token	ethereum:usdt
data.address	0xdfcad9c8b6006e019b96f6fb557a5da585e42446
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0xdfcad9c8b6006e019b96f6fb557a5da585e42446
evidence.address	0xdfcad9c8b6006e019b96f6fb557a5da585e42446
evidence.first_seen	2026-09-30T17:54:23Z
evidence.first_seen_tx	0xb8b10954d448be6388f8d2e463c50da54a83761073022d9591185b3af94f0bc5
evidence.first_seen_kind	payout
evidence.age	7:42:36
evidence.max_age	7d
evidence.history_start	2026-09-01T00:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=629934.580432 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-09-30 23:54:30

BNB Chain

R4_SELF_SUBMITTED_LARGE_PAYOUTTreasury drain

800,000 usdt payout to 0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37 was submitted by the recipient itself exploit wallet (BscScan label: Near Intents Exploiter 1)

0x9fe58e03...6c4c

Click a field to copy its value.

timestamp	2026-09-30T23:54:30Z
rule.id	R4_SELF_SUBMITTED_LARGE_PAYOUT
rule.level	5
rule.severity	low
rule.description	Large payout submitted by its own recipient
rule.groups	evm, treasury, payout, submitter
rule.tactic	Treasury drain
rule.weight	0.5 (score only)
data.tx	0x9fe58e031f73bbd880c782bc9e7446bcda32cadb304a729209871a4a81856c4c
data.block	125000023
data.ts	2026-09-30T23:54:30Z
data.chain	bsc
data.kind	payout
data.amount	800000
data.symbol	usdt
data.from	0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
data.tx_submitter	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
data.vault	hot_bridge
data.token	bsc:usdt
data.address	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
scope.address	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
matched[0]	kind=payout eq payout
matched[1]	vault=hot_bridge in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=800000 gt 100000
matched[3]	extra.tx_submitter=0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37 eq_field to_addr

2026-10-01 00:24:02

BNB Chain

R4_SELF_SUBMITTED_LARGE_PAYOUTTreasury drain

1,200,000 usdt payout to 0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37 was submitted by the recipient itself exploit wallet (BscScan label: Near Intents Exploiter 1)

0x0381265d...8220

Click a field to copy its value.

timestamp	2026-10-01T00:24:02Z
rule.id	R4_SELF_SUBMITTED_LARGE_PAYOUT
rule.level	5
rule.severity	low
rule.description	Large payout submitted by its own recipient
rule.groups	evm, treasury, payout, submitter
rule.tactic	Treasury drain
rule.weight	0.5 (score only)
data.tx	0x0381265d6a1bb09de899f49f410a8b907cd548358a7e3c91076c3a52656b8220
data.block	125003957
data.ts	2026-10-01T00:24:02Z
data.chain	bsc
data.kind	payout
data.amount	1200000
data.symbol	usdt
data.from	0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
data.tx_submitter	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
data.vault	hot_bridge
data.token	bsc:usdt
data.address	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
scope.address	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
matched[0]	kind=payout eq payout
matched[1]	vault=hot_bridge in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=1200000 gt 100000
matched[3]	extra.tx_submitter=0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37 eq_field to_addr

2026-10-01 00:50:42

BNB Chain

R4_SELF_SUBMITTED_LARGE_PAYOUTTreasury drain

1,500,000 usdt payout to 0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37 was submitted by the recipient itself exploit wallet (BscScan label: Near Intents Exploiter 1)

0x69d1c68c...cceb

Click a field to copy its value.

timestamp	2026-10-01T00:50:42Z
rule.id	R4_SELF_SUBMITTED_LARGE_PAYOUT
rule.level	5
rule.severity	low
rule.description	Large payout submitted by its own recipient
rule.groups	evm, treasury, payout, submitter
rule.tactic	Treasury drain
rule.weight	0.5 (score only)
data.tx	0x69d1c68c7e961a0199d3c9f3b6a31cb168ed775ef34b51a42762253ac1efcceb
data.block	125007511
data.ts	2026-10-01T00:50:42Z
data.chain	bsc
data.kind	payout
data.amount	1500000
data.symbol	usdt
data.from	0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
data.tx_submitter	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
data.vault	hot_bridge
data.token	bsc:usdt
data.address	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
scope.address	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
matched[0]	kind=payout eq payout
matched[1]	vault=hot_bridge in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=1500000 gt 100000
matched[3]	extra.tx_submitter=0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37 eq_field to_addr

2026-10-01 01:46:20

BNB Chain

R4_SELF_SUBMITTED_LARGE_PAYOUTTreasury drain

330,000 usdt payout to 0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37 was submitted by the recipient itself exploit wallet (BscScan label: Near Intents Exploiter 1)

0x9c10b967...003a

Click a field to copy its value.

timestamp	2026-10-01T01:46:20Z
rule.id	R4_SELF_SUBMITTED_LARGE_PAYOUT
rule.level	5
rule.severity	low
rule.description	Large payout submitted by its own recipient
rule.groups	evm, treasury, payout, submitter
rule.tactic	Treasury drain
rule.weight	0.5 (score only)
data.tx	0x9c10b967da0c85631ec105e3b322c0a851fcd01b69ff390ff58f860e5cce003a
data.block	125014927
data.ts	2026-10-01T01:46:20Z
data.chain	bsc
data.kind	payout
data.amount	330000
data.symbol	usdt
data.from	0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
data.tx_submitter	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
data.vault	hot_bridge
data.token	bsc:usdt
data.address	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
scope.address	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37
matched[0]	kind=payout eq payout
matched[1]	vault=hot_bridge in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=330000 gt 100000
matched[3]	extra.tx_submitter=0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37 eq_field to_addr

Incidents

4 incidents with alerts in the window, highest mode first. Each is SHIELD-shaped (intentwatch.incident/v1, unofficial: SHIELD's Incident API is partner-only). Alerts sharing an asset or address within 24h are one incident; two high alerts on different transactions within 2h escalate it to under_attack, unless all of them come from a rate rule (R2), which moves it onto the route and stops at paranoid.

On NEAR: incidents at paranoid or above are written to the IntentWatch incident registry registry.surs51.testnet (testnet, deployed) by a detector that holds only a function-call key limited to report_incident with a 0.25 NEAR gas allowance (read from chain 2026-10-31 19:05:23 UTC: least privilege ok). No model is connected: the summary module is ready to connect and has recorded nothing for this replay.

Agent guard wallet on testnet

The contract (contracts/agent_guard, Rust near-sdk) holds an AI agent's funds. Its only key for the agent is a function-call key limited to request_transfer (read from chain 2026-11-04 15:47:30 UTC: least privilege ok). It enforces 0.1 NEAR per transfer and 0.5 NEAR per day, then asks the incident registry about the route the agent declares and the account the money really goes to: under_attack or a paused destination is refused, paranoid is held for 60 min and re-checked, and any trouble reaching the registry is a refusal. Deployed at guard.surs51.testnet (tx). Code upgraded 2026-11-01 16:37:35 UTC (tx); a receipt recorded before that is an answer of the earlier build. Code upgraded 2026-11-04 15:46:26 UTC (tx); a receipt recorded before that is an answer of the earlier build. The "Contract answers" column comes from a mirror of the contract logic, tested against the contracts with shared vectors, assuming the detector reported each escalation as it happened; the receipts column is what the deployed contract answered on testnet, and intentwatch guard verify reads those back from chain. The chain, bridge and token are what the agent declares: an agent that lies about them and pays an account nobody has flagged is bounded by the limits only, unless the owner has set an allowlist of receivers, which the contract checks first, along with the owner's stop switch and hourly cap. Click a row for the exact call the agent signs.

Moment (UTC)	Agent asks	Declared route and real receiver	Contract answers	Testnet receipt
2026-09-29 16:14	Payment on the route, once it is paranoid 0.01 NEAR	bsc/hot/usdt 0x00000000...11ce really pays supplier.t...tnet	held route is paranoid (incident IW-20260929-160935-07515e): held until the delay ends	needs an earlier report
The `request_transfer` call the agent signs { "args": { "amount": "10000000000000000000000", "receiver_id": "supplier.testnet", "route": { "address": "0x00000000000000000000000000000000000a11ce", "bridge": "hot", "chain": "bsc", "token": "usdt" } }, "deposit": "0", "gas_tgas": 100, "method": "request_transfer", "receiver_id": "guard.surs51.testnet" }
2026-09-30 18:57	Payment on the route, now under_attack 0.01 NEAR	bsc/hot/usdt 0x00000000...11ce really pays surs51.testnet	refused route is under_attack (incident IW-20260929-160935-07515e)	refused 8FghMZpmKa...He9Y
The `request_transfer` call the agent signs { "args": { "amount": "10000000000000000000000", "receiver_id": "surs51.testnet", "route": { "address": "0x00000000000000000000000000000000000a11ce", "bridge": "hot", "chain": "bsc", "token": "usdt" } }, "deposit": "0", "gas_tgas": 100, "method": "request_transfer", "receiver_id": "guard.surs51.testnet" }
2026-09-30 18:57	The same payment on a route nothing covers 0.01 NEAR	ethereum/near_intents/usdc 0x00000000...11ce really pays surs51.testnet	sent route clear, within limits	sent 4DSpDZagW7...bzCA
The `request_transfer` call the agent signs { "args": { "amount": "10000000000000000000000", "receiver_id": "surs51.testnet", "route": { "address": "0x00000000000000000000000000000000000a11ce", "bridge": "near_intents", "chain": "ethereum", "token": "usdc" } }, "deposit": "0", "gas_tgas": 100, "method": "request_transfer", "receiver_id": "guard.surs51.testnet" }
2026-09-30 18:57	A payment that declares a paused destination 0.01 NEAR	ethereum/near_intents/usdc 0x09fd1f5d...ad37 really pays surs51.testnet	refused destination is paused (incident IW-20260929-160935-07515e)	refused Fu2n1ThxXF...uWNH
The `request_transfer` call the agent signs { "args": { "amount": "10000000000000000000000", "receiver_id": "surs51.testnet", "route": { "address": "0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37", "bridge": "near_intents", "chain": "ethereum", "token": "usdc" } }, "deposit": "0", "gas_tgas": 100, "method": "request_transfer", "receiver_id": "guard.surs51.testnet" }
2026-09-30 18:57	A payment that really goes to a paused destination, behind a clean declared route 0.01 NEAR	ethereum/near_intents/usdc 0x00000000...11ce really pays 0x09fd1f5d...ad37	refused the receiving account is a paused destination (incident IW-20260929-160935-07515e)	refused H2YQzCfJSp...56Qq
The `request_transfer` call the agent signs { "args": { "amount": "10000000000000000000000", "receiver_id": "0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37", "route": { "address": "0x00000000000000000000000000000000000a11ce", "bridge": "near_intents", "chain": "ethereum", "token": "usdc" } }, "deposit": "0", "gas_tgas": 100, "method": "request_transfer", "receiver_id": "guard.surs51.testnet" }
2026-09-30 18:57	A payment over the per-transfer limit 0.2 NEAR	ethereum/near_intents/usdc 0x00000000...11ce really pays surs51.testnet	refused amount exceeds the per-transfer limit	refused 2LXCMG3o2K...zUdG
The `request_transfer` call the agent signs { "args": { "amount": "200000000000000000000000", "receiver_id": "surs51.testnet", "route": { "address": "0x00000000000000000000000000000000000a11ce", "bridge": "near_intents", "chain": "ethereum", "token": "usdc" } }, "deposit": "0", "gas_tgas": 100, "method": "request_transfer", "receiver_id": "guard.surs51.testnet" }
2026-09-30 18:57	A payment to a fresh account, with the owner's allowlist on 0.01 NEAR	ethereum/near_intents/usdc 0x00000000...11ce really pays 5fd214f06a...f46a owner allows only surs51.testnet	refused the receiver is not on the owner's allowlist	refused FvmP6yX4y7...Emq5
The `request_transfer` call the agent signs { "args": { "amount": "10000000000000000000000", "receiver_id": "5fd214f06a0de3e6bcdf6f325ab29b494f9904f491c24e1db62c9069fdb0f46a", "route": { "address": "0x00000000000000000000000000000000000a11ce", "bridge": "near_intents", "chain": "ethereum", "token": "usdc" } }, "deposit": "0", "gas_tgas": 100, "method": "request_transfer", "receiver_id": "guard.surs51.testnet" }

under attack IW-20260929-160935-07515e critical 120 alerts · score 328.5 · BNB Chain, Ethereum, NEAR · opened 2026-09-29 16:09:35 UTC · active 37h 58m show ▾hide ▴

normal

09-29 16:09

paranoid

09-29 16:14

under attack

09-29 17:02

Recommended capability: raise_mode
Scope: chain: bscbridge: hottoken: anyaddress: any
Opened by: R6C_EXTREME_TOKEN_AMOUNT
Flagged stablecoin payouts: 9 totalling 3,865,021 USD

On-chain record hash matches

Report #0 in registry.surs51.testnet (testnet), block 275640462, 2026-10-31 19:06:03 UTC. Tx A4owYrZAKP7Q...5xxe, signed with the detector's function-call key.

The incident hash recomputed from this replay, a884bb172edd701b...b8d6, equals the stored one.

Model-written summary none recorded

Not recorded for this replay. intentwatch triage record asks a NEAR-hosted TEE model for a summary and stores the evidence (response signature, Intel TDX quote and collateral, NVIDIA GPU verdict) that the replay then re-verifies offline. It needs a NEAR AI Cloud key.

Rules in this incident

15R8_DEPOSIT_LEDGER_MISMATCH×2315R8B_UNBACKED_CREDIT_WITHDRAWN×2212R6_INTENTS_CALLBACK_ANOMALY×4612R9B_PAYOUT_FROM_FLAGGED_NEAR_ACCOUNT×712R1B_PAYOUT_SPIKE_TO_NEW_RECIPIENT×312R3B_SELF_SUBMITTED_TEST_THEN_DRAIN×212R2_VAULT_OUTFLOW_VELOCITY×112R7B_TAINTED_PAYOUT×28R6C_EXTREME_TOKEN_AMOUNT×18R1_VAULT_PAYOUT_SPIKE×38R3_TEST_THEN_DRAIN×28R5_NEW_RECIPIENT_LARGE_PAYOUT×38R10_RECIPIENT_PAYOUT_BURST×15R4_SELF_SUBMITTED_LARGE_PAYOUT×4

Mode changes and actions click a row for the alerts that led to it

Time (UTC)	Change	Reason
2026-09-29 16:09:35	normal	1 observation(s)
2026-09-29 16:14:22	paranoid	high alert R6_INTENTS_CALLBACK_ANOMALY
2026-09-29 17:02:32	under attack	high alerts on 2 transactions within 2h (R6_INTENTS_CALLBACK_ANOMALY, R8_DEPOSIT_LEDGER_MISMATCH)
2026-09-30 18:57:07	pause destination	0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37 (R9B_PAYOUT_FROM_FLAGGED_NEAR_ACCOUNT on bsc)

Raw incident JSON (alert evidence omitted: see Events, or incidents.jsonl)

{
  "schema": "intentwatch.incident/v1 (shield-compatible, unofficial)",
  "incident_id": "IW-20260929-160935-07515e",
  "opened_at": "2026-09-29T16:09:35.349391Z",
  "updated_at": "2026-10-01T06:08:26Z",
  "recommended_mode": "under_attack",
  "capability": "raise_mode",
  "scope": {
    "chain": "bsc",
    "bridge": "hot",
    "token": null,
    "address": null
  },
  "score": 328.5,
  "max_severity": "critical",
  "mode_history": [
    {
      "ts": "2026-09-29T16:09:35.349391Z",
      "mode": "normal",
      "capability": "flag_observation",
      "scope": {
        "chain": "near",
        "bridge": null,
        "token": null,
        "address": "20e6bfe4685d99004fc2095d3a0fc6158cd810ce8f801196141e183ed6e19d65"
      },
      "reason": "1 observation(s)",
      "alert_id": "R6C_EXTREME_TOKEN_AMOUNT:472ff3fe6b46"
    },
    {
      "ts": "2026-09-29T16:14:22.056408Z",
      "mode": "paranoid",
      "capability": "raise_mode",
      "scope": {
        "chain": "bsc",
        "bridge": "hot",
        "token": "usdt",
        "address": null
      },
      "reason": "high alert R6_INTENTS_CALLBACK_ANOMALY",
      "alert_id": "R8_DEPOSIT_LEDGER_MISMATCH:b0c0177c31f4"
    },
    {
      "ts": "2026-09-29T17:02:32.262974Z",
      "mode": "under_attack",
      "capability": "raise_mode",
      "scope": {
        "chain": "bsc",
        "bridge": "hot",
        "token": null,
        "address": null
      },
      "reason": "high alerts on 2 transactions within 2h (R6_INTENTS_CALLBACK_ANOMALY, R8_DEPOSIT_LEDGER_MISMATCH)",
      "alert_id": "R6_INTENTS_CALLBACK_ANOMALY:ba72775681c3"
    }
  ],
  "recommended_actions": [
    {
      "ts": "2026-09-30T18:57:07Z",
      "capability": "pause_destination",
      "scope": {
        "chain": null,
        "bridge": null,
        "token": null,
        "address": "0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37"
      },
      "reason": "R9B_PAYOUT_FROM_FLAGGED_NEAR_ACCOUNT on bsc",
      "alert_id": "R9B_PAYOUT_FROM_FLAGGED_NEAR_ACCOUNT:75a20980c729"
    }
  ],
  "alerts": [
    {
      "alert_id": "R6C_EXTREME_TOKEN_AMOUNT:472ff3fe6b46",
      "rule": "R6C_EXTREME_TOKEN_AMOUNT",
      "severity": "medium",
      "ts": "2026-09-29T16:09:35.349391Z",
      "tx": "FmwaoRNDU6BubkHZFy3ucSPpXVUrGUWkRVQwJAiJZZi3"
    },
    {
      "alert_id": "R6_INTENTS_CALLBACK_ANOMALY:bea7c1f65c97",
      "rule": "R6_INTENTS_CALLBACK_ANOMALY",
      "severity": "high",
      "ts": "2026-09-29T16:14:20.346572Z",
      "tx": "3k91uDpUiezxUe7hBgAR7kc3TBkToMZKGAiv6GqbtKiC"
    },
    {
      "alert_id": "R6_INTENTS_CALLBACK_ANOMALY:f70b6aa2c4ef",
      "rule": "R6_INTENTS_CALLBACK_ANOMALY",
      "severity": "high",
      "ts": "2026-09-29T16:14:21.562861Z",
      "tx": "3k91uDpUiezxUe7hBgAR7kc3TBkToMZKGAiv6GqbtKiC"
    },
    {
      "alert_id": "R8_DEPOSIT_LEDGER_MISMATCH:b0c0177c31f4",
      "rule": "R8_DEPOSIT_LEDGER_MISMATCH",
      "severity": "critical",
      "ts": "2026-09-29T16:14:22.056408Z",
      "tx": "3k91uDpUiezxUe7hBgAR7kc3TBkToMZKGAiv6GqbtKiC"
    },
    {
      "alert_id": "R6_INTENTS_CALLBACK_ANOMALY:ba72775681c3",
      "rule": "R6_INTENTS_CALLBACK_ANOMALY",
      "severity": "high",
      "ts": "2026-09-29T17:02:32.262974Z",
      "tx": "41Xh35y2ZpGNBzwcDzJDfF5NzJxPfM8dx2A25gzZAd52"
    },
    {
      "alert_id": "R6_INTENTS_CALLBACK_ANOMALY:973e3611fe12",
      "rule": "R6_INTENTS_CALLBACK_ANOMALY",
      "severity": "high",
      "ts": "2026-09-29T17:02:33.752140Z",
      "tx": "41Xh35y2ZpGNBzwcDzJDfF5NzJxPfM8dx2A25gzZAd52"
    },
    {
      "alert_id": "R8_DEPOSIT_LEDGER_MISMATCH:17209811e7e7",
      "rule": "R8_DEPOSIT_LEDGER_MISMATCH",
      "severity": "critical",
      "ts": "2026-09-29T17:02:34.146789Z",
      "tx": "41Xh35y2ZpGNBzwcDzJDfF5NzJxPfM8dx2A25gzZAd52"
    },
    {
      "alert_id": "R8B_UNBACKED_CREDIT_WITHDRAWN:1702d7933e09",
      "rule": "R8B_UNBACKED_CREDIT_WITHDRAWN",
      "severity": "critical",
      "ts": "2026-09-29T23:30:41.848414Z",
      "tx": "83XUi7kEqVXQERUJSZTVS2PNk4YtdG2QR1tr8hScWsyg"
    },
    {
      "alert_id": "R6_INTENTS_CALLBACK_ANOMALY:313cfd4c87d8",
      "rule": "R6_INTENTS_CALLBACK_ANOMALY",
      "severity": "high",
      "ts": "2026-09-30T00:04:14.433899Z",
      "tx": "Hjtr43MGF1t3KRDx9hPcGkSo3CGLdnY46iQKzM5X7Nk2"
    },
    {
      "alert_id": "R6_INTENTS_CALLBACK_ANOMALY:ee37748c8148",
      "rule": "R6_INTENTS_CALLBACK_ANOMALY",
      "severity": "high",
      "ts": "2026-09-30T00:04:15.422172Z",
      "tx": "Hjtr43MGF1t3KRDx9hPcGkSo3CGLdnY46iQKzM5X7Nk2"
    },
    {
      "alert_id": "R8_DEPOSIT_LEDGER_MISMATCH:a722afb26a03",
      "rule": "R8_DEPOSIT_LEDGER_MISMATCH",
      "severity": "critical",
      "ts": "2026-09-30T00:04:16.056645Z",
      "tx": "Hjtr43MGF1t3KRDx9hPcGkSo3CGLdnY46iQKzM5X7Nk2"
    },
    {
      "alert_id": "R8B_UNBACKED_CREDIT_WITHDRAWN:a4d712fcec2d",
      "rule": "R8B_UNBACKED_CREDIT_WITHDRAWN",
      "severity": "critical",
      "ts": "2026-09-30T00:06:02.189926Z",
      "tx": "CHPN9RWFnhFdD4WsPXYWJPfyWm7awZpEyJTH8CxCpmgG"
    },
    {
      "alert_id": "R6_INTENTS_CALLBACK_ANOMALY:d67893fa0291",
      "rule": "R6_INTENTS_CALLBACK_ANOMALY",
      "severity": "high",
      "ts": "2026-09-30T00:10:30.585479Z",
      "tx": "AQcebAk5oayzLHjwFW7TSTVkv5xA1FTQ2pRYExCB5yAD"
    },
    {
      "alert_id": "R6_INTENTS_CALLBACK_ANOMALY:ebbdff47e72c",
      "rule": "R6_INTENTS_CALLBACK_ANOMALY",
      "severity": "high",
      "ts": "2026-09-30T00:10:31.781623Z",
      "tx": "AQcebAk5oayzLHjwFW7TSTVkv5xA1FTQ2pRYExCB5yAD"
    },
    {
      "alert_id": "R8_DEPOSIT_LEDGER_MISMATCH:1f157d49d925",
      "rule": "R8_DEPOSIT_LEDGER_MISMATCH",
      "severity": "critical",
      "ts": "2026-09-30T00:10:32.452837Z",
      "tx": "AQcebAk5oayzLHjwFW7TSTVkv5xA1FTQ2pRYExCB5yAD"
    },
    {
      "alert_id": "R8B_UNBACKED_CREDIT_WITHDRAWN:6f1c8cd97821",
      "rule": "R8B_UNBACKED_CREDIT_WITHDRAWN",
      "severity": "critical",
      "ts": "2026-09-30T00:12:22.098975Z",
      "tx": "8RkKNzQWrTPf8Vgkbpi9yiBSHHDagFHzQsj5raykfcZj"
    },
    {
      "alert_id": "R6_INTENTS_CALLBACK_ANOMALY:4f92ac2d80ba",
      "rule": "R6_INTENTS_CALLBACK_ANOMALY",
      "severity": "high",
      "ts": "2026-09-30T00:16:45.474899Z",
      "tx": "GE3bQobJVsiCHftwDhH7AMQAjDGRUAMenFVpnaYXF68B"
    },
    {
      "alert_id": "R6_INTENTS_CALLBACK_ANOMALY:01c03dcc1fd3",
      "rule": "R6_INTENTS_CALLBACK_ANOMALY",
      "severity": "high",
      "ts": "2026-09-30T00:16:47.061902Z",
      "tx": "GE3bQobJVsiCHftwDhH7AMQAjDGRUAMenFVpnaYXF68B"
    },
    {
      "alert_id": "R8_DEPOSIT_LEDGER_MISMATCH:afc438ab142f",
      "rule": "R8_DEPOSIT_LEDGER_MISMATCH",
      "severity": "critical",
      "ts": "2026-09-30T00:16:47.380962Z",
      "tx": "GE3bQobJVsiCHftwDhH7AMQAjDGRUAMenFVpnaYXF68B"
    },
    {
      "alert_id": "R8B_UNBACKED_CREDIT_WITHDRAWN:886b5607a850",
      "rule": "R8B_UNBACKED_CREDIT_WITHDRAWN",
      "severity": "critical",
      "ts": "2026-09-30T00:18:43.181179Z",
      "tx": "AReNEihDz9tUEPRfQ1771SXthkCNynxHWUTUBz67fREY"
    },
    {
      "alert_id": "R6_INTENTS_CALLBACK_ANOMALY:0f2a838d4d23",
      "rule": "R6_INTENTS_CALLBACK_ANOMALY",
      "severity": "high",
      "ts": "2026-09-30T00:26:09.383211Z",
      "tx": "Gai9wo8FFQRdLdS6DjqZf1NCPZDLkCB6dk3Fv2H6VdGX"
    },
    {
      "alert_id": "R6_INTENTS_CALLBACK_ANOMALY:da28dc15c0ac",
      "rule": "R6_INTENTS_CALLBACK_ANOMALY",
      "severity": "high",
      "ts": "2026-09-30T00:26:10.272942Z",
      "tx": "Gai9wo8FFQRdLdS6DjqZf1NCPZDLkCB6dk3Fv2H6VdGX"
    },
    {
      "alert_id": "R8_DEPOSIT_LEDGER_MISMATCH:b648d8bad8b3",
      "rule": "R8_DEPOSIT_LEDGER_MISMATCH",
      "severity": "critical",
      "ts": "2026-09-30T00:26:10.893193Z",
      "tx": "Gai9wo8FFQRdLdS6DjqZf1NCPZDLkCB6dk3Fv2H6VdGX"
    },
    {
      "alert_id": "R8B_UNBACKED_CREDIT_WITHDRAWN:7f6baeab93f7",
      "rule": "R8B_UNBACKED_CREDIT_WITHDRAWN",
      "severity": "critical",
      "ts": "2026-09-30T00:28:38.786158Z",
      "tx": "AxbQpdbdGC9pXh9H4f5qNwN1Fj3ctneQ3pmyRZ6AWGMu"
    },
    {
      "alert_id": "R6_INTENTS_CALLBACK_ANOMALY:a44bb79334d1",
      "rule": "R6_INTENTS_CALLBACK_ANOMALY",
      "severity": "high",
      "ts": "2026-09-30T00:32:32.789238Z",
      "tx": "7Ay6C2g5oK8HpkfvEbiez6BnSTrktvAytVmdUCL8fCKq"
    },
    {
      "alert_id": "R6_INTENTS_CALLBACK_ANOMALY:ec3581491748",
      "rule": "R6_INTENTS_CALLBACK_ANOMALY",
      "severity": "high",
      "ts": "2026-09-30T00:32:34.102117Z",
      "tx": "7Ay6C2g5oK8HpkfvEbiez6BnSTrktvAytVmdUCL8fCKq"
    },
    {
      "alert_id": "R8_DEPOSIT_LEDGER_MISMATCH:726d7ca882b7",
      "rule": "R8_DEPOSIT_LEDGER_MISMATCH",
      "severity": "critical",
      "ts": "2026-09-30T00:32:34.694199Z",
      "tx": "7Ay6C2g5oK8HpkfvEbiez6BnSTrktvAytVmdUCL8fCKq"
    },
    {
      "alert_id": "R8B_UNBACKED_CREDIT_WITHDRAWN:1dcbe09ec1fc",
      "rule": "R8B_UNBACKED_CREDIT_WITHDRAWN",
      "severity": "critical",
      "ts": "2026-09-30T00:34:43.390342Z",
      "tx": "3hmhHHm1jyYFfnWAMFVpCSGNGUPsSAqBEZGeMWfJ4BPt"
    },
    {
      "alert_id": "R6_INTENTS_CALLBACK_ANOMALY:ca007f196cc4",
      "rule": "R6_INTENTS_CALLBACK_ANOMALY",
      "severity": "high",
      "ts": "2026-09-30T00:38:34.057208Z",
      "tx": "2GQ2zQzCzDefNf1czyJYQUwHAjcHYTYPYZicLbdLqVWb"
    },
    {
      "alert_id": "R6_INTENTS_CALLBACK_ANOMALY:b4fa7840aa4a",
      "rule": "R6_INTENTS_CALLBACK_ANOMALY",
      "severity": "high",
      "ts": "2026-09-30T00:38:35.307839Z",
      "tx": "2GQ2zQzCzDefNf1czyJYQUwHAjcHYTYPYZicLbdLqVWb"
    },
    {
      "alert_id": "R8_DEPOSIT_LEDGER_MISMATCH:3eb60382a3f1",
      "rule": "R8_DEPOSIT_LEDGER_MISMATCH",
      "severity": "critical",
      "ts": "2026-09-30T00:38:35.837685Z",
      "tx": "2GQ2zQzCzDefNf1czyJYQUwHAjcHYTYPYZicLbdLqVWb"
    },
    {
      "alert_id": "R8B_UNBACKED_CREDIT_WITHDRAWN:bbab49c0b531",
      "rule": "R8B_UNBACKED_CREDIT_WITHDRAWN",
      "severity": "critical",
      "ts": "2026-09-30T01:19:15.803850Z",
      "tx": "F2ZsMS5ojXSeEvdTPNNbLSXHkrweZoN4PntaDCjCgnph"
    },
    {
      "alert_id": "R9B_PAYOUT_FROM_FLAGGED_NEAR_ACCOUNT:75a20980c729",
      "rule": "R9B_PAYOUT_FROM_FLAGGED_NEAR_ACCOUNT",
      "severity": "high",
      "ts": "2026-09-30T18:57:07Z",
      "tx": "0x4f426e23cda7ab58fd146f4f81489575563770c5d25b49d156870dc1dc1428d5"
    },
    {
      "alert_id": "R9B_PAYOUT_FROM_FLAGGED_NEAR_ACCOUNT:2a773bf54501",
      "rule": "R9B_PAYOUT_FROM_FLAGGED_NEAR_ACCOUNT",
      "severity": "high",
      "ts": "2026-09-30T20:05:24Z",
      "tx": "0xc002bd17fb1d46833088c4deb2e05949fc33bdbd9f95ff53295af0c8f68bfdbf"
    },
    {
      "alert_id": "R6_INTENTS_CALLBACK_ANOMALY:035556e1594d",
      "rule": "R6_INTENTS_CALLBACK_ANOMALY",
      "severity": "high",
      "ts": "2026-09-30T20:15:31.436731Z",
      "tx": "B8qntq8eHyL7wgXcEjS1iPHDDnG86xpC1nqKH5FgRt3U"
    },
    {
      "alert_id": "R6_INTENTS_CALLBACK_ANOMALY:1724d8a34d14",
      "rule": "R6_INTENTS_CALLBACK_ANOMALY",
      "severity": "high",
      "ts": "2026-09-30T20:15:32.641435Z",
      "tx": "B8qntq8eHyL7wgXcEjS1iPHDDnG86xpC1nqKH5FgRt3U"
    },
    {
      "alert_id": "R8_DEPOSIT_LEDGER_MISMATCH:afe9712853b5",
      "rule": "R8_DEPOSIT_LEDGER_MISMATCH",
      "severity": "critical",
      "ts": "2026-09-30T20:15:33.203504Z",
      "tx": "B8qntq8eHyL7wgXcEjS1iPHDDnG86xpC1nqKH5FgRt3U"
    },
    {
      "alert_id": "R8B_UNBACKED_CREDIT_WITHDRAWN:e754bae1aea6",
      "rule": "R8B_UNBACKED_CREDIT_WITHDRAWN",
      "severity": "critical",
      "ts": "2026-09-30T20:17:57.083156Z",
      "tx": "BAheBBV6UdpgVo2Nw7tcgrygNkUVbgiEq4iKcXmps8yB"
    },
    {
      "alert_id": "R6_INTENTS_CALLBACK_ANOMALY:d86c58941276",
      "rule": "R6_INTENTS_CALLBACK_ANOMALY",
      "severity": "high",
      "ts": "2026-09-30T22:45:07.635694Z",
      "tx": "GHM8RaBBrSWPmvoWZwewboYcYdQwkrQ3UMrFJqNjrGN3"
    },
    {
      "alert_id": "R6_INTENTS_CALLBACK_ANOMALY:5b6745e2f006",
      "rule": "R6_INTENTS_CALLBACK_ANOMALY",
      "severity": "high",
      "ts": "2026-09-30T22:45:08.859185Z",
      "tx": "GHM8RaBBrSWPmvoWZwewboYcYdQwkrQ3UMrFJqNjrGN3"
    },
    {
      "alert_id": "R8_DEPOSIT_LEDGER_MISMATCH:2b1390f5a604",
      "rule": "R8_DEPOSIT_LEDGER_MISMATCH",
      "severity": "critical",
      "ts": "2026-09-30T22:45:09.508442Z",
      "tx": "GHM8RaBBrSWPmvoWZwewboYcYdQwkrQ3UMrFJqNjrGN3"
    },
    {
      "alert_id": "R8B_UNBACKED_CREDIT_WITHDRAWN:9c1e2698c52f",
      "rule": "R8B_UNBACKED_CREDIT_WITHDRAWN",
      "severity": "critical",
      "ts": "2026-09-30T22:47:51.534848Z",
      "tx": "Dcv6DategDyCmQ6tYUR15PwoampWV5pJGGnSEk9bMvNb"
    },
    {
      "alert_id": "R6_INTENTS_CALLBACK_ANOMALY:948ed508228a",
      "rule": "R6_INTENTS_CALLBACK_ANOMALY",
      "severity": "high",
      "ts": "2026-09-30T22:51:18.085023Z",
      "tx": "8ehzw7rsNxXJLvfQLmmbmLagSNKfRE5V4vxcoPVCmx6g"
    },
    {
      "alert_id": "R6_INTENTS_CALLBACK_ANOMALY:8faf5ca05ad4",
      "rule": "R6_INTENTS_CALLBACK_ANOMALY",
      "severity": "high",
      "ts": "2026-09-30T22:51:19.181039Z",
      "tx": "8ehzw7rsNxXJLvfQLmmbmLagSNKfRE5V4vxcoPVCmx6g"
    },
    {
      "alert_id": "R8_DEPOSIT_LEDGER_MISMATCH:f347cf2ee78e",
      "rule": "R8_DEPOSIT_LEDGER_MISMATCH",
      "severity": "critical",
      "ts": "2026-09-30T22:51:19.750148Z",
      "tx": "8ehzw7rsNxXJLvfQLmmbmLagSNKfRE5V4vxcoPVCmx6g"
    },
    {
      "alert_id": "R8B_UNBACKED_CREDIT_WITHDRAWN:5723ed882127",
      "rule": "R8B_UNBACKED_CREDIT_WITHDRAWN",
      "severity": "critical",
      "ts": "2026-09-30T22:53:46.089850Z",
      "tx": "6z3oigyUV1YSQyY27exTGYYuQHfktaP3qL9peVU5XTDX"
    },
    {
      "alert_id": "R6_INTENTS_CALLBACK_ANOMALY:eed812690ec0",
      "rule": "R6_INTENTS_CALLBACK_ANOMALY",
      "severity": "high",
      "ts": "2026-09-30T22:59:57.239758Z",
      "tx": "8CteieSk8whDSERy5ceBx1L7LWMhaAx9eM7m6QUrmhYX"
    },
    {
      "alert_id": "R6_INTENTS_CALLBACK_ANOMALY:fb772c9b29d2",
      "rule": "R6_INTENTS_CALLBACK_ANOMALY",
      "severity": "high",
      "ts": "2026-09-30T22:59:58.369538Z",
      "tx": "8CteieSk8whDSERy5ceBx1L7LWMhaAx9eM7m6QUrmhYX"
    },
    {
      "alert_id": "R8_DEPOSIT_LEDGER_MISMATCH:d70ed292d116",
      "rule": "R8_DEPOSIT_LEDGER_MISMATCH",
      "severity": "critical",
      "ts": "2026-09-30T22:59:59.051113Z",
      "tx": "8CteieSk8whDSERy5ceBx1L7LWMhaAx9eM7m6QUrmhYX"
    },
    {
      "alert_id": "R8B_UNBACKED_CREDIT_WITHDRAWN:80e6220806de",
      "rule": "R8B_UNBACKED_CREDIT_WITHDRAWN",
      "severity": "critical",
      "ts": "2026-09-30T23:11:38.867522Z",
      "tx": "GppzthfzF1iyyQmQrxMCcsrZMqN7W16vw2Pkjtnkd4sf"
    },
    {
      "alert_id": "R6_INTENTS_CALLBACK_ANOMALY:088ffa94c611",
      "rule": "R6_INTENTS_CALLBACK_ANOMALY",
      "severity": "high",
      "ts": "2026-09-30T23:15:59.742381Z",
      "tx": "HWdeqqPagcdLcJaH7Lcc5mCnd1ZGp7rW2fHeRBNHC2hy"
    },
    {
      "alert_id": "R6_INTENTS_CALLBACK_ANOMALY:286b9db8af6a",
      "rule": "R6_INTENTS_CALLBACK_ANOMALY",
      "severity": "high",
      "ts": "2026-09-30T23:16:00.884890Z",
      "tx": "HWdeqqPagcdLcJaH7Lcc5mCnd1ZGp7rW2fHeRBNHC2hy"
    },
    {
      "alert_id": "R8_DEPOSIT_LEDGER_MISMATCH:3e0fa856c6ba",
      "rule": "R8_DEPOSIT_LEDGER_MISMATCH",
      "severity": "critical",
      "ts": "2026-09-30T23:16:01.624903Z",
      "tx": "HWdeqqPagcdLcJaH7Lcc5mCnd1ZGp7rW2fHeRBNHC2hy"
    },
    {
      "alert_id": "R8B_UNBACKED_CREDIT_WITHDRAWN:50eb3ac2220b",
      "rule": "R8B_UNBACKED_CREDIT_WITHDRAWN",
      "severity": "critical",
      "ts": "2026-09-30T23:18:33.004906Z",
      "tx": "918cwzG6k6CrrceWTZbbttFtGXtK6H5LCArYfTvcsxtt"
    },
    {
      "alert_id": "R6_INTENTS_CALLBACK_ANOMALY:1e5689d910b3",
      "rule": "R6_INTENTS_CALLBACK_ANOMALY",
      "severity": "high",
      "ts": "2026-09-30T23:21:59.615898Z",
      "tx": "5UqKvRvRbAowDpQSS94YJs5YQPhjzHBodhBZA2UhRAQF"
    },
    {
      "alert_id": "R6_INTENTS_CALLBACK_ANOMALY:da40d9af42d9",
      "rule": "R6_INTENTS_CALLBACK_ANOMALY",
      "severity": "high",
      "ts": "2026-09-30T23:22:00.921139Z",
      "tx": "5UqKvRvRbAowDpQSS94YJs5YQPhjzHBodhBZA2UhRAQF"
    },
    {
      "alert_id": "R8_DEPOSIT_LEDGER_MISMATCH:fc5771b9bb0b",
      "rule": "R8_DEPOSIT_LEDGER_MISMATCH",
      "severity": "critical",
      "ts": "2026-09-30T23:22:01.618068Z",
      "tx": "5UqKvRvRbAowDpQSS94YJs5YQPhjzHBodhBZA2UhRAQF"
    },
    {
      "alert_id": "R8B_UNBACKED_CREDIT_WITHDRAWN:f06e28300772",
      "rule": "R8B_UNBACKED_CREDIT_WITHDRAWN",
      "severity": "critical",
      "ts": "2026-09-30T23:24:38.875584Z",
      "tx": "FDTTHheF1b48nzVdk33y2zEbPtnHqEY1zcLGL24qsuFS"
    },
    {
      "alert_id": "R6_INTENTS_CALLBACK_ANOMALY:3c52d363e1c2",
      "rule": "R6_INTENTS_CALLBACK_ANOMALY",
      "severity": "high",
      "ts": "2026-09-30T23:28:26.978012Z",
      "tx": "54KPopgLZUR3cG4RdJAxETEN8rMUFwJ8YfrUdAS2e4tH"
    },
    {
      "alert_id": "R6_INTENTS_CALLBACK_ANOMALY:8628f9f43948",
      "rule": "R6_INTENTS_CALLBACK_ANOMALY",
      "severity": "high",
      "ts": "2026-09-30T23:28:28.277182Z",
      "tx": "54KPopgLZUR3cG4RdJAxETEN8rMUFwJ8YfrUdAS2e4tH"
    },
    {
      "alert_id": "R8_DEPOSIT_LEDGER_MISMATCH:8d2c2e4af088",
      "rule": "R8_DEPOSIT_LEDGER_MISMATCH",
      "severity": "critical",
      "ts": "2026-09-30T23:28:28.917789Z",
      "tx": "54KPopgLZUR3cG4RdJAxETEN8rMUFwJ8YfrUdAS2e4tH"
    },
    {
      "alert_id": "R8B_UNBACKED_CREDIT_WITHDRAWN:bcc69f1ab2c0",
      "rule": "R8B_UNBACKED_CREDIT_WITHDRAWN",
      "severity": "critical",
      "ts": "2026-09-30T23:31:06.881914Z",
      "tx": "4FNS8zEuaNqYYDsBWSfTXVFEDtRhsXY5FPQgL8p5Q5pC"
    },
    {
      "alert_id": "R6_INTENTS_CALLBACK_ANOMALY:415ff199c937",
      "rule": "R6_INTENTS_CALLBACK_ANOMALY",
      "severity": "high",
      "ts": "2026-09-30T23:35:15.879165Z",
      "tx": "3pFTRxiJxr1eKvWx5aTC9qNkxRjjDLWbKF8RsLdxjveg"
    },
    {
      "alert_id": "R6_INTENTS_CALLBACK_ANOMALY:a4a1b6c4bfa9",
      "rule": "R6_INTENTS_CALLBACK_ANOMALY",
      "severity": "high",
      "ts": "2026-09-30T23:35:17.049892Z",
      "tx": "3pFTRxiJxr1eKvWx5aTC9qNkxRjjDLWbKF8RsLdxjveg"
    },
    {
      "alert_id": "R8_DEPOSIT_LEDGER_MISMATCH:31613af56e07",
      "rule": "R8_DEPOSIT_LEDGER_MISMATCH",
      "severity": "critical",
      "ts": "2026-09-30T23:35:17.683155Z",
      "tx": "3pFTRxiJxr1eKvWx5aTC9qNkxRjjDLWbKF8RsLdxjveg"
    },
    {
      "alert_id": "R8B_UNBACKED_CREDIT_WITHDRAWN:25641eb785d2",
      "rule": "R8B_UNBACKED_CREDIT_WITHDRAWN",
      "severity": "critical",
      "ts": "2026-09-30T23:37:54.537486Z",
      "tx": "9PMKhUn8U8pvXnxrEBKdTiD5JoHA8qehwrm28FhsJgh8"
    },
    {
      "alert_id": "R6_INTENTS_CALLBACK_ANOMALY:89f7d0ace55a",
      "rule": "R6_INTENTS_CALLBACK_ANOMALY",
      "severity": "high",
      "ts": "2026-09-30T23:41:27.233199Z",
      "tx": "3mst2uZ32KPuCs7wc8rJqEtCrZqugCy4yDSZ3df8KPm3"
    },
    {
      "alert_id": "R6_INTENTS_CALLBACK_ANOMALY:55db5a43f3a7",
      "rule": "R6_INTENTS_CALLBACK_ANOMALY",
      "severity": "high",
      "ts": "2026-09-30T23:41:28.395579Z",
      "tx": "3mst2uZ32KPuCs7wc8rJqEtCrZqugCy4yDSZ3df8KPm3"
    },
    {
      "alert_id": "R8_DEPOSIT_LEDGER_MISMATCH:ad39fd28fe76",
      "rule": "R8_DEPOSIT_LEDGER_MISMATCH",
      "severity": "critical",
      "ts": "2026-09-30T23:41:28.959504Z",
      "tx": "3mst2uZ32KPuCs7wc8rJqEtCrZqugCy4yDSZ3df8KPm3"
    },
    {
      "alert_id": "R8B_UNBACKED_CREDIT_WITHDRAWN:4609672be332",
      "rule": "R8B_UNBACKED_CREDIT_WITHDRAWN",
      "severity": "critical",
      "ts": "2026-09-30T23:44:08.382602Z",
      "tx": "DEy5njwRaUYSyC7X5pnPWBhuiWUjJN4ZjrrJjzE3ub3T"
    },
    {
      "alert_id": "R1B_PAYOUT_SPIKE_TO_NEW_RECIPIENT:002a3411a34c",
      "rule": "R1B_PAYOUT_SPIKE_TO_NEW_RECIPIENT",
      "severity": "high",
      "ts": "2026-09-30T23:54:30Z",
      "tx": "0x9fe58e031f73bbd880c782bc9e7446bcda32cadb304a729209871a4a81856c4c"
    },
    {
      "alert_id": "R1_VAULT_PAYOUT_SPIKE:f6566cb6415f",
      "rule": "R1_VAULT_PAYOUT_SPIKE",
      "severity": "medium",
      "ts": "2026-09-30T23:54:30Z",
      "tx": "0x9fe58e031f73bbd880c782bc9e7446bcda32cadb304a729209871a4a81856c4c"
    },
    {
      "alert_id": "R3B_SELF_SUBMITTED_TEST_THEN_DRAIN:596a9e928f44",
      "rule": "R3B_SELF_SUBMITTED_TEST_THEN_DRAIN",
      "severity": "high",
      "ts": "2026-09-30T23:54:30Z",
      "tx": "0x9fe58e031f73bbd880c782bc9e7446bcda32cadb304a729209871a4a81856c4c"
    },
    {
      "alert_id": "R3_TEST_THEN_DRAIN:9b3dc3e37ab6",
      "rule": "R3_TEST_THEN_DRAIN",
      "severity": "medium",
      "ts": "2026-09-30T23:54:30Z",
      "tx": "0x9fe58e031f73bbd880c782bc9e7446bcda32cadb304a729209871a4a81856c4c"
    },
    {
      "alert_id": "R4_SELF_SUBMITTED_LARGE_PAYOUT:0182f8eca9ce",
      "rule": "R4_SELF_SUBMITTED_LARGE_PAYOUT",
      "severity": "low",
      "ts": "2026-09-30T23:54:30Z",
      "tx": "0x9fe58e031f73bbd880c782bc9e7446bcda32cadb304a729209871a4a81856c4c"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:23b380b511b4",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-09-30T23:54:30Z",
      "tx": "0x9fe58e031f73bbd880c782bc9e7446bcda32cadb304a729209871a4a81856c4c"
    },
    {
      "alert_id": "R9B_PAYOUT_FROM_FLAGGED_NEAR_ACCOUNT:a73f8238615a",
      "rule": "R9B_PAYOUT_FROM_FLAGGED_NEAR_ACCOUNT",
      "severity": "high",
      "ts": "2026-09-30T23:54:30Z",
      "tx": "0x9fe58e031f73bbd880c782bc9e7446bcda32cadb304a729209871a4a81856c4c"
    },
    {
      "alert_id": "R6_INTENTS_CALLBACK_ANOMALY:fcaac8ba40ad",
      "rule": "R6_INTENTS_CALLBACK_ANOMALY",
      "severity": "high",
      "ts": "2026-10-01T00:07:01.087892Z",
      "tx": "GU5NC7V89yqAGjqRGS9QrUPFcRg9kPr4A3aEuNrn8jpP"
    },
    {
      "alert_id": "R6_INTENTS_CALLBACK_ANOMALY:dfefc792e5ab",
      "rule": "R6_INTENTS_CALLBACK_ANOMALY",
      "severity": "high",
      "ts": "2026-10-01T00:07:02.362202Z",
      "tx": "GU5NC7V89yqAGjqRGS9QrUPFcRg9kPr4A3aEuNrn8jpP"
    },
    {
      "alert_id": "R8_DEPOSIT_LEDGER_MISMATCH:0320faf0705a",
      "rule": "R8_DEPOSIT_LEDGER_MISMATCH",
      "severity": "critical",
      "ts": "2026-10-01T00:07:03.060291Z",
      "tx": "GU5NC7V89yqAGjqRGS9QrUPFcRg9kPr4A3aEuNrn8jpP"
    },
    {
      "alert_id": "R8B_UNBACKED_CREDIT_WITHDRAWN:3ae7ae759388",
      "rule": "R8B_UNBACKED_CREDIT_WITHDRAWN",
      "severity": "critical",
      "ts": "2026-10-01T00:09:19.957139Z",
      "tx": "Cjsnx1re3DEES4GBvsiSS7V4fvQGmgh5S7t46n4DsEnd"
    },
    {
      "alert_id": "R6_INTENTS_CALLBACK_ANOMALY:3a6af52aff51",
      "rule": "R6_INTENTS_CALLBACK_ANOMALY",
      "severity": "high",
      "ts": "2026-10-01T00:12:38.117014Z",
      "tx": "6Rgww9eZ5AhwkTLDvfyBNFUBJCec97ExR4Wa8aW4U1ic"
    },
    {
      "alert_id": "R6_INTENTS_CALLBACK_ANOMALY:e064e461e07a",
      "rule": "R6_INTENTS_CALLBACK_ANOMALY",
      "severity": "high",
      "ts": "2026-10-01T00:12:39.370800Z",
      "tx": "6Rgww9eZ5AhwkTLDvfyBNFUBJCec97ExR4Wa8aW4U1ic"
    },
    {
      "alert_id": "R8_DEPOSIT_LEDGER_MISMATCH:755b8c227d1f",
      "rule": "R8_DEPOSIT_LEDGER_MISMATCH",
      "severity": "critical",
      "ts": "2026-10-01T00:12:39.827235Z",
      "tx": "6Rgww9eZ5AhwkTLDvfyBNFUBJCec97ExR4Wa8aW4U1ic"
    },
    {
      "alert_id": "R8B_UNBACKED_CREDIT_WITHDRAWN:21283ad24f9c",
      "rule": "R8B_UNBACKED_CREDIT_WITHDRAWN",
      "severity": "critical",
      "ts": "2026-10-01T00:15:09.382079Z",
      "tx": "EjKTER1fanv6U6LgLe59VgbWqLQbuyuQWhgephP5ksK7"
    },
    {
      "alert_id": "R1B_PAYOUT_SPIKE_TO_NEW_RECIPIENT:540d508112e6",
      "rule": "R1B_PAYOUT_SPIKE_TO_NEW_RECIPIENT",
      "severity": "high",
      "ts": "2026-10-01T00:24:02Z",
      "tx": "0x0381265d6a1bb09de899f49f410a8b907cd548358a7e3c91076c3a52656b8220"
    },
    {
      "alert_id": "R1_VAULT_PAYOUT_SPIKE:6aaedfbbc20d",
      "rule": "R1_VAULT_PAYOUT_SPIKE",
      "severity": "medium",
      "ts": "2026-10-01T00:24:02Z",
      "tx": "0x0381265d6a1bb09de899f49f410a8b907cd548358a7e3c91076c3a52656b8220"
    },
    {
      "alert_id": "R2_VAULT_OUTFLOW_VELOCITY:c3f8f2166125",
      "rule": "R2_VAULT_OUTFLOW_VELOCITY",
      "severity": "high",
      "ts": "2026-10-01T00:24:02Z",
      "tx": "0x0381265d6a1bb09de899f49f410a8b907cd548358a7e3c91076c3a52656b8220"
    },
    {
      "alert_id": "R3B_SELF_SUBMITTED_TEST_THEN_DRAIN:9062ea83a361",
      "rule": "R3B_SELF_SUBMITTED_TEST_THEN_DRAIN",
      "severity": "high",
      "ts": "2026-10-01T00:24:02Z",
      "tx": "0x0381265d6a1bb09de899f49f410a8b907cd548358a7e3c91076c3a52656b8220"
    },
    {
      "alert_id": "R3_TEST_THEN_DRAIN:a3155b8c05f8",
      "rule": "R3_TEST_THEN_DRAIN",
      "severity": "medium",
      "ts": "2026-10-01T00:24:02Z",
      "tx": "0x0381265d6a1bb09de899f49f410a8b907cd548358a7e3c91076c3a52656b8220"
    },
    {
      "alert_id": "R4_SELF_SUBMITTED_LARGE_PAYOUT:813aa8c227b5",
      "rule": "R4_SELF_SUBMITTED_LARGE_PAYOUT",
      "severity": "low",
      "ts": "2026-10-01T00:24:02Z",
      "tx": "0x0381265d6a1bb09de899f49f410a8b907cd548358a7e3c91076c3a52656b8220"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:443c5172f43f",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-10-01T00:24:02Z",
      "tx": "0x0381265d6a1bb09de899f49f410a8b907cd548358a7e3c91076c3a52656b8220"
    },
    {
      "alert_id": "R9B_PAYOUT_FROM_FLAGGED_NEAR_ACCOUNT:59c044eb49ec",
      "rule": "R9B_PAYOUT_FROM_FLAGGED_NEAR_ACCOUNT",
      "severity": "high",
      "ts": "2026-10-01T00:24:02Z",
      "tx": "0x0381265d6a1bb09de899f49f410a8b907cd548358a7e3c91076c3a52656b8220"
    },
    {
      "alert_id": "R6_INTENTS_CALLBACK_ANOMALY:9b6f4997b25e",
      "rule": "R6_INTENTS_CALLBACK_ANOMALY",
      "severity": "high",
      "ts": "2026-10-01T00:35:49.016451Z",
      "tx": "GdCwdzdNkfP6LAnnym5Vgam4YYNM7XWgteRNAKNA2ViL"
    },
    {
      "alert_id": "R6_INTENTS_CALLBACK_ANOMALY:2a9f1b31f270",
      "rule": "R6_INTENTS_CALLBACK_ANOMALY",
      "severity": "high",
      "ts": "2026-10-01T00:35:50.225956Z",
      "tx": "GdCwdzdNkfP6LAnnym5Vgam4YYNM7XWgteRNAKNA2ViL"
    },
    {
      "alert_id": "R8_DEPOSIT_LEDGER_MISMATCH:5e4369a68abb",
      "rule": "R8_DEPOSIT_LEDGER_MISMATCH",
      "severity": "critical",
      "ts": "2026-10-01T00:35:50.888245Z",
      "tx": "GdCwdzdNkfP6LAnnym5Vgam4YYNM7XWgteRNAKNA2ViL"
    },
    {
      "alert_id": "R8B_UNBACKED_CREDIT_WITHDRAWN:7e8bc7869f3f",
      "rule": "R8B_UNBACKED_CREDIT_WITHDRAWN",
      "severity": "critical",
      "ts": "2026-10-01T00:41:35.442770Z",
      "tx": "AbVeLUkZhdhbzbkyqTaiyLmNRhHFbjHsxmXry1tCgVWq"
    },
    {
      "alert_id": "R10_RECIPIENT_PAYOUT_BURST:064678912e79",
      "rule": "R10_RECIPIENT_PAYOUT_BURST",
      "severity": "medium",
      "ts": "2026-10-01T00:50:42Z",
      "tx": "0x69d1c68c7e961a0199d3c9f3b6a31cb168ed775ef34b51a42762253ac1efcceb"
    },
    {
      "alert_id": "R1B_PAYOUT_SPIKE_TO_NEW_RECIPIENT:3381d153984d",
      "rule": "R1B_PAYOUT_SPIKE_TO_NEW_RECIPIENT",
      "severity": "high",
      "ts": "2026-10-01T00:50:42Z",
      "tx": "0x69d1c68c7e961a0199d3c9f3b6a31cb168ed775ef34b51a42762253ac1efcceb"
    },
    {
      "alert_id": "R1_VAULT_PAYOUT_SPIKE:0ba8ae7126f4",
      "rule": "R1_VAULT_PAYOUT_SPIKE",
      "severity": "medium",
      "ts": "2026-10-01T00:50:42Z",
      "tx": "0x69d1c68c7e961a0199d3c9f3b6a31cb168ed775ef34b51a42762253ac1efcceb"
    },
    {
      "alert_id": "R4_SELF_SUBMITTED_LARGE_PAYOUT:9f2c672191ca",
      "rule": "R4_SELF_SUBMITTED_LARGE_PAYOUT",
      "severity": "low",
      "ts": "2026-10-01T00:50:42Z",
      "tx": "0x69d1c68c7e961a0199d3c9f3b6a31cb168ed775ef34b51a42762253ac1efcceb"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:62a79a90bbc8",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-10-01T00:50:42Z",
      "tx": "0x69d1c68c7e961a0199d3c9f3b6a31cb168ed775ef34b51a42762253ac1efcceb"
    },
    {
      "alert_id": "R9B_PAYOUT_FROM_FLAGGED_NEAR_ACCOUNT:bcdf98fb8517",
      "rule": "R9B_PAYOUT_FROM_FLAGGED_NEAR_ACCOUNT",
      "severity": "high",
      "ts": "2026-10-01T00:50:42Z",
      "tx": "0x69d1c68c7e961a0199d3c9f3b6a31cb168ed775ef34b51a42762253ac1efcceb"
    },
    {
      "alert_id": "R7B_TAINTED_PAYOUT:91ad4991821a",
      "rule": "R7B_TAINTED_PAYOUT",
      "severity": "high",
      "ts": "2026-10-01T01:15:35Z",
      "tx": "0x383ee25422cba1e5b47ee511760a395259bfdb8a7f35df9be7eb0560495f8c6f"
    },
    {
      "alert_id": "R6_INTENTS_CALLBACK_ANOMALY:05fba54c9084",
      "rule": "R6_INTENTS_CALLBACK_ANOMALY",
      "severity": "high",
      "ts": "2026-10-01T01:22:45.680986Z",
      "tx": "bMdkzhZf7tQZbXNnXcAnuJaLyTxaCq8W9BnTh28EaDr"
    },
    {
      "alert_id": "R6_INTENTS_CALLBACK_ANOMALY:39376feff221",
      "rule": "R6_INTENTS_CALLBACK_ANOMALY",
      "severity": "high",
      "ts": "2026-10-01T01:22:46.953797Z",
      "tx": "bMdkzhZf7tQZbXNnXcAnuJaLyTxaCq8W9BnTh28EaDr"
    },
    {
      "alert_id": "R8_DEPOSIT_LEDGER_MISMATCH:e46e36ad5eab",
      "rule": "R8_DEPOSIT_LEDGER_MISMATCH",
      "severity": "critical",
      "ts": "2026-10-01T01:22:47.637206Z",
      "tx": "bMdkzhZf7tQZbXNnXcAnuJaLyTxaCq8W9BnTh28EaDr"
    },
    {
      "alert_id": "R8B_UNBACKED_CREDIT_WITHDRAWN:186d9cea5764",
      "rule": "R8B_UNBACKED_CREDIT_WITHDRAWN",
      "severity": "critical",
      "ts": "2026-10-01T01:25:27.184488Z",
      "tx": "7rFoxyXGSMTgGCUhE3xwho26YJwpRAJg8BeMhz7KNVti"
    },
    {
      "alert_id": "R7B_TAINTED_PAYOUT:f4631d9b2756",
      "rule": "R7B_TAINTED_PAYOUT",
      "severity": "high",
      "ts": "2026-10-01T01:26:11Z",
      "tx": "0x1b589df14968199ed8b2d3e6efe8514a9b32484c5cdc18ea8498ed48e64873c9"
    },
    {
      "alert_id": "R6_INTENTS_CALLBACK_ANOMALY:3a1d5c750c45",
      "rule": "R6_INTENTS_CALLBACK_ANOMALY",
      "severity": "high",
      "ts": "2026-10-01T01:29:26.511282Z",
      "tx": "CWhtCr8ziTJJ4qbXGtZ3bBwzWtVa6rRAp7Q8ARgAfoDg"
    },
    {
      "alert_id": "R6_INTENTS_CALLBACK_ANOMALY:b5ba8e0f9d46",
      "rule": "R6_INTENTS_CALLBACK_ANOMALY",
      "severity": "high",
      "ts": "2026-10-01T01:29:27.579827Z",
      "tx": "CWhtCr8ziTJJ4qbXGtZ3bBwzWtVa6rRAp7Q8ARgAfoDg"
    },
    {
      "alert_id": "R8_DEPOSIT_LEDGER_MISMATCH:5d7c0f4e2cf2",
      "rule": "R8_DEPOSIT_LEDGER_MISMATCH",
      "severity": "critical",
      "ts": "2026-10-01T01:29:28.189016Z",
      "tx": "CWhtCr8ziTJJ4qbXGtZ3bBwzWtVa6rRAp7Q8ARgAfoDg"
    },
    {
      "alert_id": "R8B_UNBACKED_CREDIT_WITHDRAWN:ab690847061f",
      "rule": "R8B_UNBACKED_CREDIT_WITHDRAWN",
      "severity": "critical",
      "ts": "2026-10-01T01:32:35.870516Z",
      "tx": "Fn51iWKQtU41UWfYLECoYe9V2AkcN53p2DJS54uhcEit"
    },
    {
      "alert_id": "R4_SELF_SUBMITTED_LARGE_PAYOUT:df8339a57a48",
      "rule": "R4_SELF_SUBMITTED_LARGE_PAYOUT",
      "severity": "low",
      "ts": "2026-10-01T01:46:20Z",
      "tx": "0x9c10b967da0c85631ec105e3b322c0a851fcd01b69ff390ff58f860e5cce003a"
    },
    {
      "alert_id": "R9B_PAYOUT_FROM_FLAGGED_NEAR_ACCOUNT:63f499537716",
      "rule": "R9B_PAYOUT_FROM_FLAGGED_NEAR_ACCOUNT",
      "severity": "high",
      "ts": "2026-10-01T01:46:20Z",
      "tx": "0x9c10b967da0c85631ec105e3b322c0a851fcd01b69ff390ff58f860e5cce003a"
    },
    {
      "alert_id": "R6_INTENTS_CALLBACK_ANOMALY:bbf7890a7cbf",
      "rule": "R6_INTENTS_CALLBACK_ANOMALY",
      "severity": "high",
      "ts": "2026-10-01T05:47:28.529593Z",
      "tx": "GAQKwHdTaLPyvvAMCGfmcyPcR8rptuXu1mCRwz7UCQEG"
    },
    {
      "alert_id": "R6_INTENTS_CALLBACK_ANOMALY:17a75524b8e3",
      "rule": "R6_INTENTS_CALLBACK_ANOMALY",
      "severity": "high",
      "ts": "2026-10-01T05:47:29.723373Z",
      "tx": "GAQKwHdTaLPyvvAMCGfmcyPcR8rptuXu1mCRwz7UCQEG"
    },
    {
      "alert_id": "R8_DEPOSIT_LEDGER_MISMATCH:eb783e5cdffc",
      "rule": "R8_DEPOSIT_LEDGER_MISMATCH",
      "severity": "critical",
      "ts": "2026-10-01T05:47:30.239711Z",
      "tx": "GAQKwHdTaLPyvvAMCGfmcyPcR8rptuXu1mCRwz7UCQEG"
    },
    {
      "alert_id": "R8B_UNBACKED_CREDIT_WITHDRAWN:b502df2d4ef6",
      "rule": "R8B_UNBACKED_CREDIT_WITHDRAWN",
      "severity": "critical",
      "ts": "2026-10-01T05:54:40.283501Z",
      "tx": "5d1VV4tyFh3xWomy2tWJbG9qfLDaRdbksjedUZ3A3j3o"
    },
    {
      "alert_id": "R9B_PAYOUT_FROM_FLAGGED_NEAR_ACCOUNT:b77fa6bc5b2f",
      "rule": "R9B_PAYOUT_FROM_FLAGGED_NEAR_ACCOUNT",
      "severity": "high",
      "ts": "2026-10-01T06:08:26Z",
      "tx": "0x16ddfa695b9525662b8e57c35723f44af89b4e7fc2dedc3634f730caf8b90c02"
    }
  ],
  "summary": "120 alerts (R10_RECIPIENT_PAYOUT_BURST, R1B_PAYOUT_SPIKE_TO_NEW_RECIPIENT, R1_VAULT_PAYOUT_SPIKE, R2_VAULT_OUTFLOW_VELOCITY, R3B_SELF_SUBMITTED_TEST_THEN_DRAIN, R3_TEST_THEN_DRAIN, R4_SELF_SUBMITTED_LARGE_PAYOUT, R5_NEW_RECIPIENT_LARGE_PAYOUT, R6C_EXTREME_TOKEN_AMOUNT, R6_INTENTS_CALLBACK_ANOMALY, R7B_TAINTED_PAYOUT, R8B_UNBACKED_CREDIT_WITHDRAWN, R8_DEPOSIT_LEDGER_MISMATCH, R9B_PAYOUT_FROM_FLAGGED_NEAR_ACCOUNT) on bsc, ethereum, near; opened 2026-09-29T16:09:35.349391Z by R6C_EXTREME_TOKEN_AMOUNT; mode under_attack; 9 flagged stablecoin payouts totalling 3,865,021 USD."
}

normal IW-20260927-131347-c253a3 medium 19 alerts · score 28.5 · Ethereum · opened 2026-09-27 13:13:47 UTC · active 3d 12h show ▾hide ▴

normal

09-27 13:13

paranoid

under attack

Recommended capability: flag_observation
Scope: chain: ethereumbridge: near_intentstoken: usdtaddress: 0xc9379729...b6c7
Opened by: R3_TEST_THEN_DRAIN
Flagged stablecoin payouts: 18 totalling 9,855,857.66 USD

On-chain record below paranoid

Only incidents at paranoid or above go on chain. Incident hash 3c95d63eeb650fa9...8bf3.

Model-written summary none recorded

Summaries are written for incidents at paranoid or above.

Rules in this incident

8R3_TEST_THEN_DRAIN×88R10_RECIPIENT_PAYOUT_BURST×28R5_NEW_RECIPIENT_LARGE_PAYOUT×9

Mode changes and actions click a row for the alerts that led to it

Time (UTC)	Change	Reason
2026-09-27 13:13:47	normal	1 observation(s)

Raw incident JSON (alert evidence omitted: see Events, or incidents.jsonl)

{
  "schema": "intentwatch.incident/v1 (shield-compatible, unofficial)",
  "incident_id": "IW-20260927-131347-c253a3",
  "opened_at": "2026-09-27T13:13:47Z",
  "updated_at": "2026-10-01T01:36:59Z",
  "recommended_mode": "normal",
  "capability": "flag_observation",
  "scope": {
    "chain": "ethereum",
    "bridge": "near_intents",
    "token": "usdt",
    "address": "0xc9379729b1e271bc65044ce0cab9ef3f2674b6c7"
  },
  "score": 28.5,
  "max_severity": "medium",
  "mode_history": [
    {
      "ts": "2026-09-27T13:13:47Z",
      "mode": "normal",
      "capability": "flag_observation",
      "scope": {
        "chain": "ethereum",
        "bridge": "near_intents",
        "token": "usdt",
        "address": "0xc9379729b1e271bc65044ce0cab9ef3f2674b6c7"
      },
      "reason": "1 observation(s)",
      "alert_id": "R3_TEST_THEN_DRAIN:78e62f82c2cc"
    }
  ],
  "recommended_actions": [],
  "alerts": [
    {
      "alert_id": "R3_TEST_THEN_DRAIN:78e62f82c2cc",
      "rule": "R3_TEST_THEN_DRAIN",
      "severity": "medium",
      "ts": "2026-09-27T13:13:47Z",
      "tx": "0xf3f6eda9262ac1fe4ba948bd7930673259a95e0d24bee4addae1fc1ac531a62e"
    },
    {
      "alert_id": "R3_TEST_THEN_DRAIN:21a50d5dfa6c",
      "rule": "R3_TEST_THEN_DRAIN",
      "severity": "medium",
      "ts": "2026-09-28T12:53:35Z",
      "tx": "0x37913a1e5488feed66f1a52afd0e0ef0e2b7d1e1f7b33d85900bb2c412aa40d1"
    },
    {
      "alert_id": "R3_TEST_THEN_DRAIN:8e71d0e2b7b6",
      "rule": "R3_TEST_THEN_DRAIN",
      "severity": "medium",
      "ts": "2026-09-28T13:02:35Z",
      "tx": "0x1c11e4635c75522dc551b47c0c5d1915da1fcadf87150a7b74349df831dafd75"
    },
    {
      "alert_id": "R10_RECIPIENT_PAYOUT_BURST:757575d35377",
      "rule": "R10_RECIPIENT_PAYOUT_BURST",
      "severity": "medium",
      "ts": "2026-09-28T13:07:47Z",
      "tx": "0xf32c6995510ae31261ecdd93bc208ade7c9737fd5ba532ac40611942911a49ce"
    },
    {
      "alert_id": "R3_TEST_THEN_DRAIN:56151619c3b4",
      "rule": "R3_TEST_THEN_DRAIN",
      "severity": "medium",
      "ts": "2026-09-29T08:20:35Z",
      "tx": "0x8d5a6bd8277789960aaee5e10af2cb01e362d1f964b1ca2a34fc20db6faf2c78"
    },
    {
      "alert_id": "R3_TEST_THEN_DRAIN:30019f042c24",
      "rule": "R3_TEST_THEN_DRAIN",
      "severity": "medium",
      "ts": "2026-09-29T08:32:35Z",
      "tx": "0x07e589c789f0e79b700e6ce55e8944affcd031859c04acf2c511661769204f84"
    },
    {
      "alert_id": "R3_TEST_THEN_DRAIN:a5d11f670398",
      "rule": "R3_TEST_THEN_DRAIN",
      "severity": "medium",
      "ts": "2026-09-29T08:42:59Z",
      "tx": "0x9d87c6597857c883cd0b8f300d2fd5e40183f7c50554c95e776778af23d7c45d"
    },
    {
      "alert_id": "R3_TEST_THEN_DRAIN:52f9e7f90db8",
      "rule": "R3_TEST_THEN_DRAIN",
      "severity": "medium",
      "ts": "2026-09-29T09:04:23Z",
      "tx": "0xbbbf969b72bba4e6cda8f03944f95f4c4a2c03edb620b42c22e526c8c4b9205b"
    },
    {
      "alert_id": "R3_TEST_THEN_DRAIN:93cf02475d10",
      "rule": "R3_TEST_THEN_DRAIN",
      "severity": "medium",
      "ts": "2026-09-29T09:13:47Z",
      "tx": "0x387fc29feeb7cbef24bab177487211ba26704afdd80367f162cfd0e5d027b8e5"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:8632b4bb514a",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-09-29T18:08:11Z",
      "tx": "0x219c15e22daa74ab5cedd64a12fdb62b7328058eb953fe0d4b50c2f03a0dc189"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:f0f30b3625fd",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-09-30T01:03:59Z",
      "tx": "0x39ec91acdb973ab2ead9106cfe79add1846ea67612a5dbf968469a56ab947532"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:0e30b9fbfae2",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-09-30T12:13:59Z",
      "tx": "0x8f4ddfedc6091824d445907ae527e0f9457d9e1b7906d375ed747f760df7b236"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:4515d2176b4e",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-09-30T23:54:47Z",
      "tx": "0xc815d45607e85b25eddd7167783b57bf5a3604d1cd496449d59fe67dc5e62e55"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:0a23c2260669",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-10-01T00:01:59Z",
      "tx": "0x364d9494b46507d90b44651b34255a2128be011778586c4d0b7298ae8626016d"
    },
    {
      "alert_id": "R10_RECIPIENT_PAYOUT_BURST:9d40cfd58bee",
      "rule": "R10_RECIPIENT_PAYOUT_BURST",
      "severity": "medium",
      "ts": "2026-10-01T00:06:47Z",
      "tx": "0xb53480efe758077e3cb468df5014d9ec3b944e66e139b12b4fe59b225d1a3676"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:fc1e97227e49",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-10-01T00:06:47Z",
      "tx": "0xb53480efe758077e3cb468df5014d9ec3b944e66e139b12b4fe59b225d1a3676"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:84161a5d1f09",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-10-01T00:12:59Z",
      "tx": "0xf8542b861e48e882bf6909db53332929634d8d33be67b0d6d694b7a4a5a64ad0"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:1d0962453b18",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-10-01T01:16:35Z",
      "tx": "0xd2ec14b0bfd107b132b2ad1e2883635293ea93655995768f5063a0c50cd7db41"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:dfb3e8e2744c",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-10-01T01:36:59Z",
      "tx": "0x649148e94d9bb693d6c4c2deddb00b550c1e9cbfa4a51e582a815f3ebd9b6234"
    }
  ],
  "summary": "19 alerts (R10_RECIPIENT_PAYOUT_BURST, R3_TEST_THEN_DRAIN, R5_NEW_RECIPIENT_LARGE_PAYOUT) on ethereum; opened 2026-09-27T13:13:47Z by R3_TEST_THEN_DRAIN; mode normal; 18 flagged stablecoin payouts totalling 9,855,857.66 USD."
}

normal IW-20260930-064635-323a8e medium 2 alerts · score 3.0 · Ethereum · opened 2026-09-30 06:46:35 UTC · active 15h 32m show ▾hide ▴

normal

09-30 06:46

paranoid

under attack

Recommended capability: flag_observation
Scope: chain: ethereumbridge: near_intentstoken: usdcaddress: 0x790f788c...fe82
Opened by: R10_RECIPIENT_PAYOUT_BURST
Flagged stablecoin payouts: 2 totalling 419,295.05 USD

On-chain record below paranoid

Only incidents at paranoid or above go on chain. Incident hash c24e7c42f12895f3...293a.

Model-written summary none recorded

Summaries are written for incidents at paranoid or above.

Rules in this incident

8R10_RECIPIENT_PAYOUT_BURST×18R3_TEST_THEN_DRAIN×1

Mode changes and actions click a row for the alerts that led to it

Time (UTC)	Change	Reason
2026-09-30 06:46:35	normal	1 observation(s)

Raw incident JSON (alert evidence omitted: see Events, or incidents.jsonl)

{
  "schema": "intentwatch.incident/v1 (shield-compatible, unofficial)",
  "incident_id": "IW-20260930-064635-323a8e",
  "opened_at": "2026-09-30T06:46:35Z",
  "updated_at": "2026-09-30T22:18:47Z",
  "recommended_mode": "normal",
  "capability": "flag_observation",
  "scope": {
    "chain": "ethereum",
    "bridge": "near_intents",
    "token": "usdc",
    "address": "0x790f788cd9d247c2a2f18e4106fbb7563676fe82"
  },
  "score": 3.0,
  "max_severity": "medium",
  "mode_history": [
    {
      "ts": "2026-09-30T06:46:35Z",
      "mode": "normal",
      "capability": "flag_observation",
      "scope": {
        "chain": "ethereum",
        "bridge": "near_intents",
        "token": "usdc",
        "address": "0x790f788cd9d247c2a2f18e4106fbb7563676fe82"
      },
      "reason": "1 observation(s)",
      "alert_id": "R10_RECIPIENT_PAYOUT_BURST:f24de6a764d9"
    }
  ],
  "recommended_actions": [],
  "alerts": [
    {
      "alert_id": "R10_RECIPIENT_PAYOUT_BURST:f24de6a764d9",
      "rule": "R10_RECIPIENT_PAYOUT_BURST",
      "severity": "medium",
      "ts": "2026-09-30T06:46:35Z",
      "tx": "0x64d49af44912c9f6a7b6b39704104d1e5be8b960c98b15cb0f5e63b8032fab9a"
    },
    {
      "alert_id": "R3_TEST_THEN_DRAIN:afd155db2181",
      "rule": "R3_TEST_THEN_DRAIN",
      "severity": "medium",
      "ts": "2026-09-30T22:18:47Z",
      "tx": "0x6adc61b4d205af000fbf6dadd95204da696d949162926dd255b070c90c862659"
    }
  ],
  "summary": "2 alerts (R10_RECIPIENT_PAYOUT_BURST, R3_TEST_THEN_DRAIN) on ethereum; opened 2026-09-30T06:46:35Z by R10_RECIPIENT_PAYOUT_BURST; mode normal; 2 flagged stablecoin payouts totalling 419,295.05 USD."
}

normal IW-20260930-171524-0660ba medium 1 alert · score 1.5 · BNB Chain · opened 2026-09-30 17:15:24 UTC · active 0s show ▾hide ▴

normal

09-30 17:15

paranoid

under attack

Recommended capability: flag_observation
Scope: chain: bscbridge: hottoken: usdcaddress: 0x88bbcaee...e758
Opened by: R1_VAULT_PAYOUT_SPIKE
Flagged stablecoin payouts: 1 totalling 389,711.36 USD

On-chain record below paranoid

Only incidents at paranoid or above go on chain. Incident hash 06111156c7356850...a9b1.

Model-written summary none recorded

Summaries are written for incidents at paranoid or above.

Rules in this incident

8R1_VAULT_PAYOUT_SPIKE×1

Mode changes and actions click a row for the alerts that led to it

Time (UTC)	Change	Reason
2026-09-30 17:15:24	normal	1 observation(s)

Raw incident JSON (alert evidence omitted: see Events, or incidents.jsonl)

{
  "schema": "intentwatch.incident/v1 (shield-compatible, unofficial)",
  "incident_id": "IW-20260930-171524-0660ba",
  "opened_at": "2026-09-30T17:15:24Z",
  "updated_at": "2026-09-30T17:15:24Z",
  "recommended_mode": "normal",
  "capability": "flag_observation",
  "scope": {
    "chain": "bsc",
    "bridge": "hot",
    "token": "usdc",
    "address": "0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758"
  },
  "score": 1.5,
  "max_severity": "medium",
  "mode_history": [
    {
      "ts": "2026-09-30T17:15:24Z",
      "mode": "normal",
      "capability": "flag_observation",
      "scope": {
        "chain": "bsc",
        "bridge": "hot",
        "token": "usdc",
        "address": "0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758"
      },
      "reason": "1 observation(s)",
      "alert_id": "R1_VAULT_PAYOUT_SPIKE:e78ecd6c17e7"
    }
  ],
  "recommended_actions": [],
  "alerts": [
    {
      "alert_id": "R1_VAULT_PAYOUT_SPIKE:e78ecd6c17e7",
      "rule": "R1_VAULT_PAYOUT_SPIKE",
      "severity": "medium",
      "ts": "2026-09-30T17:15:24Z",
      "tx": "0x190847c3ed8eb4f03027c10110f5a75fb5f1788d37ab45434620626f4a9599b0"
    }
  ],
  "summary": "1 alerts (R1_VAULT_PAYOUT_SPIKE) on bsc; opened 2026-09-30T17:15:24Z by R1_VAULT_PAYOUT_SPIKE; mode normal; 1 flagged stablecoin payouts totalling 389,711.36 USD."
}

Rules

Ruleset config/rules + local/rules; YAML, explainable and deterministic; click a rule for its logic

Level	Rule	Description	Stage	Groups	In window	Baseline / day
8	R1_VAULT_PAYOUT_SPIKER1_vault_payout_spike.yaml	Treasury payout far above recent maximumA single stablecoin payout from a bridge treasury is more than `factor` times the largest payout of the same (chain, vault, token) over the trailing 48h. Payouts that fired this rule are kept out of the baseline, so a drain cannot raise its own threshold. On the September BNB Chain baseline this fired ~1/day, mostly for recurring large recipients (ratios 2.05-6.1x, W1 was 2.38x), so it is medium on its own; R1B escalates spikes to new recipients.	Treasury drain	evmtreasurypayoutspike	4	0.857
{ "source": "evm.erc20_transfer", "match": { "kind": "payout", "vault": [ "hot_bridge", "near_intents" ], "symbol": [ "usdt", "usdc" ] }, "condition": { "type": "ratio_to_rolling_max", "group_by": [ "chain", "vault", "token" ], "window": "48h", "factor": 2.0, "min_value": 50000, "value_field": "amount_usd" }, "shield": { "capability": "flag_observation", "scope": [ "chain", "bridge", "token" ] } }
12	R1B_PAYOUT_SPIKE_TO_NEW_RECIPIENTR1_vault_payout_spike.yaml	Treasury payout spike to a recipient first seen less than 7 days agoComposite (Wazuh-style): R1 (payout > 2x the 48h max) and R5 (recipient first seen < 7 days ago, payout > $500K) fire on the same payout.	Treasury drain	evmtreasurypayoutspikecomposite	3	0.048
{ "source": "evm.*", "match": { "kind": "payout" }, "if_all": [ "R1_VAULT_PAYOUT_SPIKE", "R5_NEW_RECIPIENT_LARGE_PAYOUT" ], "shield": { "mode": "paranoid", "capability": "raise_mode", "scope": [ "chain", "bridge", "token", "address" ] } }
12	R2_VAULT_OUTFLOW_VELOCITYR2_vault_outflow_velocity.yaml (rate rule: cannot escalate alone)	Treasury outflow velocity above its 7-day p99The trailing 1h stablecoin outflow of a (chain, vault, token) exceeds 2x the p99 of hourly outflow over the trailing 7 days (empty hours count as zero), and at least $1M. Throttled to one alert per hour per group. Velocity is about the treasury, so it never taints the recipient of the last payout. A rolling sum fires on the flow: its transaction is only where the sum crossed the line, so two alerts are one flow measured twice, and it cannot escalate alone.	Treasury drain	evmtreasurypayoutvelocity	1	0.095
{ "source": "evm.erc20_transfer", "match": { "kind": "payout", "vault": [ "hot_bridge", "near_intents" ], "symbol": [ "usdt", "usdc" ] }, "condition": { "type": "rolling_sum_vs_percentile", "group_by": [ "chain", "vault", "token" ], "window": "1h", "bucket": "1h", "baseline": "7d", "percentile": 99, "factor": 2.0, "min_value": 1000000, "min_buckets": 72, "value_field": "amount_usd" }, "ignore": "1h", "ignore_key": [ "chain", "vault", "token" ], "shield": { "mode": "paranoid", "capability": "raise_mode", "scope": [ "chain", "bridge", "token" ] } }
8	R3_TEST_THEN_DRAINR3_test_then_drain.yaml	Small test payout followed by a large payout to the same recipientThe same recipient gets at least one payout under $100 and then, within 24h, a payout over $100K from a treasury, and had at most 3 payouts in the 7 days before. Honest users test too: on the September Ethereum baseline this fired ~1/day even after excluding established counterparties, so it is medium on its own; R3B escalates it when the recipient also submitted the payout itself.	Treasury drain	evmtreasurypayoutsequence	3	0.905
{ "source": "evm.erc20_transfer", "match": { "kind": "payout", "vault": [ "hot_bridge", "near_intents" ], "symbol": [ "usdt", "usdc" ] }, "condition": { "type": "sequence", "group_by": [ "to_addr" ], "within": "24h", "max_prior": { "count": 3, "within": "7d" }, "steps": [ { "name": "test_payout", "match": { "amount_usd": { "lt": 100 } } }, { "name": "large_payout", "match": { "amount_usd": { "gt": 100000 } } } ] }, "shield": { "capability": "flag_observation", "scope": [ "address" ] } }
12	R3B_SELF_SUBMITTED_TEST_THEN_DRAINR3_test_then_drain.yaml	Test-then-drain payout that the recipient submitted itselfComposite (Wazuh-style): R3 and R4 fire on the same payout. A fresh recipient that tested with a small payout and then pulled a large one by submitting the payout tx itself.	Treasury drain	evmtreasurypayoutsequencecomposite	2	0.0
{ "source": "evm.erc20_transfer", "match": { "kind": "payout" }, "if_all": [ "R3_TEST_THEN_DRAIN", "R4_SELF_SUBMITTED_LARGE_PAYOUT" ], "shield": { "mode": "paranoid", "capability": "raise_mode", "scope": [ "chain", "bridge", "token", "address" ] } }
5	R4_SELF_SUBMITTED_LARGE_PAYOUTR4_self_submitted_large_payout.yaml (score only)	Large payout submitted by its own recipientThe payout tx was sent by the recipient itself (tx.from == transfer.to) instead of a relayer. HOT's design allows self-submission, so this is a weak signal: score only, it never opens an incident by itself.	Treasury drain	evmtreasurypayoutsubmitter	4	0.0
{ "source": "evm.erc20_transfer", "match": { "kind": "payout", "vault": [ "hot_bridge", "near_intents" ], "amount_usd": { "gt": 100000 }, "extra.tx_submitter": { "eq_field": "to_addr" } } }
8	R5_NEW_RECIPIENT_LARGE_PAYOUTR5_new_recipient_large_payout.yaml	Payout over $500K to a recipient first seen less than 7 days agoThe recipient's first interaction with any watched treasury (as sender or receiver, any chain) is less than 7 days old. Needs 7 days of observed history before it can fire.	Treasury drain	evmtreasurypayoutnew_address	12	1.952
{ "source": "evm.*", "match": { "kind": "payout", "vault": [ "hot_bridge", "near_intents" ], "amount_usd": { "gt": 500000 } }, "condition": { "type": "first_seen", "field": "to_addr", "track": [ "from_addr", "to_addr" ], "max_age": "7d", "observe": { "vault": { "exists": true } } }, "shield": { "capability": "flag_observation", "scope": [ "address" ] } }
12	R6_INTENTS_CALLBACK_ANOMALYR6_intents_callback_anomaly.yaml	Abnormal resolve callback or oversized event on intents.nearOn the Verifier contract: a failed resolve callback (e.g. mt_resolve_deposit), a log that was rejected for exceeding NEAR's 16,384-byte limit or is close to it, or a single event entry carrying more than 32 token/amount pairs.	Ledger tampering	nearverifiercallback	46	sample: 0
{ "source": [ "near.receipt", "near.nep245", "near.dip4" ], "match": { "contract": "intents.near", "any": [ { "kind": "callback_failure", "extra.methods": { "regex": "resolve" } }, { "extra.rejected_log_size": { "gt": 15000 } }, { "extra.max_log_size": { "gt": 15000 } }, { "extra.n_token_pairs": { "gt": 32 } } ] }, "shield": { "mode": "paranoid", "capability": "raise_mode", "scope": [ "chain", "bridge", "token" ] } }
8	R6B_TOKEN_ID_LENGTH_OUTLIERR6B_token_id_length_outlier.yaml	Token id length above the p99.9 of observed Verifier eventsThe longest token id in a Verifier multi-token event is longer than 99.9% of token ids seen so far (needs 2,000 samples first). Unusually long ids inflate event logs.	Probing	nearverifiertoken_id	0	sample: 0
No alerts in this window. { "source": "near.nep245", "match": { "contract": "intents.near" }, "condition": { "type": "percentile_outlier", "field": "extra.max_token_id_len", "percentile": 99.9, "min_samples": 2000 } }
8	R6C_EXTREME_TOKEN_AMOUNTR6C_extreme_token_amount.yaml	Token amount near the u128 limit on intents.near or the HOT omni contractA multi-token event moves more than 2^120 raw units of one token (within 2^8 of u128::MAX). No real token supply comes close (wNEAR, with 24 decimals, has ~1.2e33 raw units in total), so such amounts are crafted values that probe overflow, accounting or log-size limits. One alert per token per day. Medium on its own: it says nothing about whether the value was credited.	Probing	nearverifieramount	1	sample: 0
{ "source": "near.nep245", "match": { "contract": [ "intents.near", "v2_1.omni.hot.tg" ], "amount_raw": { "gt": 1329227995784915872903807060280344576 } }, "ignore": "24h", "ignore_key": [ "token" ], "shield": { "capability": "flag_observation", "scope": [ "chain", "bridge", "token" ] } }
12	R7_TAINTED_REENTRYR7_tainted_reentry.yaml	Address tainted by a flagged payout deposits into a treasuryAn address that received a payout flagged by R1B/R3B/R9B (or got funds from such an address, one hop) later deposits into any NEAR Intents / HOT treasury on any EVM chain.	Fund movement	evmtreasurydeposittaint	0	0.0
No alerts in this window. { "source": "evm.*", "match": { "kind": "deposit", "vault": { "exists": true } }, "condition": { "type": "tainted", "taint_from": [ "R1B_PAYOUT_SPIKE_TO_NEW_RECIPIENT", "R3B_SELF_SUBMITTED_TEST_THEN_DRAIN", "R9B_PAYOUT_FROM_FLAGGED_NEAR_ACCOUNT" ], "taint_field": "address", "hops": 1, "check": [ "from_addr" ] }, "shield": { "mode": "paranoid", "capability": "raise_mode", "scope": [ "chain", "bridge", "address" ] } }
12	R7B_TAINTED_PAYOUTR7_tainted_reentry.yaml	Treasury pays an address tainted by a flagged payout on another chain or vaultAfter R1B/R3B/R9B flag a payout, any other treasury (or the same treasury on another chain) pays that recipient. EVM addresses are the same across chains, so taint follows them.	Fund movement	evmtreasurypayouttaint	2	0.0
{ "source": "evm.*", "match": { "kind": "payout", "vault": { "exists": true } }, "condition": { "type": "tainted", "taint_from": [ "R1B_PAYOUT_SPIKE_TO_NEW_RECIPIENT", "R3B_SELF_SUBMITTED_TEST_THEN_DRAIN", "R9B_PAYOUT_FROM_FLAGGED_NEAR_ACCOUNT" ], "taint_field": "address", "hops": 1, "check": [ "to_addr" ], "cross_only": true }, "shield": { "mode": "paranoid", "capability": "pause_destination", "scope": [ "address" ] } }
15	R8_DEPOSIT_LEDGER_MISMATCHR8_deposit_ledger_mismatch.yaml	Verifier credited a deposit that the token contract refundedShadow ledger at transaction granularity. For one NEAR tx and token, intents.near's internal balance change (mt_mint - mt_burn) must not exceed what it actually kept on the token contract (deposited - refunded). Evaluated when the token contract emits the refund.	Ledger tampering	nearverifierledger	23	sample: 0
{ "source": "near.nep245", "condition": { "type": "deposit_ledger_mismatch", "verifier": "intents.near", "token_contracts": [ "v2_1.omni.hot.tg" ] }, "shield": { "mode": "under_attack", "capability": "raise_mode", "scope": [ "chain", "bridge", "token" ] } }
15	R8B_UNBACKED_CREDIT_WITHDRAWNR8_deposit_ledger_mismatch.yaml	Account withdraws from intents.near after receiving an unbacked creditFollow-up to R8. The Verifier accounts that received a credit the token contract refunded (R8 evidence `credited_accounts`), or an account they moved funds to inside the Verifier (one hop), withdraw from intents.near. This is the step where an unbacked balance leaves the Verifier, before any treasury on another chain pays it out.	Withdrawal	nearverifierledgerwithdrawaltaint	22	sample: 0
{ "source": "near.nep245", "match": { "contract": "intents.near", "kind": "withdrawal", "status": "success" }, "condition": { "type": "tainted", "taint_from": [ "R8_DEPOSIT_LEDGER_MISMATCH" ], "taint_field": "evidence.credited_accounts", "hops": 1, "check": [ "from_addr" ], "observe": { "chain": "near", "contract": "intents.near" } }, "shield": { "mode": "under_attack", "capability": "raise_mode", "scope": [ "chain", "bridge", "token" ] } }
12	R9B_PAYOUT_FROM_FLAGGED_NEAR_ACCOUNTR9_withdrawal_link.yaml	Treasury payout authorized by a NEAR account that NEAR rules flaggedCross-chain link. A HOT treasury payout's calldata nonce equals the memo of the HOT omni mt_burn on NEAR that authorized it. If the NEAR account that burned was involved in an R6 or R8 alert (or received funds from such an account, one hop), the EVM payout inherits the flag and its recipient is tainted for R7 / R7B.	Treasury drain	evmtreasurypayoutxchain	7	sample: 0
{ "source": [ "evm.erc20_transfer", "near.nep245", "near.dip4" ], "match": { "kind": "payout", "vault": "hot_bridge", "extra.withdraw_nonce": { "exists": true } }, "condition": { "type": "withdrawal_link", "mode": "tainted_origin", "taint_from": [ "R6_INTENTS_CALLBACK_ANOMALY", "R8_DEPOSIT_LEDGER_MISMATCH" ], "hops": 1 }, "shield": { "mode": "paranoid", "capability": "pause_destination", "scope": [ "address" ] } }
8	R10_RECIPIENT_PAYOUT_BURSTR10_recipient_payout_burst.yaml	Burst of large treasury payouts to one new counterpartyWazuh-style frequency rule: three or more stablecoin payouts over $250K from the same treasury to the same recipient within 2h, where the recipient had at most 3 such payouts in the 7 days before the burst. Regular counterparties of the NEAR Intents Ethereum treasury receive bursts like this every day; `max_prior` keeps those regular counterparties out. Splitting a drain into several payouts below the R1 / R5 thresholds still trips it. One alert per recipient per 6h.	Treasury drain	evmtreasurypayoutfrequency	3	0.143
{ "source": "evm.erc20_transfer", "match": { "kind": "payout", "vault": [ "hot_bridge", "near_intents" ], "symbol": [ "usdt", "usdc" ], "amount_usd": { "gt": 250000 } }, "condition": { "type": "frequency", "group_by": [ "chain", "vault", "to_addr" ], "count": 3, "within": "2h", "max_prior": { "count": 3, "within": "7d" } }, "ignore": "6h", "ignore_key": [ "chain", "vault", "to_addr" ], "shield": { "capability": "flag_observation", "scope": [ "chain", "bridge", "token", "address" ] } }
15	R9_UNMATCHED_HOT_PAYOUTR9_withdrawal_link.yaml (disabled)	HOT treasury payout without a matching NEAR burnReconciliation. Every HOT treasury payout should match a HOT omni mt_burn on NEAR with the same nonce, token and amount. Disabled by default: it needs complete NEAR coverage of the HOT omni contract (live mode). The replay holds sampled NEAR blocks, where most honest payouts would look unmatched.	Treasury drain	evmtreasurypayoutxchainreconciliation	0	-
No alerts in this window. { "source": [ "evm.erc20_transfer", "near.nep245" ], "match": { "kind": "payout", "vault": "hot_bridge", "extra.withdraw_nonce": { "exists": true } }, "condition": { "type": "withdrawal_link", "mode": "unmatched" }, "shield": { "mode": "under_attack", "capability": "raise_mode", "scope": [ "chain", "bridge", "token" ] } }
5	R100_ROUND_AMOUNT_PAYOUTR100_round_amount_payout.yaml (disabled) (score only)	Large payout of an exact round amountExample of a local extension. Exact round amounts above $100K are a weak signal; score only.	Treasury drain	localevmpayout	0	-
No alerts in this window. { "source": "evm.erc20_transfer", "match": { "kind": "payout", "vault": { "exists": true } }, "condition": { "type": "round_amount", "step": 100000, "min_value": 100000 } }

Baseline false positives 2026-09-08 to 2026-09-29, 21.0 days, same rules and thresholds, no known incident

Payouts in window

51,738

BNB Chain 11,482Ethereum 40,256

Alerts

all severities

High / critical per day

0.143

3 in total

Incidents opened

22 normal3 paranoid0 under attack

Escalated to under attack

the number that would pause a bridge

In sample: thresholds were tuned on this window with the incident replay at hand, and the rules were written from its post-mortem. See the out-of-sample scenario for data they never saw. Events in window: BNB Chain 23,700, Ethereum 40,256, NEAR 1,099.
NEAR rules have no rate here. They read 107 of about 3,013,842 NEAR blocks in this window (0.0036%, about 1.1 minutes of chain time), all picked around known transactions: 119 Verifier transactions, 0 NEAR alerts. Zero alerts in so few blocks only bounds the rate below 2.52% of Verifier transactions, or about 4,024 alerts a day (95%, rule of three).
An ordinary payment, asked hourly: every route allow 100% of 504 hours.

Data & provenance

Fixtures recorded public chain data

151,372 normalized events replayed (whole replay window 01 Sep - 01 Oct 2026). Recorded 2026-10-26T18:32:21.957424Z with intentwatch fetch-fixtures --scenario oct1 into tests/fixtures/oct1.

Part	Range	Records
NEARblocks	68 anchor txs, 576 blocks	576
Manifest entry { "anchors": 68, "blocks": 576, "chain": "near", "kind": "blocks" }
Ethereumrange via etherscan	2026-09-01T00:00 → 2026-10-01T16:00 blocks 25878705-26098520 (out)	59,988
Manifest entry { "chain": "ethereum", "collector": "etherscan", "directions": [ "out" ], "from_block": 25878705, "from_ts": "2026-09-01T00:00:00Z", "kind": "range", "native": false, "records": 59988, "to_block": 26098520, "to_ts": "2026-10-01T16:00:00Z" }
Ethereumrange via etherscan	2026-09-30T12:00 → 2026-10-01T16:00 blocks 26090155-26098520 (in, native)	10,571
Manifest entry { "chain": "ethereum", "collector": "etherscan", "directions": [ "in" ], "from_block": 26090155, "from_ts": "2026-09-30T12:00:00Z", "kind": "range", "native": true, "records": 10571, "to_block": 26098520, "to_ts": "2026-10-01T16:00:00Z" }
Ethereumknown_txs	2 known txs	2
Manifest entry { "chain": "ethereum", "kind": "known_txs", "records": 2, "txs": 2 }
BNB Chainrange via evm_rpc	2026-09-01T00:00 → 2026-10-01T16:00 blocks 119243646-125128702 (out+in)	76,585
Manifest entry { "chain": "bsc", "collector": "evm_rpc", "directions": [ "out", "in" ], "from_block": 119243646, "from_ts": "2026-09-01T00:00:00Z", "kind": "range", "native": false, "records": 76585, "to_block": 125128702, "to_ts": "2026-10-01T16:00:00Z" }
BNB Chainknown_txs	5 known txs	5
Manifest entry { "chain": "bsc", "kind": "known_txs", "records": 5, "txs": 5 }
BNB Chainscan	2026-09-30T18:56 → 2026-09-30T18:58 blocks -	1
Manifest entry { "chain": "bsc", "from_ts": "2026-09-30T18:56:00Z", "kind": "scan", "note": "10 USDT test withdrawal", "records": 1, "to_ts": "2026-09-30T18:58:30Z", "txs": [ "0x4f426e23cda7ab58fd146f4f81489575563770c5d25b49d156870dc1dc1428d5" ] }
BNB Chainscan	2026-09-30T20:04 → 2026-09-30T20:06 blocks -	1
Manifest entry { "chain": "bsc", "from_ts": "2026-09-30T20:04:00Z", "kind": "scan", "note": "11 USDT test withdrawal", "records": 1, "to_ts": "2026-09-30T20:06:30Z", "txs": [ "0xc002bd17fb1d46833088c4deb2e05949fc33bdbd9f95ff53295af0c8f68bfdbf" ] }

Blind spots and caveats

Confidential Intents (private shard): only entry and exit are visible.
HOT / MPC off-chain entitlement accounting: not visible; only its on-chain effects are.
Non-EVM treasuries (BTC, SOL, TON, Stellar, ...) are not collected; native BNB flows on BNB Chain are not either.
NEAR is sampled: the incident replay holds the blocks around the attacker's own NEAR transactions, which were picked by hand from the post-mortem, plus about a minute of benign context. A live run has no such list.
Hindsight: rules were designed after the post-mortem and tuned with the replay at hand, so timing on the incident is a best case. The out-of-sample scenario is the real test.
Detection, not prevention: nothing here submits to SHIELD or blocks anything on NEAR Intents or HOT.

Sources: https://rekt.news/near-intents-rekt, https://docs.near-intents.org/security-compliance/treasury-addresses, https://github.com/near/intents/pull/362

IntentWatch · external, read-only detection over public on-chain data · incidents are SHIELD-shaped but unofficial · built at NEAR HACKATHON