What the fixed correlator and the frozen rules raise on treasury payouts from 26 Oct 00:00 to 1 Nov 18:00 UTC, on data that played no part in writing, tuning or fixing them. No incident is known in this window to us; every alert is a false positive or an unexplained observation unless the notes say otherwise. The first 7 days of the replay, 19 - 26 Oct, come from the earlier window and only warm up the baselines.
| Level | Rule | What it detects | Alerts in window | First (UTC) |
|---|---|---|---|---|
| 1. Probing0 alerts · silent: R6B R6C | ||||
| 2. Ledger tampering0 alerts · silent: R8 R6 | ||||
| 3. Withdrawal0 alerts · silent: R8B | ||||
| 4. Treasury drain35 alerts · silent: R1B R3B R9B R4 | ||||
| 8 | R1 | Treasury payout far above recent maximum | 26 Oct 04:21 | |
| 8 | R3 | Small test payout followed by a large payout to the same recipient | 26 Oct 14:19 | |
| 8 | R5 | Payout over $500K to a recipient first seen less than 7 days ago | 26 Oct 17:04 | |
| 8 | R10 | Burst of large treasury payouts to one new counterparty | 27 Oct 08:45 | |
| 12 | R2 | Treasury outflow velocity above its 7-day p99 | 28 Oct 16:21 | |
| 5. Fund movement0 alerts · silent: R7B R7 | ||||
| 2026-10-28 16:21:47 | Ethereum | R2_VAULT_OUTFLOW_VELOCITYTreasury drain | ethereum near_intents usdc outflow 2,277,279.31 in 1h vs 7d hourly p99 949,887.15 | 12 | 0x10b15441...7a44 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 2026-10-26 04:21:06 | BNB Chain | R1_VAULT_PAYOUT_SPIKETreasury drain | bsc hot_bridge paid 279,831.47 usdt to 0xfd1043098584cbc763f4d2460aecb94dd4b6fee3: 4.04x the 48h max of 69,278.06 | 8 | 0x61ba92b0...c568 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 2026-10-26 14:19:35 | Ethereum | R3_TEST_THEN_DRAINTreasury drain | 0x964c1ec2b7c05eb6efbbfe90a2f92bf081b76754 received a test payout 10m 18s before this 199,989.40 usdc payout | 8 | 0x1edbbb1c...c33c | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 2026-10-26 16:01:35 | Ethereum | R3_TEST_THEN_DRAINTreasury drain | 0x430beef06bcd698bacd358ff2a734e5dc4a598c9 received a test payout 39m 12s before this 301,096.13 usdc payout | 8 | 0xa34693d8...3d04 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 2026-10-26 17:04:11 | Ethereum | R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain | 829,328.21 usdt to 0xdebc13171403cc4c6ed9aa852f5ed492b7e2f091, first seen 0s ago (payout) | 8 | 0x3a241083...3be2 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 2026-10-26 17:18:21 | BNB Chain | R1_VAULT_PAYOUT_SPIKETreasury drain | bsc hot_bridge paid 597,980.35 usdt to 0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758: 11.82x the 48h max of 50,592.21 | 8 | 0xd4e573a6...ce19 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 2026-10-26 18:00:23 | BNB Chain | R1_VAULT_PAYOUT_SPIKETreasury drain | bsc hot_bridge paid 195,011.44 usdt to 0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758: 3.85x the 48h max of 50,592.21 | 8 | 0xac4e6063...5678 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 2026-10-27 08:18:47 | Ethereum | R3_TEST_THEN_DRAINTreasury drain | 0xc0ddbc402cb8c5a73aa950749f008c3aa0d67576 received a test payout 11m 12s before this 217,320.19 usdt payout | 8 | 0x3ea4416a...ec25 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 2026-10-27 08:20:59 | Ethereum | R3_TEST_THEN_DRAINTreasury drain | 0x2f12d2a53828060a9fad8ed7a71c3a5d62ad715b received a test payout 12m 48s before this 350,196.77 usdt payout | 8 | 0x7aebf8bf...7bc3 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 2026-10-27 08:32:23 | Ethereum | R3_TEST_THEN_DRAINTreasury drain | 0xc0ddbc402cb8c5a73aa950749f008c3aa0d67576 received a test payout 24m 48s before this 200,000 usdt payout | 8 | 0x26d28e9c...df31 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 2026-10-27 08:45:11 | Ethereum | R10_RECIPIENT_PAYOUT_BURSTTreasury drain | near_intents on ethereum paid 0xa7d11059477a359f2d8d7f4f9aebf73b9bd84042 3 times over $250K in 19m 0s (1,426,076.63 usdt), 3 such payouts in the 7d before | 8 | 0xf9c4cf15...aaf1 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 2026-10-27 08:46:47 | Ethereum | R3_TEST_THEN_DRAINTreasury drain | 0xddc00a16600165d149a4fdbeaef91f2c0943dc32 received a test payout 38m 0s before this 321,770 usdt payout | 8 | 0xce8c511c...d6cd | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 2026-10-27 09:07:11 | Ethereum | R3_TEST_THEN_DRAINTreasury drain | 0xddc00a16600165d149a4fdbeaef91f2c0943dc32 received a test payout 58m 24s before this 249,619.40 usdt payout | 8 | 0x5331bf32...0c8d | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 2026-10-27 09:10:08 | BNB Chain | R1_VAULT_PAYOUT_SPIKETreasury drain | bsc hot_bridge paid 394,999.63 usdt to 0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758: 3.23x the 48h max of 122,154.31 | 8 | 0x4a2628d0...fbe5 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 2026-10-28 03:06:35 | Ethereum | R3_TEST_THEN_DRAINTreasury drain | 0x5c6ba473320453248bbca9fb9d27e44ed4764b25 received a test payout 6h 24m before this 190,220.33 usdt payout | 8 | 0xc6b671bf...3ed0 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 2026-10-28 15:54:23 | Ethereum | R3_TEST_THEN_DRAINTreasury drain | 0x9bcfd6aab83c6de8f4cf62a8cf508ff06006152b received a test payout 36m 36s before this 150,098.45 usdc payout | 8 | 0x0e6fd849...f4bd | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 2026-10-28 16:06:47 | Ethereum | R1_VAULT_PAYOUT_SPIKETreasury drain | ethereum near_intents paid 947,218.49 usdc to 0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758: 2.37x the 48h max of 399,999.70 | 8 | 0xb7d95bad...d44a | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 2026-10-28 16:26:59 | Ethereum | R3_TEST_THEN_DRAINTreasury drain | 0x6ee447a89f39472de4a63fef1b161506dc6f7f4c received a test payout 3h 52m before this 349,917.84 usdt payout | 8 | 0x2d1b13f7...0947 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 2026-10-28 16:45:47 | Ethereum | R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain | 1,220,000 usdt to 0x89fafcbb10d4a6354a22fae1e8efca21f25bd8ab, first seen 0s ago (payout) | 8 | 0x8bb50613...9234 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 2026-10-28 16:49:59 | Ethereum | R10_RECIPIENT_PAYOUT_BURSTTreasury drain | near_intents on ethereum paid 0xf70da97812cb96acdf810712aa562db8dfa3dbef 3 times over $250K in 21m 48s (834,197.11 usdc), 0 such payouts in the 7d before | 8 | 0x7dfb5416...1c6e | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 2026-10-28 17:04:10 | BNB Chain | R1_VAULT_PAYOUT_SPIKETreasury drain | bsc hot_bridge paid 270,582.71 usdc to 0x51aa68f9c5efe263fddcd28459e18d974258758a: 7.71x the 48h max of 35,089.19 | 8 | 0x0179a5d0...1f10 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 2026-10-28 19:51:41 | BNB Chain | R1_VAULT_PAYOUT_SPIKETreasury drain | bsc hot_bridge paid 287,289.21 usdc to 0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758: 8.19x the 48h max of 35,089.19 | 8 | 0xb3ba991b...9c94 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 2026-10-29 01:36:10 | BNB Chain | R1_VAULT_PAYOUT_SPIKETreasury drain | bsc hot_bridge paid 279,723.75 usdc to 0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758: 7.97x the 48h max of 35,089.19 | 8 | 0xfd912bfd...8c81 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 2026-10-29 20:41:59 | Ethereum | R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain | 626,506.88 usdt to 0xfddceed706749091a10ef893121c1fa53c7d408c, first seen 0s ago (payout) | 8 | 0x5989f4d0...623e | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 2026-10-29 23:44:11 | Ethereum | R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain | 633,246.02 usdt to 0x2233dc6d522da46407a24c2193624f241b4c4cfd, first seen 0s ago (payout) | 8 | 0xca2cb8b9...1a2e | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 2026-10-30 15:16:47 | Ethereum | R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain | 706,483.14 usdt to 0xaee62237566b1a3fa409855c02f1cd006c57377b, first seen 1h 18m ago (payout) | 8 | 0x871e4bf5...fb2e | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 2026-10-31 08:10:47 | Ethereum | R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain | 520,000 usdc to 0x2132c3fc4196ea20b6450bb1b6ed5170811d55f5, first seen 17h 18m ago (payout) | 8 | 0x5258a75b...e82b | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 2026-10-31 09:01:03 | BNB Chain | R1_VAULT_PAYOUT_SPIKETreasury drain | bsc hot_bridge paid 99,890.81 usdc to 0x7ee4cc9ef167bfe563eea5a76161a8bc5a22ceca: 9.92x the 48h max of 10,072.56 | 8 | 0x6a00f936...0f3f | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 2026-10-31 09:07:04 | BNB Chain | R1_VAULT_PAYOUT_SPIKETreasury drain | bsc hot_bridge paid 99,890.72 usdc to 0x7ee4cc9ef167bfe563eea5a76161a8bc5a22ceca: 9.92x the 48h max of 10,072.56 | 8 | 0x0c34b3a6...3075 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 2026-10-31 13:09:47 | Ethereum | R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain | 1,066,261.15 usdc to 0x2132c3fc4196ea20b6450bb1b6ed5170811d55f5, first seen 22h 17m ago (payout) | 8 | 0xdcd3a5cd...2158 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 2026-11-01 09:23:06 | BNB Chain | R1_VAULT_PAYOUT_SPIKETreasury drain | bsc hot_bridge paid 618,833.00 usdt to 0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758: 4.85x the 48h max of 127,635.37 | 8 | 0x6aa9a0a7...8aed | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 2026-11-01 10:45:05 | BNB Chain | R1_VAULT_PAYOUT_SPIKETreasury drain | bsc hot_bridge paid 179,258.00 usdc to 0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758: 17.92x the 48h max of 10,002.29 | 8 | 0xdb15d796...a621 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 2026-11-01 10:48:03 | BNB Chain | R1_VAULT_PAYOUT_SPIKETreasury drain | bsc hot_bridge paid 599,010.37 usdt to 0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758: 4.69x the 48h max of 127,635.37 | 8 | 0x1b55b42b...692d | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 2026-11-01 12:21:03 | BNB Chain | R1_VAULT_PAYOUT_SPIKETreasury drain | bsc hot_bridge paid 89,185.55 usdc to 0x5e6d72de4d2ba2aaa3d7418c90cce007b5872e4e: 8.92x the 48h max of 10,002.29 | 8 | 0xe953c88b...61e4 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 2026-11-01 13:39:03 | BNB Chain | R1_VAULT_PAYOUT_SPIKETreasury drain | bsc hot_bridge paid 77,045.35 usdc to 0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758: 3.56x the 48h max of 21,654.91 | 8 | 0x163155c4...1452 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
No alerts match these filters in the report window.
8 incidents with alerts in the window, highest mode first. Each is SHIELD-shaped
(intentwatch.incident/v1, unofficial: SHIELD's Incident API is partner-only). Alerts sharing an asset or address within 24h
are one incident; two high alerts on different transactions within 2h escalate it to under_attack, unless all of them come from a rate rule (R2), which moves it onto the route and stops at paranoid.
On NEAR: incidents at paranoid or above are written to the IntentWatch incident registry
registry.surs51.testnet (testnet, deployed)
by a detector that holds only a function-call key limited to report_incident with a 0.25 NEAR gas allowance
(read from chain 2026-10-31 19:05:23 UTC: least privilege ok).
No model is connected: the summary module is ready to connect and has recorded nothing for this replay.
The contract (contracts/agent_guard, Rust near-sdk) holds an AI agent's funds. Its only key for the agent is a function-call key limited to
request_transfer (read from chain 2026-11-04 15:47:30 UTC: least privilege ok).
It enforces 0.1 NEAR per transfer and 0.5 NEAR per day, then asks the incident registry about the route the agent declares and the account the money really goes to:
under_attack or a paused destination is refused, paranoid is held for 60 min and re-checked, and any trouble reaching the registry is a refusal.
Deployed at guard.surs51.testnet (tx).
Code upgraded 2026-11-01 16:37:35 UTC (tx); a receipt recorded before that is an answer of the earlier build. Code upgraded 2026-11-04 15:46:26 UTC (tx); a receipt recorded before that is an answer of the earlier build.
The "Contract answers" column comes from a mirror of the contract logic, tested against the contracts with shared vectors, assuming the detector reported each escalation as it happened; the receipts column is what the deployed contract answered on testnet, and intentwatch guard verify reads those back from chain.
The chain, bridge and token are what the agent declares: an agent that lies about them and pays an account nobody has flagged is bounded by the limits only, unless the owner has set an allowlist of receivers, which the contract checks first, along with the owner's stop switch and hourly cap. Click a row for the exact call the agent signs.
| Moment (UTC) | Agent asks | Declared route and real receiver | Contract answers | Testnet receipt |
|---|---|---|---|---|
| 2026-10-28 16:21 | Payment on the route, now paranoid 0.01 NEAR |
ethereum/near_intents/usdc 0x88bbcaee...e758 really pays surs51.testnet |
held route is paranoid (incident IW-20261028-155423-a9e4c8): held until the delay ends | refused 8FghMZpmKa...He9Y |
The request_transfer call the agent signs{
"args": {
"amount": "10000000000000000000000",
"receiver_id": "surs51.testnet",
"route": {
"address": "0x00000000000000000000000000000000000a11ce",
"bridge": "hot",
"chain": "bsc",
"token": "usdt"
}
},
"deposit": "0",
"gas_tgas": 100,
"method": "request_transfer",
"receiver_id": "guard.surs51.testnet"
} | ||||
| 2026-10-28 16:21 | The same payment on a route nothing covers 0.01 NEAR |
bsc/hot/usdc 0x00000000...11ce really pays surs51.testnet |
sent route clear, within limits | sent 4DSpDZagW7...bzCA |
The request_transfer call the agent signs{
"args": {
"amount": "10000000000000000000000",
"receiver_id": "surs51.testnet",
"route": {
"address": "0x00000000000000000000000000000000000a11ce",
"bridge": "near_intents",
"chain": "ethereum",
"token": "usdc"
}
},
"deposit": "0",
"gas_tgas": 100,
"method": "request_transfer",
"receiver_id": "guard.surs51.testnet"
} | ||||
| 2026-10-28 16:21 | A payment over the per-transfer limit 0.2 NEAR |
bsc/hot/usdc 0x00000000...11ce really pays surs51.testnet |
refused amount exceeds the per-transfer limit | refused 2LXCMG3o2K...zUdG |
The request_transfer call the agent signs{
"args": {
"amount": "200000000000000000000000",
"receiver_id": "surs51.testnet",
"route": {
"address": "0x00000000000000000000000000000000000a11ce",
"bridge": "near_intents",
"chain": "ethereum",
"token": "usdc"
}
},
"deposit": "0",
"gas_tgas": 100,
"method": "request_transfer",
"receiver_id": "guard.surs51.testnet"
} | ||||
| 2026-10-28 16:21 | A payment to a fresh account, with the owner's allowlist on 0.01 NEAR |
bsc/hot/usdc 0x00000000...11ce really pays 5fd214f06a...f46a owner allows only surs51.testnet |
refused the receiver is not on the owner's allowlist | refused FvmP6yX4y7...Emq5 |
The request_transfer call the agent signs{
"args": {
"amount": "10000000000000000000000",
"receiver_id": "5fd214f06a0de3e6bcdf6f325ab29b494f9904f491c24e1db62c9069fdb0f46a",
"route": {
"address": "0x00000000000000000000000000000000000a11ce",
"bridge": "near_intents",
"chain": "ethereum",
"token": "usdc"
}
},
"deposit": "0",
"gas_tgas": 100,
"method": "request_transfer",
"receiver_id": "guard.surs51.testnet"
} | ||||
raise_modeNo recorded report for this incident.
Incident hash a8481189c23dc294...e707 (sha256 of the canonical incident JSON; intentwatch registry hashes recomputes it).
report_incident call the detector would sign{
"args": {
"report": {
"alerts": 7,
"attestation_hash": null,
"capability": "raise_mode",
"incident_hash": "a8481189c23dc29469afd24c9fff918dce9cbb2a8ab9dea91c0a61b01a8ae707",
"incident_id": "IW-20261028-155423-a9e4c8",
"mode": "paranoid",
"opened_at_ms": 1793202863000,
"paused_destinations": [],
"scope": {
"address": "0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758",
"bridge": "near_intents",
"chain": "ethereum",
"token": "usdc"
},
"summary_hash": null
}
},
"deposit": "0",
"gas_tgas": 10,
"method": "report_incident",
"receiver_id": "registry.surs51.testnet"
}
Not recorded for this replay. intentwatch triage record asks a NEAR-hosted TEE model for a summary and stores the evidence
(response signature, Intel TDX quote and collateral, NVIDIA GPU verdict) that the replay then re-verifies offline. It needs a NEAR AI Cloud key.
| Time (UTC) | Change | Reason |
|---|---|---|
| 2026-10-28 15:54:23 | normal | 1 observation(s) |
| 2026-10-28 16:21:47 | paranoid | high alert R2_VAULT_OUTFLOW_VELOCITY |
{
"schema": "intentwatch.incident/v1 (shield-compatible, unofficial)",
"incident_id": "IW-20261028-155423-a9e4c8",
"opened_at": "2026-10-28T15:54:23Z",
"updated_at": "2026-10-29T01:36:10Z",
"recommended_mode": "paranoid",
"capability": "raise_mode",
"scope": {
"chain": "ethereum",
"bridge": "near_intents",
"token": "usdc",
"address": "0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758"
},
"score": 11.0,
"max_severity": "high",
"mode_history": [
{
"ts": "2026-10-28T15:54:23Z",
"mode": "normal",
"capability": "flag_observation",
"scope": {
"chain": "ethereum",
"bridge": "near_intents",
"token": "usdc",
"address": "0x9bcfd6aab83c6de8f4cf62a8cf508ff06006152b"
},
"reason": "1 observation(s)",
"alert_id": "R3_TEST_THEN_DRAIN:0caa6824c97a"
},
{
"ts": "2026-10-28T16:21:47Z",
"mode": "paranoid",
"capability": "raise_mode",
"scope": {
"chain": "ethereum",
"bridge": "near_intents",
"token": "usdc",
"address": "0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758"
},
"reason": "high alert R2_VAULT_OUTFLOW_VELOCITY",
"alert_id": "R2_VAULT_OUTFLOW_VELOCITY:5556d10d3f96"
}
],
"recommended_actions": [],
"alerts": [
{
"alert_id": "R3_TEST_THEN_DRAIN:0caa6824c97a",
"rule": "R3_TEST_THEN_DRAIN",
"severity": "medium",
"ts": "2026-10-28T15:54:23Z",
"tx": "0x0e6fd849296bfdb764356018c423d31277748469abec3a861cbebb059a82f4bd"
},
{
"alert_id": "R1_VAULT_PAYOUT_SPIKE:e87e7560b5e4",
"rule": "R1_VAULT_PAYOUT_SPIKE",
"severity": "medium",
"ts": "2026-10-28T16:06:47Z",
"tx": "0xb7d95bad2674698a9fde53fdbb149c5210a4cd05a061709e4a1b7883e53ed44a"
},
{
"alert_id": "R2_VAULT_OUTFLOW_VELOCITY:5556d10d3f96",
"rule": "R2_VAULT_OUTFLOW_VELOCITY",
"severity": "high",
"ts": "2026-10-28T16:21:47Z",
"tx": "0x10b154414e69a672c93c05a9734712777bc42a84fb07eb88ba401092165e7a44"
},
{
"alert_id": "R10_RECIPIENT_PAYOUT_BURST:da6dfe73218f",
"rule": "R10_RECIPIENT_PAYOUT_BURST",
"severity": "medium",
"ts": "2026-10-28T16:49:59Z",
"tx": "0x7dfb54160fd573c9715dc0cdb140a831ba33aa7808a35db1a39817d844d41c6e"
},
{
"alert_id": "R1_VAULT_PAYOUT_SPIKE:339092a8d3ed",
"rule": "R1_VAULT_PAYOUT_SPIKE",
"severity": "medium",
"ts": "2026-10-28T17:04:10Z",
"tx": "0x0179a5d0f930729c70bc63240efb9f7ad0610f87eb25ecc9657908750cf51f10"
},
{
"alert_id": "R1_VAULT_PAYOUT_SPIKE:5587b39941e1",
"rule": "R1_VAULT_PAYOUT_SPIKE",
"severity": "medium",
"ts": "2026-10-28T19:51:41Z",
"tx": "0xb3ba991b221ab5494ea36e29d57f3dfd8838c7ed4df3ce55b227e8d052a79c94"
},
{
"alert_id": "R1_VAULT_PAYOUT_SPIKE:d393a17e2bb9",
"rule": "R1_VAULT_PAYOUT_SPIKE",
"severity": "medium",
"ts": "2026-10-29T01:36:10Z",
"tx": "0xfd912bfdaa75918676c0949ca5bb6aac849aa404a2181a60cf48b09216758c81"
}
],
"summary": "7 alerts (R10_RECIPIENT_PAYOUT_BURST, R1_VAULT_PAYOUT_SPIKE, R2_VAULT_OUTFLOW_VELOCITY, R3_TEST_THEN_DRAIN) on bsc, ethereum; opened 2026-10-28T15:54:23Z by R3_TEST_THEN_DRAIN; mode paranoid; 7 flagged stablecoin payouts totalling 2,706,047.97 USD."
}flag_observationOnly incidents at paranoid or above go on chain. Incident hash d07c5a2ab7e52d9a...18f2.
Summaries are written for incidents at paranoid or above.
| Time (UTC) | Change | Reason |
|---|---|---|
| 2026-10-26 17:04:11 | normal | 1 observation(s) |
{
"schema": "intentwatch.incident/v1 (shield-compatible, unofficial)",
"incident_id": "IW-20261026-170411-1e51dc",
"opened_at": "2026-10-26T17:04:11Z",
"updated_at": "2026-10-28T16:45:47Z",
"recommended_mode": "normal",
"capability": "flag_observation",
"scope": {
"chain": "ethereum",
"bridge": "near_intents",
"token": "usdt",
"address": "0xdebc13171403cc4c6ed9aa852f5ed492b7e2f091"
},
"score": 15.0,
"max_severity": "medium",
"mode_history": [
{
"ts": "2026-10-26T17:04:11Z",
"mode": "normal",
"capability": "flag_observation",
"scope": {
"chain": "ethereum",
"bridge": "near_intents",
"token": "usdt",
"address": "0xdebc13171403cc4c6ed9aa852f5ed492b7e2f091"
},
"reason": "1 observation(s)",
"alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:7cab4c1d5e31"
}
],
"recommended_actions": [],
"alerts": [
{
"alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:7cab4c1d5e31",
"rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
"severity": "medium",
"ts": "2026-10-26T17:04:11Z",
"tx": "0x3a241083a2211185f65abd8f522dba7919da871d65c5c40087dd149038093be2"
},
{
"alert_id": "R3_TEST_THEN_DRAIN:e4752f936d0f",
"rule": "R3_TEST_THEN_DRAIN",
"severity": "medium",
"ts": "2026-10-27T08:18:47Z",
"tx": "0x3ea4416aead0034e6f8cb3d7e5356fc863de4fe696030c0cd422b7317c6dec25"
},
{
"alert_id": "R3_TEST_THEN_DRAIN:4fe4bc64860d",
"rule": "R3_TEST_THEN_DRAIN",
"severity": "medium",
"ts": "2026-10-27T08:20:59Z",
"tx": "0x7aebf8bf80784aaae8a1be8b16a537eab7f68ace17ad72ea57b3bc4f8c4c7bc3"
},
{
"alert_id": "R3_TEST_THEN_DRAIN:cac44346ad34",
"rule": "R3_TEST_THEN_DRAIN",
"severity": "medium",
"ts": "2026-10-27T08:32:23Z",
"tx": "0x26d28e9c8a2b697fae46a441e4f670462c567c13c33157982b1b6e02a9a6df31"
},
{
"alert_id": "R10_RECIPIENT_PAYOUT_BURST:da3f559f68b3",
"rule": "R10_RECIPIENT_PAYOUT_BURST",
"severity": "medium",
"ts": "2026-10-27T08:45:11Z",
"tx": "0xf9c4cf15c49e1019505fbb886d3078d2ed5bf53ab623eb1a0f8c5d8eb2a1aaf1"
},
{
"alert_id": "R3_TEST_THEN_DRAIN:eb3463357a9b",
"rule": "R3_TEST_THEN_DRAIN",
"severity": "medium",
"ts": "2026-10-27T08:46:47Z",
"tx": "0xce8c511c522ecee28e33877c45621864db70bbc97dbae563dd53b8226ee3d6cd"
},
{
"alert_id": "R3_TEST_THEN_DRAIN:77dcf0ec9eee",
"rule": "R3_TEST_THEN_DRAIN",
"severity": "medium",
"ts": "2026-10-27T09:07:11Z",
"tx": "0x5331bf321ee183e0b6fde940432e5a3e10bc57a3248d21664a703ff5ed960c8d"
},
{
"alert_id": "R3_TEST_THEN_DRAIN:61eab6b6014b",
"rule": "R3_TEST_THEN_DRAIN",
"severity": "medium",
"ts": "2026-10-28T03:06:35Z",
"tx": "0xc6b671bff58fdfec31f3a715aecaca5520985d64d38d3cff19b4e533e15d3ed0"
},
{
"alert_id": "R3_TEST_THEN_DRAIN:65bbdd5683e8",
"rule": "R3_TEST_THEN_DRAIN",
"severity": "medium",
"ts": "2026-10-28T16:26:59Z",
"tx": "0x2d1b13f75a0c6f32a5cb4e83a2088b8949652500606dc35221acb6bacd430947"
},
{
"alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:083de45a37f6",
"rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
"severity": "medium",
"ts": "2026-10-28T16:45:47Z",
"tx": "0x8bb5061348e07f12c2d3847e7ce447fb8bc53a7b23d0d4b9e870bcf4289a9234"
}
],
"summary": "10 alerts (R10_RECIPIENT_PAYOUT_BURST, R3_TEST_THEN_DRAIN, R5_NEW_RECIPIENT_LARGE_PAYOUT) on ethereum; opened 2026-10-26T17:04:11Z by R5_NEW_RECIPIENT_LARGE_PAYOUT; mode normal; 10 flagged stablecoin payouts totalling 4,323,331.86 USD."
}flag_observationOnly incidents at paranoid or above go on chain. Incident hash 88640dec310af25c...9d38.
Summaries are written for incidents at paranoid or above.
| Time (UTC) | Change | Reason |
|---|---|---|
| 2026-10-25 06:45:06 | normal | 1 observation(s) |
{
"schema": "intentwatch.incident/v1 (shield-compatible, unofficial)",
"incident_id": "IW-20261025-064506-124e4a",
"opened_at": "2026-10-25T06:45:06Z",
"updated_at": "2026-10-27T09:10:08Z",
"recommended_mode": "normal",
"capability": "flag_observation",
"scope": {
"chain": "bsc",
"bridge": "hot",
"token": "usdt",
"address": "0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758"
},
"score": 7.5,
"max_severity": "medium",
"mode_history": [
{
"ts": "2026-10-25T06:45:06Z",
"mode": "normal",
"capability": "flag_observation",
"scope": {
"chain": "bsc",
"bridge": "hot",
"token": "usdt",
"address": "0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758"
},
"reason": "1 observation(s)",
"alert_id": "R1_VAULT_PAYOUT_SPIKE:3ef0c6b3ba31"
}
],
"recommended_actions": [],
"alerts": [
{
"alert_id": "R1_VAULT_PAYOUT_SPIKE:3ef0c6b3ba31",
"rule": "R1_VAULT_PAYOUT_SPIKE",
"severity": "medium",
"ts": "2026-10-25T06:45:06Z",
"tx": "0xded3fc9775eb7733be7638b1528290e52c1be05b18bfd34a6f74306bef9ff7f3"
},
{
"alert_id": "R1_VAULT_PAYOUT_SPIKE:4e47e1b84af2",
"rule": "R1_VAULT_PAYOUT_SPIKE",
"severity": "medium",
"ts": "2026-10-26T04:21:06Z",
"tx": "0x61ba92b0e2b83361baeaae7ecec0083be44e5ea447101364e1e01954a283c568"
},
{
"alert_id": "R1_VAULT_PAYOUT_SPIKE:71c5b700b809",
"rule": "R1_VAULT_PAYOUT_SPIKE",
"severity": "medium",
"ts": "2026-10-26T17:18:21Z",
"tx": "0xd4e573a6c5e5dddadeb8101de02ecab7c5598cb30741edf220e5ebc6066fce19"
},
{
"alert_id": "R1_VAULT_PAYOUT_SPIKE:95596eb262cd",
"rule": "R1_VAULT_PAYOUT_SPIKE",
"severity": "medium",
"ts": "2026-10-26T18:00:23Z",
"tx": "0xac4e60636a715f014124e525372519d860de176405ee89ba98fb863db4fe5678"
},
{
"alert_id": "R1_VAULT_PAYOUT_SPIKE:d01e2672281c",
"rule": "R1_VAULT_PAYOUT_SPIKE",
"severity": "medium",
"ts": "2026-10-27T09:10:08Z",
"tx": "0x4a2628d0f21551fc249aa79c81d77d38bd856eea2a25e347b2e9833f9e65fbe5"
}
],
"summary": "5 alerts (R1_VAULT_PAYOUT_SPIKE) on bsc; opened 2026-10-25T06:45:06Z by R1_VAULT_PAYOUT_SPIKE; mode normal; 5 flagged stablecoin payouts totalling 1,788,801.38 USD."
}flag_observationOnly incidents at paranoid or above go on chain. Incident hash 0f09318d5aa14b62...31b1.
Summaries are written for incidents at paranoid or above.
| Time (UTC) | Change | Reason |
|---|---|---|
| 2026-11-01 09:23:06 | normal | 1 observation(s) |
{
"schema": "intentwatch.incident/v1 (shield-compatible, unofficial)",
"incident_id": "IW-20261101-092306-16e931",
"opened_at": "2026-11-01T09:23:06Z",
"updated_at": "2026-11-01T13:39:03Z",
"recommended_mode": "normal",
"capability": "flag_observation",
"scope": {
"chain": "bsc",
"bridge": "hot",
"token": "usdt",
"address": "0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758"
},
"score": 7.5,
"max_severity": "medium",
"mode_history": [
{
"ts": "2026-11-01T09:23:06Z",
"mode": "normal",
"capability": "flag_observation",
"scope": {
"chain": "bsc",
"bridge": "hot",
"token": "usdt",
"address": "0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758"
},
"reason": "1 observation(s)",
"alert_id": "R1_VAULT_PAYOUT_SPIKE:e483fc8cdab7"
}
],
"recommended_actions": [],
"alerts": [
{
"alert_id": "R1_VAULT_PAYOUT_SPIKE:e483fc8cdab7",
"rule": "R1_VAULT_PAYOUT_SPIKE",
"severity": "medium",
"ts": "2026-11-01T09:23:06Z",
"tx": "0x6aa9a0a7c3040007d0375a19fd395070261f80990c812c89dce015aacaba8aed"
},
{
"alert_id": "R1_VAULT_PAYOUT_SPIKE:9d299be31526",
"rule": "R1_VAULT_PAYOUT_SPIKE",
"severity": "medium",
"ts": "2026-11-01T10:45:05Z",
"tx": "0xdb15d796de4586e84822ae46a23d304c1acaff37182e0f20cd985e0a1a1da621"
},
{
"alert_id": "R1_VAULT_PAYOUT_SPIKE:2828d91a61ae",
"rule": "R1_VAULT_PAYOUT_SPIKE",
"severity": "medium",
"ts": "2026-11-01T10:48:03Z",
"tx": "0x1b55b42b316373050197a14af8a3b6b2ed5b48d4b739d1360fb60d81b5b7692d"
},
{
"alert_id": "R1_VAULT_PAYOUT_SPIKE:ad426f921bfd",
"rule": "R1_VAULT_PAYOUT_SPIKE",
"severity": "medium",
"ts": "2026-11-01T12:21:03Z",
"tx": "0xe953c88bb17282f785365b9ea93b25704461c603009e4673d3092cba308561e4"
},
{
"alert_id": "R1_VAULT_PAYOUT_SPIKE:8944cdcbd417",
"rule": "R1_VAULT_PAYOUT_SPIKE",
"severity": "medium",
"ts": "2026-11-01T13:39:03Z",
"tx": "0x163155c4de3b3be67deaea80c2edafd2f801da1081f4407656595382a8e01452"
}
],
"summary": "5 alerts (R1_VAULT_PAYOUT_SPIKE) on bsc; opened 2026-11-01T09:23:06Z by R1_VAULT_PAYOUT_SPIKE; mode normal; 5 flagged stablecoin payouts totalling 1,563,332.27 USD."
}flag_observationOnly incidents at paranoid or above go on chain. Incident hash defe5db2cf3fc4eb...d71e.
Summaries are written for incidents at paranoid or above.
| Time (UTC) | Change | Reason |
|---|---|---|
| 2026-10-29 20:41:59 | normal | 1 observation(s) |
{
"schema": "intentwatch.incident/v1 (shield-compatible, unofficial)",
"incident_id": "IW-20261029-204159-9d72f9",
"opened_at": "2026-10-29T20:41:59Z",
"updated_at": "2026-10-30T15:16:47Z",
"recommended_mode": "normal",
"capability": "flag_observation",
"scope": {
"chain": "ethereum",
"bridge": "near_intents",
"token": "usdt",
"address": "0xfddceed706749091a10ef893121c1fa53c7d408c"
},
"score": 4.5,
"max_severity": "medium",
"mode_history": [
{
"ts": "2026-10-29T20:41:59Z",
"mode": "normal",
"capability": "flag_observation",
"scope": {
"chain": "ethereum",
"bridge": "near_intents",
"token": "usdt",
"address": "0xfddceed706749091a10ef893121c1fa53c7d408c"
},
"reason": "1 observation(s)",
"alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:8ee9b886b866"
}
],
"recommended_actions": [],
"alerts": [
{
"alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:8ee9b886b866",
"rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
"severity": "medium",
"ts": "2026-10-29T20:41:59Z",
"tx": "0x5989f4d0527bc3dfc9fcc3d1d529f4eb3b9837926cef7199ca725c0e7c20623e"
},
{
"alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:931284f635ab",
"rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
"severity": "medium",
"ts": "2026-10-29T23:44:11Z",
"tx": "0xca2cb8b95414ad44d97fb8390730984739d78529787c282487405648c1601a2e"
},
{
"alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:8053ed1f7f64",
"rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
"severity": "medium",
"ts": "2026-10-30T15:16:47Z",
"tx": "0x871e4bf5b10acd8648e3bd12fae7d2672a5a61f679b9956733c607f8ebbefb2e"
}
],
"summary": "3 alerts (R5_NEW_RECIPIENT_LARGE_PAYOUT) on ethereum; opened 2026-10-29T20:41:59Z by R5_NEW_RECIPIENT_LARGE_PAYOUT; mode normal; 3 flagged stablecoin payouts totalling 1,966,236.03 USD."
}flag_observationOnly incidents at paranoid or above go on chain. Incident hash 69b0bae2738f2a40...3764.
Summaries are written for incidents at paranoid or above.
| Time (UTC) | Change | Reason |
|---|---|---|
| 2026-10-26 14:19:35 | normal | 1 observation(s) |
{
"schema": "intentwatch.incident/v1 (shield-compatible, unofficial)",
"incident_id": "IW-20261026-141935-86affe",
"opened_at": "2026-10-26T14:19:35Z",
"updated_at": "2026-10-26T16:01:35Z",
"recommended_mode": "normal",
"capability": "flag_observation",
"scope": {
"chain": "ethereum",
"bridge": "near_intents",
"token": "usdc",
"address": "0x964c1ec2b7c05eb6efbbfe90a2f92bf081b76754"
},
"score": 3.0,
"max_severity": "medium",
"mode_history": [
{
"ts": "2026-10-26T14:19:35Z",
"mode": "normal",
"capability": "flag_observation",
"scope": {
"chain": "ethereum",
"bridge": "near_intents",
"token": "usdc",
"address": "0x964c1ec2b7c05eb6efbbfe90a2f92bf081b76754"
},
"reason": "1 observation(s)",
"alert_id": "R3_TEST_THEN_DRAIN:f709c401d970"
}
],
"recommended_actions": [],
"alerts": [
{
"alert_id": "R3_TEST_THEN_DRAIN:f709c401d970",
"rule": "R3_TEST_THEN_DRAIN",
"severity": "medium",
"ts": "2026-10-26T14:19:35Z",
"tx": "0x1edbbb1c6da0e39afc02f0808c12aff15ec243ea96f08cdf93563a3e0ddbc33c"
},
{
"alert_id": "R3_TEST_THEN_DRAIN:b7088b131c93",
"rule": "R3_TEST_THEN_DRAIN",
"severity": "medium",
"ts": "2026-10-26T16:01:35Z",
"tx": "0xa34693d840b771c683f6a667fc43352fb7c7dca83761de1ac248dce8640e3d04"
}
],
"summary": "2 alerts (R3_TEST_THEN_DRAIN) on ethereum; opened 2026-10-26T14:19:35Z by R3_TEST_THEN_DRAIN; mode normal; 2 flagged stablecoin payouts totalling 501,085.53 USD."
}flag_observationOnly incidents at paranoid or above go on chain. Incident hash c16dbc63c8f042c4...48b7.
Summaries are written for incidents at paranoid or above.
| Time (UTC) | Change | Reason |
|---|---|---|
| 2026-10-31 08:10:47 | normal | 1 observation(s) |
{
"schema": "intentwatch.incident/v1 (shield-compatible, unofficial)",
"incident_id": "IW-20261031-081047-4c7195",
"opened_at": "2026-10-31T08:10:47Z",
"updated_at": "2026-10-31T13:09:47Z",
"recommended_mode": "normal",
"capability": "flag_observation",
"scope": {
"chain": "ethereum",
"bridge": "near_intents",
"token": "usdc",
"address": "0x2132c3fc4196ea20b6450bb1b6ed5170811d55f5"
},
"score": 3.0,
"max_severity": "medium",
"mode_history": [
{
"ts": "2026-10-31T08:10:47Z",
"mode": "normal",
"capability": "flag_observation",
"scope": {
"chain": "ethereum",
"bridge": "near_intents",
"token": "usdc",
"address": "0x2132c3fc4196ea20b6450bb1b6ed5170811d55f5"
},
"reason": "1 observation(s)",
"alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:5bf98620a5b5"
}
],
"recommended_actions": [],
"alerts": [
{
"alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:5bf98620a5b5",
"rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
"severity": "medium",
"ts": "2026-10-31T08:10:47Z",
"tx": "0x5258a75b79c5fb7c59fae7710c8663dc3020a42bfeaf13dbee678086486be82b"
},
{
"alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:1c95861aa919",
"rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
"severity": "medium",
"ts": "2026-10-31T13:09:47Z",
"tx": "0xdcd3a5cdfe42347a0af3feadb749dce9b7194655e3b7723f91b2c237e9b22158"
}
],
"summary": "2 alerts (R5_NEW_RECIPIENT_LARGE_PAYOUT) on ethereum; opened 2026-10-31T08:10:47Z by R5_NEW_RECIPIENT_LARGE_PAYOUT; mode normal; 2 flagged stablecoin payouts totalling 1,586,261.15 USD."
}flag_observationOnly incidents at paranoid or above go on chain. Incident hash 6edfe434cd98f2a0...b292.
Summaries are written for incidents at paranoid or above.
| Time (UTC) | Change | Reason |
|---|---|---|
| 2026-10-31 09:01:03 | normal | 1 observation(s) |
{
"schema": "intentwatch.incident/v1 (shield-compatible, unofficial)",
"incident_id": "IW-20261031-090103-9b2a88",
"opened_at": "2026-10-31T09:01:03Z",
"updated_at": "2026-10-31T09:07:04Z",
"recommended_mode": "normal",
"capability": "flag_observation",
"scope": {
"chain": "bsc",
"bridge": "hot",
"token": "usdc",
"address": "0x7ee4cc9ef167bfe563eea5a76161a8bc5a22ceca"
},
"score": 3.0,
"max_severity": "medium",
"mode_history": [
{
"ts": "2026-10-31T09:01:03Z",
"mode": "normal",
"capability": "flag_observation",
"scope": {
"chain": "bsc",
"bridge": "hot",
"token": "usdc",
"address": "0x7ee4cc9ef167bfe563eea5a76161a8bc5a22ceca"
},
"reason": "1 observation(s)",
"alert_id": "R1_VAULT_PAYOUT_SPIKE:c10327cf8317"
}
],
"recommended_actions": [],
"alerts": [
{
"alert_id": "R1_VAULT_PAYOUT_SPIKE:c10327cf8317",
"rule": "R1_VAULT_PAYOUT_SPIKE",
"severity": "medium",
"ts": "2026-10-31T09:01:03Z",
"tx": "0x6a00f93624ba3008a36c54db8ea4f9e1750a6a6c45be41bde52d9c13aaa90f3f"
},
{
"alert_id": "R1_VAULT_PAYOUT_SPIKE:b79096133945",
"rule": "R1_VAULT_PAYOUT_SPIKE",
"severity": "medium",
"ts": "2026-10-31T09:07:04Z",
"tx": "0x0c34b3a61d22945b1bcfe2781e4172d825f787e8d2bf2f7d431a5e487e9d3075"
}
],
"summary": "2 alerts (R1_VAULT_PAYOUT_SPIKE) on bsc; opened 2026-10-31T09:01:03Z by R1_VAULT_PAYOUT_SPIKE; mode normal; 2 flagged stablecoin payouts totalling 199,781.53 USD."
}| Level | Rule | Description | Stage | Groups | In window | Baseline / day |
|---|---|---|---|---|---|---|
| 8 | R1_ |
Treasury payout far above recent maximumA single stablecoin payout from a bridge treasury is more than `factor` times the largest payout of the same (chain, vault, token) over the trailing 48h. Payouts that fired this rule are kept out of the baseline, so a drain cannot raise its own threshold. On the September BNB Chain baseline this fired ~1/day, mostly for recurring large recipients (ratios 2.05-6.1x, W1 was 2.38x), so it is medium on its own; R1B escalates spikes to new recipients. | Treasury drain | evmtreasurypayoutspike | 15 | 2.222 |
{
"source": "evm.erc20_transfer",
"match": {
"kind": "payout",
"vault": [
"hot_bridge",
"near_intents"
],
"symbol": [
"usdt",
"usdc"
]
},
"condition": {
"type": "ratio_to_rolling_max",
"group_by": [
"chain",
"vault",
"token"
],
"window": "48h",
"factor": 2.0,
"min_value": 50000,
"value_field": "amount_usd"
},
"shield": {
"capability": "flag_observation",
"scope": [
"chain",
"bridge",
"token"
]
}
}
| ||||||
| 12 | R1B_ |
Treasury payout spike to a recipient first seen less than 7 days agoComposite (Wazuh-style): R1 (payout > 2x the 48h max) and R5 (recipient first seen < 7 days ago, payout > $500K) fire on the same payout. | Treasury drain | evmtreasurypayoutspikecomposite | 0 | 0.0 |
No alerts in this window.
{
"source": "evm.*",
"match": {
"kind": "payout"
},
"if_all": [
"R1_VAULT_PAYOUT_SPIKE",
"R5_NEW_RECIPIENT_LARGE_PAYOUT"
],
"shield": {
"mode": "paranoid",
"capability": "raise_mode",
"scope": [
"chain",
"bridge",
"token",
"address"
]
}
}
| ||||||
| 12 | R2_ |
Treasury outflow velocity above its 7-day p99The trailing 1h stablecoin outflow of a (chain, vault, token) exceeds 2x the p99 of hourly outflow over the trailing 7 days (empty hours count as zero), and at least $1M. Throttled to one alert per hour per group. Velocity is about the treasury, so it never taints the recipient of the last payout. A rolling sum fires on the flow: its transaction is only where the sum crossed the line, so two alerts are one flow measured twice, and it cannot escalate alone. | Treasury drain | evmtreasurypayoutvelocity | 1 | 0.148 |
{
"source": "evm.erc20_transfer",
"match": {
"kind": "payout",
"vault": [
"hot_bridge",
"near_intents"
],
"symbol": [
"usdt",
"usdc"
]
},
"condition": {
"type": "rolling_sum_vs_percentile",
"group_by": [
"chain",
"vault",
"token"
],
"window": "1h",
"bucket": "1h",
"baseline": "7d",
"percentile": 99,
"factor": 2.0,
"min_value": 1000000,
"min_buckets": 72,
"value_field": "amount_usd"
},
"ignore": "1h",
"ignore_key": [
"chain",
"vault",
"token"
],
"shield": {
"mode": "paranoid",
"capability": "raise_mode",
"scope": [
"chain",
"bridge",
"token"
]
}
}
| ||||||
| 8 | R3_ |
Small test payout followed by a large payout to the same recipientThe same recipient gets at least one payout under $100 and then, within 24h, a payout over $100K from a treasury, and had at most 3 payouts in the 7 days before. Honest users test too: on the September Ethereum baseline this fired ~1/day even after excluding established counterparties, so it is medium on its own; R3B escalates it when the recipient also submitted the payout itself. | Treasury drain | evmtreasurypayoutsequence | 10 | 1.481 |
{
"source": "evm.erc20_transfer",
"match": {
"kind": "payout",
"vault": [
"hot_bridge",
"near_intents"
],
"symbol": [
"usdt",
"usdc"
]
},
"condition": {
"type": "sequence",
"group_by": [
"to_addr"
],
"within": "24h",
"max_prior": {
"count": 3,
"within": "7d"
},
"steps": [
{
"name": "test_payout",
"match": {
"amount_usd": {
"lt": 100
}
}
},
{
"name": "large_payout",
"match": {
"amount_usd": {
"gt": 100000
}
}
}
]
},
"shield": {
"capability": "flag_observation",
"scope": [
"address"
]
}
}
| ||||||
| 12 | R3B_ |
Test-then-drain payout that the recipient submitted itselfComposite (Wazuh-style): R3 and R4 fire on the same payout. A fresh recipient that tested with a small payout and then pulled a large one by submitting the payout tx itself. | Treasury drain | evmtreasurypayoutsequencecomposite | 0 | 0.0 |
No alerts in this window.
{
"source": "evm.erc20_transfer",
"match": {
"kind": "payout"
},
"if_all": [
"R3_TEST_THEN_DRAIN",
"R4_SELF_SUBMITTED_LARGE_PAYOUT"
],
"shield": {
"mode": "paranoid",
"capability": "raise_mode",
"scope": [
"chain",
"bridge",
"token",
"address"
]
}
}
| ||||||
| 5 | R4_ |
Large payout submitted by its own recipientThe payout tx was sent by the recipient itself (tx.from == transfer.to) instead of a relayer. HOT's design allows self-submission, so this is a weak signal: score only, it never opens an incident by itself. | Treasury drain | evmtreasurypayoutsubmitter | 0 | 0.0 |
No alerts in this window.
{
"source": "evm.erc20_transfer",
"match": {
"kind": "payout",
"vault": [
"hot_bridge",
"near_intents"
],
"amount_usd": {
"gt": 100000
},
"extra.tx_submitter": {
"eq_field": "to_addr"
}
}
}
| ||||||
| 8 | R5_ |
Payout over $500K to a recipient first seen less than 7 days agoThe recipient's first interaction with any watched treasury (as sender or receiver, any chain) is less than 7 days old. Needs 7 days of observed history before it can fire. | Treasury drain | evmtreasurypayoutnew_address | 7 | 1.037 |
{
"source": "evm.*",
"match": {
"kind": "payout",
"vault": [
"hot_bridge",
"near_intents"
],
"amount_usd": {
"gt": 500000
}
},
"condition": {
"type": "first_seen",
"field": "to_addr",
"track": [
"from_addr",
"to_addr"
],
"max_age": "7d",
"observe": {
"vault": {
"exists": true
}
}
},
"shield": {
"capability": "flag_observation",
"scope": [
"address"
]
}
}
| ||||||
| 12 | R6_ |
Abnormal resolve callback or oversized event on intents.nearOn the Verifier contract: a failed resolve callback (e.g. mt_resolve_deposit), a log that was rejected for exceeding NEAR's 16,384-byte limit or is close to it, or a single event entry carrying more than 32 token/amount pairs. | Ledger tampering | nearverifiercallback | 0 | sample: 0 |
No alerts in this window.
{
"source": [
"near.receipt",
"near.nep245",
"near.dip4"
],
"match": {
"contract": "intents.near",
"any": [
{
"kind": "callback_failure",
"extra.methods": {
"regex": "resolve"
}
},
{
"extra.rejected_log_size": {
"gt": 15000
}
},
{
"extra.max_log_size": {
"gt": 15000
}
},
{
"extra.n_token_pairs": {
"gt": 32
}
}
]
},
"shield": {
"mode": "paranoid",
"capability": "raise_mode",
"scope": [
"chain",
"bridge",
"token"
]
}
}
| ||||||
| 8 | R6B_ |
Token id length above the p99.9 of observed Verifier eventsThe longest token id in a Verifier multi-token event is longer than 99.9% of token ids seen so far (needs 2,000 samples first). Unusually long ids inflate event logs. | Probing | nearverifiertoken_id | 0 | sample: 0 |
No alerts in this window.
{
"source": "near.nep245",
"match": {
"contract": "intents.near"
},
"condition": {
"type": "percentile_outlier",
"field": "extra.max_token_id_len",
"percentile": 99.9,
"min_samples": 2000
}
}
| ||||||
| 8 | R6C_ |
Token amount near the u128 limit on intents.near or the HOT omni contractA multi-token event moves more than 2^120 raw units of one token (within 2^8 of u128::MAX). No real token supply comes close (wNEAR, with 24 decimals, has ~1.2e33 raw units in total), so such amounts are crafted values that probe overflow, accounting or log-size limits. One alert per token per day. Medium on its own: it says nothing about whether the value was credited. | Probing | nearverifieramount | 0 | sample: 0 |
No alerts in this window.
{
"source": "near.nep245",
"match": {
"contract": [
"intents.near",
"v2_1.omni.hot.tg"
],
"amount_raw": {
"gt": 1329227995784915872903807060280344576
}
},
"ignore": "24h",
"ignore_key": [
"token"
],
"shield": {
"capability": "flag_observation",
"scope": [
"chain",
"bridge",
"token"
]
}
}
| ||||||
| 12 | R7_ |
Address tainted by a flagged payout deposits into a treasuryAn address that received a payout flagged by R1B/R3B/R9B (or got funds from such an address, one hop) later deposits into any NEAR Intents / HOT treasury on any EVM chain. | Fund movement | evmtreasurydeposittaint | 0 | 0.0 |
No alerts in this window.
{
"source": "evm.*",
"match": {
"kind": "deposit",
"vault": {
"exists": true
}
},
"condition": {
"type": "tainted",
"taint_from": [
"R1B_PAYOUT_SPIKE_TO_NEW_RECIPIENT",
"R3B_SELF_SUBMITTED_TEST_THEN_DRAIN",
"R9B_PAYOUT_FROM_FLAGGED_NEAR_ACCOUNT"
],
"taint_field": "address",
"hops": 1,
"check": [
"from_addr"
]
},
"shield": {
"mode": "paranoid",
"capability": "raise_mode",
"scope": [
"chain",
"bridge",
"address"
]
}
}
| ||||||
| 12 | R7B_ |
Treasury pays an address tainted by a flagged payout on another chain or vaultAfter R1B/R3B/R9B flag a payout, any *other* treasury (or the same treasury on another chain) pays that recipient. EVM addresses are the same across chains, so taint follows them. | Fund movement | evmtreasurypayouttaint | 0 | 0.0 |
No alerts in this window.
{
"source": "evm.*",
"match": {
"kind": "payout",
"vault": {
"exists": true
}
},
"condition": {
"type": "tainted",
"taint_from": [
"R1B_PAYOUT_SPIKE_TO_NEW_RECIPIENT",
"R3B_SELF_SUBMITTED_TEST_THEN_DRAIN",
"R9B_PAYOUT_FROM_FLAGGED_NEAR_ACCOUNT"
],
"taint_field": "address",
"hops": 1,
"check": [
"to_addr"
],
"cross_only": true
},
"shield": {
"mode": "paranoid",
"capability": "pause_destination",
"scope": [
"address"
]
}
}
| ||||||
| 15 | R8_ |
Verifier credited a deposit that the token contract refundedShadow ledger at transaction granularity. For one NEAR tx and token, intents.near's internal balance change (mt_mint - mt_burn) must not exceed what it actually kept on the token contract (deposited - refunded). Evaluated when the token contract emits the refund. | Ledger tampering | nearverifierledger | 0 | sample: 0 |
No alerts in this window.
{
"source": "near.nep245",
"condition": {
"type": "deposit_ledger_mismatch",
"verifier": "intents.near",
"token_contracts": [
"v2_1.omni.hot.tg"
]
},
"shield": {
"mode": "under_attack",
"capability": "raise_mode",
"scope": [
"chain",
"bridge",
"token"
]
}
}
| ||||||
| 15 | R8B_ |
Account withdraws from intents.near after receiving an unbacked creditFollow-up to R8. The Verifier accounts that received a credit the token contract refunded (R8 evidence `credited_accounts`), or an account they moved funds to inside the Verifier (one hop), withdraw from intents.near. This is the step where an unbacked balance leaves the Verifier, before any treasury on another chain pays it out. | Withdrawal | nearverifierledgerwithdrawaltaint | 0 | sample: 0 |
No alerts in this window.
{
"source": "near.nep245",
"match": {
"contract": "intents.near",
"kind": "withdrawal",
"status": "success"
},
"condition": {
"type": "tainted",
"taint_from": [
"R8_DEPOSIT_LEDGER_MISMATCH"
],
"taint_field": "evidence.credited_accounts",
"hops": 1,
"check": [
"from_addr"
],
"observe": {
"chain": "near",
"contract": "intents.near"
}
},
"shield": {
"mode": "under_attack",
"capability": "raise_mode",
"scope": [
"chain",
"bridge",
"token"
]
}
}
| ||||||
| 12 | R9B_ |
Treasury payout authorized by a NEAR account that NEAR rules flaggedCross-chain link. A HOT treasury payout's calldata nonce equals the memo of the HOT omni mt_burn on NEAR that authorized it. If the NEAR account that burned was involved in an R6 or R8 alert (or received funds from such an account, one hop), the EVM payout inherits the flag and its recipient is tainted for R7 / R7B. | Treasury drain | evmtreasurypayoutxchain | 0 | sample: 0 |
No alerts in this window.
{
"source": [
"evm.erc20_transfer",
"near.nep245",
"near.dip4"
],
"match": {
"kind": "payout",
"vault": "hot_bridge",
"extra.withdraw_nonce": {
"exists": true
}
},
"condition": {
"type": "withdrawal_link",
"mode": "tainted_origin",
"taint_from": [
"R6_INTENTS_CALLBACK_ANOMALY",
"R8_DEPOSIT_LEDGER_MISMATCH"
],
"hops": 1
},
"shield": {
"mode": "paranoid",
"capability": "pause_destination",
"scope": [
"address"
]
}
}
| ||||||
| 8 | R10_ |
Burst of large treasury payouts to one new counterpartyWazuh-style frequency rule: three or more stablecoin payouts over $250K from the same treasury to the same recipient within 2h, where the recipient had at most 3 such payouts in the 7 days before the burst. Regular counterparties of the NEAR Intents Ethereum treasury receive bursts like this every day; `max_prior` keeps those regular counterparties out. Splitting a drain into several payouts below the R1 / R5 thresholds still trips it. One alert per recipient per 6h. | Treasury drain | evmtreasurypayoutfrequency | 2 | 0.296 |
{
"source": "evm.erc20_transfer",
"match": {
"kind": "payout",
"vault": [
"hot_bridge",
"near_intents"
],
"symbol": [
"usdt",
"usdc"
],
"amount_usd": {
"gt": 250000
}
},
"condition": {
"type": "frequency",
"group_by": [
"chain",
"vault",
"to_addr"
],
"count": 3,
"within": "2h",
"max_prior": {
"count": 3,
"within": "7d"
}
},
"ignore": "6h",
"ignore_key": [
"chain",
"vault",
"to_addr"
],
"shield": {
"capability": "flag_observation",
"scope": [
"chain",
"bridge",
"token",
"address"
]
}
}
| ||||||
| 15 | R9_ |
HOT treasury payout without a matching NEAR burnReconciliation. Every HOT treasury payout should match a HOT omni mt_burn on NEAR with the same nonce, token and amount. Disabled by default: it needs complete NEAR coverage of the HOT omni contract (live mode). The replay holds sampled NEAR blocks, where most honest payouts would look unmatched. | Treasury drain | evmtreasurypayoutxchainreconciliation | 0 | - |
No alerts in this window.
{
"source": [
"evm.erc20_transfer",
"near.nep245"
],
"match": {
"kind": "payout",
"vault": "hot_bridge",
"extra.withdraw_nonce": {
"exists": true
}
},
"condition": {
"type": "withdrawal_link",
"mode": "unmatched"
},
"shield": {
"mode": "under_attack",
"capability": "raise_mode",
"scope": [
"chain",
"bridge",
"token"
]
}
}
| ||||||
| 5 | R100_ |
Large payout of an exact round amountExample of a local extension. Exact round amounts above $100K are a weak signal; score only. | Treasury drain | localevmpayout | 0 | - |
No alerts in this window.
{
"source": "evm.erc20_transfer",
"match": {
"kind": "payout",
"vault": {
"exists": true
}
},
"condition": {
"type": "round_amount",
"step": 100000,
"min_value": 100000
}
}
| ||||||
34,005 normalized events replayed (whole replay window
19 Oct - 01 Nov 2026). Recorded 2026-11-01T18:52:45.340873Z with
intentwatch fetch-fixtures --scenario oct26-oos into tests/fixtures/oct26_oos.
| Part | Range | Records |
|---|---|---|
| Ethereumrange via etherscan | 2026-10-26T00:00 → 2026-11-01T18:00 blocks 26273137-26321574 (out) |
11,923 |
Manifest entry {
"chain": "ethereum",
"collector": "etherscan",
"directions": [
"out"
],
"from_block": 26273137,
"from_ts": "2026-10-26T00:00:00Z",
"kind": "range",
"native": false,
"records": 11923,
"to_block": 26321574,
"to_ts": "2026-11-01T18:00:00Z"
} | ||
| BNB Chainrange via evm_rpc | 2026-10-26T00:00 → 2026-11-01T18:00 blocks 129797838-131093203 (out+in) |
3,775 |
Manifest entry {
"chain": "bsc",
"collector": "evm_rpc",
"directions": [
"out",
"in"
],
"from_block": 129797838,
"from_ts": "2026-10-26T00:00:00Z",
"kind": "range",
"native": false,
"records": 3775,
"to_block": 131093203,
"to_ts": "2026-11-01T18:00:00Z"
} | ||
| NEARsample | 2026-10-26T00:00 → 2026-11-01T18:00 40 random windows of 20 blocks, seed 20261102 |
800 |
Manifest entry {
"blocks": 800,
"blocks_per_window": 20,
"chain": "near",
"from_block": 221609942,
"from_ts": "2026-10-26T00:00:00Z",
"kind": "sample",
"seed": 20261102,
"to_block": 222603712,
"to_ts": "2026-11-01T18:00:00Z",
"window_starts": [
221614902,
221636122,
221668522,
221682262,
221696882,
221706522,
221723082,
221745222,
221769342,
221818882,
221854002,
221862602,
221871102,
221875942,
222034542,
222104302,
222141122,
222144002,
222153402,
222189922,
222221882,
222266702,
222286162,
222299802,
222321022,
222326002,
222342942,
222350522,
222352482,
222386442,
222394322,
222418522,
222435942,
222440102,
222449222,
222450022,
222461542,
222490022,
222508222,
222532102
]
} | ||
| Ethereumrange via etherscan | 2026-10-01T16:00 → 2026-10-26T00:00 blocks 26098521-26273136 (out) |
46,192 |
Manifest entry {
"chain": "ethereum",
"collector": "etherscan",
"directions": [
"out"
],
"from_block": 26098521,
"from_ts": "2026-10-01T16:00:00Z",
"kind": "range",
"native": false,
"records": 46192,
"to_block": 26273136,
"to_ts": "2026-10-26T00:00:00Z"
} | ||
| BNB Chainrange via evm_rpc | 2026-10-01T16:00 → 2026-10-26T00:00 blocks 125128703-129797837 (out+in) |
11,029 |
Manifest entry {
"chain": "bsc",
"collector": "evm_rpc",
"directions": [
"out",
"in"
],
"from_block": 125128703,
"from_ts": "2026-10-01T16:00:00Z",
"kind": "range",
"native": false,
"records": 11029,
"to_block": 129797837,
"to_ts": "2026-10-26T00:00:00Z"
} | ||
| NEARsample | 2026-10-01T16:00 → 2026-10-26T00:00 40 random windows of 20 blocks, seed 20261101 |
796 |
Manifest entry {
"blocks": 796,
"blocks_per_window": 20,
"chain": "near",
"from_block": 218078295,
"from_ts": "2026-10-01T16:00:00Z",
"kind": "sample",
"seed": 20261101,
"to_block": 221609942,
"to_ts": "2026-10-26T00:00:00Z",
"window_starts": [
218085355,
218114055,
218216495,
218231255,
218305835,
218342655,
218391455,
218555275,
218555515,
218619835,
218649315,
218685295,
218735095,
218792915,
218823135,
218898615,
219037835,
219055815,
219227435,
219331175,
219373855,
219518435,
219638815,
219689655,
219784995,
219805035,
219808475,
219865695,
219931975,
220112435,
220144415,
220242555,
220418795,
220639675,
220656515,
220678615,
221016015,
221350595,
221377635,
221492735
]
} | ||
Sources: https://docs.near-intents.org/security-compliance/treasury-addresses