Normal operations

Normal operations, 8 - 29 Sep 2026

What an analyst would have seen over the three weeks before the incident: every alert the shipped rules raise on 11,482 HOT Bridge payouts on BNB Chain, 40,256 NEAR Intents treasury payouts on Ethereum and a sliver of NEAR. No known incident falls in this window, so every alert here is a false positive or an unexplained observation. Thresholds were tuned on it, so this is in sample.

scenario sep-baseline window 21.0 days chains Ethereum, BNB Chain, NEAR rules 16 enabled events in window 68,887 generated 2026-11-04T22:12:58Z

Dashboard

Total alerts

3 high81 medium

Level 12 or above

on 3 transactions

Incidents

3 paranoid22 normal

Highest SHIELD mode

paranoid

recommended by any incident in the window

Events analyzed

68,887

Ethereum 40,256BNB Chain 23,700NEAR 4,931

Analyst notes what this example shows

No incident reaches under_attack: the three high alerts land in three separate incidents, one high alert each, which stay at paranoid with a narrow scope (one recipient address).
Most volume is medium observations (R5 new recipient, R3 test-then-drain, R1 spike, R10 burst): 22 of the 25 incidents hold nothing else and stay at normal (flag_observation), for which a consumer answers allow.
The taint and cross-chain rules (R7, R7B, R9B) stay silent, and so do the NEAR rules (R6, R6B, R6C, R8, R8B). That last part is weak evidence: see the coverage line of the false-positive table.

Timeline everything on one time axis (UTC); each payout lane has its own scale

Alert severity criticalhighmediumlow payout, no alert SHIELD mode normal paranoid under attack reference event Hover a mark for details, click it to drill down

Kill chain alerts by stage of a bridge drain, rules ranked by alerts (IntentWatch's own taxonomy, loosely after MITRE ATT&CK tactics)

Stage 1 Probing 0alerts silent: R6B, R6C
Stage 2 Ledger tampering 0alerts silent: R8, R6
Stage 3 Withdrawal 0alerts silent: R8B
Stage 4 Treasury drain 84alerts first 08 Sep 04:25
Stage 5 Fund movement 0alerts silent: R7B, R7

Level	Rule	What it detects	Alerts in window	First (UTC)
1. Probing0 alerts · silent: R6B R6C
2. Ledger tampering0 alerts · silent: R8 R6
3. Withdrawal0 alerts · silent: R8B
4. Treasury drain84 alerts · silent: R3B R9B R4
8	R5	Payout over $500K to a recipient first seen less than 7 days ago	41	08 Sep 04:47
8	R3	Small test payout followed by a large payout to the same recipient	19	08 Sep 04:25
8	R1	Treasury payout far above recent maximum	18	10 Sep 16:54
8	R10	Burst of large treasury payouts to one new counterparty	3	17 Sep 19:52
12	R2	Treasury outflow velocity above its 7-day p99	2	09 Sep 15:36
12	R1B	Treasury payout spike to a recipient first seen less than 7 days ago	1	24 Sep 20:54
5. Fund movement0 alerts · silent: R7B R7

Events

Security events 84 alerts in the window (88 in the whole replay), most severe first; click a column header to sort, a row for the full document

84 hits

2026-09-09 15:36:23

Ethereum

R2_VAULT_OUTFLOW_VELOCITYTreasury drain

ethereum near_intents usdt outflow 4,844,957.39 in 1h vs 7d hourly p99 2,307,396.32

0xf1d75582...4638

Click a field to copy its value.

timestamp	2026-09-09T15:36:23Z
rule.id	R2_VAULT_OUTFLOW_VELOCITY
rule.level	12
rule.severity	high
rule.description	Treasury outflow velocity above its 7-day p99
rule.groups	evm, treasury, payout, velocity
rule.tactic	Treasury drain
rule.weight	2.0
data.tx	0xf1d755820f2748dd247019487c87bd7645ed19b0e12d2bdf3b6088657b2f4638
data.block	25940750
data.ts	2026-09-09T15:36:23Z
data.chain	ethereum
data.kind	payout
data.amount	653422.219424
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
data.vault	near_intents
data.token	ethereum:usdt
data.address	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
evidence.value_field	amount_usd
evidence.window_sum	4844957.389936
evidence.window	1h
evidence.baseline_percentile	99.0
evidence.baseline_value	2307396.31508605
evidence.baseline_buckets	168
evidence.baseline_horizon	7d
evidence.factor	2.0
evidence.threshold	4614792.6301721
evidence.window_txs	0xde2d1b7c1d265a58e964c162c34dc67c179b7184036644ee9bc472aefed8ce12, 0x9a902a9c316b93485b23e70edf2ea5d925760368881bf248106fcd5d1388fef8, 0x7149650930db91d4244134e73f6ecf303600ddf960fa66e7b5fac01f18dc37e3, 0x6710734b4836c953cf226f3f93ced281bc03ac179322a657350bb6fd19011e80, 0xe617784b509f0bc0793753a863674dbbd6fd1e04ea346b1b2c115f70cb07784d, 0xd74f1a33ef63a1f1dc54b52dccc88a93382acc111d97accf136b5ef4a494c87a, 0xa38cc75a9767d81bea2c339cac89b2f1e81bcd2621c273bb72d80d90fdf1ebec, 0x0517dcba31058657b881b0bd5f03f8aea0159b5afcb8a804c82f791774ec4ece, 0x0ecf2cde5c43687688d2311d4a205d02d1a39bef4a8d6748e132c759812a052e, 0x993f350d5a3c7c3692759899c815ea0563d133452552daa030e7e113eecbe0a7, 0x1857d77e937f363766e76e323e6e2f3ed8448b3bda0ef380a06d03646b505190, 0xc6cf29b9afb8b8f93c1472c17fb0cbb28228c2eeb00531d5dda2bd98ba9a4846, 0x99942fb768143894fcb2001f397519ffdeff25d49bab9e325b6845f9aea11364, 0x29f84aa29a61a9f810e9d25c8267c2f2866b8b348bf73db63003409168a630a2, 0x4dc1e92d00aeddb6fe69fde8dae0dd1bee155372cdb337f348977e9d97565528, 0x26889ef418f59a44099e2ad80fa0e67b821724edd717a4ae059e7ec531228472, 0xac3fea4e9c2dc05b8876d9a8271804918ee2443c573818a9d4e7d29b44d986d6, 0xccdff833646a21b85d98263b6feac7df7d53513d141d8fbfba601794e080f403, 0xa1298c0c442405414f13de3bf383de884d2c22e798392386849e7def1b2c44df, 0xf1d755820f2748dd247019487c87bd7645ed19b0e12d2bdf3b6088657b2f4638
evidence.window_tx_count	66
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdt in ['usdt', 'usdc']
shield.mode	paranoid
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-24 20:54:54

BNB Chain

R1B_PAYOUT_SPIKE_TO_NEW_RECIPIENTTreasury drain

bsc hot_bridge paid 768,574.37 usdt to 0x7c96279ec1e888aa56b9b836e0db26ca48573e1c: 4.33x the 48h max of 177,431.92, recipient first seen 0s ago

0x718e5ea9...74dd

Click a field to copy its value.

timestamp	2026-09-24T20:54:54Z
rule.id	R1B_PAYOUT_SPIKE_TO_NEW_RECIPIENT
rule.level	12
rule.severity	high
rule.description	Treasury payout spike to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, spike, composite
rule.tactic	Treasury drain
rule.weight	3.0
data.tx	0x718e5ea9a5e54426da72acb778c033508004b1e797ada87bc528599c800e74dd
data.block	123824491
data.ts	2026-09-24T20:54:54Z
data.chain	bsc
data.kind	payout
data.amount	768574.366767755535445594
data.symbol	usdt
data.from	0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to	0x7c96279ec1e888aa56b9b836e0db26ca48573e1c
data.tx_submitter	0xcf495cea699b8beca4073279eda66882ccfa273c
data.vault	hot_bridge
data.token	bsc:usdt
data.address	0x7c96279ec1e888aa56b9b836e0db26ca48573e1c
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
scope.address	0x7c96279ec1e888aa56b9b836e0db26ca48573e1c
evidence.value_field	amount_usd
evidence.value	768574.366767755535445594
evidence.baseline_max	177431.920814326836413666
evidence.baseline_tx	0x19539afd3b82325e360c250a203d28628437eae5ac71a0f317fbb273ec20b116
evidence.baseline_ts	2026-09-23T14:15:10Z
evidence.baseline_window	48h
evidence.baseline_events	854
evidence.ratio	4.33
evidence.factor	2.0
evidence.min_value	50000
evidence.address	0x7c96279ec1e888aa56b9b836e0db26ca48573e1c
evidence.first_seen	2026-09-24T20:54:54Z
evidence.first_seen_tx	0x718e5ea9a5e54426da72acb778c033508004b1e797ada87bc528599c800e74dd
evidence.first_seen_kind	payout
evidence.age	0:00:00
evidence.max_age	7d
evidence.history_start	2026-09-01T00:00:14Z
evidence.parents	R1_VAULT_PAYOUT_SPIKE, R5_NEW_RECIPIENT_LARGE_PAYOUT
matched[0]	kind=payout eq payout
shield.mode	paranoid
shield.capability	raise_mode
shield.scope	chain, bridge, token, address

2026-09-28 10:49:25

BNB Chain

R2_VAULT_OUTFLOW_VELOCITYTreasury drain

bsc hot_bridge usdt outflow 1,342,515.90 in 1h vs 7d hourly p99 658,585.25

0x61dbd420...2056

Click a field to copy its value.

timestamp	2026-09-28T10:49:25Z
rule.id	R2_VAULT_OUTFLOW_VELOCITY
rule.level	12
rule.severity	high
rule.description	Treasury outflow velocity above its 7-day p99
rule.groups	evm, treasury, payout, velocity
rule.tactic	Treasury drain
rule.weight	2.0
data.tx	0x61dbd4202d47f48deada4d5e4fbb641eb27ae10ecdd69d3b4a357b0975062056
data.block	124511574
data.ts	2026-09-28T10:49:25Z
data.chain	bsc
data.kind	payout
data.amount	300000
data.symbol	usdt
data.from	0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to	0xc565b3db8527fe7f7f89b630886ec348ae1eb994
data.tx_submitter	0xec4b57d230516a4f3406c9c235963593160b5efe
data.vault	hot_bridge
data.token	bsc:usdt
data.address	0xc565b3db8527fe7f7f89b630886ec348ae1eb994
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
scope.address	0xc565b3db8527fe7f7f89b630886ec348ae1eb994
evidence.value_field	amount_usd
evidence.window_sum	1342515.903512588294937719
evidence.window	1h
evidence.baseline_percentile	99.0
evidence.baseline_value	658585.2498479363183458009
evidence.baseline_buckets	168
evidence.baseline_horizon	7d
evidence.factor	2.0
evidence.threshold	1317170.4996958726366916018
evidence.window_txs	0x7360fb2e3ed59276eeefad01b27a617b67367e070022f003e20397be6515ec15, 0x365c0dc63aaa1b07bb78a58197a65d8dc3928b30c779e992c8715f8789745192, 0xf2e2f9260dcf8195cd669a1131f90ae25ca0507c852608194d160676fe274b22, 0xdeec05bf6d9239e31748326b828501cbe7475b6c9976e968852bd2d9bf47bb48, 0x85165569cab784abc70ac6390081ae8a747f16682006bb96f5c3d288a2fb0372, 0x6c6d8ffe289ff47799a36cdedbbaafc21ae5340355898d9e74abdf1eecaf9c04, 0x30245a51da40966fac07e69bc87585b3daba3883f8acb4ad651a77f88d089fef, 0xbfadc7a52721d873f790dfdeeed4b9830d01709ea32755a2749c7641ed000880, 0x1ca00ae815fe0c74c42c231a9b428fd57b2dcbe8139122312ca884ee2fde5e9d, 0x96f0d536a4e6dbf5a3f630cac452164f2561e73fc7f798b04575ad31da9d792b, 0xc8d3dfc140a8aab6a49bd5da869c227e998594f97359c90d7824cc7eb407fc07, 0xc3ed34b49d9f558975eb03f385f07adfff086468f17efff35a687a722b86bdcf, 0x1bdecc16e4e10ecf0917592e3a993d69740caa649a8918daa17ceee0f0b0aad4, 0xf26fd744f494030c64edf56bf6abb986fe4b535096722a0ddae124bc1df90714, 0x48f8a53dcd943e241df399d4bacaa3fe9ecea3c117f6728bb6ce9d7d113c9d4f, 0x841cd49671a349afdf0b233f03fbb0c0f96aab02faeee76e67e4e3f4177eb492, 0x97bcff55f5a65e7940e664b8a8ada647af53ce9206980bf9df8063e34240c094, 0x1f4326a365f950134a5d42a0532a8be3a50604dd53b57a0b1fb9c9d1908ce82f, 0x09ce25301471694499d039d9d156dba149bb53594c3da66b9e87f746a1360721, 0x61dbd4202d47f48deada4d5e4fbb641eb27ae10ecdd69d3b4a357b0975062056
evidence.window_tx_count	69
matched[0]	kind=payout eq payout
matched[1]	vault=hot_bridge in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdt in ['usdt', 'usdc']
shield.mode	paranoid
shield.capability	raise_mode
shield.scope	chain, bridge, token

2026-09-08 04:25:47

Ethereum

R3_TEST_THEN_DRAINTreasury drain

0x7c947c2fbebd86e5b88b28f097c379fa29831c1a received a test payout 11h 41m before this 106,528.56 usdt payout

0x31ed105a...fe5a

Click a field to copy its value.

timestamp	2026-09-08T04:25:47Z
rule.id	R3_TEST_THEN_DRAIN
rule.level	8
rule.severity	medium
rule.description	Small test payout followed by a large payout to the same recipient
rule.groups	evm, treasury, payout, sequence
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x31ed105aed553c14d2735bd6491317106ea82d2860bf6c2ff90b0906dc70fe5a
data.block	25930244
data.ts	2026-09-08T04:25:47Z
data.chain	ethereum
data.kind	payout
data.amount	106528.560181
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x7c947c2fbebd86e5b88b28f097c379fa29831c1a
data.vault	near_intents
data.token	ethereum:usdt
data.address	0x7c947c2fbebd86e5b88b28f097c379fa29831c1a
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0x7c947c2fbebd86e5b88b28f097c379fa29831c1a
evidence.group.to_addr	0x7c947c2fbebd86e5b88b28f097c379fa29831c1a
evidence.within	24h
evidence.steps	[{"step": "test_payout", "tx": "0xd8de17b257b7a66cb8e8d4accb7ae342946db0f0f51cb941802cb6e24f8274e1", "ts": "2026-09-07T16:44:47Z", "amount": "11.170617"}, {"step": "large_payout", "tx": "0x31ed105aed553c14d2735bd6491317106ea82d2860bf6c2ff90b0906dc70fe5a", "ts": "2026-09-08T04:25:47Z", "amount": "106528.560181"}]
evidence.first_step_age	11:41:00
evidence.prior_events	[{"step": "test_payout", "tx": "0xd8de17b257b7a66cb8e8d4accb7ae342946db0f0f51cb941802cb6e24f8274e1", "ts": "2026-09-07T16:44:47Z", "amount": "11.170617"}]
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdt in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	address

2026-09-08 04:47:47

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

1,371,970 usdt to 0x89fafcbb10d4a6354a22fae1e8efca21f25bd8ab, first seen 6d 22h ago (payout)

0xfaaab5c8...65e1

Click a field to copy its value.

timestamp	2026-09-08T04:47:47Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0xfaaab5c81e23b000234f25c3e002f5b05a8fa630d71f6dc579b2f332db2465e1
data.block	25930353
data.ts	2026-09-08T04:47:47Z
data.chain	ethereum
data.kind	payout
data.amount	1371970
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x89fafcbb10d4a6354a22fae1e8efca21f25bd8ab
data.vault	near_intents
data.token	ethereum:usdt
data.address	0x89fafcbb10d4a6354a22fae1e8efca21f25bd8ab
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0x89fafcbb10d4a6354a22fae1e8efca21f25bd8ab
evidence.address	0x89fafcbb10d4a6354a22fae1e8efca21f25bd8ab
evidence.first_seen	2026-09-01T06:11:35Z
evidence.first_seen_tx	0x8f94efd2edbffe9678d37b5fa474b58dbf770ee771f4c7a11924aa5b75a6cdc9
evidence.first_seen_kind	payout
evidence.age	6 days, 22:36:12
evidence.max_age	7d
evidence.history_start	2026-09-01T00:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=1371970 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-09-08 04:54:16

BNB Chain

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

602,793 usdt to 0x89fafcbb10d4a6354a22fae1e8efca21f25bd8ab, first seen 6d 22h ago (payout)

0x397a842c...a446

Click a field to copy its value.

timestamp	2026-09-08T04:54:16Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x397a842c1b01652646f8fe8619deaccce39ad277301ce4756f96baf3d9a8a446
data.block	120625785
data.ts	2026-09-08T04:54:16Z
data.chain	bsc
data.kind	payout
data.amount	602793
data.symbol	usdt
data.from	0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to	0x89fafcbb10d4a6354a22fae1e8efca21f25bd8ab
data.tx_submitter	0xcf495cea699b8beca4073279eda66882ccfa273c
data.vault	hot_bridge
data.token	bsc:usdt
data.address	0x89fafcbb10d4a6354a22fae1e8efca21f25bd8ab
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
scope.address	0x89fafcbb10d4a6354a22fae1e8efca21f25bd8ab
evidence.address	0x89fafcbb10d4a6354a22fae1e8efca21f25bd8ab
evidence.first_seen	2026-09-01T06:11:35Z
evidence.first_seen_tx	0x8f94efd2edbffe9678d37b5fa474b58dbf770ee771f4c7a11924aa5b75a6cdc9
evidence.first_seen_kind	payout
evidence.age	6 days, 22:42:41
evidence.max_age	7d
evidence.history_start	2026-09-01T00:00:14Z
matched[0]	kind=payout eq payout
matched[1]	vault=hot_bridge in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=602793 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-09-08 06:44:47

Ethereum

R3_TEST_THEN_DRAINTreasury drain

0x09af2cee65fc69f8052eb4611fac428c9cd08905 received a test payout 18m 36s before this 780,398.29 usdc payout

0x7243937a...fc73

Click a field to copy its value.

timestamp	2026-09-08T06:44:47Z
rule.id	R3_TEST_THEN_DRAIN
rule.level	8
rule.severity	medium
rule.description	Small test payout followed by a large payout to the same recipient
rule.groups	evm, treasury, payout, sequence
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x7243937a98bf926553ce7d726cefbe32c688b1c9d7893a3d7e49dd3adecefc73
data.block	25930938
data.ts	2026-09-08T06:44:47Z
data.chain	ethereum
data.kind	payout
data.amount	780398.29406
data.symbol	usdc
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x09af2cee65fc69f8052eb4611fac428c9cd08905
data.vault	near_intents
data.token	ethereum:usdc
data.address	0x09af2cee65fc69f8052eb4611fac428c9cd08905
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdc
scope.address	0x09af2cee65fc69f8052eb4611fac428c9cd08905
evidence.group.to_addr	0x09af2cee65fc69f8052eb4611fac428c9cd08905
evidence.within	24h
evidence.steps	[{"step": "test_payout", "tx": "0xb23ae3f44a870f33e4271ad44cb1cc719c42e70e9eb5877851d00e632d91979d", "ts": "2026-09-08T06:26:11Z", "amount": "10"}, {"step": "large_payout", "tx": "0x7243937a98bf926553ce7d726cefbe32c688b1c9d7893a3d7e49dd3adecefc73", "ts": "2026-09-08T06:44:47Z", "amount": "780398.29406"}]
evidence.first_step_age	0:18:36
evidence.prior_events	[{"step": "test_payout", "tx": "0xb23ae3f44a870f33e4271ad44cb1cc719c42e70e9eb5877851d00e632d91979d", "ts": "2026-09-08T06:26:11Z", "amount": "10"}]
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdc in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	address

2026-09-08 06:44:47

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

780,398.29 usdc to 0x09af2cee65fc69f8052eb4611fac428c9cd08905, first seen 18m 36s ago (payout)

0x7243937a...fc73

Click a field to copy its value.

timestamp	2026-09-08T06:44:47Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x7243937a98bf926553ce7d726cefbe32c688b1c9d7893a3d7e49dd3adecefc73
data.block	25930938
data.ts	2026-09-08T06:44:47Z
data.chain	ethereum
data.kind	payout
data.amount	780398.29406
data.symbol	usdc
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x09af2cee65fc69f8052eb4611fac428c9cd08905
data.vault	near_intents
data.token	ethereum:usdc
data.address	0x09af2cee65fc69f8052eb4611fac428c9cd08905
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdc
scope.address	0x09af2cee65fc69f8052eb4611fac428c9cd08905
evidence.address	0x09af2cee65fc69f8052eb4611fac428c9cd08905
evidence.first_seen	2026-09-08T06:26:11Z
evidence.first_seen_tx	0xb23ae3f44a870f33e4271ad44cb1cc719c42e70e9eb5877851d00e632d91979d
evidence.first_seen_kind	payout
evidence.age	0:18:36
evidence.max_age	7d
evidence.history_start	2026-09-01T00:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=780398.29406 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-09-08 12:25:11

Ethereum

R3_TEST_THEN_DRAINTreasury drain

0x332f3d3de216535473deda446a8a19fa8ade0ee0 received a test payout 14m 12s before this 336,531.60 usdt payout

0x677882c0...8411

Click a field to copy its value.

timestamp	2026-09-08T12:25:11Z
rule.id	R3_TEST_THEN_DRAIN
rule.level	8
rule.severity	medium
rule.description	Small test payout followed by a large payout to the same recipient
rule.groups	evm, treasury, payout, sequence
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x677882c06aa2ccb093dbc392a491f983a355ebcdf0ce0609ed1a56b853ed8411
data.block	25932630
data.ts	2026-09-08T12:25:11Z
data.chain	ethereum
data.kind	payout
data.amount	336531.597765
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x332f3d3de216535473deda446a8a19fa8ade0ee0
data.vault	near_intents
data.token	ethereum:usdt
data.address	0x332f3d3de216535473deda446a8a19fa8ade0ee0
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0x332f3d3de216535473deda446a8a19fa8ade0ee0
evidence.group.to_addr	0x332f3d3de216535473deda446a8a19fa8ade0ee0
evidence.within	24h
evidence.steps	[{"step": "test_payout", "tx": "0x197cc86c377d23e7d2ad18509195623c3a025657bd8a57e3a6a65ca36d673098", "ts": "2026-09-08T12:10:59Z", "amount": "9.69741"}, {"step": "large_payout", "tx": "0x677882c06aa2ccb093dbc392a491f983a355ebcdf0ce0609ed1a56b853ed8411", "ts": "2026-09-08T12:25:11Z", "amount": "336531.597765"}]
evidence.first_step_age	0:14:12
evidence.prior_events	[{"step": "test_payout", "tx": "0x197cc86c377d23e7d2ad18509195623c3a025657bd8a57e3a6a65ca36d673098", "ts": "2026-09-08T12:10:59Z", "amount": "9.69741"}]
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdt in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	address

2026-09-08 15:39:11

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

773,004.40 usdt to 0x2d190b179b5e33e5b88bbff26164635e2fa1142e, first seen 10m 0s ago (payout)

0xb99933ca...a367

Click a field to copy its value.

timestamp	2026-09-08T15:39:11Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0xb99933ca4517f32f92128ae8061047053bfd9d738678b7c82c0603b21541a367
data.block	25933594
data.ts	2026-09-08T15:39:11Z
data.chain	ethereum
data.kind	payout
data.amount	773004.400271
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x2d190b179b5e33e5b88bbff26164635e2fa1142e
data.vault	near_intents
data.token	ethereum:usdt
data.address	0x2d190b179b5e33e5b88bbff26164635e2fa1142e
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0x2d190b179b5e33e5b88bbff26164635e2fa1142e
evidence.address	0x2d190b179b5e33e5b88bbff26164635e2fa1142e
evidence.first_seen	2026-09-08T15:29:11Z
evidence.first_seen_tx	0x79a7b63bf15132c0e23112e142cf18d09156a20b702a1c4b3a3c7aacd7b5b7fd
evidence.first_seen_kind	payout
evidence.age	0:10:00
evidence.max_age	7d
evidence.history_start	2026-09-01T00:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=773004.400271 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-09-08 19:55:59

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

584,839.67 usdc to 0x1d639a688b78f3d7e57166e59d9a8886b1bfb5a5, first seen 0s ago (payout)

0xb53547dc...3154

Click a field to copy its value.

timestamp	2026-09-08T19:55:59Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0xb53547dc7a6c5a2750de1ce922994e28eede0072e83c231988fa0b1d23653154
data.block	25934872
data.ts	2026-09-08T19:55:59Z
data.chain	ethereum
data.kind	payout
data.amount	584839.665171
data.symbol	usdc
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x1d639a688b78f3d7e57166e59d9a8886b1bfb5a5
data.vault	near_intents
data.token	ethereum:usdc
data.address	0x1d639a688b78f3d7e57166e59d9a8886b1bfb5a5
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdc
scope.address	0x1d639a688b78f3d7e57166e59d9a8886b1bfb5a5
evidence.address	0x1d639a688b78f3d7e57166e59d9a8886b1bfb5a5
evidence.first_seen	2026-09-08T19:55:59Z
evidence.first_seen_tx	0xb53547dc7a6c5a2750de1ce922994e28eede0072e83c231988fa0b1d23653154
evidence.first_seen_kind	payout
evidence.age	0:00:00
evidence.max_age	7d
evidence.history_start	2026-09-01T00:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=584839.665171 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-09-08 20:34:11

Ethereum

R3_TEST_THEN_DRAINTreasury drain

0xb6faebab097b7405120d2acb70c02ae7cea4ab39 received a test payout 8m 36s before this 144,000 usdc payout

0xebf07066...d3b2

Click a field to copy its value.

timestamp	2026-09-08T20:34:11Z
rule.id	R3_TEST_THEN_DRAIN
rule.level	8
rule.severity	medium
rule.description	Small test payout followed by a large payout to the same recipient
rule.groups	evm, treasury, payout, sequence
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0xebf0706643ab349f235c19a4cdedb366671fd86993df0a5ed6a2d2c71fa7d3b2
data.block	25935063
data.ts	2026-09-08T20:34:11Z
data.chain	ethereum
data.kind	payout
data.amount	144000
data.symbol	usdc
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0xb6faebab097b7405120d2acb70c02ae7cea4ab39
data.vault	near_intents
data.token	ethereum:usdc
data.address	0xb6faebab097b7405120d2acb70c02ae7cea4ab39
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdc
scope.address	0xb6faebab097b7405120d2acb70c02ae7cea4ab39
evidence.group.to_addr	0xb6faebab097b7405120d2acb70c02ae7cea4ab39
evidence.within	24h
evidence.steps	[{"step": "test_payout", "tx": "0xe4aa40cfd9416d1014d9a5b2a4bf43a829e3b6a4f0e32f5509c01700c4bd7eb0", "ts": "2026-09-08T20:25:35Z", "amount": "28"}, {"step": "large_payout", "tx": "0xebf0706643ab349f235c19a4cdedb366671fd86993df0a5ed6a2d2c71fa7d3b2", "ts": "2026-09-08T20:34:11Z", "amount": "144000"}]
evidence.first_step_age	0:08:36
evidence.prior_events	[{"step": "test_payout", "tx": "0xe4aa40cfd9416d1014d9a5b2a4bf43a829e3b6a4f0e32f5509c01700c4bd7eb0", "ts": "2026-09-08T20:25:35Z", "amount": "28"}]
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdc in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	address

2026-09-09 09:36:59

Ethereum

R3_TEST_THEN_DRAINTreasury drain

0x1f89291eeaeb857cce9efbe38887081248875934 received a test payout 28m 12s before this 120,294.72 usdc payout

0xdfc30ad9...e210

Click a field to copy its value.

timestamp	2026-09-09T09:36:59Z
rule.id	R3_TEST_THEN_DRAIN
rule.level	8
rule.severity	medium
rule.description	Small test payout followed by a large payout to the same recipient
rule.groups	evm, treasury, payout, sequence
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0xdfc30ad9228bc2a6ee5a8a25f212e0b1866ed6965a90c96a686d09e28270e210
data.block	25938962
data.ts	2026-09-09T09:36:59Z
data.chain	ethereum
data.kind	payout
data.amount	120294.722512
data.symbol	usdc
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x1f89291eeaeb857cce9efbe38887081248875934
data.vault	near_intents
data.token	ethereum:usdc
data.address	0x1f89291eeaeb857cce9efbe38887081248875934
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdc
scope.address	0x1f89291eeaeb857cce9efbe38887081248875934
evidence.group.to_addr	0x1f89291eeaeb857cce9efbe38887081248875934
evidence.within	24h
evidence.steps	[{"step": "test_payout", "tx": "0x812a98c89b262d360680b77636cba70ae51536f73be13d36910dddcddf391663", "ts": "2026-09-09T09:08:47Z", "amount": "12.051915"}, {"step": "large_payout", "tx": "0xdfc30ad9228bc2a6ee5a8a25f212e0b1866ed6965a90c96a686d09e28270e210", "ts": "2026-09-09T09:36:59Z", "amount": "120294.722512"}]
evidence.first_step_age	0:28:12
evidence.prior_events	[{"step": "test_payout", "tx": "0x812a98c89b262d360680b77636cba70ae51536f73be13d36910dddcddf391663", "ts": "2026-09-09T09:08:47Z", "amount": "12.051915"}]
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdc in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	address

2026-09-10 06:22:59

Ethereum

R3_TEST_THEN_DRAINTreasury drain

0xc9379729b1e271bc65044ce0cab9ef3f2674b6c7 received a test payout 6m 36s before this 159,974.48 usdt payout

0x8a5d6b8e...ce17

Click a field to copy its value.

timestamp	2026-09-10T06:22:59Z
rule.id	R3_TEST_THEN_DRAIN
rule.level	8
rule.severity	medium
rule.description	Small test payout followed by a large payout to the same recipient
rule.groups	evm, treasury, payout, sequence
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x8a5d6b8e68a2e9bda3353fcc40a75db61bbedc3c711758ea5f04c035bd7bce17
data.block	25945171
data.ts	2026-09-10T06:22:59Z
data.chain	ethereum
data.kind	payout
data.amount	159974.48003
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0xc9379729b1e271bc65044ce0cab9ef3f2674b6c7
data.vault	near_intents
data.token	ethereum:usdt
data.address	0xc9379729b1e271bc65044ce0cab9ef3f2674b6c7
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0xc9379729b1e271bc65044ce0cab9ef3f2674b6c7
evidence.group.to_addr	0xc9379729b1e271bc65044ce0cab9ef3f2674b6c7
evidence.within	24h
evidence.steps	[{"step": "test_payout", "tx": "0x5bedd5baeb3a14d1c3a3f0f9c3669d3c638e9f2a09aefa66014f48fa1f199685", "ts": "2026-09-10T06:16:23Z", "amount": "8"}, {"step": "large_payout", "tx": "0x8a5d6b8e68a2e9bda3353fcc40a75db61bbedc3c711758ea5f04c035bd7bce17", "ts": "2026-09-10T06:22:59Z", "amount": "159974.48003"}]
evidence.first_step_age	0:06:36
evidence.prior_events	[{"step": "test_payout", "tx": "0x5bedd5baeb3a14d1c3a3f0f9c3669d3c638e9f2a09aefa66014f48fa1f199685", "ts": "2026-09-10T06:16:23Z", "amount": "8"}]
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdt in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	address

2026-09-10 13:05:11

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

1,166,646.95 usdt to 0x2233dc6d522da46407a24c2193624f241b4c4cfd, first seen 6d 3h ago (payout)

0xd9a99e63...2776

Click a field to copy its value.

timestamp	2026-09-10T13:05:11Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0xd9a99e636968aee4d6db329c6ff9f7576b5f8f2a4b503d627a56934fe93a2776
data.block	25947172
data.ts	2026-09-10T13:05:11Z
data.chain	ethereum
data.kind	payout
data.amount	1166646.946047
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x2233dc6d522da46407a24c2193624f241b4c4cfd
data.vault	near_intents
data.token	ethereum:usdt
data.address	0x2233dc6d522da46407a24c2193624f241b4c4cfd
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0x2233dc6d522da46407a24c2193624f241b4c4cfd
evidence.address	0x2233dc6d522da46407a24c2193624f241b4c4cfd
evidence.first_seen	2026-09-04T09:13:35Z
evidence.first_seen_tx	0xd73b18b344ac26b477a974c2940c16bbda386c269eba4d6e1b9f343f16439493
evidence.first_seen_kind	payout
evidence.age	6 days, 3:51:36
evidence.max_age	7d
evidence.history_start	2026-09-01T00:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=1166646.946047 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-09-10 14:21:35

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

567,435.09 usdt to 0x663362feb50f30cfebbd8cd3277ad59fd223bb99, first seen 52m 36s ago (payout)

0xb005ef01...a27a

Click a field to copy its value.

timestamp	2026-09-10T14:21:35Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0xb005ef015f6a30781bb5d94fe80f38d304ee7ae53d4e37641d5129d37774a27a
data.block	25947553
data.ts	2026-09-10T14:21:35Z
data.chain	ethereum
data.kind	payout
data.amount	567435.093206
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x663362feb50f30cfebbd8cd3277ad59fd223bb99
data.vault	near_intents
data.token	ethereum:usdt
data.address	0x663362feb50f30cfebbd8cd3277ad59fd223bb99
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0x663362feb50f30cfebbd8cd3277ad59fd223bb99
evidence.address	0x663362feb50f30cfebbd8cd3277ad59fd223bb99
evidence.first_seen	2026-09-10T13:28:59Z
evidence.first_seen_tx	0x8769b1ace04842791dd259a866fb7d58df62eb41a59219207469114a9b4a4785
evidence.first_seen_kind	payout
evidence.age	0:52:36
evidence.max_age	7d
evidence.history_start	2026-09-01T00:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=567435.093206 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-09-10 16:54:30

BNB Chain

R1_VAULT_PAYOUT_SPIKETreasury drain

bsc hot_bridge paid 193,088.49 usdc to 0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758: 2.65x the 48h max of 72,793.94

0xffae3a9b...0de2

Click a field to copy its value.

timestamp	2026-09-10T16:54:30Z
rule.id	R1_VAULT_PAYOUT_SPIKE
rule.level	8
rule.severity	medium
rule.description	Treasury payout far above recent maximum
rule.groups	evm, treasury, payout, spike
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0xffae3a9b074c70430c7e108da231aa57982dee10579d5f68b66313c738bf0de2
data.block	121105580
data.ts	2026-09-10T16:54:30Z
data.chain	bsc
data.kind	payout
data.amount	193088.490226878002550614
data.symbol	usdc
data.from	0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
data.tx_submitter	0xcf495cea699b8beca4073279eda66882ccfa273c
data.vault	hot_bridge
data.token	bsc:usdc
data.address	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
scope.chain	bsc
scope.bridge	hot
scope.token	usdc
scope.address	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
evidence.value_field	amount_usd
evidence.value	193088.490226878002550614
evidence.baseline_max	72793.936263532006477744
evidence.baseline_tx	0xfb5453b4f83632729e91f5e4bb3268941330a412c00cb2eef58306cd3a75a790
evidence.baseline_ts	2026-09-10T11:15:22Z
evidence.baseline_window	48h
evidence.baseline_events	98
evidence.ratio	2.65
evidence.factor	2.0
evidence.min_value	50000
matched[0]	kind=payout eq payout
matched[1]	vault=hot_bridge in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdc in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	chain, bridge, token

2026-09-10 17:15:06

BNB Chain

R1_VAULT_PAYOUT_SPIKETreasury drain

bsc hot_bridge paid 199,928.46 usdc to 0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758: 2.75x the 48h max of 72,793.94

0x5dcedd67...4901

Click a field to copy its value.

timestamp	2026-09-10T17:15:06Z
rule.id	R1_VAULT_PAYOUT_SPIKE
rule.level	8
rule.severity	medium
rule.description	Treasury payout far above recent maximum
rule.groups	evm, treasury, payout, spike
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x5dcedd67f63b6aad287460e434fc0b6bcb404045d90be861282917111ba34901
data.block	121108326
data.ts	2026-09-10T17:15:06Z
data.chain	bsc
data.kind	payout
data.amount	199928.462496239570538146
data.symbol	usdc
data.from	0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
data.tx_submitter	0xcf495cea699b8beca4073279eda66882ccfa273c
data.vault	hot_bridge
data.token	bsc:usdc
data.address	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
scope.chain	bsc
scope.bridge	hot
scope.token	usdc
scope.address	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
evidence.value_field	amount_usd
evidence.value	199928.462496239570538146
evidence.baseline_max	72793.936263532006477744
evidence.baseline_tx	0xfb5453b4f83632729e91f5e4bb3268941330a412c00cb2eef58306cd3a75a790
evidence.baseline_ts	2026-09-10T11:15:22Z
evidence.baseline_window	48h
evidence.baseline_events	99
evidence.ratio	2.75
evidence.factor	2.0
evidence.min_value	50000
matched[0]	kind=payout eq payout
matched[1]	vault=hot_bridge in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdc in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	chain, bridge, token

2026-09-10 18:15:14

BNB Chain

R1_VAULT_PAYOUT_SPIKETreasury drain

bsc hot_bridge paid 171,237.30 usdc to 0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758: 2.35x the 48h max of 72,793.94

0xf124d70a...baa6

Click a field to copy its value.

timestamp	2026-09-10T18:15:14Z
rule.id	R1_VAULT_PAYOUT_SPIKE
rule.level	8
rule.severity	medium
rule.description	Treasury payout far above recent maximum
rule.groups	evm, treasury, payout, spike
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0xf124d70ab583a8f87873f11531cb09f5e40169c39f144dc9722c3e730ef8baa6
data.block	121116340
data.ts	2026-09-10T18:15:14Z
data.chain	bsc
data.kind	payout
data.amount	171237.299535023991033496
data.symbol	usdc
data.from	0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
data.tx_submitter	0xcf495cea699b8beca4073279eda66882ccfa273c
data.vault	hot_bridge
data.token	bsc:usdc
data.address	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
scope.chain	bsc
scope.bridge	hot
scope.token	usdc
scope.address	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
evidence.value_field	amount_usd
evidence.value	171237.299535023991033496
evidence.baseline_max	72793.936263532006477744
evidence.baseline_tx	0xfb5453b4f83632729e91f5e4bb3268941330a412c00cb2eef58306cd3a75a790
evidence.baseline_ts	2026-09-10T11:15:22Z
evidence.baseline_window	48h
evidence.baseline_events	96
evidence.ratio	2.35
evidence.factor	2.0
evidence.min_value	50000
matched[0]	kind=payout eq payout
matched[1]	vault=hot_bridge in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdc in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	chain, bridge, token

2026-09-10 18:54:42

BNB Chain

R1_VAULT_PAYOUT_SPIKETreasury drain

bsc hot_bridge paid 200,032.57 usdc to 0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758: 2.75x the 48h max of 72,793.94

0xf727cdc3...ff6e

Click a field to copy its value.

timestamp	2026-09-10T18:54:42Z
rule.id	R1_VAULT_PAYOUT_SPIKE
rule.level	8
rule.severity	medium
rule.description	Treasury payout far above recent maximum
rule.groups	evm, treasury, payout, spike
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0xf727cdc36d45e1448ca1c80587e0dc0991ab0ee11c289f91ed22176d202fff6e
data.block	121121600
data.ts	2026-09-10T18:54:42Z
data.chain	bsc
data.kind	payout
data.amount	200032.574490062136485695
data.symbol	usdc
data.from	0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
data.tx_submitter	0xcf495cea699b8beca4073279eda66882ccfa273c
data.vault	hot_bridge
data.token	bsc:usdc
data.address	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
scope.chain	bsc
scope.bridge	hot
scope.token	usdc
scope.address	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
evidence.value_field	amount_usd
evidence.value	200032.574490062136485695
evidence.baseline_max	72793.936263532006477744
evidence.baseline_tx	0xfb5453b4f83632729e91f5e4bb3268941330a412c00cb2eef58306cd3a75a790
evidence.baseline_ts	2026-09-10T11:15:22Z
evidence.baseline_window	48h
evidence.baseline_events	96
evidence.ratio	2.75
evidence.factor	2.0
evidence.min_value	50000
matched[0]	kind=payout eq payout
matched[1]	vault=hot_bridge in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdc in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	chain, bridge, token

2026-09-10 19:45:38

BNB Chain

R1_VAULT_PAYOUT_SPIKETreasury drain

bsc hot_bridge paid 167,762.86 usdc to 0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758: 2.3x the 48h max of 72,793.94

0x55e4fac0...0c80

Click a field to copy its value.

timestamp	2026-09-10T19:45:38Z
rule.id	R1_VAULT_PAYOUT_SPIKE
rule.level	8
rule.severity	medium
rule.description	Treasury payout far above recent maximum
rule.groups	evm, treasury, payout, spike
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x55e4fac0ff4949c6190df65d9be14c9ecb057072fac556d94269628955260c80
data.block	121128389
data.ts	2026-09-10T19:45:38Z
data.chain	bsc
data.kind	payout
data.amount	167762.86265
data.symbol	usdc
data.from	0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
data.tx_submitter	0xcf495cea699b8beca4073279eda66882ccfa273c
data.vault	hot_bridge
data.token	bsc:usdc
data.address	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
scope.chain	bsc
scope.bridge	hot
scope.token	usdc
scope.address	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
evidence.value_field	amount_usd
evidence.value	167762.86265
evidence.baseline_max	72793.936263532006477744
evidence.baseline_tx	0xfb5453b4f83632729e91f5e4bb3268941330a412c00cb2eef58306cd3a75a790
evidence.baseline_ts	2026-09-10T11:15:22Z
evidence.baseline_window	48h
evidence.baseline_events	94
evidence.ratio	2.3
evidence.factor	2.0
evidence.min_value	50000
matched[0]	kind=payout eq payout
matched[1]	vault=hot_bridge in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdc in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	chain, bridge, token

2026-09-10 20:14:39

BNB Chain

R1_VAULT_PAYOUT_SPIKETreasury drain

bsc hot_bridge paid 175,862.68 usdc to 0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758: 2.42x the 48h max of 72,793.94

0x6d3d602c...e027

Click a field to copy its value.

timestamp	2026-09-10T20:14:39Z
rule.id	R1_VAULT_PAYOUT_SPIKE
rule.level	8
rule.severity	medium
rule.description	Treasury payout far above recent maximum
rule.groups	evm, treasury, payout, spike
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x6d3d602c6c5b7a84dd2563b98be36f6f77f5c892bca7642fe652b8ceb6dee027
data.block	121132259
data.ts	2026-09-10T20:14:39Z
data.chain	bsc
data.kind	payout
data.amount	175862.680025
data.symbol	usdc
data.from	0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
data.tx_submitter	0xcf495cea699b8beca4073279eda66882ccfa273c
data.vault	hot_bridge
data.token	bsc:usdc
data.address	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
scope.chain	bsc
scope.bridge	hot
scope.token	usdc
scope.address	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
evidence.value_field	amount_usd
evidence.value	175862.680025
evidence.baseline_max	72793.936263532006477744
evidence.baseline_tx	0xfb5453b4f83632729e91f5e4bb3268941330a412c00cb2eef58306cd3a75a790
evidence.baseline_ts	2026-09-10T11:15:22Z
evidence.baseline_window	48h
evidence.baseline_events	91
evidence.ratio	2.42
evidence.factor	2.0
evidence.min_value	50000
matched[0]	kind=payout eq payout
matched[1]	vault=hot_bridge in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdc in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	chain, bridge, token

2026-09-10 20:57:06

BNB Chain

R1_VAULT_PAYOUT_SPIKETreasury drain

bsc hot_bridge paid 201,796.85 usdc to 0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758: 2.77x the 48h max of 72,793.94

0x0e148ec6...de9e

Click a field to copy its value.

timestamp	2026-09-10T20:57:06Z
rule.id	R1_VAULT_PAYOUT_SPIKE
rule.level	8
rule.severity	medium
rule.description	Treasury payout far above recent maximum
rule.groups	evm, treasury, payout, spike
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x0e148ec6936205344162f8e54a0f7457cef33fa3fc1a57aedff464eba91fde9e
data.block	121137915
data.ts	2026-09-10T20:57:06Z
data.chain	bsc
data.kind	payout
data.amount	201796.853056
data.symbol	usdc
data.from	0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
data.tx_submitter	0xcf495cea699b8beca4073279eda66882ccfa273c
data.vault	hot_bridge
data.token	bsc:usdc
data.address	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
scope.chain	bsc
scope.bridge	hot
scope.token	usdc
scope.address	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
evidence.value_field	amount_usd
evidence.value	201796.853056
evidence.baseline_max	72793.936263532006477744
evidence.baseline_tx	0xfb5453b4f83632729e91f5e4bb3268941330a412c00cb2eef58306cd3a75a790
evidence.baseline_ts	2026-09-10T11:15:22Z
evidence.baseline_window	48h
evidence.baseline_events	90
evidence.ratio	2.77
evidence.factor	2.0
evidence.min_value	50000
matched[0]	kind=payout eq payout
matched[1]	vault=hot_bridge in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdc in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	chain, bridge, token

2026-09-11 08:59:23

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

586,360.55 usdc to 0x68c599e571cb3b5d593afd67a757493109557f51, first seen 47h 26m ago (payout)

0x8636d3f8...c903

Click a field to copy its value.

timestamp	2026-09-11T08:59:23Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x8636d3f8e8d8ee8c9772d60621bc82b86aa0eaf4f352c3cb0ddc83699fb7c903
data.block	25953119
data.ts	2026-09-11T08:59:23Z
data.chain	ethereum
data.kind	payout
data.amount	586360.554961
data.symbol	usdc
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x68c599e571cb3b5d593afd67a757493109557f51
data.vault	near_intents
data.token	ethereum:usdc
data.address	0x68c599e571cb3b5d593afd67a757493109557f51
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdc
scope.address	0x68c599e571cb3b5d593afd67a757493109557f51
evidence.address	0x68c599e571cb3b5d593afd67a757493109557f51
evidence.first_seen	2026-09-09T09:32:59Z
evidence.first_seen_tx	0x77561047a939811cf2ae55b0b5a9991dfc55f8081ef805e1254a870886cb54b5
evidence.first_seen_kind	payout
evidence.age	1 day, 23:26:24
evidence.max_age	7d
evidence.history_start	2026-09-01T00:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=586360.554961 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-09-11 23:55:47

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

663,389.73 usdt to 0x956466762d6089316923121e3cbc4947a623be68, first seen 0s ago (payout)

0x0f9b59bc...d6c5

Click a field to copy its value.

timestamp	2026-09-11T23:55:47Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x0f9b59bcdbb239ae6bc7996b38f9f3190673f4e6d38b0898283a3d396444d6c5
data.block	25957584
data.ts	2026-09-11T23:55:47Z
data.chain	ethereum
data.kind	payout
data.amount	663389.733748
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x956466762d6089316923121e3cbc4947a623be68
data.vault	near_intents
data.token	ethereum:usdt
data.address	0x956466762d6089316923121e3cbc4947a623be68
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0x956466762d6089316923121e3cbc4947a623be68
evidence.address	0x956466762d6089316923121e3cbc4947a623be68
evidence.first_seen	2026-09-11T23:55:47Z
evidence.first_seen_tx	0x0f9b59bcdbb239ae6bc7996b38f9f3190673f4e6d38b0898283a3d396444d6c5
evidence.first_seen_kind	payout
evidence.age	0:00:00
evidence.max_age	7d
evidence.history_start	2026-09-01T00:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=663389.733748 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-09-12 19:02:35

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

721,120.62 usdc to 0x88fadcfce0264e48dbc399209a1d11352d22cd10, first seen 0s ago (payout)

0x553b38c3...7094

Click a field to copy its value.

timestamp	2026-09-12T19:02:35Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x553b38c33f093bfe74186bd0796a080f8956fa2c4eb2eb0ae63362f7b2727094
data.block	25963298
data.ts	2026-09-12T19:02:35Z
data.chain	ethereum
data.kind	payout
data.amount	721120.624963
data.symbol	usdc
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x88fadcfce0264e48dbc399209a1d11352d22cd10
data.vault	near_intents
data.token	ethereum:usdc
data.address	0x88fadcfce0264e48dbc399209a1d11352d22cd10
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdc
scope.address	0x88fadcfce0264e48dbc399209a1d11352d22cd10
evidence.address	0x88fadcfce0264e48dbc399209a1d11352d22cd10
evidence.first_seen	2026-09-12T19:02:35Z
evidence.first_seen_tx	0x553b38c33f093bfe74186bd0796a080f8956fa2c4eb2eb0ae63362f7b2727094
evidence.first_seen_kind	payout
evidence.age	0:00:00
evidence.max_age	7d
evidence.history_start	2026-09-01T00:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=721120.624963 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-09-13 11:44:35

Ethereum

R3_TEST_THEN_DRAINTreasury drain

0xc9379729b1e271bc65044ce0cab9ef3f2674b6c7 received a test payout 52m 12s before this 209,967.38 usdt payout

0xd479c7e2...67bb

Click a field to copy its value.

timestamp	2026-09-13T11:44:35Z
rule.id	R3_TEST_THEN_DRAIN
rule.level	8
rule.severity	medium
rule.description	Small test payout followed by a large payout to the same recipient
rule.groups	evm, treasury, payout, sequence
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0xd479c7e2e063ae8539c2ce41e3acb2700b78afd4c8c9bc2fe609de5cd83c67bb
data.block	25968295
data.ts	2026-09-13T11:44:35Z
data.chain	ethereum
data.kind	payout
data.amount	209967.38004
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0xc9379729b1e271bc65044ce0cab9ef3f2674b6c7
data.vault	near_intents
data.token	ethereum:usdt
data.address	0xc9379729b1e271bc65044ce0cab9ef3f2674b6c7
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0xc9379729b1e271bc65044ce0cab9ef3f2674b6c7
evidence.group.to_addr	0xc9379729b1e271bc65044ce0cab9ef3f2674b6c7
evidence.within	24h
evidence.steps	[{"step": "test_payout", "tx": "0x9f56830e017ea5569e44ab1a7cd56f6c3d05722abd439eedcec306d25cd657ae", "ts": "2026-09-13T10:52:23Z", "amount": "10"}, {"step": "large_payout", "tx": "0xd479c7e2e063ae8539c2ce41e3acb2700b78afd4c8c9bc2fe609de5cd83c67bb", "ts": "2026-09-13T11:44:35Z", "amount": "209967.38004"}]
evidence.first_step_age	0:52:12
evidence.prior_events	[{"step": "test_payout", "tx": "0x9f56830e017ea5569e44ab1a7cd56f6c3d05722abd439eedcec306d25cd657ae", "ts": "2026-09-13T10:52:23Z", "amount": "10"}]
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdt in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	address

2026-09-14 07:01:23

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

581,514.09 usdt to 0x1b24d9f2022ccdbd894289ef41a14f24e8b6edd1, first seen 0s ago (payout)

0xa92a8fb7...ab11

Click a field to copy its value.

timestamp	2026-09-14T07:01:23Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0xa92a8fb7a081b2870c10ed9dfafb1e28e8bf4e92bca0d7b57cf98789e942ab11
data.block	25974063
data.ts	2026-09-14T07:01:23Z
data.chain	ethereum
data.kind	payout
data.amount	581514.094357
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x1b24d9f2022ccdbd894289ef41a14f24e8b6edd1
data.vault	near_intents
data.token	ethereum:usdt
data.address	0x1b24d9f2022ccdbd894289ef41a14f24e8b6edd1
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0x1b24d9f2022ccdbd894289ef41a14f24e8b6edd1
evidence.address	0x1b24d9f2022ccdbd894289ef41a14f24e8b6edd1
evidence.first_seen	2026-09-14T07:01:23Z
evidence.first_seen_tx	0xa92a8fb7a081b2870c10ed9dfafb1e28e8bf4e92bca0d7b57cf98789e942ab11
evidence.first_seen_kind	payout
evidence.age	0:00:00
evidence.max_age	7d
evidence.history_start	2026-09-01T00:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=581514.094357 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-09-14 12:54:07

BNB Chain

R1_VAULT_PAYOUT_SPIKETreasury drain

bsc hot_bridge paid 815,299 usdt to 0x89fafcbb10d4a6354a22fae1e8efca21f25bd8ab: 2.05x the 48h max of 396,802.00

0x3e90d741...3157

Click a field to copy its value.

timestamp	2026-09-14T12:54:07Z
rule.id	R1_VAULT_PAYOUT_SPIKE
rule.level	8
rule.severity	medium
rule.description	Treasury payout far above recent maximum
rule.groups	evm, treasury, payout, spike
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x3e90d7415965456e868a3599fcf1cdbbcf92ac9798afe05d75abe197a1743157
data.block	121841162
data.ts	2026-09-14T12:54:07Z
data.chain	bsc
data.kind	payout
data.amount	815299
data.symbol	usdt
data.from	0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to	0x89fafcbb10d4a6354a22fae1e8efca21f25bd8ab
data.tx_submitter	0xcf495cea699b8beca4073279eda66882ccfa273c
data.vault	hot_bridge
data.token	bsc:usdt
data.address	0x89fafcbb10d4a6354a22fae1e8efca21f25bd8ab
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
scope.address	0x89fafcbb10d4a6354a22fae1e8efca21f25bd8ab
evidence.value_field	amount_usd
evidence.value	815299
evidence.baseline_max	396801.996819587227990424
evidence.baseline_tx	0xbd7e5998ca89f254c756dbed775dea58e1897fcb000082a99b811bf8fb41919c
evidence.baseline_ts	2026-09-12T13:51:18Z
evidence.baseline_window	48h
evidence.baseline_events	594
evidence.ratio	2.05
evidence.factor	2.0
evidence.min_value	50000
matched[0]	kind=payout eq payout
matched[1]	vault=hot_bridge in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdt in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	chain, bridge, token

2026-09-14 15:06:22

BNB Chain

R1_VAULT_PAYOUT_SPIKETreasury drain

bsc hot_bridge paid 502,087.30 usdt to 0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758: 2.81x the 48h max of 178,624.82

0xffcccc64...3d18

Click a field to copy its value.

timestamp	2026-09-14T15:06:22Z
rule.id	R1_VAULT_PAYOUT_SPIKE
rule.level	8
rule.severity	medium
rule.description	Treasury payout far above recent maximum
rule.groups	evm, treasury, payout, spike
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0xffcccc649e69c9ece838cbd33974cb826667f85468485f79c2a54b2773793d18
data.block	121858786
data.ts	2026-09-14T15:06:22Z
data.chain	bsc
data.kind	payout
data.amount	502087.29723
data.symbol	usdt
data.from	0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
data.tx_submitter	0xcf495cea699b8beca4073279eda66882ccfa273c
data.vault	hot_bridge
data.token	bsc:usdt
data.address	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
scope.address	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
evidence.value_field	amount_usd
evidence.value	502087.29723
evidence.baseline_max	178624.81757229637961499
evidence.baseline_tx	0xb6c5589c04f85d25ac9bd96fb03db8cecd117abf043c50e2b01d3d429fd39937
evidence.baseline_ts	2026-09-13T14:36:18Z
evidence.baseline_window	48h
evidence.baseline_events	601
evidence.ratio	2.81
evidence.factor	2.0
evidence.min_value	50000
matched[0]	kind=payout eq payout
matched[1]	vault=hot_bridge in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdt in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	chain, bridge, token

2026-09-14 21:58:35

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

582,222.52 usdc to 0xd3ad516ed8963179c6160c73109c969bcccba6ae, first seen 45h 4m ago (payout)

0x310cba1e...fe70

Click a field to copy its value.

timestamp	2026-09-14T21:58:35Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x310cba1ec2bbb3de946a9b32fe40bccc51ca472ad1d1374b0e7377611028fe70
data.block	25978532
data.ts	2026-09-14T21:58:35Z
data.chain	ethereum
data.kind	payout
data.amount	582222.522003
data.symbol	usdc
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0xd3ad516ed8963179c6160c73109c969bcccba6ae
data.vault	near_intents
data.token	ethereum:usdc
data.address	0xd3ad516ed8963179c6160c73109c969bcccba6ae
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdc
scope.address	0xd3ad516ed8963179c6160c73109c969bcccba6ae
evidence.address	0xd3ad516ed8963179c6160c73109c969bcccba6ae
evidence.first_seen	2026-09-13T00:53:59Z
evidence.first_seen_tx	0x38311e77e5d89a1a1761ee624ad3691a81cbdc15b4a2f107ed4d5e6f099831f5
evidence.first_seen_kind	payout
evidence.age	1 day, 21:04:36
evidence.max_age	7d
evidence.history_start	2026-09-01T00:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=582222.522003 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-09-15 02:55:23

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

765,344.92 usdt to 0x2d190b179b5e33e5b88bbff26164635e2fa1142e, first seen 6d 11h ago (payout)

0x0cc66c21...fcee

Click a field to copy its value.

timestamp	2026-09-15T02:55:23Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x0cc66c21793a5d8f1d45ad9cb981028e708675b2c7a91befb16dd9f03f8efcee
data.block	25980008
data.ts	2026-09-15T02:55:23Z
data.chain	ethereum
data.kind	payout
data.amount	765344.918385
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x2d190b179b5e33e5b88bbff26164635e2fa1142e
data.vault	near_intents
data.token	ethereum:usdt
data.address	0x2d190b179b5e33e5b88bbff26164635e2fa1142e
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0x2d190b179b5e33e5b88bbff26164635e2fa1142e
evidence.address	0x2d190b179b5e33e5b88bbff26164635e2fa1142e
evidence.first_seen	2026-09-08T15:29:11Z
evidence.first_seen_tx	0x79a7b63bf15132c0e23112e142cf18d09156a20b702a1c4b3a3c7aacd7b5b7fd
evidence.first_seen_kind	payout
evidence.age	6 days, 11:26:12
evidence.max_age	7d
evidence.history_start	2026-09-01T00:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=765344.918385 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-09-15 19:24:27

BNB Chain

R1_VAULT_PAYOUT_SPIKETreasury drain

bsc hot_bridge paid 202,898.61 usdc to 0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758: 5.98x the 48h max of 33,932.93

0x357bc160...6245

Click a field to copy its value.

timestamp	2026-09-15T19:24:27Z
rule.id	R1_VAULT_PAYOUT_SPIKE
rule.level	8
rule.severity	medium
rule.description	Treasury payout far above recent maximum
rule.groups	evm, treasury, payout, spike
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x357bc160a1243835fe3d3d1e05798a675c2207726243fc0228f5090f03746245
data.block	122085124
data.ts	2026-09-15T19:24:27Z
data.chain	bsc
data.kind	payout
data.amount	202898.612683100615027353
data.symbol	usdc
data.from	0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
data.tx_submitter	0xcf495cea699b8beca4073279eda66882ccfa273c
data.vault	hot_bridge
data.token	bsc:usdc
data.address	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
scope.chain	bsc
scope.bridge	hot
scope.token	usdc
scope.address	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
evidence.value_field	amount_usd
evidence.value	202898.612683100615027353
evidence.baseline_max	33932.928718285237022366
evidence.baseline_tx	0x5d5df4c1b8b65c0bc2bf8b0b93d605a5be111744b4b509bf07ec22834933031a
evidence.baseline_ts	2026-09-14T07:42:06Z
evidence.baseline_window	48h
evidence.baseline_events	86
evidence.ratio	5.98
evidence.factor	2.0
evidence.min_value	50000
matched[0]	kind=payout eq payout
matched[1]	vault=hot_bridge in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdc in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	chain, bridge, token

2026-09-15 20:06:21

BNB Chain

R1_VAULT_PAYOUT_SPIKETreasury drain

bsc hot_bridge paid 208,488.19 usdc to 0x94bd10695b1f87b0e9407ac85fa2b52869ce1c14: 6.14x the 48h max of 33,932.93

0x106eaa17...895e

Click a field to copy its value.

timestamp	2026-09-15T20:06:21Z
rule.id	R1_VAULT_PAYOUT_SPIKE
rule.level	8
rule.severity	medium
rule.description	Treasury payout far above recent maximum
rule.groups	evm, treasury, payout, spike
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x106eaa1773a97cefd74785cdcbf610b0b680db0a8efac36ee16a4f46b7c8895e
data.block	122090708
data.ts	2026-09-15T20:06:21Z
data.chain	bsc
data.kind	payout
data.amount	208488.193474579308990635
data.symbol	usdc
data.from	0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to	0x94bd10695b1f87b0e9407ac85fa2b52869ce1c14
data.tx_submitter	0xcf495cea699b8beca4073279eda66882ccfa273c
data.vault	hot_bridge
data.token	bsc:usdc
data.address	0x94bd10695b1f87b0e9407ac85fa2b52869ce1c14
scope.chain	bsc
scope.bridge	hot
scope.token	usdc
scope.address	0x94bd10695b1f87b0e9407ac85fa2b52869ce1c14
evidence.value_field	amount_usd
evidence.value	208488.193474579308990635
evidence.baseline_max	33932.928718285237022366
evidence.baseline_tx	0x5d5df4c1b8b65c0bc2bf8b0b93d605a5be111744b4b509bf07ec22834933031a
evidence.baseline_ts	2026-09-14T07:42:06Z
evidence.baseline_window	48h
evidence.baseline_events	90
evidence.ratio	6.14
evidence.factor	2.0
evidence.min_value	50000
matched[0]	kind=payout eq payout
matched[1]	vault=hot_bridge in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdc in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	chain, bridge, token

2026-09-16 03:55:11

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

620,468.63 usdt to 0xe8e29f787f59499abff43a7bb18284feb8163192, first seen 0s ago (payout)

0xd5ebcf00...0927

Click a field to copy its value.

timestamp	2026-09-16T03:55:11Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0xd5ebcf0088a1acdbe318618d0e1cf284a16abe582e176ac828f244c113cc0927
data.block	25987480
data.ts	2026-09-16T03:55:11Z
data.chain	ethereum
data.kind	payout
data.amount	620468.628083
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0xe8e29f787f59499abff43a7bb18284feb8163192
data.vault	near_intents
data.token	ethereum:usdt
data.address	0xe8e29f787f59499abff43a7bb18284feb8163192
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0xe8e29f787f59499abff43a7bb18284feb8163192
evidence.address	0xe8e29f787f59499abff43a7bb18284feb8163192
evidence.first_seen	2026-09-16T03:55:11Z
evidence.first_seen_tx	0xd5ebcf0088a1acdbe318618d0e1cf284a16abe582e176ac828f244c113cc0927
evidence.first_seen_kind	payout
evidence.age	0:00:00
evidence.max_age	7d
evidence.history_start	2026-09-01T00:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=620468.628083 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-09-16 09:45:27

BNB Chain

R1_VAULT_PAYOUT_SPIKETreasury drain

bsc hot_bridge paid 546,380.52 usdt to 0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758: 2.27x the 48h max of 240,704.16

0xd97808f2...d517

Click a field to copy its value.

timestamp	2026-09-16T09:45:27Z
rule.id	R1_VAULT_PAYOUT_SPIKE
rule.level	8
rule.severity	medium
rule.description	Treasury payout far above recent maximum
rule.groups	evm, treasury, payout, spike
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0xd97808f253d2dac6d6e0842b24f8f4a5a1ed17ac3125cbfe78f2441e942fd517
data.block	122199869
data.ts	2026-09-16T09:45:27Z
data.chain	bsc
data.kind	payout
data.amount	546380.524535640580495987
data.symbol	usdt
data.from	0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
data.tx_submitter	0xcf495cea699b8beca4073279eda66882ccfa273c
data.vault	hot_bridge
data.token	bsc:usdt
data.address	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
scope.address	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
evidence.value_field	amount_usd
evidence.value	546380.524535640580495987
evidence.baseline_max	240704.15953
evidence.baseline_tx	0x36b7e23e533731331bd2a5ba5ae36c9424c9ebebb87aeed582f36264e73a54c2
evidence.baseline_ts	2026-09-16T06:45:17Z
evidence.baseline_window	48h
evidence.baseline_events	683
evidence.ratio	2.27
evidence.factor	2.0
evidence.min_value	50000
matched[0]	kind=payout eq payout
matched[1]	vault=hot_bridge in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdt in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	chain, bridge, token

2026-09-16 12:11:35

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

511,998.31 usdt to 0x04f461af0894c871d3997b29eac293260f68021c, first seen 0s ago (payout)

0x9ddd5e2d...b58a

Click a field to copy its value.

timestamp	2026-09-16T12:11:35Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x9ddd5e2d34790da4fd44922987048966216161e48e5abfb7943597a253feb58a
data.block	25989953
data.ts	2026-09-16T12:11:35Z
data.chain	ethereum
data.kind	payout
data.amount	511998.31
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x04f461af0894c871d3997b29eac293260f68021c
data.vault	near_intents
data.token	ethereum:usdt
data.address	0x04f461af0894c871d3997b29eac293260f68021c
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0x04f461af0894c871d3997b29eac293260f68021c
evidence.address	0x04f461af0894c871d3997b29eac293260f68021c
evidence.first_seen	2026-09-16T12:11:35Z
evidence.first_seen_tx	0x9ddd5e2d34790da4fd44922987048966216161e48e5abfb7943597a253feb58a
evidence.first_seen_kind	payout
evidence.age	0:00:00
evidence.max_age	7d
evidence.history_start	2026-09-01T00:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=511998.31 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-09-17 17:42:59

Ethereum

R3_TEST_THEN_DRAINTreasury drain

0x09af2cee65fc69f8052eb4611fac428c9cd08905 received a test payout 4m 12s before this 295,281.13 usdc payout

0xe5bc2c69...bc33

Click a field to copy its value.

timestamp	2026-09-17T17:42:59Z
rule.id	R3_TEST_THEN_DRAIN
rule.level	8
rule.severity	medium
rule.description	Small test payout followed by a large payout to the same recipient
rule.groups	evm, treasury, payout, sequence
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0xe5bc2c691ba42b3e4ce34c5338c9dea59d924d62d7bdff19698174c061a6bc33
data.block	25998777
data.ts	2026-09-17T17:42:59Z
data.chain	ethereum
data.kind	payout
data.amount	295281.130047
data.symbol	usdc
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x09af2cee65fc69f8052eb4611fac428c9cd08905
data.vault	near_intents
data.token	ethereum:usdc
data.address	0x09af2cee65fc69f8052eb4611fac428c9cd08905
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdc
scope.address	0x09af2cee65fc69f8052eb4611fac428c9cd08905
evidence.group.to_addr	0x09af2cee65fc69f8052eb4611fac428c9cd08905
evidence.within	24h
evidence.steps	[{"step": "test_payout", "tx": "0x978afa3e9258b7b263fbbdd6b72fdf3ecd4ca67f7efc7f9273de721c3eee6b93", "ts": "2026-09-17T17:38:47Z", "amount": "5.14"}, {"step": "large_payout", "tx": "0xe5bc2c691ba42b3e4ce34c5338c9dea59d924d62d7bdff19698174c061a6bc33", "ts": "2026-09-17T17:42:59Z", "amount": "295281.130047"}]
evidence.first_step_age	0:04:12
evidence.prior_events	[{"step": "test_payout", "tx": "0x978afa3e9258b7b263fbbdd6b72fdf3ecd4ca67f7efc7f9273de721c3eee6b93", "ts": "2026-09-17T17:38:47Z", "amount": "5.14"}]
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdc in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	address

2026-09-17 19:27:47

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

616,275.02 usdt to 0x736278d93b31be6d30a78372410b507070a96c08, first seen 16m 36s ago (payout)

0x3d71b011...7845

Click a field to copy its value.

timestamp	2026-09-17T19:27:47Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x3d71b01186b27d9b2aadda9b06423154c2745e5be650d68676b3ca633cb77845
data.block	25999300
data.ts	2026-09-17T19:27:47Z
data.chain	ethereum
data.kind	payout
data.amount	616275.024399
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x736278d93b31be6d30a78372410b507070a96c08
data.vault	near_intents
data.token	ethereum:usdt
data.address	0x736278d93b31be6d30a78372410b507070a96c08
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0x736278d93b31be6d30a78372410b507070a96c08
evidence.address	0x736278d93b31be6d30a78372410b507070a96c08
evidence.first_seen	2026-09-17T19:11:11Z
evidence.first_seen_tx	0x9dae491a87c82bb146afcc48cb4054307c5d7956c833527bf861b38f5ade71cd
evidence.first_seen_kind	payout
evidence.age	0:16:36
evidence.max_age	7d
evidence.history_start	2026-09-01T00:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=616275.024399 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-09-17 19:52:11

Ethereum

R10_RECIPIENT_PAYOUT_BURSTTreasury drain

near_intents on ethereum paid 0x736278d93b31be6d30a78372410b507070a96c08 3 times over $250K in 41m 0s (1,672,177.30 usdt), 0 such payouts in the 7d before

0x672f4c84...4cbc

Click a field to copy its value.

timestamp	2026-09-17T19:52:11Z
rule.id	R10_RECIPIENT_PAYOUT_BURST
rule.level	8
rule.severity	medium
rule.description	Burst of large treasury payouts to one new counterparty
rule.groups	evm, treasury, payout, frequency
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x672f4c8455c3ca1c9c7ff0efd50e796fbf0d20470ca056b85d97ae0f15a64cbc
data.block	25999422
data.ts	2026-09-17T19:52:11Z
data.chain	ethereum
data.kind	payout
data.amount	621307.209036
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x736278d93b31be6d30a78372410b507070a96c08
data.vault	near_intents
data.token	ethereum:usdt
data.address	0x736278d93b31be6d30a78372410b507070a96c08
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0x736278d93b31be6d30a78372410b507070a96c08
evidence.group.chain	ethereum
evidence.group.vault	near_intents
evidence.group.to_addr	0x736278d93b31be6d30a78372410b507070a96c08
evidence.count	3
evidence.min_count	3
evidence.within	2h
evidence.window_sum	1672177.295983
evidence.burst_txs	0x9dae491a87c82bb146afcc48cb4054307c5d7956c833527bf861b38f5ade71cd, 0x3d71b01186b27d9b2aadda9b06423154c2745e5be650d68676b3ca633cb77845, 0x672f4c8455c3ca1c9c7ff0efd50e796fbf0d20470ca056b85d97ae0f15a64cbc
evidence.burst_started	2026-09-17T19:11:11Z
evidence.burst_span	0:41:00
evidence.prior_events	0
evidence.max_prior	3
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdt in ['usdt', 'usdc']
matched[3]	amount_usd=621307.209036 gt 250000
shield.capability	flag_observation
shield.scope	chain, bridge, token, address

2026-09-17 19:52:11

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

621,307.21 usdt to 0x736278d93b31be6d30a78372410b507070a96c08, first seen 41m 0s ago (payout)

0x672f4c84...4cbc

Click a field to copy its value.

timestamp	2026-09-17T19:52:11Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x672f4c8455c3ca1c9c7ff0efd50e796fbf0d20470ca056b85d97ae0f15a64cbc
data.block	25999422
data.ts	2026-09-17T19:52:11Z
data.chain	ethereum
data.kind	payout
data.amount	621307.209036
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x736278d93b31be6d30a78372410b507070a96c08
data.vault	near_intents
data.token	ethereum:usdt
data.address	0x736278d93b31be6d30a78372410b507070a96c08
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0x736278d93b31be6d30a78372410b507070a96c08
evidence.address	0x736278d93b31be6d30a78372410b507070a96c08
evidence.first_seen	2026-09-17T19:11:11Z
evidence.first_seen_tx	0x9dae491a87c82bb146afcc48cb4054307c5d7956c833527bf861b38f5ade71cd
evidence.first_seen_kind	payout
evidence.age	0:41:00
evidence.max_age	7d
evidence.history_start	2026-09-01T00:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=621307.209036 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-09-17 20:04:11

Ethereum

R3_TEST_THEN_DRAINTreasury drain

0x4bebc06524496babffa3a48dcc3971b06fbaf01f received a test payout 13m 12s before this 147,967.89 usdc payout

0xdf57ce2a...a431

Click a field to copy its value.

timestamp	2026-09-17T20:04:11Z
rule.id	R3_TEST_THEN_DRAIN
rule.level	8
rule.severity	medium
rule.description	Small test payout followed by a large payout to the same recipient
rule.groups	evm, treasury, payout, sequence
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0xdf57ce2a723ac40d319b6ef20bf8813d23e5b4a1742c01c262ab84f4af81a431
data.block	25999482
data.ts	2026-09-17T20:04:11Z
data.chain	ethereum
data.kind	payout
data.amount	147967.89283
data.symbol	usdc
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x4bebc06524496babffa3a48dcc3971b06fbaf01f
data.vault	near_intents
data.token	ethereum:usdc
data.address	0x4bebc06524496babffa3a48dcc3971b06fbaf01f
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdc
scope.address	0x4bebc06524496babffa3a48dcc3971b06fbaf01f
evidence.group.to_addr	0x4bebc06524496babffa3a48dcc3971b06fbaf01f
evidence.within	24h
evidence.steps	[{"step": "test_payout", "tx": "0x5ec847d1abcf23d25b25f5e75c3f7fe756039f9066be2ca074946803299445f5", "ts": "2026-09-17T19:50:59Z", "amount": "5.595101"}, {"step": "large_payout", "tx": "0xdf57ce2a723ac40d319b6ef20bf8813d23e5b4a1742c01c262ab84f4af81a431", "ts": "2026-09-17T20:04:11Z", "amount": "147967.89283"}]
evidence.first_step_age	0:13:12
evidence.prior_events	[{"step": "test_payout", "tx": "0x5ec847d1abcf23d25b25f5e75c3f7fe756039f9066be2ca074946803299445f5", "ts": "2026-09-17T19:50:59Z", "amount": "5.595101"}]
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdc in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	address

2026-09-17 20:07:35

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

635,202.11 usdt to 0x736278d93b31be6d30a78372410b507070a96c08, first seen 56m 24s ago (payout)

0xd4058e20...214b

Click a field to copy its value.

timestamp	2026-09-17T20:07:35Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0xd4058e20b6ff9e15b1f396bb9ea9befe16d55aac8d34cc88b657209e41b6214b
data.block	25999499
data.ts	2026-09-17T20:07:35Z
data.chain	ethereum
data.kind	payout
data.amount	635202.113972
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x736278d93b31be6d30a78372410b507070a96c08
data.vault	near_intents
data.token	ethereum:usdt
data.address	0x736278d93b31be6d30a78372410b507070a96c08
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0x736278d93b31be6d30a78372410b507070a96c08
evidence.address	0x736278d93b31be6d30a78372410b507070a96c08
evidence.first_seen	2026-09-17T19:11:11Z
evidence.first_seen_tx	0x9dae491a87c82bb146afcc48cb4054307c5d7956c833527bf861b38f5ade71cd
evidence.first_seen_kind	payout
evidence.age	0:56:24
evidence.max_age	7d
evidence.history_start	2026-09-01T00:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=635202.113972 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-09-17 20:28:11

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

637,726.09 usdt to 0x736278d93b31be6d30a78372410b507070a96c08, first seen 1h 17m ago (payout)

0x5870f048...5d2a

Click a field to copy its value.

timestamp	2026-09-17T20:28:11Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x5870f04897eaafb3fdffd61d58e14cf2b1fd467412d5f8b1cafd92271f9f5d2a
data.block	25999600
data.ts	2026-09-17T20:28:11Z
data.chain	ethereum
data.kind	payout
data.amount	637726.088771
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x736278d93b31be6d30a78372410b507070a96c08
data.vault	near_intents
data.token	ethereum:usdt
data.address	0x736278d93b31be6d30a78372410b507070a96c08
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0x736278d93b31be6d30a78372410b507070a96c08
evidence.address	0x736278d93b31be6d30a78372410b507070a96c08
evidence.first_seen	2026-09-17T19:11:11Z
evidence.first_seen_tx	0x9dae491a87c82bb146afcc48cb4054307c5d7956c833527bf861b38f5ade71cd
evidence.first_seen_kind	payout
evidence.age	1:17:00
evidence.max_age	7d
evidence.history_start	2026-09-01T00:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=637726.088771 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-09-17 21:00:47

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

645,898.60 usdt to 0x736278d93b31be6d30a78372410b507070a96c08, first seen 1h 49m ago (payout)

0xe3898c92...acf2

Click a field to copy its value.

timestamp	2026-09-17T21:00:47Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0xe3898c92b0e3dadaab1bfdc58345a29abcf3b68d529621c099e4babcf399acf2
data.block	25999759
data.ts	2026-09-17T21:00:47Z
data.chain	ethereum
data.kind	payout
data.amount	645898.602808
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x736278d93b31be6d30a78372410b507070a96c08
data.vault	near_intents
data.token	ethereum:usdt
data.address	0x736278d93b31be6d30a78372410b507070a96c08
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0x736278d93b31be6d30a78372410b507070a96c08
evidence.address	0x736278d93b31be6d30a78372410b507070a96c08
evidence.first_seen	2026-09-17T19:11:11Z
evidence.first_seen_tx	0x9dae491a87c82bb146afcc48cb4054307c5d7956c833527bf861b38f5ade71cd
evidence.first_seen_kind	payout
evidence.age	1:49:36
evidence.max_age	7d
evidence.history_start	2026-09-01T00:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=645898.602808 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-09-18 07:03:59

Ethereum

R3_TEST_THEN_DRAINTreasury drain

0x82046d5271fc96471cc9965f89d948ec216eadb5 received a test payout 3m 24s before this 372,941.40 usdc payout

0xd4402166...6188

Click a field to copy its value.

timestamp	2026-09-18T07:03:59Z
rule.id	R3_TEST_THEN_DRAIN
rule.level	8
rule.severity	medium
rule.description	Small test payout followed by a large payout to the same recipient
rule.groups	evm, treasury, payout, sequence
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0xd4402166bb7a6b19394afee3e4806b4e9f33234736b0bca68b66ca6bbd436188
data.block	26002768
data.ts	2026-09-18T07:03:59Z
data.chain	ethereum
data.kind	payout
data.amount	372941.397066
data.symbol	usdc
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x82046d5271fc96471cc9965f89d948ec216eadb5
data.vault	near_intents
data.token	ethereum:usdc
data.address	0x82046d5271fc96471cc9965f89d948ec216eadb5
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdc
scope.address	0x82046d5271fc96471cc9965f89d948ec216eadb5
evidence.group.to_addr	0x82046d5271fc96471cc9965f89d948ec216eadb5
evidence.within	24h
evidence.steps	[{"step": "test_payout", "tx": "0x6d05d6435443ed9f06bdd7119643ca47822a247949bf3125567e448165e1979c", "ts": "2026-09-18T07:00:35Z", "amount": "50"}, {"step": "large_payout", "tx": "0xd4402166bb7a6b19394afee3e4806b4e9f33234736b0bca68b66ca6bbd436188", "ts": "2026-09-18T07:03:59Z", "amount": "372941.397066"}]
evidence.first_step_age	0:03:24
evidence.prior_events	[{"step": "test_payout", "tx": "0x6d05d6435443ed9f06bdd7119643ca47822a247949bf3125567e448165e1979c", "ts": "2026-09-18T07:00:35Z", "amount": "50"}]
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdc in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	address

2026-09-18 07:07:35

Ethereum

R3_TEST_THEN_DRAINTreasury drain

0x82046d5271fc96471cc9965f89d948ec216eadb5 received a test payout 7m 0s before this 149,487.50 usdc payout

0x50187465...5691

Click a field to copy its value.

timestamp	2026-09-18T07:07:35Z
rule.id	R3_TEST_THEN_DRAIN
rule.level	8
rule.severity	medium
rule.description	Small test payout followed by a large payout to the same recipient
rule.groups	evm, treasury, payout, sequence
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x501874652700479d144ef0e0174473523b45a60b464d9a5e7bb1807542755691
data.block	26002786
data.ts	2026-09-18T07:07:35Z
data.chain	ethereum
data.kind	payout
data.amount	149487.495629
data.symbol	usdc
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x82046d5271fc96471cc9965f89d948ec216eadb5
data.vault	near_intents
data.token	ethereum:usdc
data.address	0x82046d5271fc96471cc9965f89d948ec216eadb5
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdc
scope.address	0x82046d5271fc96471cc9965f89d948ec216eadb5
evidence.group.to_addr	0x82046d5271fc96471cc9965f89d948ec216eadb5
evidence.within	24h
evidence.steps	[{"step": "test_payout", "tx": "0x6d05d6435443ed9f06bdd7119643ca47822a247949bf3125567e448165e1979c", "ts": "2026-09-18T07:00:35Z", "amount": "50"}, {"step": "large_payout", "tx": "0x501874652700479d144ef0e0174473523b45a60b464d9a5e7bb1807542755691", "ts": "2026-09-18T07:07:35Z", "amount": "149487.495629"}]
evidence.first_step_age	0:07:00
evidence.prior_events	[{"step": "test_payout", "tx": "0x6d05d6435443ed9f06bdd7119643ca47822a247949bf3125567e448165e1979c", "ts": "2026-09-18T07:00:35Z", "amount": "50"}]
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdc in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	address

2026-09-18 11:37:59

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

1,513,564.78 usdc to 0xc41081fcd2d57b98d601d1347a1cc0e42efe94d8, first seen 0s ago (payout)

0xc41c519e...2908

Click a field to copy its value.

timestamp	2026-09-18T11:37:59Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0xc41c519e0a7e70a97641aec6825b14df153ff187172696b2637ee10005542908
data.block	26004137
data.ts	2026-09-18T11:37:59Z
data.chain	ethereum
data.kind	payout
data.amount	1513564.780395
data.symbol	usdc
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0xc41081fcd2d57b98d601d1347a1cc0e42efe94d8
data.vault	near_intents
data.token	ethereum:usdc
data.address	0xc41081fcd2d57b98d601d1347a1cc0e42efe94d8
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdc
scope.address	0xc41081fcd2d57b98d601d1347a1cc0e42efe94d8
evidence.address	0xc41081fcd2d57b98d601d1347a1cc0e42efe94d8
evidence.first_seen	2026-09-18T11:37:59Z
evidence.first_seen_tx	0xc41c519e0a7e70a97641aec6825b14df153ff187172696b2637ee10005542908
evidence.first_seen_kind	payout
evidence.age	0:00:00
evidence.max_age	7d
evidence.history_start	2026-09-01T00:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=1513564.780395 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-09-18 18:03:19

BNB Chain

R1_VAULT_PAYOUT_SPIKETreasury drain

bsc hot_bridge paid 500,006.73 usdc to 0x51aa68f9c5efe263fddcd28459e18d974258758a: 5.22x the 48h max of 95,739.32

0xd1d9f7c7...d46e

Click a field to copy its value.

timestamp	2026-09-18T18:03:19Z
rule.id	R1_VAULT_PAYOUT_SPIKE
rule.level	8
rule.severity	medium
rule.description	Treasury payout far above recent maximum
rule.groups	evm, treasury, payout, spike
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0xd1d9f7c71970f15eea562ec5cfc9d66090519e5467e9075b33e166a0ee9fd46e
data.block	122650046
data.ts	2026-09-18T18:03:19Z
data.chain	bsc
data.kind	payout
data.amount	500006.732768639929464435
data.symbol	usdc
data.from	0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to	0x51aa68f9c5efe263fddcd28459e18d974258758a
data.tx_submitter	0xcf495cea699b8beca4073279eda66882ccfa273c
data.vault	hot_bridge
data.token	bsc:usdc
data.address	0x51aa68f9c5efe263fddcd28459e18d974258758a
scope.chain	bsc
scope.bridge	hot
scope.token	usdc
scope.address	0x51aa68f9c5efe263fddcd28459e18d974258758a
evidence.value_field	amount_usd
evidence.value	500006.732768639929464435
evidence.baseline_max	95739.319494565119990176
evidence.baseline_tx	0x8c074ab372d2c73324c17d776da317194b48f34298bceccff95108258298bf1a
evidence.baseline_ts	2026-09-18T07:48:05Z
evidence.baseline_window	48h
evidence.baseline_events	166
evidence.ratio	5.22
evidence.factor	2.0
evidence.min_value	50000
matched[0]	kind=payout eq payout
matched[1]	vault=hot_bridge in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdc in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	chain, bridge, token

2026-09-18 20:29:35

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

704,261.67 usdc to 0xa4084449aa38e814ebe0014d2ecba4c280903cdf, first seen 0s ago (payout)

0xb16d6e4e...f560

Click a field to copy its value.

timestamp	2026-09-18T20:29:35Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0xb16d6e4e9ce6aa03aded6b47afbeaa2b32596800d9097db699e38384aec2f560
data.block	26006786
data.ts	2026-09-18T20:29:35Z
data.chain	ethereum
data.kind	payout
data.amount	704261.674991
data.symbol	usdc
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0xa4084449aa38e814ebe0014d2ecba4c280903cdf
data.vault	near_intents
data.token	ethereum:usdc
data.address	0xa4084449aa38e814ebe0014d2ecba4c280903cdf
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdc
scope.address	0xa4084449aa38e814ebe0014d2ecba4c280903cdf
evidence.address	0xa4084449aa38e814ebe0014d2ecba4c280903cdf
evidence.first_seen	2026-09-18T20:29:35Z
evidence.first_seen_tx	0xb16d6e4e9ce6aa03aded6b47afbeaa2b32596800d9097db699e38384aec2f560
evidence.first_seen_kind	payout
evidence.age	0:00:00
evidence.max_age	7d
evidence.history_start	2026-09-01T00:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=704261.674991 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-09-19 19:23:23

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

514,959.03 usdc to 0xe5d5c7eda671f7bc07ebdb3605910fbcab97256d, first seen 0s ago (payout)

0xc5fe4fa3...e3a1

Click a field to copy its value.

timestamp	2026-09-19T19:23:23Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0xc5fe4fa392cf8e46fb6bed0d585e3c552841573c61917757e52b9a27a4a1e3a1
data.block	26013624
data.ts	2026-09-19T19:23:23Z
data.chain	ethereum
data.kind	payout
data.amount	514959.02701
data.symbol	usdc
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0xe5d5c7eda671f7bc07ebdb3605910fbcab97256d
data.vault	near_intents
data.token	ethereum:usdc
data.address	0xe5d5c7eda671f7bc07ebdb3605910fbcab97256d
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdc
scope.address	0xe5d5c7eda671f7bc07ebdb3605910fbcab97256d
evidence.address	0xe5d5c7eda671f7bc07ebdb3605910fbcab97256d
evidence.first_seen	2026-09-19T19:23:23Z
evidence.first_seen_tx	0xc5fe4fa392cf8e46fb6bed0d585e3c552841573c61917757e52b9a27a4a1e3a1
evidence.first_seen_kind	payout
evidence.age	0:00:00
evidence.max_age	7d
evidence.history_start	2026-09-01T00:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=514959.02701 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-09-19 20:33:23

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

756,225.41 usdc to 0x954e0ae72fc28e9962cfe4fa192a816257414455, first seen 0s ago (payout)

0x1e54a06c...1c30

Click a field to copy its value.

timestamp	2026-09-19T20:33:23Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x1e54a06c173419abc5f7dd9595f291110e5cb9134b3ad8262bd18c39881b1c30
data.block	26013971
data.ts	2026-09-19T20:33:23Z
data.chain	ethereum
data.kind	payout
data.amount	756225.408567
data.symbol	usdc
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x954e0ae72fc28e9962cfe4fa192a816257414455
data.vault	near_intents
data.token	ethereum:usdc
data.address	0x954e0ae72fc28e9962cfe4fa192a816257414455
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdc
scope.address	0x954e0ae72fc28e9962cfe4fa192a816257414455
evidence.address	0x954e0ae72fc28e9962cfe4fa192a816257414455
evidence.first_seen	2026-09-19T20:33:23Z
evidence.first_seen_tx	0x1e54a06c173419abc5f7dd9595f291110e5cb9134b3ad8262bd18c39881b1c30
evidence.first_seen_kind	payout
evidence.age	0:00:00
evidence.max_age	7d
evidence.history_start	2026-09-01T00:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=756225.408567 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-09-19 21:11:11

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

773,393.66 usdc to 0x015354106478dda69c4aae3c0cf801290b738052, first seen 0s ago (payout)

0x3ff988b0...3f95

Click a field to copy its value.

timestamp	2026-09-19T21:11:11Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x3ff988b055a49bb970af3585869acaf826ad3599dd6c960e1ce8d797f2333f95
data.block	26014159
data.ts	2026-09-19T21:11:11Z
data.chain	ethereum
data.kind	payout
data.amount	773393.661782
data.symbol	usdc
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x015354106478dda69c4aae3c0cf801290b738052
data.vault	near_intents
data.token	ethereum:usdc
data.address	0x015354106478dda69c4aae3c0cf801290b738052
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdc
scope.address	0x015354106478dda69c4aae3c0cf801290b738052
evidence.address	0x015354106478dda69c4aae3c0cf801290b738052
evidence.first_seen	2026-09-19T21:11:11Z
evidence.first_seen_tx	0x3ff988b055a49bb970af3585869acaf826ad3599dd6c960e1ce8d797f2333f95
evidence.first_seen_kind	payout
evidence.age	0:00:00
evidence.max_age	7d
evidence.history_start	2026-09-01T00:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=773393.661782 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-09-19 21:13:35

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

508,485.82 usdc to 0x6d092dd825d74303114eae27988bc5ce029b957d, first seen 0s ago (payout)

0x2bc0ebd0...221d

Click a field to copy its value.

timestamp	2026-09-19T21:13:35Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x2bc0ebd0e0b19541e332f0c41b8b100ef65b88a0ea42ad75f8fea9b4a7a3221d
data.block	26014171
data.ts	2026-09-19T21:13:35Z
data.chain	ethereum
data.kind	payout
data.amount	508485.817802
data.symbol	usdc
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x6d092dd825d74303114eae27988bc5ce029b957d
data.vault	near_intents
data.token	ethereum:usdc
data.address	0x6d092dd825d74303114eae27988bc5ce029b957d
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdc
scope.address	0x6d092dd825d74303114eae27988bc5ce029b957d
evidence.address	0x6d092dd825d74303114eae27988bc5ce029b957d
evidence.first_seen	2026-09-19T21:13:35Z
evidence.first_seen_tx	0x2bc0ebd0e0b19541e332f0c41b8b100ef65b88a0ea42ad75f8fea9b4a7a3221d
evidence.first_seen_kind	payout
evidence.age	0:00:00
evidence.max_age	7d
evidence.history_start	2026-09-01T00:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=508485.817802 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-09-21 01:08:35

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

671,037.00 usdc to 0xe6ce6f6efaa103f12ccbf08cdec2f08f43f4070a, first seen 7h 40m ago (payout)

0xf12e5dd7...6343

Click a field to copy its value.

timestamp	2026-09-21T01:08:35Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0xf12e5dd71632d45d48302657e1da7afeb9e00374cc287f53eb0339230f116343
data.block	26022510
data.ts	2026-09-21T01:08:35Z
data.chain	ethereum
data.kind	payout
data.amount	671036.995594
data.symbol	usdc
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0xe6ce6f6efaa103f12ccbf08cdec2f08f43f4070a
data.vault	near_intents
data.token	ethereum:usdc
data.address	0xe6ce6f6efaa103f12ccbf08cdec2f08f43f4070a
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdc
scope.address	0xe6ce6f6efaa103f12ccbf08cdec2f08f43f4070a
evidence.address	0xe6ce6f6efaa103f12ccbf08cdec2f08f43f4070a
evidence.first_seen	2026-09-20T17:28:23Z
evidence.first_seen_tx	0x6fff4f08a7286af93b1dfb8ea04db1df463101b620cda6f7f6b34723d236abb9
evidence.first_seen_kind	payout
evidence.age	7:40:12
evidence.max_age	7d
evidence.history_start	2026-09-01T00:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=671036.995594 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-09-21 04:07:47

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

743,750.07 usdc to 0xd4f7b31b2063db3d091e85f958951f216fabd791, first seen 0s ago (payout)

0xda731411...a353

Click a field to copy its value.

timestamp	2026-09-21T04:07:47Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0xda731411e4512f26a7eb7ebf3d88ea8abd5c4250e15e2b08949dd957e9f1a353
data.block	26023400
data.ts	2026-09-21T04:07:47Z
data.chain	ethereum
data.kind	payout
data.amount	743750.069157
data.symbol	usdc
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0xd4f7b31b2063db3d091e85f958951f216fabd791
data.vault	near_intents
data.token	ethereum:usdc
data.address	0xd4f7b31b2063db3d091e85f958951f216fabd791
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdc
scope.address	0xd4f7b31b2063db3d091e85f958951f216fabd791
evidence.address	0xd4f7b31b2063db3d091e85f958951f216fabd791
evidence.first_seen	2026-09-21T04:07:47Z
evidence.first_seen_tx	0xda731411e4512f26a7eb7ebf3d88ea8abd5c4250e15e2b08949dd957e9f1a353
evidence.first_seen_kind	payout
evidence.age	0:00:00
evidence.max_age	7d
evidence.history_start	2026-09-01T00:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=743750.069157 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-09-21 19:50:35

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

515,055.80 usdt to 0xd015d8d4f36d98039881bbc9e8457137775964a4, first seen 0s ago (payout)

0x447f7c57...0be1

Click a field to copy its value.

timestamp	2026-09-21T19:50:35Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x447f7c570381a1c58a35334a535c86b777ed167d6f31a31c5f9a8daeb0430be1
data.block	26028077
data.ts	2026-09-21T19:50:35Z
data.chain	ethereum
data.kind	payout
data.amount	515055.79784
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0xd015d8d4f36d98039881bbc9e8457137775964a4
data.vault	near_intents
data.token	ethereum:usdt
data.address	0xd015d8d4f36d98039881bbc9e8457137775964a4
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0xd015d8d4f36d98039881bbc9e8457137775964a4
evidence.address	0xd015d8d4f36d98039881bbc9e8457137775964a4
evidence.first_seen	2026-09-21T19:50:35Z
evidence.first_seen_tx	0x447f7c570381a1c58a35334a535c86b777ed167d6f31a31c5f9a8daeb0430be1
evidence.first_seen_kind	payout
evidence.age	0:00:00
evidence.max_age	7d
evidence.history_start	2026-09-01T00:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=515055.79784 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-09-21 21:23:59

Ethereum

R3_TEST_THEN_DRAINTreasury drain

0x0214b177102b437aedc134313c2fbadd7e51abae received a test payout 25m 12s before this 114,297.14 usdt payout

0x6ff1a9e5...8817

Click a field to copy its value.

timestamp	2026-09-21T21:23:59Z
rule.id	R3_TEST_THEN_DRAIN
rule.level	8
rule.severity	medium
rule.description	Small test payout followed by a large payout to the same recipient
rule.groups	evm, treasury, payout, sequence
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x6ff1a9e51f59fcb3592377e51a434cdd8779e69f2bf18514d0b72ef9f3838817
data.block	26028538
data.ts	2026-09-21T21:23:59Z
data.chain	ethereum
data.kind	payout
data.amount	114297.143252
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x0214b177102b437aedc134313c2fbadd7e51abae
data.vault	near_intents
data.token	ethereum:usdt
data.address	0x0214b177102b437aedc134313c2fbadd7e51abae
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0x0214b177102b437aedc134313c2fbadd7e51abae
evidence.group.to_addr	0x0214b177102b437aedc134313c2fbadd7e51abae
evidence.within	24h
evidence.steps	[{"step": "test_payout", "tx": "0x29d6a04032a6f8fef220afdec438d508e910985d45e2fcc168151b7ad088a8e1", "ts": "2026-09-21T20:58:47Z", "amount": "16.847196"}, {"step": "large_payout", "tx": "0x6ff1a9e51f59fcb3592377e51a434cdd8779e69f2bf18514d0b72ef9f3838817", "ts": "2026-09-21T21:23:59Z", "amount": "114297.143252"}]
evidence.first_step_age	0:25:12
evidence.prior_events	[{"step": "test_payout", "tx": "0x29d6a04032a6f8fef220afdec438d508e910985d45e2fcc168151b7ad088a8e1", "ts": "2026-09-21T20:58:47Z", "amount": "16.847196"}]
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdt in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	address

2026-09-22 05:38:35

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

592,568.59 usdc to 0x204823d2995230ec1660512013c96d6f06bee3f8, first seen 36s ago (payout)

0x703a200c...6ef7

Click a field to copy its value.

timestamp	2026-09-22T05:38:35Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x703a200c25cb9e35f85a1b04adec2e58f4ff87abf9b0a23c9154f1b771046ef7
data.block	26030994
data.ts	2026-09-22T05:38:35Z
data.chain	ethereum
data.kind	payout
data.amount	592568.586024
data.symbol	usdc
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x204823d2995230ec1660512013c96d6f06bee3f8
data.vault	near_intents
data.token	ethereum:usdc
data.address	0x204823d2995230ec1660512013c96d6f06bee3f8
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdc
scope.address	0x204823d2995230ec1660512013c96d6f06bee3f8
evidence.address	0x204823d2995230ec1660512013c96d6f06bee3f8
evidence.first_seen	2026-09-22T05:37:59Z
evidence.first_seen_tx	0x331f3c8d14ceeb814cb5605e564b4ca6c016e2292038bdff688c7319bd6bc161
evidence.first_seen_kind	payout
evidence.age	0:00:36
evidence.max_age	7d
evidence.history_start	2026-09-01T00:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=592568.586024 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-09-22 07:15:22

BNB Chain

R1_VAULT_PAYOUT_SPIKETreasury drain

bsc hot_bridge paid 452,609.76 usdt to 0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758: 2.54x the 48h max of 178,020.89

0xd3f45ae3...01f2

Click a field to copy its value.

timestamp	2026-09-22T07:15:22Z
rule.id	R1_VAULT_PAYOUT_SPIKE
rule.level	8
rule.severity	medium
rule.description	Treasury payout far above recent maximum
rule.groups	evm, treasury, payout, spike
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0xd3f45ae396ce597509daa97148e6eb6e48286e0f5efb36f3af630133454801f2
data.block	123331401
data.ts	2026-09-22T07:15:22Z
data.chain	bsc
data.kind	payout
data.amount	452609.76418
data.symbol	usdt
data.from	0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
data.tx_submitter	0xcf495cea699b8beca4073279eda66882ccfa273c
data.vault	hot_bridge
data.token	bsc:usdt
data.address	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
scope.address	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
evidence.value_field	amount_usd
evidence.value	452609.76418
evidence.baseline_max	178020.887803789166211689
evidence.baseline_tx	0xf6ad54a0f66a89c70776405ce22a39fef707c0dcf0b22e386a598f94980467c7
evidence.baseline_ts	2026-09-21T05:24:21Z
evidence.baseline_window	48h
evidence.baseline_events	849
evidence.ratio	2.54
evidence.factor	2.0
evidence.min_value	50000
matched[0]	kind=payout eq payout
matched[1]	vault=hot_bridge in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdt in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	chain, bridge, token

2026-09-22 09:33:59

Ethereum

R3_TEST_THEN_DRAINTreasury drain

0x52155bedf386d618d85eb0cf2e242a36c19c3ed4 received a test payout 5h 39m before this 142,601.01 usdc payout

0x8d48c343...f801

Click a field to copy its value.

timestamp	2026-09-22T09:33:59Z
rule.id	R3_TEST_THEN_DRAIN
rule.level	8
rule.severity	medium
rule.description	Small test payout followed by a large payout to the same recipient
rule.groups	evm, treasury, payout, sequence
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x8d48c34355914adae306e9a77a23425d4bb725877df498d94a59fc8e89abf801
data.block	26032160
data.ts	2026-09-22T09:33:59Z
data.chain	ethereum
data.kind	payout
data.amount	142601.005292
data.symbol	usdc
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x52155bedf386d618d85eb0cf2e242a36c19c3ed4
data.vault	near_intents
data.token	ethereum:usdc
data.address	0x52155bedf386d618d85eb0cf2e242a36c19c3ed4
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdc
scope.address	0x52155bedf386d618d85eb0cf2e242a36c19c3ed4
evidence.group.to_addr	0x52155bedf386d618d85eb0cf2e242a36c19c3ed4
evidence.within	24h
evidence.steps	[{"step": "test_payout", "tx": "0x8af170f63f307bb969e65751fc96d0312ece69612b0a1519c07c3ceac7ed0051", "ts": "2026-09-22T03:54:59Z", "amount": "21.435491"}, {"step": "large_payout", "tx": "0x8d48c34355914adae306e9a77a23425d4bb725877df498d94a59fc8e89abf801", "ts": "2026-09-22T09:33:59Z", "amount": "142601.005292"}]
evidence.first_step_age	5:39:00
evidence.prior_events	[{"step": "test_payout", "tx": "0x8af170f63f307bb969e65751fc96d0312ece69612b0a1519c07c3ceac7ed0051", "ts": "2026-09-22T03:54:59Z", "amount": "21.435491"}]
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdc in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	address

2026-09-22 13:42:47

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

503,608.16 usdc to 0x0f335446e2e9ac1c2d006c39b7dbc0438e8eeb96, first seen 0s ago (payout)

0xc4072c7c...bdd7

Click a field to copy its value.

timestamp	2026-09-22T13:42:47Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0xc4072c7c8dfcab12f291adaf674a5c9a8241fcffbff0d5c760ad1933dd2cbdd7
data.block	26033400
data.ts	2026-09-22T13:42:47Z
data.chain	ethereum
data.kind	payout
data.amount	503608.156494
data.symbol	usdc
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x0f335446e2e9ac1c2d006c39b7dbc0438e8eeb96
data.vault	near_intents
data.token	ethereum:usdc
data.address	0x0f335446e2e9ac1c2d006c39b7dbc0438e8eeb96
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdc
scope.address	0x0f335446e2e9ac1c2d006c39b7dbc0438e8eeb96
evidence.address	0x0f335446e2e9ac1c2d006c39b7dbc0438e8eeb96
evidence.first_seen	2026-09-22T13:42:47Z
evidence.first_seen_tx	0xc4072c7c8dfcab12f291adaf674a5c9a8241fcffbff0d5c760ad1933dd2cbdd7
evidence.first_seen_kind	payout
evidence.age	0:00:00
evidence.max_age	7d
evidence.history_start	2026-09-01T00:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=503608.156494 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-09-22 17:05:35

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

510,750.25 usdc to 0x77c90a156031d35783f348c83707bf762db11a3e, first seen 1h 19m ago (payout)

0x3a86bc26...8de9

Click a field to copy its value.

timestamp	2026-09-22T17:05:35Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x3a86bc269b4550d5b58476150a7beab3c95f1e010aa72fbab8b1ac3b4a6a8de9
data.block	26034405
data.ts	2026-09-22T17:05:35Z
data.chain	ethereum
data.kind	payout
data.amount	510750.249166
data.symbol	usdc
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x77c90a156031d35783f348c83707bf762db11a3e
data.vault	near_intents
data.token	ethereum:usdc
data.address	0x77c90a156031d35783f348c83707bf762db11a3e
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdc
scope.address	0x77c90a156031d35783f348c83707bf762db11a3e
evidence.address	0x77c90a156031d35783f348c83707bf762db11a3e
evidence.first_seen	2026-09-22T15:45:47Z
evidence.first_seen_tx	0x5621d0ef88646037e99dcfa58d8e67542b303d5cee7431d6f86958993fb6659f
evidence.first_seen_kind	payout
evidence.age	1:19:48
evidence.max_age	7d
evidence.history_start	2026-09-01T00:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=510750.249166 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-09-22 18:11:35

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

748,358.54 usdc to 0x62f8e0373c4d41bce3855d7c2e3ff6c4c5d7ca87, first seen 0s ago (payout)

0x4eb5ad3e...22c9

Click a field to copy its value.

timestamp	2026-09-22T18:11:35Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x4eb5ad3e8dff33bde98d68df107962a715f544ce8473fe8ee18b1588c0b522c9
data.block	26034730
data.ts	2026-09-22T18:11:35Z
data.chain	ethereum
data.kind	payout
data.amount	748358.53972
data.symbol	usdc
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x62f8e0373c4d41bce3855d7c2e3ff6c4c5d7ca87
data.vault	near_intents
data.token	ethereum:usdc
data.address	0x62f8e0373c4d41bce3855d7c2e3ff6c4c5d7ca87
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdc
scope.address	0x62f8e0373c4d41bce3855d7c2e3ff6c4c5d7ca87
evidence.address	0x62f8e0373c4d41bce3855d7c2e3ff6c4c5d7ca87
evidence.first_seen	2026-09-22T18:11:35Z
evidence.first_seen_tx	0x4eb5ad3e8dff33bde98d68df107962a715f544ce8473fe8ee18b1588c0b522c9
evidence.first_seen_kind	payout
evidence.age	0:00:00
evidence.max_age	7d
evidence.history_start	2026-09-01T00:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=748358.53972 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-09-23 01:04:35

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

555,194.07 usdc to 0x44eb23e537d1dfaa5e03a889e6ba6c5b77e87a54, first seen 4h 47m ago (payout)

0xf78874ab...d79c

Click a field to copy its value.

timestamp	2026-09-23T01:04:35Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0xf78874abb3b7e32a114274c8edeb34bb54d32f3cc42a81781e8915279f92d79c
data.block	26036786
data.ts	2026-09-23T01:04:35Z
data.chain	ethereum
data.kind	payout
data.amount	555194.071061
data.symbol	usdc
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x44eb23e537d1dfaa5e03a889e6ba6c5b77e87a54
data.vault	near_intents
data.token	ethereum:usdc
data.address	0x44eb23e537d1dfaa5e03a889e6ba6c5b77e87a54
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdc
scope.address	0x44eb23e537d1dfaa5e03a889e6ba6c5b77e87a54
evidence.address	0x44eb23e537d1dfaa5e03a889e6ba6c5b77e87a54
evidence.first_seen	2026-09-22T20:17:11Z
evidence.first_seen_tx	0xb10500563da14e2dc679a91835913b2002d8f3fe67ef622982b869cb140dc0ef
evidence.first_seen_kind	payout
evidence.age	4:47:24
evidence.max_age	7d
evidence.history_start	2026-09-01T00:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=555194.071061 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-09-23 18:17:11

Ethereum

R10_RECIPIENT_PAYOUT_BURSTTreasury drain

near_intents on ethereum paid 0x9f266c9a9430573f9384cbee8985f78c00cd3985 3 times over $250K in 1h 44m (879,969.86 usdc), 1 such payouts in the 7d before

0x2d19e32f...9f0c

Click a field to copy its value.

timestamp	2026-09-23T18:17:11Z
rule.id	R10_RECIPIENT_PAYOUT_BURST
rule.level	8
rule.severity	medium
rule.description	Burst of large treasury payouts to one new counterparty
rule.groups	evm, treasury, payout, frequency
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x2d19e32fda4a438637486a54271e4b3930df17868ebd367128f047eda28e9f0c
data.block	26041905
data.ts	2026-09-23T18:17:11Z
data.chain	ethereum
data.kind	payout
data.amount	251866.360571
data.symbol	usdc
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x9f266c9a9430573f9384cbee8985f78c00cd3985
data.vault	near_intents
data.token	ethereum:usdc
data.address	0x9f266c9a9430573f9384cbee8985f78c00cd3985
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdc
scope.address	0x9f266c9a9430573f9384cbee8985f78c00cd3985
evidence.group.chain	ethereum
evidence.group.vault	near_intents
evidence.group.to_addr	0x9f266c9a9430573f9384cbee8985f78c00cd3985
evidence.count	3
evidence.min_count	3
evidence.within	2h
evidence.window_sum	879969.855336
evidence.burst_txs	0x941f1f3cdfc9b531337b57cb45bc96f9da6db89ee17778a32b8cede69a2ec7d0, 0x3d62cbb76ef5b7896e18e754769dae6217be06704cc09786191ff646c686874c, 0x2d19e32fda4a438637486a54271e4b3930df17868ebd367128f047eda28e9f0c
evidence.burst_started	2026-09-23T16:33:11Z
evidence.burst_span	1:44:00
evidence.prior_events	1
evidence.max_prior	3
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdc in ['usdt', 'usdc']
matched[3]	amount_usd=251866.360571 gt 250000
shield.capability	flag_observation
shield.scope	chain, bridge, token, address

2026-09-24 07:50:11

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

500,165 usdt to 0xb5428d020e9da0f9a5ebcf4c606352b9b6301da7, first seen 5m 36s ago (payout)

0x40bc2f67...d64f

Click a field to copy its value.

timestamp	2026-09-24T07:50:11Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x40bc2f677153ffeb73ad5bbd9e7aa3d778b678316b2b33363d0231ef6573d64f
data.block	26045942
data.ts	2026-09-24T07:50:11Z
data.chain	ethereum
data.kind	payout
data.amount	500165
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0xb5428d020e9da0f9a5ebcf4c606352b9b6301da7
data.vault	near_intents
data.token	ethereum:usdt
data.address	0xb5428d020e9da0f9a5ebcf4c606352b9b6301da7
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0xb5428d020e9da0f9a5ebcf4c606352b9b6301da7
evidence.address	0xb5428d020e9da0f9a5ebcf4c606352b9b6301da7
evidence.first_seen	2026-09-24T07:44:35Z
evidence.first_seen_tx	0x9642618c5535b9afecba0c7ac59131ee5ddec7fb114c72035d83ae0d0fa95543
evidence.first_seen_kind	payout
evidence.age	0:05:36
evidence.max_age	7d
evidence.history_start	2026-09-01T00:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=500165 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-09-24 08:26:47

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

1,000,215 usdt to 0xcf184835bdb51ea5847386f03ab90b20c1dbf714, first seen 6m 36s ago (payout)

0x44da16c2...f27a

Click a field to copy its value.

timestamp	2026-09-24T08:26:47Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x44da16c2d695fd7ff114136861b91e4e63ff56b18f4ce2ee6363a4694599f27a
data.block	26046123
data.ts	2026-09-24T08:26:47Z
data.chain	ethereum
data.kind	payout
data.amount	1000215
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0xcf184835bdb51ea5847386f03ab90b20c1dbf714
data.vault	near_intents
data.token	ethereum:usdt
data.address	0xcf184835bdb51ea5847386f03ab90b20c1dbf714
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0xcf184835bdb51ea5847386f03ab90b20c1dbf714
evidence.address	0xcf184835bdb51ea5847386f03ab90b20c1dbf714
evidence.first_seen	2026-09-24T08:20:11Z
evidence.first_seen_tx	0x682ec2fef6d25981e905f258c6a826e0d952498d96dff5d3c13e5b6a4870ad91
evidence.first_seen_kind	payout
evidence.age	0:06:36
evidence.max_age	7d
evidence.history_start	2026-09-01T00:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=1000215 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-09-24 09:15:23

Ethereum

R3_TEST_THEN_DRAINTreasury drain

0x953ebe695ca59085f88b3f009bb78b9e45ff3404 received a test payout 9m 24s before this 816,869.22 usdt payout

0x5d83f361...bece

Click a field to copy its value.

timestamp	2026-09-24T09:15:23Z
rule.id	R3_TEST_THEN_DRAIN
rule.level	8
rule.severity	medium
rule.description	Small test payout followed by a large payout to the same recipient
rule.groups	evm, treasury, payout, sequence
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x5d83f3612d349e6a265dedf4fe529dfb06e78521ccedc349394d9d4a30c1bece
data.block	26046363
data.ts	2026-09-24T09:15:23Z
data.chain	ethereum
data.kind	payout
data.amount	816869.22
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x953ebe695ca59085f88b3f009bb78b9e45ff3404
data.vault	near_intents
data.token	ethereum:usdt
data.address	0x953ebe695ca59085f88b3f009bb78b9e45ff3404
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0x953ebe695ca59085f88b3f009bb78b9e45ff3404
evidence.group.to_addr	0x953ebe695ca59085f88b3f009bb78b9e45ff3404
evidence.within	24h
evidence.steps	[{"step": "test_payout", "tx": "0x18d8143b2135879326cda4ecc9c670a2f547ec59f2d50311c70dacd44c928d79", "ts": "2026-09-24T09:05:59Z", "amount": "10"}, {"step": "large_payout", "tx": "0x5d83f3612d349e6a265dedf4fe529dfb06e78521ccedc349394d9d4a30c1bece", "ts": "2026-09-24T09:15:23Z", "amount": "816869.22"}]
evidence.first_step_age	0:09:24
evidence.prior_events	[{"step": "test_payout", "tx": "0x18d8143b2135879326cda4ecc9c670a2f547ec59f2d50311c70dacd44c928d79", "ts": "2026-09-24T09:05:59Z", "amount": "10"}]
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdt in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	address

2026-09-24 09:15:23

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

816,869.22 usdt to 0x953ebe695ca59085f88b3f009bb78b9e45ff3404, first seen 9m 24s ago (payout)

0x5d83f361...bece

Click a field to copy its value.

timestamp	2026-09-24T09:15:23Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x5d83f3612d349e6a265dedf4fe529dfb06e78521ccedc349394d9d4a30c1bece
data.block	26046363
data.ts	2026-09-24T09:15:23Z
data.chain	ethereum
data.kind	payout
data.amount	816869.22
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x953ebe695ca59085f88b3f009bb78b9e45ff3404
data.vault	near_intents
data.token	ethereum:usdt
data.address	0x953ebe695ca59085f88b3f009bb78b9e45ff3404
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0x953ebe695ca59085f88b3f009bb78b9e45ff3404
evidence.address	0x953ebe695ca59085f88b3f009bb78b9e45ff3404
evidence.first_seen	2026-09-24T09:05:59Z
evidence.first_seen_tx	0x18d8143b2135879326cda4ecc9c670a2f547ec59f2d50311c70dacd44c928d79
evidence.first_seen_kind	payout
evidence.age	0:09:24
evidence.max_age	7d
evidence.history_start	2026-09-01T00:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=816869.22 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-09-24 09:41:59

Ethereum

R3_TEST_THEN_DRAINTreasury drain

0xc82a8109b88691eac7c1d1b509a58981546e158c received a test payout 7m 24s before this 524,548.68 usdt payout

0x1cb543d5...24d0

Click a field to copy its value.

timestamp	2026-09-24T09:41:59Z
rule.id	R3_TEST_THEN_DRAIN
rule.level	8
rule.severity	medium
rule.description	Small test payout followed by a large payout to the same recipient
rule.groups	evm, treasury, payout, sequence
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x1cb543d5653847638288b7022862cacd632a9655447aaa9f2467f94a9bae24d0
data.block	26046495
data.ts	2026-09-24T09:41:59Z
data.chain	ethereum
data.kind	payout
data.amount	524548.682027
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0xc82a8109b88691eac7c1d1b509a58981546e158c
data.vault	near_intents
data.token	ethereum:usdt
data.address	0xc82a8109b88691eac7c1d1b509a58981546e158c
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0xc82a8109b88691eac7c1d1b509a58981546e158c
evidence.group.to_addr	0xc82a8109b88691eac7c1d1b509a58981546e158c
evidence.within	24h
evidence.steps	[{"step": "test_payout", "tx": "0xe56dcf43e395cddda3291ca4909066f283553a2b40efcf5c871bf377ec2112e1", "ts": "2026-09-24T09:34:35Z", "amount": "10"}, {"step": "large_payout", "tx": "0x1cb543d5653847638288b7022862cacd632a9655447aaa9f2467f94a9bae24d0", "ts": "2026-09-24T09:41:59Z", "amount": "524548.682027"}]
evidence.first_step_age	0:07:24
evidence.prior_events	[{"step": "test_payout", "tx": "0xe56dcf43e395cddda3291ca4909066f283553a2b40efcf5c871bf377ec2112e1", "ts": "2026-09-24T09:34:35Z", "amount": "10"}]
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdt in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	address

2026-09-24 09:41:59

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

524,548.68 usdt to 0xc82a8109b88691eac7c1d1b509a58981546e158c, first seen 7m 24s ago (payout)

0x1cb543d5...24d0

Click a field to copy its value.

timestamp	2026-09-24T09:41:59Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x1cb543d5653847638288b7022862cacd632a9655447aaa9f2467f94a9bae24d0
data.block	26046495
data.ts	2026-09-24T09:41:59Z
data.chain	ethereum
data.kind	payout
data.amount	524548.682027
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0xc82a8109b88691eac7c1d1b509a58981546e158c
data.vault	near_intents
data.token	ethereum:usdt
data.address	0xc82a8109b88691eac7c1d1b509a58981546e158c
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0xc82a8109b88691eac7c1d1b509a58981546e158c
evidence.address	0xc82a8109b88691eac7c1d1b509a58981546e158c
evidence.first_seen	2026-09-24T09:34:35Z
evidence.first_seen_tx	0xe56dcf43e395cddda3291ca4909066f283553a2b40efcf5c871bf377ec2112e1
evidence.first_seen_kind	payout
evidence.age	0:07:24
evidence.max_age	7d
evidence.history_start	2026-09-01T00:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=524548.682027 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-09-24 09:48:23

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

648,087.07 usdc to 0xefa117fc408c83e82427fcc22a7d06302c542346, first seen 36h 3m ago (payout)

0x691f936e...388a

Click a field to copy its value.

timestamp	2026-09-24T09:48:23Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x691f936e904859c6df98e34bbef2931737b0bb0d3527fdfdd068ddbe37b8388a
data.block	26046527
data.ts	2026-09-24T09:48:23Z
data.chain	ethereum
data.kind	payout
data.amount	648087.073128
data.symbol	usdc
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0xefa117fc408c83e82427fcc22a7d06302c542346
data.vault	near_intents
data.token	ethereum:usdc
data.address	0xefa117fc408c83e82427fcc22a7d06302c542346
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdc
scope.address	0xefa117fc408c83e82427fcc22a7d06302c542346
evidence.address	0xefa117fc408c83e82427fcc22a7d06302c542346
evidence.first_seen	2026-09-22T21:44:47Z
evidence.first_seen_tx	0xe034625ccb9a1249ebbf665bf42ec55a99d80689f1eff62467d17b070403bb7a
evidence.first_seen_kind	payout
evidence.age	1 day, 12:03:36
evidence.max_age	7d
evidence.history_start	2026-09-01T00:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=648087.073128 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-09-24 20:54:54

BNB Chain

R1_VAULT_PAYOUT_SPIKETreasury drain

bsc hot_bridge paid 768,574.37 usdt to 0x7c96279ec1e888aa56b9b836e0db26ca48573e1c: 4.33x the 48h max of 177,431.92

0x718e5ea9...74dd

Click a field to copy its value.

timestamp	2026-09-24T20:54:54Z
rule.id	R1_VAULT_PAYOUT_SPIKE
rule.level	8
rule.severity	medium
rule.description	Treasury payout far above recent maximum
rule.groups	evm, treasury, payout, spike
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x718e5ea9a5e54426da72acb778c033508004b1e797ada87bc528599c800e74dd
data.block	123824491
data.ts	2026-09-24T20:54:54Z
data.chain	bsc
data.kind	payout
data.amount	768574.366767755535445594
data.symbol	usdt
data.from	0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to	0x7c96279ec1e888aa56b9b836e0db26ca48573e1c
data.tx_submitter	0xcf495cea699b8beca4073279eda66882ccfa273c
data.vault	hot_bridge
data.token	bsc:usdt
data.address	0x7c96279ec1e888aa56b9b836e0db26ca48573e1c
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
scope.address	0x7c96279ec1e888aa56b9b836e0db26ca48573e1c
evidence.value_field	amount_usd
evidence.value	768574.366767755535445594
evidence.baseline_max	177431.920814326836413666
evidence.baseline_tx	0x19539afd3b82325e360c250a203d28628437eae5ac71a0f317fbb273ec20b116
evidence.baseline_ts	2026-09-23T14:15:10Z
evidence.baseline_window	48h
evidence.baseline_events	854
evidence.ratio	4.33
evidence.factor	2.0
evidence.min_value	50000
matched[0]	kind=payout eq payout
matched[1]	vault=hot_bridge in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdt in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	chain, bridge, token

2026-09-24 20:54:54

BNB Chain

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

768,574.37 usdt to 0x7c96279ec1e888aa56b9b836e0db26ca48573e1c, first seen 0s ago (payout)

0x718e5ea9...74dd

Click a field to copy its value.

timestamp	2026-09-24T20:54:54Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x718e5ea9a5e54426da72acb778c033508004b1e797ada87bc528599c800e74dd
data.block	123824491
data.ts	2026-09-24T20:54:54Z
data.chain	bsc
data.kind	payout
data.amount	768574.366767755535445594
data.symbol	usdt
data.from	0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to	0x7c96279ec1e888aa56b9b836e0db26ca48573e1c
data.tx_submitter	0xcf495cea699b8beca4073279eda66882ccfa273c
data.vault	hot_bridge
data.token	bsc:usdt
data.address	0x7c96279ec1e888aa56b9b836e0db26ca48573e1c
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
scope.address	0x7c96279ec1e888aa56b9b836e0db26ca48573e1c
evidence.address	0x7c96279ec1e888aa56b9b836e0db26ca48573e1c
evidence.first_seen	2026-09-24T20:54:54Z
evidence.first_seen_tx	0x718e5ea9a5e54426da72acb778c033508004b1e797ada87bc528599c800e74dd
evidence.first_seen_kind	payout
evidence.age	0:00:00
evidence.max_age	7d
evidence.history_start	2026-09-01T00:00:14Z
matched[0]	kind=payout eq payout
matched[1]	vault=hot_bridge in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=768574.366767755535445594 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-09-25 12:39:15

BNB Chain

R1_VAULT_PAYOUT_SPIKETreasury drain

bsc hot_bridge paid 129,910.36 usdc to 0x5a8e12d1f7148886fe35f6fa04f5a2c2b60ac354: 2.95x the 48h max of 44,096.75

0x5639d2a3...243f

Click a field to copy its value.

timestamp	2026-09-25T12:39:15Z
rule.id	R1_VAULT_PAYOUT_SPIKE
rule.level	8
rule.severity	medium
rule.description	Treasury payout far above recent maximum
rule.groups	evm, treasury, payout, spike
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x5639d2a3e563f0bd28a00d30d39e69857a9ca4dfd84c7bbb92d43f88d8d8243f
data.block	123950370
data.ts	2026-09-25T12:39:15Z
data.chain	bsc
data.kind	payout
data.amount	129910.358654115058441374
data.symbol	usdc
data.from	0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to	0x5a8e12d1f7148886fe35f6fa04f5a2c2b60ac354
data.tx_submitter	0xcf495cea699b8beca4073279eda66882ccfa273c
data.vault	hot_bridge
data.token	bsc:usdc
data.address	0x5a8e12d1f7148886fe35f6fa04f5a2c2b60ac354
scope.chain	bsc
scope.bridge	hot
scope.token	usdc
scope.address	0x5a8e12d1f7148886fe35f6fa04f5a2c2b60ac354
evidence.value_field	amount_usd
evidence.value	129910.358654115058441374
evidence.baseline_max	44096.745538880876640867
evidence.baseline_tx	0x85dffb92b092175ce3a8dfedf003296098edf3b1c97cc68bf276b04289408073
evidence.baseline_ts	2026-09-24T04:06:07Z
evidence.baseline_window	48h
evidence.baseline_events	138
evidence.ratio	2.95
evidence.factor	2.0
evidence.min_value	50000
matched[0]	kind=payout eq payout
matched[1]	vault=hot_bridge in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdc in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	chain, bridge, token

2026-09-25 13:24:23

Ethereum

R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain

796,054.47 usdc to 0x30ccf020619a9d2bb1e7477a353f90f4144fdbb2, first seen 6d 19h ago (payout)

0x746a9d36...48ac

Click a field to copy its value.

timestamp	2026-09-25T13:24:23Z
rule.id	R5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level	8
rule.severity	medium
rule.description	Payout over $500K to a recipient first seen less than 7 days ago
rule.groups	evm, treasury, payout, new_address
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x746a9d36c635e9571d4f479c3f4b7a1bba5666b6d32b264eb66c24b4c1cc48ac
data.block	26054747
data.ts	2026-09-25T13:24:23Z
data.chain	ethereum
data.kind	payout
data.amount	796054.467841
data.symbol	usdc
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x30ccf020619a9d2bb1e7477a353f90f4144fdbb2
data.vault	near_intents
data.token	ethereum:usdc
data.address	0x30ccf020619a9d2bb1e7477a353f90f4144fdbb2
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdc
scope.address	0x30ccf020619a9d2bb1e7477a353f90f4144fdbb2
evidence.address	0x30ccf020619a9d2bb1e7477a353f90f4144fdbb2
evidence.first_seen	2026-09-18T17:28:23Z
evidence.first_seen_tx	0x09a88bbc406902bbb2fcb598a9114b6f74dc34be79020d58e8d1c051502ababf
evidence.first_seen_kind	payout
evidence.age	6 days, 19:56:00
evidence.max_age	7d
evidence.history_start	2026-09-01T00:02:11Z
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	amount_usd=796054.467841 gt 500000
shield.capability	flag_observation
shield.scope	address

2026-09-26 13:33:06

BNB Chain

R1_VAULT_PAYOUT_SPIKETreasury drain

bsc hot_bridge paid 495,952.55 usdt to 0x1e7083a4ef19efbbaad4512745e045ac36321423: 2.13x the 48h max of 232,777.98

0x09288cdd...62aa

Click a field to copy its value.

timestamp	2026-09-26T13:33:06Z
rule.id	R1_VAULT_PAYOUT_SPIKE
rule.level	8
rule.severity	medium
rule.description	Treasury payout far above recent maximum
rule.groups	evm, treasury, payout, spike
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x09288cdd4bad1a9774ccc432ea25f335a659ce115532f5fd8ff903d540bc62aa
data.block	124149487
data.ts	2026-09-26T13:33:06Z
data.chain	bsc
data.kind	payout
data.amount	495952.547934435795489841
data.symbol	usdt
data.from	0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to	0x1e7083a4ef19efbbaad4512745e045ac36321423
data.tx_submitter	0xcf495cea699b8beca4073279eda66882ccfa273c
data.vault	hot_bridge
data.token	bsc:usdt
data.address	0x1e7083a4ef19efbbaad4512745e045ac36321423
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
scope.address	0x1e7083a4ef19efbbaad4512745e045ac36321423
evidence.value_field	amount_usd
evidence.value	495952.547934435795489841
evidence.baseline_max	232777.981025866162235922
evidence.baseline_tx	0x99042e9fd7f35dc46aec5747f47560fd68c0dbe9cef9971b86d2a05c93f9f903
evidence.baseline_ts	2026-09-26T08:15:08Z
evidence.baseline_window	48h
evidence.baseline_events	847
evidence.ratio	2.13
evidence.factor	2.0
evidence.min_value	50000
matched[0]	kind=payout eq payout
matched[1]	vault=hot_bridge in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdt in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	chain, bridge, token

2026-09-27 13:13:47

Ethereum

R3_TEST_THEN_DRAINTreasury drain

0xc9379729b1e271bc65044ce0cab9ef3f2674b6c7 received a test payout 5m 36s before this 189,970.42 usdt payout

0xf3f6eda9...a62e

Click a field to copy its value.

timestamp	2026-09-27T13:13:47Z
rule.id	R3_TEST_THEN_DRAIN
rule.level	8
rule.severity	medium
rule.description	Small test payout followed by a large payout to the same recipient
rule.groups	evm, treasury, payout, sequence
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0xf3f6eda9262ac1fe4ba948bd7930673259a95e0d24bee4addae1fc1ac531a62e
data.block	26069019
data.ts	2026-09-27T13:13:47Z
data.chain	ethereum
data.kind	payout
data.amount	189970.420036
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0xc9379729b1e271bc65044ce0cab9ef3f2674b6c7
data.vault	near_intents
data.token	ethereum:usdt
data.address	0xc9379729b1e271bc65044ce0cab9ef3f2674b6c7
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0xc9379729b1e271bc65044ce0cab9ef3f2674b6c7
evidence.group.to_addr	0xc9379729b1e271bc65044ce0cab9ef3f2674b6c7
evidence.within	24h
evidence.steps	[{"step": "test_payout", "tx": "0x6710dee4d472e64b52e6c0c31b4dbcc31296a0bdc4a1aa70080ce53453a0b039", "ts": "2026-09-27T13:08:11Z", "amount": "9"}, {"step": "large_payout", "tx": "0xf3f6eda9262ac1fe4ba948bd7930673259a95e0d24bee4addae1fc1ac531a62e", "ts": "2026-09-27T13:13:47Z", "amount": "189970.420036"}]
evidence.first_step_age	0:05:36
evidence.prior_events	[{"step": "test_payout", "tx": "0x6710dee4d472e64b52e6c0c31b4dbcc31296a0bdc4a1aa70080ce53453a0b039", "ts": "2026-09-27T13:08:11Z", "amount": "9"}]
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdt in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	address

2026-09-28 09:57:14

BNB Chain

R1_VAULT_PAYOUT_SPIKETreasury drain

bsc hot_bridge paid 696,446.12 usdt to 0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758: 3.16x the 48h max of 220,659.30

0xa42bd47d...8c14

Click a field to copy its value.

timestamp	2026-09-28T09:57:14Z
rule.id	R1_VAULT_PAYOUT_SPIKE
rule.level	8
rule.severity	medium
rule.description	Treasury payout far above recent maximum
rule.groups	evm, treasury, payout, spike
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0xa42bd47db530dec86f0c52a7f0702768ba64efbb716ec9e0433bcc25f4328c14
data.block	124504616
data.ts	2026-09-28T09:57:14Z
data.chain	bsc
data.kind	payout
data.amount	696446.116484238928033896
data.symbol	usdt
data.from	0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
data.tx_submitter	0xcf495cea699b8beca4073279eda66882ccfa273c
data.vault	hot_bridge
data.token	bsc:usdt
data.address	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
scope.chain	bsc
scope.bridge	hot
scope.token	usdt
scope.address	0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758
evidence.value_field	amount_usd
evidence.value	696446.116484238928033896
evidence.baseline_max	220659.303134086233321495
evidence.baseline_tx	0xee68868c559de954a85f6965cca40792740c9b9337c6e49d1509ac69007bff52
evidence.baseline_ts	2026-09-28T02:54:48Z
evidence.baseline_window	48h
evidence.baseline_events	1557
evidence.ratio	3.16
evidence.factor	2.0
evidence.min_value	50000
matched[0]	kind=payout eq payout
matched[1]	vault=hot_bridge in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdt in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	chain, bridge, token

2026-09-28 12:53:35

Ethereum

R3_TEST_THEN_DRAINTreasury drain

0x1299c0dff080d246e29fb93975987fc07f698652 received a test payout 12m 0s before this 268,319.40 usdt payout

0x37913a1e...40d1

Click a field to copy its value.

timestamp	2026-09-28T12:53:35Z
rule.id	R3_TEST_THEN_DRAIN
rule.level	8
rule.severity	medium
rule.description	Small test payout followed by a large payout to the same recipient
rule.groups	evm, treasury, payout, sequence
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x37913a1e5488feed66f1a52afd0e0ef0e2b7d1e1f7b33d85900bb2c412aa40d1
data.block	26076080
data.ts	2026-09-28T12:53:35Z
data.chain	ethereum
data.kind	payout
data.amount	268319.4
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x1299c0dff080d246e29fb93975987fc07f698652
data.vault	near_intents
data.token	ethereum:usdt
data.address	0x1299c0dff080d246e29fb93975987fc07f698652
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0x1299c0dff080d246e29fb93975987fc07f698652
evidence.group.to_addr	0x1299c0dff080d246e29fb93975987fc07f698652
evidence.within	24h
evidence.steps	[{"step": "test_payout", "tx": "0xf60d5b970092cf081de997c1457d51c4bbdacc19c6c3a5c10180cfb3b8d22105", "ts": "2026-09-28T12:41:35Z", "amount": "99.4"}, {"step": "large_payout", "tx": "0x37913a1e5488feed66f1a52afd0e0ef0e2b7d1e1f7b33d85900bb2c412aa40d1", "ts": "2026-09-28T12:53:35Z", "amount": "268319.4"}]
evidence.first_step_age	0:12:00
evidence.prior_events	[{"step": "test_payout", "tx": "0xf60d5b970092cf081de997c1457d51c4bbdacc19c6c3a5c10180cfb3b8d22105", "ts": "2026-09-28T12:41:35Z", "amount": "99.4"}]
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdt in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	address

2026-09-28 13:02:35

Ethereum

R3_TEST_THEN_DRAINTreasury drain

0x1299c0dff080d246e29fb93975987fc07f698652 received a test payout 21m 0s before this 499,999.40 usdt payout

0x1c11e463...fd75

Click a field to copy its value.

timestamp	2026-09-28T13:02:35Z
rule.id	R3_TEST_THEN_DRAIN
rule.level	8
rule.severity	medium
rule.description	Small test payout followed by a large payout to the same recipient
rule.groups	evm, treasury, payout, sequence
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0x1c11e4635c75522dc551b47c0c5d1915da1fcadf87150a7b74349df831dafd75
data.block	26076125
data.ts	2026-09-28T13:02:35Z
data.chain	ethereum
data.kind	payout
data.amount	499999.4
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x1299c0dff080d246e29fb93975987fc07f698652
data.vault	near_intents
data.token	ethereum:usdt
data.address	0x1299c0dff080d246e29fb93975987fc07f698652
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0x1299c0dff080d246e29fb93975987fc07f698652
evidence.group.to_addr	0x1299c0dff080d246e29fb93975987fc07f698652
evidence.within	24h
evidence.steps	[{"step": "test_payout", "tx": "0xf60d5b970092cf081de997c1457d51c4bbdacc19c6c3a5c10180cfb3b8d22105", "ts": "2026-09-28T12:41:35Z", "amount": "99.4"}, {"step": "large_payout", "tx": "0x1c11e4635c75522dc551b47c0c5d1915da1fcadf87150a7b74349df831dafd75", "ts": "2026-09-28T13:02:35Z", "amount": "499999.4"}]
evidence.first_step_age	0:21:00
evidence.prior_events	[{"step": "test_payout", "tx": "0xf60d5b970092cf081de997c1457d51c4bbdacc19c6c3a5c10180cfb3b8d22105", "ts": "2026-09-28T12:41:35Z", "amount": "99.4"}]
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdt in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	address

2026-09-28 13:07:47

Ethereum

R10_RECIPIENT_PAYOUT_BURSTTreasury drain

near_intents on ethereum paid 0x1299c0dff080d246e29fb93975987fc07f698652 3 times over $250K in 14m 12s (1,268,314.20 usdt), 0 such payouts in the 7d before

0xf32c6995...49ce

Click a field to copy its value.

timestamp	2026-09-28T13:07:47Z
rule.id	R10_RECIPIENT_PAYOUT_BURST
rule.level	8
rule.severity	medium
rule.description	Burst of large treasury payouts to one new counterparty
rule.groups	evm, treasury, payout, frequency
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0xf32c6995510ae31261ecdd93bc208ade7c9737fd5ba532ac40611942911a49ce
data.block	26076151
data.ts	2026-09-28T13:07:47Z
data.chain	ethereum
data.kind	payout
data.amount	499995.4
data.symbol	usdt
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0x1299c0dff080d246e29fb93975987fc07f698652
data.vault	near_intents
data.token	ethereum:usdt
data.address	0x1299c0dff080d246e29fb93975987fc07f698652
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdt
scope.address	0x1299c0dff080d246e29fb93975987fc07f698652
evidence.group.chain	ethereum
evidence.group.vault	near_intents
evidence.group.to_addr	0x1299c0dff080d246e29fb93975987fc07f698652
evidence.count	3
evidence.min_count	3
evidence.within	2h
evidence.window_sum	1268314.2
evidence.burst_txs	0x37913a1e5488feed66f1a52afd0e0ef0e2b7d1e1f7b33d85900bb2c412aa40d1, 0x1c11e4635c75522dc551b47c0c5d1915da1fcadf87150a7b74349df831dafd75, 0xf32c6995510ae31261ecdd93bc208ade7c9737fd5ba532ac40611942911a49ce
evidence.burst_started	2026-09-28T12:53:35Z
evidence.burst_span	0:14:12
evidence.prior_events	0
evidence.max_prior	3
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdt in ['usdt', 'usdc']
matched[3]	amount_usd=499995.4 gt 250000
shield.capability	flag_observation
shield.scope	chain, bridge, token, address

2026-09-28 14:13:11

Ethereum

R3_TEST_THEN_DRAINTreasury drain

0xbaba6d208770bd3b9b8d061f00c91d403415e8d0 received a test payout 15m 0s before this 104,948.05 usdc payout

0xe5f387c8...d598

Click a field to copy its value.

timestamp	2026-09-28T14:13:11Z
rule.id	R3_TEST_THEN_DRAIN
rule.level	8
rule.severity	medium
rule.description	Small test payout followed by a large payout to the same recipient
rule.groups	evm, treasury, payout, sequence
rule.tactic	Treasury drain
rule.weight	1.5
data.tx	0xe5f387c869d0d86413a30e940532670633d7e460a935d9531ccd637d25e9d598
data.block	26076476
data.ts	2026-09-28T14:13:11Z
data.chain	ethereum
data.kind	payout
data.amount	104948.052447
data.symbol	usdc
data.from	0x2cff890f0378a11913b6129b2e97417a2c302680
data.to	0xbaba6d208770bd3b9b8d061f00c91d403415e8d0
data.vault	near_intents
data.token	ethereum:usdc
data.address	0xbaba6d208770bd3b9b8d061f00c91d403415e8d0
scope.chain	ethereum
scope.bridge	near_intents
scope.token	usdc
scope.address	0xbaba6d208770bd3b9b8d061f00c91d403415e8d0
evidence.group.to_addr	0xbaba6d208770bd3b9b8d061f00c91d403415e8d0
evidence.within	24h
evidence.steps	[{"step": "test_payout", "tx": "0x3eb798b6b0bdab0be06bb1ab885ecc67f2738fcdd04d57b897a18a9e429991fa", "ts": "2026-09-28T13:58:11Z", "amount": "99.676304"}, {"step": "large_payout", "tx": "0xe5f387c869d0d86413a30e940532670633d7e460a935d9531ccd637d25e9d598", "ts": "2026-09-28T14:13:11Z", "amount": "104948.052447"}]
evidence.first_step_age	0:15:00
evidence.prior_events	[{"step": "test_payout", "tx": "0x3eb798b6b0bdab0be06bb1ab885ecc67f2738fcdd04d57b897a18a9e429991fa", "ts": "2026-09-28T13:58:11Z", "amount": "99.676304"}]
matched[0]	kind=payout eq payout
matched[1]	vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]	symbol=usdc in ['usdt', 'usdc']
shield.capability	flag_observation
shield.scope	address

Incidents

25 incidents with alerts in the window, highest mode first. Each is SHIELD-shaped (intentwatch.incident/v1, unofficial: SHIELD's Incident API is partner-only). Alerts sharing an asset or address within 24h are one incident; two high alerts on different transactions within 2h escalate it to under_attack, unless all of them come from a rate rule (R2), which moves it onto the route and stops at paranoid.

On NEAR: incidents at paranoid or above are written to the IntentWatch incident registry registry.surs51.testnet (testnet, deployed) by a detector that holds only a function-call key limited to report_incident with a 0.25 NEAR gas allowance (read from chain 2026-10-31 19:05:23 UTC: least privilege ok). No model is connected: the summary module is ready to connect and has recorded nothing for this replay.

Agent guard wallet on testnet

The contract (contracts/agent_guard, Rust near-sdk) holds an AI agent's funds. Its only key for the agent is a function-call key limited to request_transfer (read from chain 2026-11-04 15:47:30 UTC: least privilege ok). It enforces 0.1 NEAR per transfer and 0.5 NEAR per day, then asks the incident registry about the route the agent declares and the account the money really goes to: under_attack or a paused destination is refused, paranoid is held for 60 min and re-checked, and any trouble reaching the registry is a refusal. Deployed at guard.surs51.testnet (tx). Code upgraded 2026-11-01 16:37:35 UTC (tx); a receipt recorded before that is an answer of the earlier build. Code upgraded 2026-11-04 15:46:26 UTC (tx); a receipt recorded before that is an answer of the earlier build. The "Contract answers" column comes from a mirror of the contract logic, tested against the contracts with shared vectors, assuming the detector reported each escalation as it happened; the receipts column is what the deployed contract answered on testnet, and intentwatch guard verify reads those back from chain. The chain, bridge and token are what the agent declares: an agent that lies about them and pays an account nobody has flagged is bounded by the limits only, unless the owner has set an allowlist of receivers, which the contract checks first, along with the owner's stop switch and hourly cap. Click a row for the exact call the agent signs.

Moment (UTC)	Agent asks	Declared route and real receiver	Contract answers	Testnet receipt
2026-09-09 15:36	Payment on the route, now paranoid 0.01 NEAR	ethereum/near_intents/usdt 0x88bbcaee...e758 really pays surs51.testnet	held route is paranoid (incident IW-20260908-042547-8b412a): held until the delay ends	refused 8FghMZpmKa...He9Y
The `request_transfer` call the agent signs { "args": { "amount": "10000000000000000000000", "receiver_id": "surs51.testnet", "route": { "address": "0x00000000000000000000000000000000000a11ce", "bridge": "hot", "chain": "bsc", "token": "usdt" } }, "deposit": "0", "gas_tgas": 100, "method": "request_transfer", "receiver_id": "guard.surs51.testnet" }
2026-09-09 15:36	The same payment on a route nothing covers 0.01 NEAR	bsc/hot/usdc 0x00000000...11ce really pays surs51.testnet	sent route clear, within limits	sent 4DSpDZagW7...bzCA
The `request_transfer` call the agent signs { "args": { "amount": "10000000000000000000000", "receiver_id": "surs51.testnet", "route": { "address": "0x00000000000000000000000000000000000a11ce", "bridge": "near_intents", "chain": "ethereum", "token": "usdc" } }, "deposit": "0", "gas_tgas": 100, "method": "request_transfer", "receiver_id": "guard.surs51.testnet" }
2026-09-09 15:36	A payment over the per-transfer limit 0.2 NEAR	bsc/hot/usdc 0x00000000...11ce really pays surs51.testnet	refused amount exceeds the per-transfer limit	refused 2LXCMG3o2K...zUdG
The `request_transfer` call the agent signs { "args": { "amount": "200000000000000000000000", "receiver_id": "surs51.testnet", "route": { "address": "0x00000000000000000000000000000000000a11ce", "bridge": "near_intents", "chain": "ethereum", "token": "usdc" } }, "deposit": "0", "gas_tgas": 100, "method": "request_transfer", "receiver_id": "guard.surs51.testnet" }
2026-09-09 15:36	A payment to a fresh account, with the owner's allowlist on 0.01 NEAR	bsc/hot/usdc 0x00000000...11ce really pays 5fd214f06a...f46a owner allows only surs51.testnet	refused the receiver is not on the owner's allowlist	refused FvmP6yX4y7...Emq5
The `request_transfer` call the agent signs { "args": { "amount": "10000000000000000000000", "receiver_id": "5fd214f06a0de3e6bcdf6f325ab29b494f9904f491c24e1db62c9069fdb0f46a", "route": { "address": "0x00000000000000000000000000000000000a11ce", "bridge": "near_intents", "chain": "ethereum", "token": "usdc" } }, "deposit": "0", "gas_tgas": 100, "method": "request_transfer", "receiver_id": "guard.surs51.testnet" }

paranoid IW-20260908-042547-8b412a high 16 alerts · score 24.5 · BNB Chain, Ethereum · opened 2026-09-08 04:25:47 UTC · active 64h 31m show ▾hide ▴

normal

09-08 04:25

paranoid

09-09 15:36

under attack

Recommended capability: raise_mode
Scope: chain: ethereumbridge: near_intentstoken: usdtaddress: 0x88bbcaee...e758
Opened by: R3_TEST_THEN_DRAIN
Flagged stablecoin payouts: 16 totalling 7,048,015.52 USD

On-chain record not recorded

No recorded report for this incident. Incident hash 3979e76cf619aa20...42b3 (sha256 of the canonical incident JSON; intentwatch registry hashes recomputes it).

The report_incident call the detector would sign

{
  "args": {
    "report": {
      "alerts": 16,
      "attestation_hash": null,
      "capability": "raise_mode",
      "incident_hash": "3979e76cf619aa20862d98d2f358043b4965ab48f99843a4c5f0f08950e942b3",
      "incident_id": "IW-20260908-042547-8b412a",
      "mode": "paranoid",
      "opened_at_ms": 1788841547000,
      "paused_destinations": [],
      "scope": {
        "address": "0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758",
        "bridge": "near_intents",
        "chain": "ethereum",
        "token": "usdt"
      },
      "summary_hash": null
    }
  },
  "deposit": "0",
  "gas_tgas": 10,
  "method": "report_incident",
  "receiver_id": "registry.surs51.testnet"
}

Model-written summary none recorded

Not recorded for this replay. intentwatch triage record asks a NEAR-hosted TEE model for a summary and stores the evidence (response signature, Intel TDX quote and collateral, NVIDIA GPU verdict) that the replay then re-verifies offline. It needs a NEAR AI Cloud key.

Rules in this incident

12R2_VAULT_OUTFLOW_VELOCITY×18R3_TEST_THEN_DRAIN×38R5_NEW_RECIPIENT_LARGE_PAYOUT×58R1_VAULT_PAYOUT_SPIKE×7

Mode changes and actions click a row for the alerts that led to it

Time (UTC)	Change	Reason
2026-09-08 04:25:47	normal	1 observation(s)
2026-09-09 15:36:23	paranoid	high alert R2_VAULT_OUTFLOW_VELOCITY

Raw incident JSON (alert evidence omitted: see Events, or incidents.jsonl)

{
  "schema": "intentwatch.incident/v1 (shield-compatible, unofficial)",
  "incident_id": "IW-20260908-042547-8b412a",
  "opened_at": "2026-09-08T04:25:47Z",
  "updated_at": "2026-09-10T20:57:06Z",
  "recommended_mode": "paranoid",
  "capability": "raise_mode",
  "scope": {
    "chain": "ethereum",
    "bridge": "near_intents",
    "token": "usdt",
    "address": "0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758"
  },
  "score": 24.5,
  "max_severity": "high",
  "mode_history": [
    {
      "ts": "2026-09-08T04:25:47Z",
      "mode": "normal",
      "capability": "flag_observation",
      "scope": {
        "chain": "ethereum",
        "bridge": "near_intents",
        "token": "usdt",
        "address": "0x7c947c2fbebd86e5b88b28f097c379fa29831c1a"
      },
      "reason": "1 observation(s)",
      "alert_id": "R3_TEST_THEN_DRAIN:e0bc4605c5f2"
    },
    {
      "ts": "2026-09-09T15:36:23Z",
      "mode": "paranoid",
      "capability": "raise_mode",
      "scope": {
        "chain": "ethereum",
        "bridge": "near_intents",
        "token": "usdt",
        "address": "0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758"
      },
      "reason": "high alert R2_VAULT_OUTFLOW_VELOCITY",
      "alert_id": "R2_VAULT_OUTFLOW_VELOCITY:0f0a886d3ce8"
    }
  ],
  "recommended_actions": [],
  "alerts": [
    {
      "alert_id": "R3_TEST_THEN_DRAIN:e0bc4605c5f2",
      "rule": "R3_TEST_THEN_DRAIN",
      "severity": "medium",
      "ts": "2026-09-08T04:25:47Z",
      "tx": "0x31ed105aed553c14d2735bd6491317106ea82d2860bf6c2ff90b0906dc70fe5a"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:8a3624419443",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-09-08T04:47:47Z",
      "tx": "0xfaaab5c81e23b000234f25c3e002f5b05a8fa630d71f6dc579b2f332db2465e1"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:977b8872bab3",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-09-08T04:54:16Z",
      "tx": "0x397a842c1b01652646f8fe8619deaccce39ad277301ce4756f96baf3d9a8a446"
    },
    {
      "alert_id": "R3_TEST_THEN_DRAIN:d9817353c743",
      "rule": "R3_TEST_THEN_DRAIN",
      "severity": "medium",
      "ts": "2026-09-08T12:25:11Z",
      "tx": "0x677882c06aa2ccb093dbc392a491f983a355ebcdf0ce0609ed1a56b853ed8411"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:152c62432127",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-09-08T15:39:11Z",
      "tx": "0xb99933ca4517f32f92128ae8061047053bfd9d738678b7c82c0603b21541a367"
    },
    {
      "alert_id": "R2_VAULT_OUTFLOW_VELOCITY:0f0a886d3ce8",
      "rule": "R2_VAULT_OUTFLOW_VELOCITY",
      "severity": "high",
      "ts": "2026-09-09T15:36:23Z",
      "tx": "0xf1d755820f2748dd247019487c87bd7645ed19b0e12d2bdf3b6088657b2f4638"
    },
    {
      "alert_id": "R3_TEST_THEN_DRAIN:0e54495d80fc",
      "rule": "R3_TEST_THEN_DRAIN",
      "severity": "medium",
      "ts": "2026-09-10T06:22:59Z",
      "tx": "0x8a5d6b8e68a2e9bda3353fcc40a75db61bbedc3c711758ea5f04c035bd7bce17"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:770ea03f5732",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-09-10T13:05:11Z",
      "tx": "0xd9a99e636968aee4d6db329c6ff9f7576b5f8f2a4b503d627a56934fe93a2776"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:32ac96d5da28",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-09-10T14:21:35Z",
      "tx": "0xb005ef015f6a30781bb5d94fe80f38d304ee7ae53d4e37641d5129d37774a27a"
    },
    {
      "alert_id": "R1_VAULT_PAYOUT_SPIKE:6bd59c62e568",
      "rule": "R1_VAULT_PAYOUT_SPIKE",
      "severity": "medium",
      "ts": "2026-09-10T16:54:30Z",
      "tx": "0xffae3a9b074c70430c7e108da231aa57982dee10579d5f68b66313c738bf0de2"
    },
    {
      "alert_id": "R1_VAULT_PAYOUT_SPIKE:0e7eafe40799",
      "rule": "R1_VAULT_PAYOUT_SPIKE",
      "severity": "medium",
      "ts": "2026-09-10T17:15:06Z",
      "tx": "0x5dcedd67f63b6aad287460e434fc0b6bcb404045d90be861282917111ba34901"
    },
    {
      "alert_id": "R1_VAULT_PAYOUT_SPIKE:677794cbbae9",
      "rule": "R1_VAULT_PAYOUT_SPIKE",
      "severity": "medium",
      "ts": "2026-09-10T18:15:14Z",
      "tx": "0xf124d70ab583a8f87873f11531cb09f5e40169c39f144dc9722c3e730ef8baa6"
    },
    {
      "alert_id": "R1_VAULT_PAYOUT_SPIKE:bf6cc98c15db",
      "rule": "R1_VAULT_PAYOUT_SPIKE",
      "severity": "medium",
      "ts": "2026-09-10T18:54:42Z",
      "tx": "0xf727cdc36d45e1448ca1c80587e0dc0991ab0ee11c289f91ed22176d202fff6e"
    },
    {
      "alert_id": "R1_VAULT_PAYOUT_SPIKE:2aaeefa65045",
      "rule": "R1_VAULT_PAYOUT_SPIKE",
      "severity": "medium",
      "ts": "2026-09-10T19:45:38Z",
      "tx": "0x55e4fac0ff4949c6190df65d9be14c9ecb057072fac556d94269628955260c80"
    },
    {
      "alert_id": "R1_VAULT_PAYOUT_SPIKE:1ad3c1a55aa3",
      "rule": "R1_VAULT_PAYOUT_SPIKE",
      "severity": "medium",
      "ts": "2026-09-10T20:14:39Z",
      "tx": "0x6d3d602c6c5b7a84dd2563b98be36f6f77f5c892bca7642fe652b8ceb6dee027"
    },
    {
      "alert_id": "R1_VAULT_PAYOUT_SPIKE:d43aad5e3c61",
      "rule": "R1_VAULT_PAYOUT_SPIKE",
      "severity": "medium",
      "ts": "2026-09-10T20:57:06Z",
      "tx": "0x0e148ec6936205344162f8e54a0f7457cef33fa3fc1a57aedff464eba91fde9e"
    }
  ],
  "summary": "16 alerts (R1_VAULT_PAYOUT_SPIKE, R2_VAULT_OUTFLOW_VELOCITY, R3_TEST_THEN_DRAIN, R5_NEW_RECIPIENT_LARGE_PAYOUT) on bsc, ethereum; opened 2026-09-08T04:25:47Z by R3_TEST_THEN_DRAIN; mode paranoid; 16 flagged stablecoin payouts totalling 7,048,015.52 USD."
}

paranoid IW-20260924-205454-d17c87 high 3 alerts · score 6.0 · BNB Chain · opened 2026-09-24 20:54:54 UTC · active 0s show ▾hide ▴

normal

09-24 20:54

paranoid

09-24 20:54

under attack

Recommended capability: raise_mode
Scope: chain: bscbridge: hottoken: usdtaddress: 0x7c96279e...3e1c
Opened by: R1B_PAYOUT_SPIKE_TO_NEW_RECIPIENT
Flagged stablecoin payouts: 1 totalling 768,574.37 USD

On-chain record not recorded

No recorded report for this incident. Incident hash af5dac8a7d13e313...40e5 (sha256 of the canonical incident JSON; intentwatch registry hashes recomputes it).

The report_incident call the detector would sign

{
  "args": {
    "report": {
      "alerts": 3,
      "attestation_hash": null,
      "capability": "raise_mode",
      "incident_hash": "af5dac8a7d13e313a4e914816caf41d441aba8ef1b4a12ec725bc4479ba540e5",
      "incident_id": "IW-20260924-205454-d17c87",
      "mode": "paranoid",
      "opened_at_ms": 1790283294000,
      "paused_destinations": [],
      "scope": {
        "address": "0x7c96279ec1e888aa56b9b836e0db26ca48573e1c",
        "bridge": "hot",
        "chain": "bsc",
        "token": "usdt"
      },
      "summary_hash": null
    }
  },
  "deposit": "0",
  "gas_tgas": 10,
  "method": "report_incident",
  "receiver_id": "registry.surs51.testnet"
}

Model-written summary none recorded

Rules in this incident

12R1B_PAYOUT_SPIKE_TO_NEW_RECIPIENT×18R1_VAULT_PAYOUT_SPIKE×18R5_NEW_RECIPIENT_LARGE_PAYOUT×1

Mode changes and actions click a row for the alerts that led to it

Time (UTC)	Change	Reason
2026-09-24 20:54:54	normal	1 observation(s)
2026-09-24 20:54:54	paranoid	high alert R1B_PAYOUT_SPIKE_TO_NEW_RECIPIENT

Raw incident JSON (alert evidence omitted: see Events, or incidents.jsonl)

{
  "schema": "intentwatch.incident/v1 (shield-compatible, unofficial)",
  "incident_id": "IW-20260924-205454-d17c87",
  "opened_at": "2026-09-24T20:54:54Z",
  "updated_at": "2026-09-24T20:54:54Z",
  "recommended_mode": "paranoid",
  "capability": "raise_mode",
  "scope": {
    "chain": "bsc",
    "bridge": "hot",
    "token": "usdt",
    "address": "0x7c96279ec1e888aa56b9b836e0db26ca48573e1c"
  },
  "score": 6.0,
  "max_severity": "high",
  "mode_history": [
    {
      "ts": "2026-09-24T20:54:54Z",
      "mode": "normal",
      "capability": "flag_observation",
      "scope": {
        "chain": "bsc",
        "bridge": "hot",
        "token": "usdt",
        "address": "0x7c96279ec1e888aa56b9b836e0db26ca48573e1c"
      },
      "reason": "1 observation(s)",
      "alert_id": "R1_VAULT_PAYOUT_SPIKE:712304584995"
    },
    {
      "ts": "2026-09-24T20:54:54Z",
      "mode": "paranoid",
      "capability": "raise_mode",
      "scope": {
        "chain": "bsc",
        "bridge": "hot",
        "token": "usdt",
        "address": "0x7c96279ec1e888aa56b9b836e0db26ca48573e1c"
      },
      "reason": "high alert R1B_PAYOUT_SPIKE_TO_NEW_RECIPIENT",
      "alert_id": "R1B_PAYOUT_SPIKE_TO_NEW_RECIPIENT:7d177a63dbfc"
    }
  ],
  "recommended_actions": [],
  "alerts": [
    {
      "alert_id": "R1B_PAYOUT_SPIKE_TO_NEW_RECIPIENT:7d177a63dbfc",
      "rule": "R1B_PAYOUT_SPIKE_TO_NEW_RECIPIENT",
      "severity": "high",
      "ts": "2026-09-24T20:54:54Z",
      "tx": "0x718e5ea9a5e54426da72acb778c033508004b1e797ada87bc528599c800e74dd"
    },
    {
      "alert_id": "R1_VAULT_PAYOUT_SPIKE:712304584995",
      "rule": "R1_VAULT_PAYOUT_SPIKE",
      "severity": "medium",
      "ts": "2026-09-24T20:54:54Z",
      "tx": "0x718e5ea9a5e54426da72acb778c033508004b1e797ada87bc528599c800e74dd"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:1bf78ebe2074",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-09-24T20:54:54Z",
      "tx": "0x718e5ea9a5e54426da72acb778c033508004b1e797ada87bc528599c800e74dd"
    }
  ],
  "summary": "3 alerts (R1B_PAYOUT_SPIKE_TO_NEW_RECIPIENT, R1_VAULT_PAYOUT_SPIKE, R5_NEW_RECIPIENT_LARGE_PAYOUT) on bsc; opened 2026-09-24T20:54:54Z by R1B_PAYOUT_SPIKE_TO_NEW_RECIPIENT; mode paranoid; 1 flagged stablecoin payouts totalling 768,574.37 USD."
}

paranoid IW-20260928-095714-b096cc high 2 alerts · score 3.5 · BNB Chain · opened 2026-09-28 09:57:14 UTC · active 52m 11s show ▾hide ▴

normal

09-28 09:57

paranoid

09-28 10:49

under attack

Recommended capability: raise_mode
Scope: chain: bscbridge: hottoken: usdtaddress: 0xc565b3db...b994
Opened by: R1_VAULT_PAYOUT_SPIKE
Flagged stablecoin payouts: 2 totalling 996,446.12 USD

On-chain record not recorded

No recorded report for this incident. Incident hash f1a9287e2dfc73bb...8b27 (sha256 of the canonical incident JSON; intentwatch registry hashes recomputes it).

The report_incident call the detector would sign

{
  "args": {
    "report": {
      "alerts": 2,
      "attestation_hash": null,
      "capability": "raise_mode",
      "incident_hash": "f1a9287e2dfc73bb758b996d9a438b7b1f1ef319d142b4ba3a8c8e097ad08b27",
      "incident_id": "IW-20260928-095714-b096cc",
      "mode": "paranoid",
      "opened_at_ms": 1790589434000,
      "paused_destinations": [],
      "scope": {
        "address": "0xc565b3db8527fe7f7f89b630886ec348ae1eb994",
        "bridge": "hot",
        "chain": "bsc",
        "token": "usdt"
      },
      "summary_hash": null
    }
  },
  "deposit": "0",
  "gas_tgas": 10,
  "method": "report_incident",
  "receiver_id": "registry.surs51.testnet"
}

Model-written summary none recorded

Rules in this incident

12R2_VAULT_OUTFLOW_VELOCITY×18R1_VAULT_PAYOUT_SPIKE×1

Mode changes and actions click a row for the alerts that led to it

Time (UTC)	Change	Reason
2026-09-28 09:57:14	normal	1 observation(s)
2026-09-28 10:49:25	paranoid	high alert R2_VAULT_OUTFLOW_VELOCITY

Raw incident JSON (alert evidence omitted: see Events, or incidents.jsonl)

{
  "schema": "intentwatch.incident/v1 (shield-compatible, unofficial)",
  "incident_id": "IW-20260928-095714-b096cc",
  "opened_at": "2026-09-28T09:57:14Z",
  "updated_at": "2026-09-28T10:49:25Z",
  "recommended_mode": "paranoid",
  "capability": "raise_mode",
  "scope": {
    "chain": "bsc",
    "bridge": "hot",
    "token": "usdt",
    "address": "0xc565b3db8527fe7f7f89b630886ec348ae1eb994"
  },
  "score": 3.5,
  "max_severity": "high",
  "mode_history": [
    {
      "ts": "2026-09-28T09:57:14Z",
      "mode": "normal",
      "capability": "flag_observation",
      "scope": {
        "chain": "bsc",
        "bridge": "hot",
        "token": "usdt",
        "address": "0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758"
      },
      "reason": "1 observation(s)",
      "alert_id": "R1_VAULT_PAYOUT_SPIKE:2691c757c379"
    },
    {
      "ts": "2026-09-28T10:49:25Z",
      "mode": "paranoid",
      "capability": "raise_mode",
      "scope": {
        "chain": "bsc",
        "bridge": "hot",
        "token": "usdt",
        "address": "0xc565b3db8527fe7f7f89b630886ec348ae1eb994"
      },
      "reason": "high alert R2_VAULT_OUTFLOW_VELOCITY",
      "alert_id": "R2_VAULT_OUTFLOW_VELOCITY:de018c7cb894"
    }
  ],
  "recommended_actions": [],
  "alerts": [
    {
      "alert_id": "R1_VAULT_PAYOUT_SPIKE:2691c757c379",
      "rule": "R1_VAULT_PAYOUT_SPIKE",
      "severity": "medium",
      "ts": "2026-09-28T09:57:14Z",
      "tx": "0xa42bd47db530dec86f0c52a7f0702768ba64efbb716ec9e0433bcc25f4328c14"
    },
    {
      "alert_id": "R2_VAULT_OUTFLOW_VELOCITY:de018c7cb894",
      "rule": "R2_VAULT_OUTFLOW_VELOCITY",
      "severity": "high",
      "ts": "2026-09-28T10:49:25Z",
      "tx": "0x61dbd4202d47f48deada4d5e4fbb641eb27ae10ecdd69d3b4a357b0975062056"
    }
  ],
  "summary": "2 alerts (R1_VAULT_PAYOUT_SPIKE, R2_VAULT_OUTFLOW_VELOCITY) on bsc; opened 2026-09-28T09:57:14Z by R1_VAULT_PAYOUT_SPIKE; mode paranoid; 2 flagged stablecoin payouts totalling 996,446.12 USD."
}

normal IW-20260917-174259-7c6eb1 medium 10 alerts · score 15.0 · Ethereum · opened 2026-09-17 17:42:59 UTC · active 51h 30m show ▾hide ▴

normal

09-17 17:42

paranoid

under attack

Recommended capability: flag_observation
Scope: chain: ethereumbridge: near_intentstoken: usdcaddress: 0x09af2cee...8905
Opened by: R3_TEST_THEN_DRAIN
Flagged stablecoin payouts: 10 totalling 5,736,568.29 USD

On-chain record below paranoid

Only incidents at paranoid or above go on chain. Incident hash 93216165721b15c1...83e2.

Model-written summary none recorded

Summaries are written for incidents at paranoid or above.

Rules in this incident

8R3_TEST_THEN_DRAIN×48R5_NEW_RECIPIENT_LARGE_PAYOUT×6

Mode changes and actions click a row for the alerts that led to it

Time (UTC)	Change	Reason
2026-09-17 17:42:59	normal	1 observation(s)

Raw incident JSON (alert evidence omitted: see Events, or incidents.jsonl)

{
  "schema": "intentwatch.incident/v1 (shield-compatible, unofficial)",
  "incident_id": "IW-20260917-174259-7c6eb1",
  "opened_at": "2026-09-17T17:42:59Z",
  "updated_at": "2026-09-19T21:13:35Z",
  "recommended_mode": "normal",
  "capability": "flag_observation",
  "scope": {
    "chain": "ethereum",
    "bridge": "near_intents",
    "token": "usdc",
    "address": "0x09af2cee65fc69f8052eb4611fac428c9cd08905"
  },
  "score": 15.0,
  "max_severity": "medium",
  "mode_history": [
    {
      "ts": "2026-09-17T17:42:59Z",
      "mode": "normal",
      "capability": "flag_observation",
      "scope": {
        "chain": "ethereum",
        "bridge": "near_intents",
        "token": "usdc",
        "address": "0x09af2cee65fc69f8052eb4611fac428c9cd08905"
      },
      "reason": "1 observation(s)",
      "alert_id": "R3_TEST_THEN_DRAIN:853981b353a5"
    }
  ],
  "recommended_actions": [],
  "alerts": [
    {
      "alert_id": "R3_TEST_THEN_DRAIN:853981b353a5",
      "rule": "R3_TEST_THEN_DRAIN",
      "severity": "medium",
      "ts": "2026-09-17T17:42:59Z",
      "tx": "0xe5bc2c691ba42b3e4ce34c5338c9dea59d924d62d7bdff19698174c061a6bc33"
    },
    {
      "alert_id": "R3_TEST_THEN_DRAIN:995df5bfdd57",
      "rule": "R3_TEST_THEN_DRAIN",
      "severity": "medium",
      "ts": "2026-09-17T20:04:11Z",
      "tx": "0xdf57ce2a723ac40d319b6ef20bf8813d23e5b4a1742c01c262ab84f4af81a431"
    },
    {
      "alert_id": "R3_TEST_THEN_DRAIN:6204b2993c23",
      "rule": "R3_TEST_THEN_DRAIN",
      "severity": "medium",
      "ts": "2026-09-18T07:03:59Z",
      "tx": "0xd4402166bb7a6b19394afee3e4806b4e9f33234736b0bca68b66ca6bbd436188"
    },
    {
      "alert_id": "R3_TEST_THEN_DRAIN:8f9d1e5f7c61",
      "rule": "R3_TEST_THEN_DRAIN",
      "severity": "medium",
      "ts": "2026-09-18T07:07:35Z",
      "tx": "0x501874652700479d144ef0e0174473523b45a60b464d9a5e7bb1807542755691"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:83ded1ffae32",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-09-18T11:37:59Z",
      "tx": "0xc41c519e0a7e70a97641aec6825b14df153ff187172696b2637ee10005542908"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:5d0d64b9f20a",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-09-18T20:29:35Z",
      "tx": "0xb16d6e4e9ce6aa03aded6b47afbeaa2b32596800d9097db699e38384aec2f560"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:e0f9426b1a90",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-09-19T19:23:23Z",
      "tx": "0xc5fe4fa392cf8e46fb6bed0d585e3c552841573c61917757e52b9a27a4a1e3a1"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:b7a738764d02",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-09-19T20:33:23Z",
      "tx": "0x1e54a06c173419abc5f7dd9595f291110e5cb9134b3ad8262bd18c39881b1c30"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:e0e0d2adb7e3",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-09-19T21:11:11Z",
      "tx": "0x3ff988b055a49bb970af3585869acaf826ad3599dd6c960e1ce8d797f2333f95"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:6150d17ca5e7",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-09-19T21:13:35Z",
      "tx": "0x2bc0ebd0e0b19541e332f0c41b8b100ef65b88a0ea42ad75f8fea9b4a7a3221d"
    }
  ],
  "summary": "10 alerts (R3_TEST_THEN_DRAIN, R5_NEW_RECIPIENT_LARGE_PAYOUT) on ethereum; opened 2026-09-17T17:42:59Z by R3_TEST_THEN_DRAIN; mode normal; 10 flagged stablecoin payouts totalling 5,736,568.29 USD."
}

normal IW-20260922-053835-d9edc6 medium 8 alerts · score 12.0 · Ethereum · opened 2026-09-22 05:38:35 UTC · active 52h 9m show ▾hide ▴

normal

09-22 05:38

paranoid

under attack

Recommended capability: flag_observation
Scope: chain: ethereumbridge: near_intentstoken: usdcaddress: 0x204823d2...e3f8
Opened by: R5_NEW_RECIPIENT_LARGE_PAYOUT
Flagged stablecoin payouts: 8 totalling 3,953,034.04 USD

On-chain record below paranoid

Only incidents at paranoid or above go on chain. Incident hash e2cd0c7d196395f9...5686.

Model-written summary none recorded

Summaries are written for incidents at paranoid or above.

Rules in this incident

8R5_NEW_RECIPIENT_LARGE_PAYOUT×68R3_TEST_THEN_DRAIN×18R10_RECIPIENT_PAYOUT_BURST×1

Mode changes and actions click a row for the alerts that led to it

Time (UTC)	Change	Reason
2026-09-22 05:38:35	normal	1 observation(s)

Raw incident JSON (alert evidence omitted: see Events, or incidents.jsonl)

{
  "schema": "intentwatch.incident/v1 (shield-compatible, unofficial)",
  "incident_id": "IW-20260922-053835-d9edc6",
  "opened_at": "2026-09-22T05:38:35Z",
  "updated_at": "2026-09-24T09:48:23Z",
  "recommended_mode": "normal",
  "capability": "flag_observation",
  "scope": {
    "chain": "ethereum",
    "bridge": "near_intents",
    "token": "usdc",
    "address": "0x204823d2995230ec1660512013c96d6f06bee3f8"
  },
  "score": 12.0,
  "max_severity": "medium",
  "mode_history": [
    {
      "ts": "2026-09-22T05:38:35Z",
      "mode": "normal",
      "capability": "flag_observation",
      "scope": {
        "chain": "ethereum",
        "bridge": "near_intents",
        "token": "usdc",
        "address": "0x204823d2995230ec1660512013c96d6f06bee3f8"
      },
      "reason": "1 observation(s)",
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:e5362e2bc825"
    }
  ],
  "recommended_actions": [],
  "alerts": [
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:e5362e2bc825",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-09-22T05:38:35Z",
      "tx": "0x703a200c25cb9e35f85a1b04adec2e58f4ff87abf9b0a23c9154f1b771046ef7"
    },
    {
      "alert_id": "R3_TEST_THEN_DRAIN:dd5294d5fb37",
      "rule": "R3_TEST_THEN_DRAIN",
      "severity": "medium",
      "ts": "2026-09-22T09:33:59Z",
      "tx": "0x8d48c34355914adae306e9a77a23425d4bb725877df498d94a59fc8e89abf801"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:074cc5f86716",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-09-22T13:42:47Z",
      "tx": "0xc4072c7c8dfcab12f291adaf674a5c9a8241fcffbff0d5c760ad1933dd2cbdd7"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:7b71eacd6630",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-09-22T17:05:35Z",
      "tx": "0x3a86bc269b4550d5b58476150a7beab3c95f1e010aa72fbab8b1ac3b4a6a8de9"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:ad6b88f4e288",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-09-22T18:11:35Z",
      "tx": "0x4eb5ad3e8dff33bde98d68df107962a715f544ce8473fe8ee18b1588c0b522c9"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:b64b73445aab",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-09-23T01:04:35Z",
      "tx": "0xf78874abb3b7e32a114274c8edeb34bb54d32f3cc42a81781e8915279f92d79c"
    },
    {
      "alert_id": "R10_RECIPIENT_PAYOUT_BURST:b5fbab4a500a",
      "rule": "R10_RECIPIENT_PAYOUT_BURST",
      "severity": "medium",
      "ts": "2026-09-23T18:17:11Z",
      "tx": "0x2d19e32fda4a438637486a54271e4b3930df17868ebd367128f047eda28e9f0c"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:699dc7428abc",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-09-24T09:48:23Z",
      "tx": "0x691f936e904859c6df98e34bbef2931737b0bb0d3527fdfdd068ddbe37b8388a"
    }
  ],
  "summary": "8 alerts (R10_RECIPIENT_PAYOUT_BURST, R3_TEST_THEN_DRAIN, R5_NEW_RECIPIENT_LARGE_PAYOUT) on ethereum; opened 2026-09-22T05:38:35Z by R5_NEW_RECIPIENT_LARGE_PAYOUT; mode normal; 8 flagged stablecoin payouts totalling 3,953,034.04 USD."
}

normal IW-20260917-192747-3d017b medium 6 alerts · score 9.0 · Ethereum · opened 2026-09-17 19:27:47 UTC · active 1h 33m show ▾hide ▴

normal

09-17 19:27

paranoid

under attack

Recommended capability: flag_observation
Scope: chain: ethereumbridge: near_intentstoken: usdtaddress: 0x736278d9...6c08
Opened by: R5_NEW_RECIPIENT_LARGE_PAYOUT
Flagged stablecoin payouts: 5 totalling 3,156,409.04 USD

On-chain record below paranoid

Only incidents at paranoid or above go on chain. Incident hash 4cc300484fe8902d...26c0.

Model-written summary none recorded

Summaries are written for incidents at paranoid or above.

Rules in this incident

8R5_NEW_RECIPIENT_LARGE_PAYOUT×58R10_RECIPIENT_PAYOUT_BURST×1

Mode changes and actions click a row for the alerts that led to it

Time (UTC)	Change	Reason
2026-09-17 19:27:47	normal	1 observation(s)

Raw incident JSON (alert evidence omitted: see Events, or incidents.jsonl)

{
  "schema": "intentwatch.incident/v1 (shield-compatible, unofficial)",
  "incident_id": "IW-20260917-192747-3d017b",
  "opened_at": "2026-09-17T19:27:47Z",
  "updated_at": "2026-09-17T21:00:47Z",
  "recommended_mode": "normal",
  "capability": "flag_observation",
  "scope": {
    "chain": "ethereum",
    "bridge": "near_intents",
    "token": "usdt",
    "address": "0x736278d93b31be6d30a78372410b507070a96c08"
  },
  "score": 9.0,
  "max_severity": "medium",
  "mode_history": [
    {
      "ts": "2026-09-17T19:27:47Z",
      "mode": "normal",
      "capability": "flag_observation",
      "scope": {
        "chain": "ethereum",
        "bridge": "near_intents",
        "token": "usdt",
        "address": "0x736278d93b31be6d30a78372410b507070a96c08"
      },
      "reason": "1 observation(s)",
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:c5e683614f37"
    }
  ],
  "recommended_actions": [],
  "alerts": [
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:c5e683614f37",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-09-17T19:27:47Z",
      "tx": "0x3d71b01186b27d9b2aadda9b06423154c2745e5be650d68676b3ca633cb77845"
    },
    {
      "alert_id": "R10_RECIPIENT_PAYOUT_BURST:2cd84824cddc",
      "rule": "R10_RECIPIENT_PAYOUT_BURST",
      "severity": "medium",
      "ts": "2026-09-17T19:52:11Z",
      "tx": "0x672f4c8455c3ca1c9c7ff0efd50e796fbf0d20470ca056b85d97ae0f15a64cbc"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:d6c78f1dfe36",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-09-17T19:52:11Z",
      "tx": "0x672f4c8455c3ca1c9c7ff0efd50e796fbf0d20470ca056b85d97ae0f15a64cbc"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:a7d0e9a54b61",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-09-17T20:07:35Z",
      "tx": "0xd4058e20b6ff9e15b1f396bb9ea9befe16d55aac8d34cc88b657209e41b6214b"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:c2c1879e62ee",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-09-17T20:28:11Z",
      "tx": "0x5870f04897eaafb3fdffd61d58e14cf2b1fd467412d5f8b1cafd92271f9f5d2a"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:84538cafb565",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-09-17T21:00:47Z",
      "tx": "0xe3898c92b0e3dadaab1bfdc58345a29abcf3b68d529621c099e4babcf399acf2"
    }
  ],
  "summary": "6 alerts (R10_RECIPIENT_PAYOUT_BURST, R5_NEW_RECIPIENT_LARGE_PAYOUT) on ethereum; opened 2026-09-17T19:27:47Z by R5_NEW_RECIPIENT_LARGE_PAYOUT; mode normal; 5 flagged stablecoin payouts totalling 3,156,409.04 USD."
}

normal IW-20260924-075011-d1a902 medium 6 alerts · score 9.0 · Ethereum · opened 2026-09-24 07:50:11 UTC · active 1h 51m show ▾hide ▴

normal

09-24 07:50

paranoid

under attack

Recommended capability: flag_observation
Scope: chain: ethereumbridge: near_intentstoken: usdtaddress: 0xb5428d02...1da7
Opened by: R5_NEW_RECIPIENT_LARGE_PAYOUT
Flagged stablecoin payouts: 4 totalling 2,841,797.90 USD

On-chain record below paranoid

Only incidents at paranoid or above go on chain. Incident hash 3c9c79337e002f3a...dceb.

Model-written summary none recorded

Summaries are written for incidents at paranoid or above.

Rules in this incident

8R5_NEW_RECIPIENT_LARGE_PAYOUT×48R3_TEST_THEN_DRAIN×2

Mode changes and actions click a row for the alerts that led to it

Time (UTC)	Change	Reason
2026-09-24 07:50:11	normal	1 observation(s)

Raw incident JSON (alert evidence omitted: see Events, or incidents.jsonl)

{
  "schema": "intentwatch.incident/v1 (shield-compatible, unofficial)",
  "incident_id": "IW-20260924-075011-d1a902",
  "opened_at": "2026-09-24T07:50:11Z",
  "updated_at": "2026-09-24T09:41:59Z",
  "recommended_mode": "normal",
  "capability": "flag_observation",
  "scope": {
    "chain": "ethereum",
    "bridge": "near_intents",
    "token": "usdt",
    "address": "0xb5428d020e9da0f9a5ebcf4c606352b9b6301da7"
  },
  "score": 9.0,
  "max_severity": "medium",
  "mode_history": [
    {
      "ts": "2026-09-24T07:50:11Z",
      "mode": "normal",
      "capability": "flag_observation",
      "scope": {
        "chain": "ethereum",
        "bridge": "near_intents",
        "token": "usdt",
        "address": "0xb5428d020e9da0f9a5ebcf4c606352b9b6301da7"
      },
      "reason": "1 observation(s)",
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:1e1cad6de945"
    }
  ],
  "recommended_actions": [],
  "alerts": [
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:1e1cad6de945",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-09-24T07:50:11Z",
      "tx": "0x40bc2f677153ffeb73ad5bbd9e7aa3d778b678316b2b33363d0231ef6573d64f"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:8095ff6f4e9e",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-09-24T08:26:47Z",
      "tx": "0x44da16c2d695fd7ff114136861b91e4e63ff56b18f4ce2ee6363a4694599f27a"
    },
    {
      "alert_id": "R3_TEST_THEN_DRAIN:cbe1fe60acac",
      "rule": "R3_TEST_THEN_DRAIN",
      "severity": "medium",
      "ts": "2026-09-24T09:15:23Z",
      "tx": "0x5d83f3612d349e6a265dedf4fe529dfb06e78521ccedc349394d9d4a30c1bece"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:f909d9cffeee",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-09-24T09:15:23Z",
      "tx": "0x5d83f3612d349e6a265dedf4fe529dfb06e78521ccedc349394d9d4a30c1bece"
    },
    {
      "alert_id": "R3_TEST_THEN_DRAIN:730bff2d8593",
      "rule": "R3_TEST_THEN_DRAIN",
      "severity": "medium",
      "ts": "2026-09-24T09:41:59Z",
      "tx": "0x1cb543d5653847638288b7022862cacd632a9655447aaa9f2467f94a9bae24d0"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:36a6ff6b0abf",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-09-24T09:41:59Z",
      "tx": "0x1cb543d5653847638288b7022862cacd632a9655447aaa9f2467f94a9bae24d0"
    }
  ],
  "summary": "6 alerts (R3_TEST_THEN_DRAIN, R5_NEW_RECIPIENT_LARGE_PAYOUT) on ethereum; opened 2026-09-24T07:50:11Z by R5_NEW_RECIPIENT_LARGE_PAYOUT; mode normal; 4 flagged stablecoin payouts totalling 2,841,797.90 USD."
}

normal IW-20260908-064447-5c19ed medium 5 alerts · score 7.5 · Ethereum · opened 2026-09-08 06:44:47 UTC · active 26h 52m show ▾hide ▴

normal

09-08 06:44

paranoid

under attack

Recommended capability: flag_observation
Scope: chain: ethereumbridge: near_intentstoken: usdcaddress: 0x09af2cee...8905
Opened by: R3_TEST_THEN_DRAIN
Flagged stablecoin payouts: 4 totalling 1,629,532.68 USD

On-chain record below paranoid

Only incidents at paranoid or above go on chain. Incident hash aa3a12d68585ff8d...9da4.

Model-written summary none recorded

Summaries are written for incidents at paranoid or above.

Rules in this incident

8R3_TEST_THEN_DRAIN×38R5_NEW_RECIPIENT_LARGE_PAYOUT×2

Mode changes and actions click a row for the alerts that led to it

Time (UTC)	Change	Reason
2026-09-08 06:44:47	normal	1 observation(s)

Raw incident JSON (alert evidence omitted: see Events, or incidents.jsonl)

{
  "schema": "intentwatch.incident/v1 (shield-compatible, unofficial)",
  "incident_id": "IW-20260908-064447-5c19ed",
  "opened_at": "2026-09-08T06:44:47Z",
  "updated_at": "2026-09-09T09:36:59Z",
  "recommended_mode": "normal",
  "capability": "flag_observation",
  "scope": {
    "chain": "ethereum",
    "bridge": "near_intents",
    "token": "usdc",
    "address": "0x09af2cee65fc69f8052eb4611fac428c9cd08905"
  },
  "score": 7.5,
  "max_severity": "medium",
  "mode_history": [
    {
      "ts": "2026-09-08T06:44:47Z",
      "mode": "normal",
      "capability": "flag_observation",
      "scope": {
        "chain": "ethereum",
        "bridge": "near_intents",
        "token": "usdc",
        "address": "0x09af2cee65fc69f8052eb4611fac428c9cd08905"
      },
      "reason": "1 observation(s)",
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:bdd247d4803b"
    }
  ],
  "recommended_actions": [],
  "alerts": [
    {
      "alert_id": "R3_TEST_THEN_DRAIN:aebc8d097be0",
      "rule": "R3_TEST_THEN_DRAIN",
      "severity": "medium",
      "ts": "2026-09-08T06:44:47Z",
      "tx": "0x7243937a98bf926553ce7d726cefbe32c688b1c9d7893a3d7e49dd3adecefc73"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:bdd247d4803b",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-09-08T06:44:47Z",
      "tx": "0x7243937a98bf926553ce7d726cefbe32c688b1c9d7893a3d7e49dd3adecefc73"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:26b8bc4f18cf",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-09-08T19:55:59Z",
      "tx": "0xb53547dc7a6c5a2750de1ce922994e28eede0072e83c231988fa0b1d23653154"
    },
    {
      "alert_id": "R3_TEST_THEN_DRAIN:64735b3998c3",
      "rule": "R3_TEST_THEN_DRAIN",
      "severity": "medium",
      "ts": "2026-09-08T20:34:11Z",
      "tx": "0xebf0706643ab349f235c19a4cdedb366671fd86993df0a5ed6a2d2c71fa7d3b2"
    },
    {
      "alert_id": "R3_TEST_THEN_DRAIN:17951721af07",
      "rule": "R3_TEST_THEN_DRAIN",
      "severity": "medium",
      "ts": "2026-09-09T09:36:59Z",
      "tx": "0xdfc30ad9228bc2a6ee5a8a25f212e0b1866ed6965a90c96a686d09e28270e210"
    }
  ],
  "summary": "5 alerts (R3_TEST_THEN_DRAIN, R5_NEW_RECIPIENT_LARGE_PAYOUT) on ethereum; opened 2026-09-08T06:44:47Z by R3_TEST_THEN_DRAIN; mode normal; 4 flagged stablecoin payouts totalling 1,629,532.68 USD."
}

normal IW-20260927-131347-c253a3 medium 4 alerts · score 6.0 · Ethereum · opened 2026-09-27 13:13:47 UTC · active 23h 54m show ▾hide ▴

normal

09-27 13:13

paranoid

under attack

Recommended capability: flag_observation
Scope: chain: ethereumbridge: near_intentstoken: usdtaddress: 0xc9379729...b6c7
Opened by: R3_TEST_THEN_DRAIN
Flagged stablecoin payouts: 4 totalling 1,458,284.62 USD

On-chain record below paranoid

Only incidents at paranoid or above go on chain. Incident hash 3d50979d7117a39a...c46d.

Model-written summary none recorded

Summaries are written for incidents at paranoid or above.

Rules in this incident

8R3_TEST_THEN_DRAIN×38R10_RECIPIENT_PAYOUT_BURST×1

Mode changes and actions click a row for the alerts that led to it

Time (UTC)	Change	Reason
2026-09-27 13:13:47	normal	1 observation(s)

Raw incident JSON (alert evidence omitted: see Events, or incidents.jsonl)

{
  "schema": "intentwatch.incident/v1 (shield-compatible, unofficial)",
  "incident_id": "IW-20260927-131347-c253a3",
  "opened_at": "2026-09-27T13:13:47Z",
  "updated_at": "2026-09-28T13:07:47Z",
  "recommended_mode": "normal",
  "capability": "flag_observation",
  "scope": {
    "chain": "ethereum",
    "bridge": "near_intents",
    "token": "usdt",
    "address": "0xc9379729b1e271bc65044ce0cab9ef3f2674b6c7"
  },
  "score": 6.0,
  "max_severity": "medium",
  "mode_history": [
    {
      "ts": "2026-09-27T13:13:47Z",
      "mode": "normal",
      "capability": "flag_observation",
      "scope": {
        "chain": "ethereum",
        "bridge": "near_intents",
        "token": "usdt",
        "address": "0xc9379729b1e271bc65044ce0cab9ef3f2674b6c7"
      },
      "reason": "1 observation(s)",
      "alert_id": "R3_TEST_THEN_DRAIN:78e62f82c2cc"
    }
  ],
  "recommended_actions": [],
  "alerts": [
    {
      "alert_id": "R3_TEST_THEN_DRAIN:78e62f82c2cc",
      "rule": "R3_TEST_THEN_DRAIN",
      "severity": "medium",
      "ts": "2026-09-27T13:13:47Z",
      "tx": "0xf3f6eda9262ac1fe4ba948bd7930673259a95e0d24bee4addae1fc1ac531a62e"
    },
    {
      "alert_id": "R3_TEST_THEN_DRAIN:21a50d5dfa6c",
      "rule": "R3_TEST_THEN_DRAIN",
      "severity": "medium",
      "ts": "2026-09-28T12:53:35Z",
      "tx": "0x37913a1e5488feed66f1a52afd0e0ef0e2b7d1e1f7b33d85900bb2c412aa40d1"
    },
    {
      "alert_id": "R3_TEST_THEN_DRAIN:8e71d0e2b7b6",
      "rule": "R3_TEST_THEN_DRAIN",
      "severity": "medium",
      "ts": "2026-09-28T13:02:35Z",
      "tx": "0x1c11e4635c75522dc551b47c0c5d1915da1fcadf87150a7b74349df831dafd75"
    },
    {
      "alert_id": "R10_RECIPIENT_PAYOUT_BURST:757575d35377",
      "rule": "R10_RECIPIENT_PAYOUT_BURST",
      "severity": "medium",
      "ts": "2026-09-28T13:07:47Z",
      "tx": "0xf32c6995510ae31261ecdd93bc208ade7c9737fd5ba532ac40611942911a49ce"
    }
  ],
  "summary": "4 alerts (R10_RECIPIENT_PAYOUT_BURST, R3_TEST_THEN_DRAIN) on ethereum; opened 2026-09-27T13:13:47Z by R3_TEST_THEN_DRAIN; mode normal; 4 flagged stablecoin payouts totalling 1,458,284.62 USD."
}

normal IW-20260913-114435-9afccc medium 3 alerts · score 4.5 · Ethereum · opened 2026-09-13 11:44:35 UTC · active 39h 10m show ▾hide ▴

normal

09-13 11:44

paranoid

under attack

Recommended capability: flag_observation
Scope: chain: ethereumbridge: near_intentstoken: usdtaddress: 0xc9379729...b6c7
Opened by: R3_TEST_THEN_DRAIN
Flagged stablecoin payouts: 3 totalling 1,556,826.39 USD

On-chain record below paranoid

Only incidents at paranoid or above go on chain. Incident hash e0dcd1bce7c34d37...63e4.

Model-written summary none recorded

Summaries are written for incidents at paranoid or above.

Rules in this incident

8R3_TEST_THEN_DRAIN×18R5_NEW_RECIPIENT_LARGE_PAYOUT×2

Mode changes and actions click a row for the alerts that led to it

Time (UTC)	Change	Reason
2026-09-13 11:44:35	normal	1 observation(s)

Raw incident JSON (alert evidence omitted: see Events, or incidents.jsonl)

{
  "schema": "intentwatch.incident/v1 (shield-compatible, unofficial)",
  "incident_id": "IW-20260913-114435-9afccc",
  "opened_at": "2026-09-13T11:44:35Z",
  "updated_at": "2026-09-15T02:55:23Z",
  "recommended_mode": "normal",
  "capability": "flag_observation",
  "scope": {
    "chain": "ethereum",
    "bridge": "near_intents",
    "token": "usdt",
    "address": "0xc9379729b1e271bc65044ce0cab9ef3f2674b6c7"
  },
  "score": 4.5,
  "max_severity": "medium",
  "mode_history": [
    {
      "ts": "2026-09-13T11:44:35Z",
      "mode": "normal",
      "capability": "flag_observation",
      "scope": {
        "chain": "ethereum",
        "bridge": "near_intents",
        "token": "usdt",
        "address": "0xc9379729b1e271bc65044ce0cab9ef3f2674b6c7"
      },
      "reason": "1 observation(s)",
      "alert_id": "R3_TEST_THEN_DRAIN:f47c9f85d9ad"
    }
  ],
  "recommended_actions": [],
  "alerts": [
    {
      "alert_id": "R3_TEST_THEN_DRAIN:f47c9f85d9ad",
      "rule": "R3_TEST_THEN_DRAIN",
      "severity": "medium",
      "ts": "2026-09-13T11:44:35Z",
      "tx": "0xd479c7e2e063ae8539c2ce41e3acb2700b78afd4c8c9bc2fe609de5cd83c67bb"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:a364870169be",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-09-14T07:01:23Z",
      "tx": "0xa92a8fb7a081b2870c10ed9dfafb1e28e8bf4e92bca0d7b57cf98789e942ab11"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:17d289d8c637",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-09-15T02:55:23Z",
      "tx": "0x0cc66c21793a5d8f1d45ad9cb981028e708675b2c7a91befb16dd9f03f8efcee"
    }
  ],
  "summary": "3 alerts (R3_TEST_THEN_DRAIN, R5_NEW_RECIPIENT_LARGE_PAYOUT) on ethereum; opened 2026-09-13T11:44:35Z by R3_TEST_THEN_DRAIN; mode normal; 3 flagged stablecoin payouts totalling 1,556,826.39 USD."
}

normal IW-20260915-192427-b77a68 medium 3 alerts · score 4.5 · BNB Chain · opened 2026-09-15 19:24:27 UTC · active 14h 21m show ▾hide ▴

normal

09-15 19:24

paranoid

under attack

Recommended capability: flag_observation
Scope: chain: bscbridge: hottoken: usdcaddress: 0x88bbcaee...e758
Opened by: R1_VAULT_PAYOUT_SPIKE
Flagged stablecoin payouts: 3 totalling 957,767.33 USD

On-chain record below paranoid

Only incidents at paranoid or above go on chain. Incident hash c37be115c740fa40...ee36.

Model-written summary none recorded

Summaries are written for incidents at paranoid or above.

Rules in this incident

8R1_VAULT_PAYOUT_SPIKE×3

Mode changes and actions click a row for the alerts that led to it

Time (UTC)	Change	Reason
2026-09-15 19:24:27	normal	1 observation(s)

Raw incident JSON (alert evidence omitted: see Events, or incidents.jsonl)

{
  "schema": "intentwatch.incident/v1 (shield-compatible, unofficial)",
  "incident_id": "IW-20260915-192427-b77a68",
  "opened_at": "2026-09-15T19:24:27Z",
  "updated_at": "2026-09-16T09:45:27Z",
  "recommended_mode": "normal",
  "capability": "flag_observation",
  "scope": {
    "chain": "bsc",
    "bridge": "hot",
    "token": "usdc",
    "address": "0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758"
  },
  "score": 4.5,
  "max_severity": "medium",
  "mode_history": [
    {
      "ts": "2026-09-15T19:24:27Z",
      "mode": "normal",
      "capability": "flag_observation",
      "scope": {
        "chain": "bsc",
        "bridge": "hot",
        "token": "usdc",
        "address": "0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758"
      },
      "reason": "1 observation(s)",
      "alert_id": "R1_VAULT_PAYOUT_SPIKE:b7327c951da2"
    }
  ],
  "recommended_actions": [],
  "alerts": [
    {
      "alert_id": "R1_VAULT_PAYOUT_SPIKE:b7327c951da2",
      "rule": "R1_VAULT_PAYOUT_SPIKE",
      "severity": "medium",
      "ts": "2026-09-15T19:24:27Z",
      "tx": "0x357bc160a1243835fe3d3d1e05798a675c2207726243fc0228f5090f03746245"
    },
    {
      "alert_id": "R1_VAULT_PAYOUT_SPIKE:ec0abad4b01e",
      "rule": "R1_VAULT_PAYOUT_SPIKE",
      "severity": "medium",
      "ts": "2026-09-15T20:06:21Z",
      "tx": "0x106eaa1773a97cefd74785cdcbf610b0b680db0a8efac36ee16a4f46b7c8895e"
    },
    {
      "alert_id": "R1_VAULT_PAYOUT_SPIKE:ef0bc0bc134d",
      "rule": "R1_VAULT_PAYOUT_SPIKE",
      "severity": "medium",
      "ts": "2026-09-16T09:45:27Z",
      "tx": "0xd97808f253d2dac6d6e0842b24f8f4a5a1ed17ac3125cbfe78f2441e942fd517"
    }
  ],
  "summary": "3 alerts (R1_VAULT_PAYOUT_SPIKE) on bsc; opened 2026-09-15T19:24:27Z by R1_VAULT_PAYOUT_SPIKE; mode normal; 3 flagged stablecoin payouts totalling 957,767.33 USD."
}

normal IW-20260914-125407-ee0088 medium 2 alerts · score 3.0 · BNB Chain · opened 2026-09-14 12:54:07 UTC · active 2h 12m show ▾hide ▴

normal

09-14 12:54

paranoid

under attack

Recommended capability: flag_observation
Scope: chain: bscbridge: hottoken: usdtaddress: 0x89fafcbb...d8ab
Opened by: R1_VAULT_PAYOUT_SPIKE
Flagged stablecoin payouts: 2 totalling 1,317,386.30 USD

On-chain record below paranoid

Only incidents at paranoid or above go on chain. Incident hash a9a7df33ecc2e117...47e6.

Model-written summary none recorded

Summaries are written for incidents at paranoid or above.

Rules in this incident

8R1_VAULT_PAYOUT_SPIKE×2

Mode changes and actions click a row for the alerts that led to it

Time (UTC)	Change	Reason
2026-09-14 12:54:07	normal	1 observation(s)

Raw incident JSON (alert evidence omitted: see Events, or incidents.jsonl)

{
  "schema": "intentwatch.incident/v1 (shield-compatible, unofficial)",
  "incident_id": "IW-20260914-125407-ee0088",
  "opened_at": "2026-09-14T12:54:07Z",
  "updated_at": "2026-09-14T15:06:22Z",
  "recommended_mode": "normal",
  "capability": "flag_observation",
  "scope": {
    "chain": "bsc",
    "bridge": "hot",
    "token": "usdt",
    "address": "0x89fafcbb10d4a6354a22fae1e8efca21f25bd8ab"
  },
  "score": 3.0,
  "max_severity": "medium",
  "mode_history": [
    {
      "ts": "2026-09-14T12:54:07Z",
      "mode": "normal",
      "capability": "flag_observation",
      "scope": {
        "chain": "bsc",
        "bridge": "hot",
        "token": "usdt",
        "address": "0x89fafcbb10d4a6354a22fae1e8efca21f25bd8ab"
      },
      "reason": "1 observation(s)",
      "alert_id": "R1_VAULT_PAYOUT_SPIKE:a7cef72888ac"
    }
  ],
  "recommended_actions": [],
  "alerts": [
    {
      "alert_id": "R1_VAULT_PAYOUT_SPIKE:a7cef72888ac",
      "rule": "R1_VAULT_PAYOUT_SPIKE",
      "severity": "medium",
      "ts": "2026-09-14T12:54:07Z",
      "tx": "0x3e90d7415965456e868a3599fcf1cdbbcf92ac9798afe05d75abe197a1743157"
    },
    {
      "alert_id": "R1_VAULT_PAYOUT_SPIKE:87b8552d5985",
      "rule": "R1_VAULT_PAYOUT_SPIKE",
      "severity": "medium",
      "ts": "2026-09-14T15:06:22Z",
      "tx": "0xffcccc649e69c9ece838cbd33974cb826667f85468485f79c2a54b2773793d18"
    }
  ],
  "summary": "2 alerts (R1_VAULT_PAYOUT_SPIKE) on bsc; opened 2026-09-14T12:54:07Z by R1_VAULT_PAYOUT_SPIKE; mode normal; 2 flagged stablecoin payouts totalling 1,317,386.30 USD."
}

normal IW-20260916-035511-ff9483 medium 2 alerts · score 3.0 · Ethereum · opened 2026-09-16 03:55:11 UTC · active 8h 16m show ▾hide ▴

normal

09-16 03:55

paranoid

under attack

Recommended capability: flag_observation
Scope: chain: ethereumbridge: near_intentstoken: usdtaddress: 0xe8e29f78...3192
Opened by: R5_NEW_RECIPIENT_LARGE_PAYOUT
Flagged stablecoin payouts: 2 totalling 1,132,466.94 USD

On-chain record below paranoid

Only incidents at paranoid or above go on chain. Incident hash af1ea067f92436d2...67a2.

Model-written summary none recorded

Summaries are written for incidents at paranoid or above.

Rules in this incident

8R5_NEW_RECIPIENT_LARGE_PAYOUT×2

Mode changes and actions click a row for the alerts that led to it

Time (UTC)	Change	Reason
2026-09-16 03:55:11	normal	1 observation(s)

Raw incident JSON (alert evidence omitted: see Events, or incidents.jsonl)

{
  "schema": "intentwatch.incident/v1 (shield-compatible, unofficial)",
  "incident_id": "IW-20260916-035511-ff9483",
  "opened_at": "2026-09-16T03:55:11Z",
  "updated_at": "2026-09-16T12:11:35Z",
  "recommended_mode": "normal",
  "capability": "flag_observation",
  "scope": {
    "chain": "ethereum",
    "bridge": "near_intents",
    "token": "usdt",
    "address": "0xe8e29f787f59499abff43a7bb18284feb8163192"
  },
  "score": 3.0,
  "max_severity": "medium",
  "mode_history": [
    {
      "ts": "2026-09-16T03:55:11Z",
      "mode": "normal",
      "capability": "flag_observation",
      "scope": {
        "chain": "ethereum",
        "bridge": "near_intents",
        "token": "usdt",
        "address": "0xe8e29f787f59499abff43a7bb18284feb8163192"
      },
      "reason": "1 observation(s)",
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:6909437813bf"
    }
  ],
  "recommended_actions": [],
  "alerts": [
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:6909437813bf",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-09-16T03:55:11Z",
      "tx": "0xd5ebcf0088a1acdbe318618d0e1cf284a16abe582e176ac828f244c113cc0927"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:faed75410ce3",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-09-16T12:11:35Z",
      "tx": "0x9ddd5e2d34790da4fd44922987048966216161e48e5abfb7943597a253feb58a"
    }
  ],
  "summary": "2 alerts (R5_NEW_RECIPIENT_LARGE_PAYOUT) on ethereum; opened 2026-09-16T03:55:11Z by R5_NEW_RECIPIENT_LARGE_PAYOUT; mode normal; 2 flagged stablecoin payouts totalling 1,132,466.94 USD."
}

normal IW-20260921-010835-576764 medium 2 alerts · score 3.0 · Ethereum · opened 2026-09-21 01:08:35 UTC · active 2h 59m show ▾hide ▴

normal

09-21 01:08

paranoid

under attack

Recommended capability: flag_observation
Scope: chain: ethereumbridge: near_intentstoken: usdcaddress: 0xe6ce6f6e...070a
Opened by: R5_NEW_RECIPIENT_LARGE_PAYOUT
Flagged stablecoin payouts: 2 totalling 1,414,787.06 USD

On-chain record below paranoid

Only incidents at paranoid or above go on chain. Incident hash 6e26244a575e94dc...b719.

Model-written summary none recorded

Summaries are written for incidents at paranoid or above.

Rules in this incident

8R5_NEW_RECIPIENT_LARGE_PAYOUT×2

Mode changes and actions click a row for the alerts that led to it

Time (UTC)	Change	Reason
2026-09-21 01:08:35	normal	1 observation(s)

Raw incident JSON (alert evidence omitted: see Events, or incidents.jsonl)

{
  "schema": "intentwatch.incident/v1 (shield-compatible, unofficial)",
  "incident_id": "IW-20260921-010835-576764",
  "opened_at": "2026-09-21T01:08:35Z",
  "updated_at": "2026-09-21T04:07:47Z",
  "recommended_mode": "normal",
  "capability": "flag_observation",
  "scope": {
    "chain": "ethereum",
    "bridge": "near_intents",
    "token": "usdc",
    "address": "0xe6ce6f6efaa103f12ccbf08cdec2f08f43f4070a"
  },
  "score": 3.0,
  "max_severity": "medium",
  "mode_history": [
    {
      "ts": "2026-09-21T01:08:35Z",
      "mode": "normal",
      "capability": "flag_observation",
      "scope": {
        "chain": "ethereum",
        "bridge": "near_intents",
        "token": "usdc",
        "address": "0xe6ce6f6efaa103f12ccbf08cdec2f08f43f4070a"
      },
      "reason": "1 observation(s)",
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:6b617e3156ae"
    }
  ],
  "recommended_actions": [],
  "alerts": [
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:6b617e3156ae",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-09-21T01:08:35Z",
      "tx": "0xf12e5dd71632d45d48302657e1da7afeb9e00374cc287f53eb0339230f116343"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:5d8159257faf",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-09-21T04:07:47Z",
      "tx": "0xda731411e4512f26a7eb7ebf3d88ea8abd5c4250e15e2b08949dd957e9f1a353"
    }
  ],
  "summary": "2 alerts (R5_NEW_RECIPIENT_LARGE_PAYOUT) on ethereum; opened 2026-09-21T01:08:35Z by R5_NEW_RECIPIENT_LARGE_PAYOUT; mode normal; 2 flagged stablecoin payouts totalling 1,414,787.06 USD."
}

normal IW-20260921-195035-398438 medium 2 alerts · score 3.0 · Ethereum · opened 2026-09-21 19:50:35 UTC · active 1h 33m show ▾hide ▴

normal

09-21 19:50

paranoid

under attack

Recommended capability: flag_observation
Scope: chain: ethereumbridge: near_intentstoken: usdtaddress: 0xd015d8d4...64a4
Opened by: R5_NEW_RECIPIENT_LARGE_PAYOUT
Flagged stablecoin payouts: 2 totalling 629,352.94 USD

On-chain record below paranoid

Only incidents at paranoid or above go on chain. Incident hash a918f5e4465c5fab...d31b.

Model-written summary none recorded

Summaries are written for incidents at paranoid or above.

Rules in this incident

8R5_NEW_RECIPIENT_LARGE_PAYOUT×18R3_TEST_THEN_DRAIN×1

Mode changes and actions click a row for the alerts that led to it

Time (UTC)	Change	Reason
2026-09-21 19:50:35	normal	1 observation(s)

Raw incident JSON (alert evidence omitted: see Events, or incidents.jsonl)

{
  "schema": "intentwatch.incident/v1 (shield-compatible, unofficial)",
  "incident_id": "IW-20260921-195035-398438",
  "opened_at": "2026-09-21T19:50:35Z",
  "updated_at": "2026-09-21T21:23:59Z",
  "recommended_mode": "normal",
  "capability": "flag_observation",
  "scope": {
    "chain": "ethereum",
    "bridge": "near_intents",
    "token": "usdt",
    "address": "0xd015d8d4f36d98039881bbc9e8457137775964a4"
  },
  "score": 3.0,
  "max_severity": "medium",
  "mode_history": [
    {
      "ts": "2026-09-21T19:50:35Z",
      "mode": "normal",
      "capability": "flag_observation",
      "scope": {
        "chain": "ethereum",
        "bridge": "near_intents",
        "token": "usdt",
        "address": "0xd015d8d4f36d98039881bbc9e8457137775964a4"
      },
      "reason": "1 observation(s)",
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:48e66bd2ad34"
    }
  ],
  "recommended_actions": [],
  "alerts": [
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:48e66bd2ad34",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-09-21T19:50:35Z",
      "tx": "0x447f7c570381a1c58a35334a535c86b777ed167d6f31a31c5f9a8daeb0430be1"
    },
    {
      "alert_id": "R3_TEST_THEN_DRAIN:bf4efd0f6383",
      "rule": "R3_TEST_THEN_DRAIN",
      "severity": "medium",
      "ts": "2026-09-21T21:23:59Z",
      "tx": "0x6ff1a9e51f59fcb3592377e51a434cdd8779e69f2bf18514d0b72ef9f3838817"
    }
  ],
  "summary": "2 alerts (R3_TEST_THEN_DRAIN, R5_NEW_RECIPIENT_LARGE_PAYOUT) on ethereum; opened 2026-09-21T19:50:35Z by R5_NEW_RECIPIENT_LARGE_PAYOUT; mode normal; 2 flagged stablecoin payouts totalling 629,352.94 USD."
}

normal IW-20260911-085923-2245bf medium 1 alert · score 1.5 · Ethereum · opened 2026-09-11 08:59:23 UTC · active 0s show ▾hide ▴

normal

09-11 08:59

paranoid

under attack

Recommended capability: flag_observation
Scope: chain: ethereumbridge: near_intentstoken: usdcaddress: 0x68c599e5...7f51
Opened by: R5_NEW_RECIPIENT_LARGE_PAYOUT
Flagged stablecoin payouts: 1 totalling 586,360.55 USD

On-chain record below paranoid

Only incidents at paranoid or above go on chain. Incident hash 8397a95db49fda6d...2d0d.

Model-written summary none recorded

Summaries are written for incidents at paranoid or above.

Rules in this incident

8R5_NEW_RECIPIENT_LARGE_PAYOUT×1

Mode changes and actions click a row for the alerts that led to it

Time (UTC)	Change	Reason
2026-09-11 08:59:23	normal	1 observation(s)

Raw incident JSON (alert evidence omitted: see Events, or incidents.jsonl)

{
  "schema": "intentwatch.incident/v1 (shield-compatible, unofficial)",
  "incident_id": "IW-20260911-085923-2245bf",
  "opened_at": "2026-09-11T08:59:23Z",
  "updated_at": "2026-09-11T08:59:23Z",
  "recommended_mode": "normal",
  "capability": "flag_observation",
  "scope": {
    "chain": "ethereum",
    "bridge": "near_intents",
    "token": "usdc",
    "address": "0x68c599e571cb3b5d593afd67a757493109557f51"
  },
  "score": 1.5,
  "max_severity": "medium",
  "mode_history": [
    {
      "ts": "2026-09-11T08:59:23Z",
      "mode": "normal",
      "capability": "flag_observation",
      "scope": {
        "chain": "ethereum",
        "bridge": "near_intents",
        "token": "usdc",
        "address": "0x68c599e571cb3b5d593afd67a757493109557f51"
      },
      "reason": "1 observation(s)",
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:47b0de91734a"
    }
  ],
  "recommended_actions": [],
  "alerts": [
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:47b0de91734a",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-09-11T08:59:23Z",
      "tx": "0x8636d3f8e8d8ee8c9772d60621bc82b86aa0eaf4f352c3cb0ddc83699fb7c903"
    }
  ],
  "summary": "1 alerts (R5_NEW_RECIPIENT_LARGE_PAYOUT) on ethereum; opened 2026-09-11T08:59:23Z by R5_NEW_RECIPIENT_LARGE_PAYOUT; mode normal; 1 flagged stablecoin payouts totalling 586,360.55 USD."
}

normal IW-20260911-235547-21ef02 medium 1 alert · score 1.5 · Ethereum · opened 2026-09-11 23:55:47 UTC · active 0s show ▾hide ▴

normal

09-11 23:55

paranoid

under attack

Recommended capability: flag_observation
Scope: chain: ethereumbridge: near_intentstoken: usdtaddress: 0x95646676...be68
Opened by: R5_NEW_RECIPIENT_LARGE_PAYOUT
Flagged stablecoin payouts: 1 totalling 663,389.73 USD

On-chain record below paranoid

Only incidents at paranoid or above go on chain. Incident hash 33a6aafc6975f891...aab9.

Model-written summary none recorded

Summaries are written for incidents at paranoid or above.

Rules in this incident

8R5_NEW_RECIPIENT_LARGE_PAYOUT×1

Mode changes and actions click a row for the alerts that led to it

Time (UTC)	Change	Reason
2026-09-11 23:55:47	normal	1 observation(s)

Raw incident JSON (alert evidence omitted: see Events, or incidents.jsonl)

{
  "schema": "intentwatch.incident/v1 (shield-compatible, unofficial)",
  "incident_id": "IW-20260911-235547-21ef02",
  "opened_at": "2026-09-11T23:55:47Z",
  "updated_at": "2026-09-11T23:55:47Z",
  "recommended_mode": "normal",
  "capability": "flag_observation",
  "scope": {
    "chain": "ethereum",
    "bridge": "near_intents",
    "token": "usdt",
    "address": "0x956466762d6089316923121e3cbc4947a623be68"
  },
  "score": 1.5,
  "max_severity": "medium",
  "mode_history": [
    {
      "ts": "2026-09-11T23:55:47Z",
      "mode": "normal",
      "capability": "flag_observation",
      "scope": {
        "chain": "ethereum",
        "bridge": "near_intents",
        "token": "usdt",
        "address": "0x956466762d6089316923121e3cbc4947a623be68"
      },
      "reason": "1 observation(s)",
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:86ef7a5506e3"
    }
  ],
  "recommended_actions": [],
  "alerts": [
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:86ef7a5506e3",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-09-11T23:55:47Z",
      "tx": "0x0f9b59bcdbb239ae6bc7996b38f9f3190673f4e6d38b0898283a3d396444d6c5"
    }
  ],
  "summary": "1 alerts (R5_NEW_RECIPIENT_LARGE_PAYOUT) on ethereum; opened 2026-09-11T23:55:47Z by R5_NEW_RECIPIENT_LARGE_PAYOUT; mode normal; 1 flagged stablecoin payouts totalling 663,389.73 USD."
}

normal IW-20260912-190235-f67dea medium 1 alert · score 1.5 · Ethereum · opened 2026-09-12 19:02:35 UTC · active 0s show ▾hide ▴

normal

09-12 19:02

paranoid

under attack

Recommended capability: flag_observation
Scope: chain: ethereumbridge: near_intentstoken: usdcaddress: 0x88fadcfc...cd10
Opened by: R5_NEW_RECIPIENT_LARGE_PAYOUT
Flagged stablecoin payouts: 1 totalling 721,120.62 USD

On-chain record below paranoid

Only incidents at paranoid or above go on chain. Incident hash bfa04e0bb261120f...92d6.

Model-written summary none recorded

Summaries are written for incidents at paranoid or above.

Rules in this incident

8R5_NEW_RECIPIENT_LARGE_PAYOUT×1

Mode changes and actions click a row for the alerts that led to it

Time (UTC)	Change	Reason
2026-09-12 19:02:35	normal	1 observation(s)

Raw incident JSON (alert evidence omitted: see Events, or incidents.jsonl)

{
  "schema": "intentwatch.incident/v1 (shield-compatible, unofficial)",
  "incident_id": "IW-20260912-190235-f67dea",
  "opened_at": "2026-09-12T19:02:35Z",
  "updated_at": "2026-09-12T19:02:35Z",
  "recommended_mode": "normal",
  "capability": "flag_observation",
  "scope": {
    "chain": "ethereum",
    "bridge": "near_intents",
    "token": "usdc",
    "address": "0x88fadcfce0264e48dbc399209a1d11352d22cd10"
  },
  "score": 1.5,
  "max_severity": "medium",
  "mode_history": [
    {
      "ts": "2026-09-12T19:02:35Z",
      "mode": "normal",
      "capability": "flag_observation",
      "scope": {
        "chain": "ethereum",
        "bridge": "near_intents",
        "token": "usdc",
        "address": "0x88fadcfce0264e48dbc399209a1d11352d22cd10"
      },
      "reason": "1 observation(s)",
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:b67cb5e8983c"
    }
  ],
  "recommended_actions": [],
  "alerts": [
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:b67cb5e8983c",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-09-12T19:02:35Z",
      "tx": "0x553b38c33f093bfe74186bd0796a080f8956fa2c4eb2eb0ae63362f7b2727094"
    }
  ],
  "summary": "1 alerts (R5_NEW_RECIPIENT_LARGE_PAYOUT) on ethereum; opened 2026-09-12T19:02:35Z by R5_NEW_RECIPIENT_LARGE_PAYOUT; mode normal; 1 flagged stablecoin payouts totalling 721,120.62 USD."
}

normal IW-20260914-215835-3f4497 medium 1 alert · score 1.5 · Ethereum · opened 2026-09-14 21:58:35 UTC · active 0s show ▾hide ▴

normal

09-14 21:58

paranoid

under attack

Recommended capability: flag_observation
Scope: chain: ethereumbridge: near_intentstoken: usdcaddress: 0xd3ad516e...a6ae
Opened by: R5_NEW_RECIPIENT_LARGE_PAYOUT
Flagged stablecoin payouts: 1 totalling 582,222.52 USD

On-chain record below paranoid

Only incidents at paranoid or above go on chain. Incident hash 5c404e115715cb2d...13f6.

Model-written summary none recorded

Summaries are written for incidents at paranoid or above.

Rules in this incident

8R5_NEW_RECIPIENT_LARGE_PAYOUT×1

Mode changes and actions click a row for the alerts that led to it

Time (UTC)	Change	Reason
2026-09-14 21:58:35	normal	1 observation(s)

Raw incident JSON (alert evidence omitted: see Events, or incidents.jsonl)

{
  "schema": "intentwatch.incident/v1 (shield-compatible, unofficial)",
  "incident_id": "IW-20260914-215835-3f4497",
  "opened_at": "2026-09-14T21:58:35Z",
  "updated_at": "2026-09-14T21:58:35Z",
  "recommended_mode": "normal",
  "capability": "flag_observation",
  "scope": {
    "chain": "ethereum",
    "bridge": "near_intents",
    "token": "usdc",
    "address": "0xd3ad516ed8963179c6160c73109c969bcccba6ae"
  },
  "score": 1.5,
  "max_severity": "medium",
  "mode_history": [
    {
      "ts": "2026-09-14T21:58:35Z",
      "mode": "normal",
      "capability": "flag_observation",
      "scope": {
        "chain": "ethereum",
        "bridge": "near_intents",
        "token": "usdc",
        "address": "0xd3ad516ed8963179c6160c73109c969bcccba6ae"
      },
      "reason": "1 observation(s)",
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:769db5343a28"
    }
  ],
  "recommended_actions": [],
  "alerts": [
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:769db5343a28",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-09-14T21:58:35Z",
      "tx": "0x310cba1ec2bbb3de946a9b32fe40bccc51ca472ad1d1374b0e7377611028fe70"
    }
  ],
  "summary": "1 alerts (R5_NEW_RECIPIENT_LARGE_PAYOUT) on ethereum; opened 2026-09-14T21:58:35Z by R5_NEW_RECIPIENT_LARGE_PAYOUT; mode normal; 1 flagged stablecoin payouts totalling 582,222.52 USD."
}

normal IW-20260918-180319-de5a20 medium 1 alert · score 1.5 · BNB Chain · opened 2026-09-18 18:03:19 UTC · active 0s show ▾hide ▴

normal

09-18 18:03

paranoid

under attack

Recommended capability: flag_observation
Scope: chain: bscbridge: hottoken: usdcaddress: 0x51aa68f9...758a
Opened by: R1_VAULT_PAYOUT_SPIKE
Flagged stablecoin payouts: 1 totalling 500,006.73 USD

On-chain record below paranoid

Only incidents at paranoid or above go on chain. Incident hash e7d0a870d917987b...b907.

Model-written summary none recorded

Summaries are written for incidents at paranoid or above.

Rules in this incident

8R1_VAULT_PAYOUT_SPIKE×1

Mode changes and actions click a row for the alerts that led to it

Time (UTC)	Change	Reason
2026-09-18 18:03:19	normal	1 observation(s)

Raw incident JSON (alert evidence omitted: see Events, or incidents.jsonl)

{
  "schema": "intentwatch.incident/v1 (shield-compatible, unofficial)",
  "incident_id": "IW-20260918-180319-de5a20",
  "opened_at": "2026-09-18T18:03:19Z",
  "updated_at": "2026-09-18T18:03:19Z",
  "recommended_mode": "normal",
  "capability": "flag_observation",
  "scope": {
    "chain": "bsc",
    "bridge": "hot",
    "token": "usdc",
    "address": "0x51aa68f9c5efe263fddcd28459e18d974258758a"
  },
  "score": 1.5,
  "max_severity": "medium",
  "mode_history": [
    {
      "ts": "2026-09-18T18:03:19Z",
      "mode": "normal",
      "capability": "flag_observation",
      "scope": {
        "chain": "bsc",
        "bridge": "hot",
        "token": "usdc",
        "address": "0x51aa68f9c5efe263fddcd28459e18d974258758a"
      },
      "reason": "1 observation(s)",
      "alert_id": "R1_VAULT_PAYOUT_SPIKE:1302ef8f58d1"
    }
  ],
  "recommended_actions": [],
  "alerts": [
    {
      "alert_id": "R1_VAULT_PAYOUT_SPIKE:1302ef8f58d1",
      "rule": "R1_VAULT_PAYOUT_SPIKE",
      "severity": "medium",
      "ts": "2026-09-18T18:03:19Z",
      "tx": "0xd1d9f7c71970f15eea562ec5cfc9d66090519e5467e9075b33e166a0ee9fd46e"
    }
  ],
  "summary": "1 alerts (R1_VAULT_PAYOUT_SPIKE) on bsc; opened 2026-09-18T18:03:19Z by R1_VAULT_PAYOUT_SPIKE; mode normal; 1 flagged stablecoin payouts totalling 500,006.73 USD."
}

normal IW-20260922-071522-e3a51a medium 1 alert · score 1.5 · BNB Chain · opened 2026-09-22 07:15:22 UTC · active 0s show ▾hide ▴

normal

09-22 07:15

paranoid

under attack

Recommended capability: flag_observation
Scope: chain: bscbridge: hottoken: usdtaddress: 0x88bbcaee...e758
Opened by: R1_VAULT_PAYOUT_SPIKE
Flagged stablecoin payouts: 1 totalling 452,609.76 USD

On-chain record below paranoid

Only incidents at paranoid or above go on chain. Incident hash 226638a8ce8fe80e...775a.

Model-written summary none recorded

Summaries are written for incidents at paranoid or above.

Rules in this incident

8R1_VAULT_PAYOUT_SPIKE×1

Mode changes and actions click a row for the alerts that led to it

Time (UTC)	Change	Reason
2026-09-22 07:15:22	normal	1 observation(s)

Raw incident JSON (alert evidence omitted: see Events, or incidents.jsonl)

{
  "schema": "intentwatch.incident/v1 (shield-compatible, unofficial)",
  "incident_id": "IW-20260922-071522-e3a51a",
  "opened_at": "2026-09-22T07:15:22Z",
  "updated_at": "2026-09-22T07:15:22Z",
  "recommended_mode": "normal",
  "capability": "flag_observation",
  "scope": {
    "chain": "bsc",
    "bridge": "hot",
    "token": "usdt",
    "address": "0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758"
  },
  "score": 1.5,
  "max_severity": "medium",
  "mode_history": [
    {
      "ts": "2026-09-22T07:15:22Z",
      "mode": "normal",
      "capability": "flag_observation",
      "scope": {
        "chain": "bsc",
        "bridge": "hot",
        "token": "usdt",
        "address": "0x88bbcaeeaf0dca4ad50e8aab9387cd78c60be758"
      },
      "reason": "1 observation(s)",
      "alert_id": "R1_VAULT_PAYOUT_SPIKE:129a5c89461e"
    }
  ],
  "recommended_actions": [],
  "alerts": [
    {
      "alert_id": "R1_VAULT_PAYOUT_SPIKE:129a5c89461e",
      "rule": "R1_VAULT_PAYOUT_SPIKE",
      "severity": "medium",
      "ts": "2026-09-22T07:15:22Z",
      "tx": "0xd3f45ae396ce597509daa97148e6eb6e48286e0f5efb36f3af630133454801f2"
    }
  ],
  "summary": "1 alerts (R1_VAULT_PAYOUT_SPIKE) on bsc; opened 2026-09-22T07:15:22Z by R1_VAULT_PAYOUT_SPIKE; mode normal; 1 flagged stablecoin payouts totalling 452,609.76 USD."
}

normal IW-20260925-123915-98e633 medium 1 alert · score 1.5 · BNB Chain · opened 2026-09-25 12:39:15 UTC · active 0s show ▾hide ▴

normal

09-25 12:39

paranoid

under attack

Recommended capability: flag_observation
Scope: chain: bscbridge: hottoken: usdcaddress: 0x5a8e12d1...c354
Opened by: R1_VAULT_PAYOUT_SPIKE
Flagged stablecoin payouts: 1 totalling 129,910.36 USD

On-chain record below paranoid

Only incidents at paranoid or above go on chain. Incident hash 5b4ec483ed27fb4a...ddc6.

Model-written summary none recorded

Summaries are written for incidents at paranoid or above.

Rules in this incident

8R1_VAULT_PAYOUT_SPIKE×1

Mode changes and actions click a row for the alerts that led to it

Time (UTC)	Change	Reason
2026-09-25 12:39:15	normal	1 observation(s)

Raw incident JSON (alert evidence omitted: see Events, or incidents.jsonl)

{
  "schema": "intentwatch.incident/v1 (shield-compatible, unofficial)",
  "incident_id": "IW-20260925-123915-98e633",
  "opened_at": "2026-09-25T12:39:15Z",
  "updated_at": "2026-09-25T12:39:15Z",
  "recommended_mode": "normal",
  "capability": "flag_observation",
  "scope": {
    "chain": "bsc",
    "bridge": "hot",
    "token": "usdc",
    "address": "0x5a8e12d1f7148886fe35f6fa04f5a2c2b60ac354"
  },
  "score": 1.5,
  "max_severity": "medium",
  "mode_history": [
    {
      "ts": "2026-09-25T12:39:15Z",
      "mode": "normal",
      "capability": "flag_observation",
      "scope": {
        "chain": "bsc",
        "bridge": "hot",
        "token": "usdc",
        "address": "0x5a8e12d1f7148886fe35f6fa04f5a2c2b60ac354"
      },
      "reason": "1 observation(s)",
      "alert_id": "R1_VAULT_PAYOUT_SPIKE:b85e619b8840"
    }
  ],
  "recommended_actions": [],
  "alerts": [
    {
      "alert_id": "R1_VAULT_PAYOUT_SPIKE:b85e619b8840",
      "rule": "R1_VAULT_PAYOUT_SPIKE",
      "severity": "medium",
      "ts": "2026-09-25T12:39:15Z",
      "tx": "0x5639d2a3e563f0bd28a00d30d39e69857a9ca4dfd84c7bbb92d43f88d8d8243f"
    }
  ],
  "summary": "1 alerts (R1_VAULT_PAYOUT_SPIKE) on bsc; opened 2026-09-25T12:39:15Z by R1_VAULT_PAYOUT_SPIKE; mode normal; 1 flagged stablecoin payouts totalling 129,910.36 USD."
}

normal IW-20260925-132423-477747 medium 1 alert · score 1.5 · Ethereum · opened 2026-09-25 13:24:23 UTC · active 0s show ▾hide ▴

normal

09-25 13:24

paranoid

under attack

Recommended capability: flag_observation
Scope: chain: ethereumbridge: near_intentstoken: usdcaddress: 0x30ccf020...dbb2
Opened by: R5_NEW_RECIPIENT_LARGE_PAYOUT
Flagged stablecoin payouts: 1 totalling 796,054.47 USD

On-chain record below paranoid

Only incidents at paranoid or above go on chain. Incident hash df4b802b1c206d3f...b540.

Model-written summary none recorded

Summaries are written for incidents at paranoid or above.

Rules in this incident

8R5_NEW_RECIPIENT_LARGE_PAYOUT×1

Mode changes and actions click a row for the alerts that led to it

Time (UTC)	Change	Reason
2026-09-25 13:24:23	normal	1 observation(s)

Raw incident JSON (alert evidence omitted: see Events, or incidents.jsonl)

{
  "schema": "intentwatch.incident/v1 (shield-compatible, unofficial)",
  "incident_id": "IW-20260925-132423-477747",
  "opened_at": "2026-09-25T13:24:23Z",
  "updated_at": "2026-09-25T13:24:23Z",
  "recommended_mode": "normal",
  "capability": "flag_observation",
  "scope": {
    "chain": "ethereum",
    "bridge": "near_intents",
    "token": "usdc",
    "address": "0x30ccf020619a9d2bb1e7477a353f90f4144fdbb2"
  },
  "score": 1.5,
  "max_severity": "medium",
  "mode_history": [
    {
      "ts": "2026-09-25T13:24:23Z",
      "mode": "normal",
      "capability": "flag_observation",
      "scope": {
        "chain": "ethereum",
        "bridge": "near_intents",
        "token": "usdc",
        "address": "0x30ccf020619a9d2bb1e7477a353f90f4144fdbb2"
      },
      "reason": "1 observation(s)",
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:9b71b323d63a"
    }
  ],
  "recommended_actions": [],
  "alerts": [
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:9b71b323d63a",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-09-25T13:24:23Z",
      "tx": "0x746a9d36c635e9571d4f479c3f4b7a1bba5666b6d32b264eb66c24b4c1cc48ac"
    }
  ],
  "summary": "1 alerts (R5_NEW_RECIPIENT_LARGE_PAYOUT) on ethereum; opened 2026-09-25T13:24:23Z by R5_NEW_RECIPIENT_LARGE_PAYOUT; mode normal; 1 flagged stablecoin payouts totalling 796,054.47 USD."
}

normal IW-20260926-133306-401654 medium 1 alert · score 1.5 · BNB Chain · opened 2026-09-26 13:33:06 UTC · active 0s show ▾hide ▴

normal

09-26 13:33

paranoid

under attack

Recommended capability: flag_observation
Scope: chain: bscbridge: hottoken: usdtaddress: 0x1e7083a4...1423
Opened by: R1_VAULT_PAYOUT_SPIKE
Flagged stablecoin payouts: 1 totalling 495,952.55 USD

On-chain record below paranoid

Only incidents at paranoid or above go on chain. Incident hash 488abd2fd0265fd7...4639.

Model-written summary none recorded

Summaries are written for incidents at paranoid or above.

Rules in this incident

8R1_VAULT_PAYOUT_SPIKE×1

Mode changes and actions click a row for the alerts that led to it

Time (UTC)	Change	Reason
2026-09-26 13:33:06	normal	1 observation(s)

Raw incident JSON (alert evidence omitted: see Events, or incidents.jsonl)

{
  "schema": "intentwatch.incident/v1 (shield-compatible, unofficial)",
  "incident_id": "IW-20260926-133306-401654",
  "opened_at": "2026-09-26T13:33:06Z",
  "updated_at": "2026-09-26T13:33:06Z",
  "recommended_mode": "normal",
  "capability": "flag_observation",
  "scope": {
    "chain": "bsc",
    "bridge": "hot",
    "token": "usdt",
    "address": "0x1e7083a4ef19efbbaad4512745e045ac36321423"
  },
  "score": 1.5,
  "max_severity": "medium",
  "mode_history": [
    {
      "ts": "2026-09-26T13:33:06Z",
      "mode": "normal",
      "capability": "flag_observation",
      "scope": {
        "chain": "bsc",
        "bridge": "hot",
        "token": "usdt",
        "address": "0x1e7083a4ef19efbbaad4512745e045ac36321423"
      },
      "reason": "1 observation(s)",
      "alert_id": "R1_VAULT_PAYOUT_SPIKE:ad32998ce62b"
    }
  ],
  "recommended_actions": [],
  "alerts": [
    {
      "alert_id": "R1_VAULT_PAYOUT_SPIKE:ad32998ce62b",
      "rule": "R1_VAULT_PAYOUT_SPIKE",
      "severity": "medium",
      "ts": "2026-09-26T13:33:06Z",
      "tx": "0x09288cdd4bad1a9774ccc432ea25f335a659ce115532f5fd8ff903d540bc62aa"
    }
  ],
  "summary": "1 alerts (R1_VAULT_PAYOUT_SPIKE) on bsc; opened 2026-09-26T13:33:06Z by R1_VAULT_PAYOUT_SPIKE; mode normal; 1 flagged stablecoin payouts totalling 495,952.55 USD."
}

normal IW-20260928-141311-dbbf2e medium 1 alert · score 1.5 · Ethereum · opened 2026-09-28 14:13:11 UTC · active 0s show ▾hide ▴

normal

09-28 14:13

paranoid

under attack

Recommended capability: flag_observation
Scope: chain: ethereumbridge: near_intentstoken: usdcaddress: 0xbaba6d20...e8d0
Opened by: R3_TEST_THEN_DRAIN
Flagged stablecoin payouts: 1 totalling 104,948.05 USD

On-chain record below paranoid

Only incidents at paranoid or above go on chain. Incident hash 0ba74a67659ef0c7...13fd.

Model-written summary none recorded

Summaries are written for incidents at paranoid or above.

Rules in this incident

8R3_TEST_THEN_DRAIN×1

Mode changes and actions click a row for the alerts that led to it

Time (UTC)	Change	Reason
2026-09-28 14:13:11	normal	1 observation(s)

Raw incident JSON (alert evidence omitted: see Events, or incidents.jsonl)

{
  "schema": "intentwatch.incident/v1 (shield-compatible, unofficial)",
  "incident_id": "IW-20260928-141311-dbbf2e",
  "opened_at": "2026-09-28T14:13:11Z",
  "updated_at": "2026-09-28T14:13:11Z",
  "recommended_mode": "normal",
  "capability": "flag_observation",
  "scope": {
    "chain": "ethereum",
    "bridge": "near_intents",
    "token": "usdc",
    "address": "0xbaba6d208770bd3b9b8d061f00c91d403415e8d0"
  },
  "score": 1.5,
  "max_severity": "medium",
  "mode_history": [
    {
      "ts": "2026-09-28T14:13:11Z",
      "mode": "normal",
      "capability": "flag_observation",
      "scope": {
        "chain": "ethereum",
        "bridge": "near_intents",
        "token": "usdc",
        "address": "0xbaba6d208770bd3b9b8d061f00c91d403415e8d0"
      },
      "reason": "1 observation(s)",
      "alert_id": "R3_TEST_THEN_DRAIN:f7f07ada961e"
    }
  ],
  "recommended_actions": [],
  "alerts": [
    {
      "alert_id": "R3_TEST_THEN_DRAIN:f7f07ada961e",
      "rule": "R3_TEST_THEN_DRAIN",
      "severity": "medium",
      "ts": "2026-09-28T14:13:11Z",
      "tx": "0xe5f387c869d0d86413a30e940532670633d7e460a935d9531ccd637d25e9d598"
    }
  ],
  "summary": "1 alerts (R3_TEST_THEN_DRAIN) on ethereum; opened 2026-09-28T14:13:11Z by R3_TEST_THEN_DRAIN; mode normal; 1 flagged stablecoin payouts totalling 104,948.05 USD."
}

Rules

Ruleset config/rules + local/rules; YAML, explainable and deterministic; click a rule for its logic

Level	Rule	Description	Stage	Groups	In window	Baseline / day
8	R1_VAULT_PAYOUT_SPIKER1_vault_payout_spike.yaml	Treasury payout far above recent maximumA single stablecoin payout from a bridge treasury is more than `factor` times the largest payout of the same (chain, vault, token) over the trailing 48h. Payouts that fired this rule are kept out of the baseline, so a drain cannot raise its own threshold. On the September BNB Chain baseline this fired ~1/day, mostly for recurring large recipients (ratios 2.05-6.1x, W1 was 2.38x), so it is medium on its own; R1B escalates spikes to new recipients.	Treasury drain	evmtreasurypayoutspike	18	0.857
{ "source": "evm.erc20_transfer", "match": { "kind": "payout", "vault": [ "hot_bridge", "near_intents" ], "symbol": [ "usdt", "usdc" ] }, "condition": { "type": "ratio_to_rolling_max", "group_by": [ "chain", "vault", "token" ], "window": "48h", "factor": 2.0, "min_value": 50000, "value_field": "amount_usd" }, "shield": { "capability": "flag_observation", "scope": [ "chain", "bridge", "token" ] } }
12	R1B_PAYOUT_SPIKE_TO_NEW_RECIPIENTR1_vault_payout_spike.yaml	Treasury payout spike to a recipient first seen less than 7 days agoComposite (Wazuh-style): R1 (payout > 2x the 48h max) and R5 (recipient first seen < 7 days ago, payout > $500K) fire on the same payout.	Treasury drain	evmtreasurypayoutspikecomposite	1	0.048
{ "source": "evm.*", "match": { "kind": "payout" }, "if_all": [ "R1_VAULT_PAYOUT_SPIKE", "R5_NEW_RECIPIENT_LARGE_PAYOUT" ], "shield": { "mode": "paranoid", "capability": "raise_mode", "scope": [ "chain", "bridge", "token", "address" ] } }
12	R2_VAULT_OUTFLOW_VELOCITYR2_vault_outflow_velocity.yaml (rate rule: cannot escalate alone)	Treasury outflow velocity above its 7-day p99The trailing 1h stablecoin outflow of a (chain, vault, token) exceeds 2x the p99 of hourly outflow over the trailing 7 days (empty hours count as zero), and at least $1M. Throttled to one alert per hour per group. Velocity is about the treasury, so it never taints the recipient of the last payout. A rolling sum fires on the flow: its transaction is only where the sum crossed the line, so two alerts are one flow measured twice, and it cannot escalate alone.	Treasury drain	evmtreasurypayoutvelocity	2	0.095
{ "source": "evm.erc20_transfer", "match": { "kind": "payout", "vault": [ "hot_bridge", "near_intents" ], "symbol": [ "usdt", "usdc" ] }, "condition": { "type": "rolling_sum_vs_percentile", "group_by": [ "chain", "vault", "token" ], "window": "1h", "bucket": "1h", "baseline": "7d", "percentile": 99, "factor": 2.0, "min_value": 1000000, "min_buckets": 72, "value_field": "amount_usd" }, "ignore": "1h", "ignore_key": [ "chain", "vault", "token" ], "shield": { "mode": "paranoid", "capability": "raise_mode", "scope": [ "chain", "bridge", "token" ] } }
8	R3_TEST_THEN_DRAINR3_test_then_drain.yaml	Small test payout followed by a large payout to the same recipientThe same recipient gets at least one payout under $100 and then, within 24h, a payout over $100K from a treasury, and had at most 3 payouts in the 7 days before. Honest users test too: on the September Ethereum baseline this fired ~1/day even after excluding established counterparties, so it is medium on its own; R3B escalates it when the recipient also submitted the payout itself.	Treasury drain	evmtreasurypayoutsequence	19	0.905
{ "source": "evm.erc20_transfer", "match": { "kind": "payout", "vault": [ "hot_bridge", "near_intents" ], "symbol": [ "usdt", "usdc" ] }, "condition": { "type": "sequence", "group_by": [ "to_addr" ], "within": "24h", "max_prior": { "count": 3, "within": "7d" }, "steps": [ { "name": "test_payout", "match": { "amount_usd": { "lt": 100 } } }, { "name": "large_payout", "match": { "amount_usd": { "gt": 100000 } } } ] }, "shield": { "capability": "flag_observation", "scope": [ "address" ] } }
12	R3B_SELF_SUBMITTED_TEST_THEN_DRAINR3_test_then_drain.yaml	Test-then-drain payout that the recipient submitted itselfComposite (Wazuh-style): R3 and R4 fire on the same payout. A fresh recipient that tested with a small payout and then pulled a large one by submitting the payout tx itself.	Treasury drain	evmtreasurypayoutsequencecomposite	0	0.0
No alerts in this window. { "source": "evm.erc20_transfer", "match": { "kind": "payout" }, "if_all": [ "R3_TEST_THEN_DRAIN", "R4_SELF_SUBMITTED_LARGE_PAYOUT" ], "shield": { "mode": "paranoid", "capability": "raise_mode", "scope": [ "chain", "bridge", "token", "address" ] } }
5	R4_SELF_SUBMITTED_LARGE_PAYOUTR4_self_submitted_large_payout.yaml (score only)	Large payout submitted by its own recipientThe payout tx was sent by the recipient itself (tx.from == transfer.to) instead of a relayer. HOT's design allows self-submission, so this is a weak signal: score only, it never opens an incident by itself.	Treasury drain	evmtreasurypayoutsubmitter	0	0.0
No alerts in this window. { "source": "evm.erc20_transfer", "match": { "kind": "payout", "vault": [ "hot_bridge", "near_intents" ], "amount_usd": { "gt": 100000 }, "extra.tx_submitter": { "eq_field": "to_addr" } } }
8	R5_NEW_RECIPIENT_LARGE_PAYOUTR5_new_recipient_large_payout.yaml	Payout over $500K to a recipient first seen less than 7 days agoThe recipient's first interaction with any watched treasury (as sender or receiver, any chain) is less than 7 days old. Needs 7 days of observed history before it can fire.	Treasury drain	evmtreasurypayoutnew_address	41	1.952
{ "source": "evm.*", "match": { "kind": "payout", "vault": [ "hot_bridge", "near_intents" ], "amount_usd": { "gt": 500000 } }, "condition": { "type": "first_seen", "field": "to_addr", "track": [ "from_addr", "to_addr" ], "max_age": "7d", "observe": { "vault": { "exists": true } } }, "shield": { "capability": "flag_observation", "scope": [ "address" ] } }
12	R6_INTENTS_CALLBACK_ANOMALYR6_intents_callback_anomaly.yaml	Abnormal resolve callback or oversized event on intents.nearOn the Verifier contract: a failed resolve callback (e.g. mt_resolve_deposit), a log that was rejected for exceeding NEAR's 16,384-byte limit or is close to it, or a single event entry carrying more than 32 token/amount pairs.	Ledger tampering	nearverifiercallback	0	sample: 0
No alerts in this window. { "source": [ "near.receipt", "near.nep245", "near.dip4" ], "match": { "contract": "intents.near", "any": [ { "kind": "callback_failure", "extra.methods": { "regex": "resolve" } }, { "extra.rejected_log_size": { "gt": 15000 } }, { "extra.max_log_size": { "gt": 15000 } }, { "extra.n_token_pairs": { "gt": 32 } } ] }, "shield": { "mode": "paranoid", "capability": "raise_mode", "scope": [ "chain", "bridge", "token" ] } }
8	R6B_TOKEN_ID_LENGTH_OUTLIERR6B_token_id_length_outlier.yaml	Token id length above the p99.9 of observed Verifier eventsThe longest token id in a Verifier multi-token event is longer than 99.9% of token ids seen so far (needs 2,000 samples first). Unusually long ids inflate event logs.	Probing	nearverifiertoken_id	0	sample: 0
No alerts in this window. { "source": "near.nep245", "match": { "contract": "intents.near" }, "condition": { "type": "percentile_outlier", "field": "extra.max_token_id_len", "percentile": 99.9, "min_samples": 2000 } }
8	R6C_EXTREME_TOKEN_AMOUNTR6C_extreme_token_amount.yaml	Token amount near the u128 limit on intents.near or the HOT omni contractA multi-token event moves more than 2^120 raw units of one token (within 2^8 of u128::MAX). No real token supply comes close (wNEAR, with 24 decimals, has ~1.2e33 raw units in total), so such amounts are crafted values that probe overflow, accounting or log-size limits. One alert per token per day. Medium on its own: it says nothing about whether the value was credited.	Probing	nearverifieramount	0	sample: 0
No alerts in this window. { "source": "near.nep245", "match": { "contract": [ "intents.near", "v2_1.omni.hot.tg" ], "amount_raw": { "gt": 1329227995784915872903807060280344576 } }, "ignore": "24h", "ignore_key": [ "token" ], "shield": { "capability": "flag_observation", "scope": [ "chain", "bridge", "token" ] } }
12	R7_TAINTED_REENTRYR7_tainted_reentry.yaml	Address tainted by a flagged payout deposits into a treasuryAn address that received a payout flagged by R1B/R3B/R9B (or got funds from such an address, one hop) later deposits into any NEAR Intents / HOT treasury on any EVM chain.	Fund movement	evmtreasurydeposittaint	0	0.0
No alerts in this window. { "source": "evm.*", "match": { "kind": "deposit", "vault": { "exists": true } }, "condition": { "type": "tainted", "taint_from": [ "R1B_PAYOUT_SPIKE_TO_NEW_RECIPIENT", "R3B_SELF_SUBMITTED_TEST_THEN_DRAIN", "R9B_PAYOUT_FROM_FLAGGED_NEAR_ACCOUNT" ], "taint_field": "address", "hops": 1, "check": [ "from_addr" ] }, "shield": { "mode": "paranoid", "capability": "raise_mode", "scope": [ "chain", "bridge", "address" ] } }
12	R7B_TAINTED_PAYOUTR7_tainted_reentry.yaml	Treasury pays an address tainted by a flagged payout on another chain or vaultAfter R1B/R3B/R9B flag a payout, any other treasury (or the same treasury on another chain) pays that recipient. EVM addresses are the same across chains, so taint follows them.	Fund movement	evmtreasurypayouttaint	0	0.0
No alerts in this window. { "source": "evm.*", "match": { "kind": "payout", "vault": { "exists": true } }, "condition": { "type": "tainted", "taint_from": [ "R1B_PAYOUT_SPIKE_TO_NEW_RECIPIENT", "R3B_SELF_SUBMITTED_TEST_THEN_DRAIN", "R9B_PAYOUT_FROM_FLAGGED_NEAR_ACCOUNT" ], "taint_field": "address", "hops": 1, "check": [ "to_addr" ], "cross_only": true }, "shield": { "mode": "paranoid", "capability": "pause_destination", "scope": [ "address" ] } }
15	R8_DEPOSIT_LEDGER_MISMATCHR8_deposit_ledger_mismatch.yaml	Verifier credited a deposit that the token contract refundedShadow ledger at transaction granularity. For one NEAR tx and token, intents.near's internal balance change (mt_mint - mt_burn) must not exceed what it actually kept on the token contract (deposited - refunded). Evaluated when the token contract emits the refund.	Ledger tampering	nearverifierledger	0	sample: 0
No alerts in this window. { "source": "near.nep245", "condition": { "type": "deposit_ledger_mismatch", "verifier": "intents.near", "token_contracts": [ "v2_1.omni.hot.tg" ] }, "shield": { "mode": "under_attack", "capability": "raise_mode", "scope": [ "chain", "bridge", "token" ] } }
15	R8B_UNBACKED_CREDIT_WITHDRAWNR8_deposit_ledger_mismatch.yaml	Account withdraws from intents.near after receiving an unbacked creditFollow-up to R8. The Verifier accounts that received a credit the token contract refunded (R8 evidence `credited_accounts`), or an account they moved funds to inside the Verifier (one hop), withdraw from intents.near. This is the step where an unbacked balance leaves the Verifier, before any treasury on another chain pays it out.	Withdrawal	nearverifierledgerwithdrawaltaint	0	sample: 0
No alerts in this window. { "source": "near.nep245", "match": { "contract": "intents.near", "kind": "withdrawal", "status": "success" }, "condition": { "type": "tainted", "taint_from": [ "R8_DEPOSIT_LEDGER_MISMATCH" ], "taint_field": "evidence.credited_accounts", "hops": 1, "check": [ "from_addr" ], "observe": { "chain": "near", "contract": "intents.near" } }, "shield": { "mode": "under_attack", "capability": "raise_mode", "scope": [ "chain", "bridge", "token" ] } }
12	R9B_PAYOUT_FROM_FLAGGED_NEAR_ACCOUNTR9_withdrawal_link.yaml	Treasury payout authorized by a NEAR account that NEAR rules flaggedCross-chain link. A HOT treasury payout's calldata nonce equals the memo of the HOT omni mt_burn on NEAR that authorized it. If the NEAR account that burned was involved in an R6 or R8 alert (or received funds from such an account, one hop), the EVM payout inherits the flag and its recipient is tainted for R7 / R7B.	Treasury drain	evmtreasurypayoutxchain	0	sample: 0
No alerts in this window. { "source": [ "evm.erc20_transfer", "near.nep245", "near.dip4" ], "match": { "kind": "payout", "vault": "hot_bridge", "extra.withdraw_nonce": { "exists": true } }, "condition": { "type": "withdrawal_link", "mode": "tainted_origin", "taint_from": [ "R6_INTENTS_CALLBACK_ANOMALY", "R8_DEPOSIT_LEDGER_MISMATCH" ], "hops": 1 }, "shield": { "mode": "paranoid", "capability": "pause_destination", "scope": [ "address" ] } }
8	R10_RECIPIENT_PAYOUT_BURSTR10_recipient_payout_burst.yaml	Burst of large treasury payouts to one new counterpartyWazuh-style frequency rule: three or more stablecoin payouts over $250K from the same treasury to the same recipient within 2h, where the recipient had at most 3 such payouts in the 7 days before the burst. Regular counterparties of the NEAR Intents Ethereum treasury receive bursts like this every day; `max_prior` keeps those regular counterparties out. Splitting a drain into several payouts below the R1 / R5 thresholds still trips it. One alert per recipient per 6h.	Treasury drain	evmtreasurypayoutfrequency	3	0.143
{ "source": "evm.erc20_transfer", "match": { "kind": "payout", "vault": [ "hot_bridge", "near_intents" ], "symbol": [ "usdt", "usdc" ], "amount_usd": { "gt": 250000 } }, "condition": { "type": "frequency", "group_by": [ "chain", "vault", "to_addr" ], "count": 3, "within": "2h", "max_prior": { "count": 3, "within": "7d" } }, "ignore": "6h", "ignore_key": [ "chain", "vault", "to_addr" ], "shield": { "capability": "flag_observation", "scope": [ "chain", "bridge", "token", "address" ] } }
15	R9_UNMATCHED_HOT_PAYOUTR9_withdrawal_link.yaml (disabled)	HOT treasury payout without a matching NEAR burnReconciliation. Every HOT treasury payout should match a HOT omni mt_burn on NEAR with the same nonce, token and amount. Disabled by default: it needs complete NEAR coverage of the HOT omni contract (live mode). The replay holds sampled NEAR blocks, where most honest payouts would look unmatched.	Treasury drain	evmtreasurypayoutxchainreconciliation	0	-
No alerts in this window. { "source": [ "evm.erc20_transfer", "near.nep245" ], "match": { "kind": "payout", "vault": "hot_bridge", "extra.withdraw_nonce": { "exists": true } }, "condition": { "type": "withdrawal_link", "mode": "unmatched" }, "shield": { "mode": "under_attack", "capability": "raise_mode", "scope": [ "chain", "bridge", "token" ] } }
5	R100_ROUND_AMOUNT_PAYOUTR100_round_amount_payout.yaml (disabled) (score only)	Large payout of an exact round amountExample of a local extension. Exact round amounts above $100K are a weak signal; score only.	Treasury drain	localevmpayout	0	-
No alerts in this window. { "source": "evm.erc20_transfer", "match": { "kind": "payout", "vault": { "exists": true } }, "condition": { "type": "round_amount", "step": 100000, "min_value": 100000 } }

Baseline false positives 2026-09-08 to 2026-09-29, 21.0 days, same rules and thresholds, no known incident

Payouts in window

51,738

BNB Chain 11,482Ethereum 40,256

Alerts

all severities

High / critical per day

0.143

3 in total

Incidents opened

22 normal3 paranoid0 under attack

Escalated to under attack

the number that would pause a bridge

In sample: thresholds were tuned on this window with the incident replay at hand, and the rules were written from its post-mortem. See the out-of-sample scenario for data they never saw. Events in window: BNB Chain 23,700, Ethereum 40,256, NEAR 4,931.
NEAR rules have no rate here. They read 905 of about 2,974,233 NEAR blocks in this window (0.0304%, about 9.2 minutes of chain time), 798 from seeded random windows and the rest around known transactions: 558 Verifier transactions, 0 NEAR alerts. Zero alerts in so few blocks only bounds the rate below 0.54% of Verifier transactions, or about 469 alerts a day (95%, rule of three).
An ordinary payment, asked hourly: every route allow 100% of 504 hours.

Data & provenance

Fixtures recorded public chain data

129,358 normalized events replayed (whole replay window 01 Sep - 29 Sep 2026). Recorded 2026-10-26T18:32:21.957424Z with intentwatch fetch-fixtures --scenario oct1 into tests/fixtures/oct1.

Part	Range	Records
NEARblocks	68 anchor txs, 576 blocks	576
Manifest entry { "anchors": 68, "blocks": 576, "chain": "near", "kind": "blocks" }
Ethereumrange via etherscan	2026-09-01T00:00 → 2026-10-01T16:00 blocks 25878705-26098520 (out)	59,988
Manifest entry { "chain": "ethereum", "collector": "etherscan", "directions": [ "out" ], "from_block": 25878705, "from_ts": "2026-09-01T00:00:00Z", "kind": "range", "native": false, "records": 59988, "to_block": 26098520, "to_ts": "2026-10-01T16:00:00Z" }
Ethereumrange via etherscan	2026-09-30T12:00 → 2026-10-01T16:00 blocks 26090155-26098520 (in, native)	10,571
Manifest entry { "chain": "ethereum", "collector": "etherscan", "directions": [ "in" ], "from_block": 26090155, "from_ts": "2026-09-30T12:00:00Z", "kind": "range", "native": true, "records": 10571, "to_block": 26098520, "to_ts": "2026-10-01T16:00:00Z" }
Ethereumknown_txs	2 known txs	2
Manifest entry { "chain": "ethereum", "kind": "known_txs", "records": 2, "txs": 2 }
BNB Chainrange via evm_rpc	2026-09-01T00:00 → 2026-10-01T16:00 blocks 119243646-125128702 (out+in)	76,585
Manifest entry { "chain": "bsc", "collector": "evm_rpc", "directions": [ "out", "in" ], "from_block": 119243646, "from_ts": "2026-09-01T00:00:00Z", "kind": "range", "native": false, "records": 76585, "to_block": 125128702, "to_ts": "2026-10-01T16:00:00Z" }
BNB Chainknown_txs	5 known txs	5
Manifest entry { "chain": "bsc", "kind": "known_txs", "records": 5, "txs": 5 }
BNB Chainscan	2026-09-30T18:56 → 2026-09-30T18:58 blocks -	1
Manifest entry { "chain": "bsc", "from_ts": "2026-09-30T18:56:00Z", "kind": "scan", "note": "10 USDT test withdrawal", "records": 1, "to_ts": "2026-09-30T18:58:30Z", "txs": [ "0x4f426e23cda7ab58fd146f4f81489575563770c5d25b49d156870dc1dc1428d5" ] }
BNB Chainscan	2026-09-30T20:04 → 2026-09-30T20:06 blocks -	1
Manifest entry { "chain": "bsc", "from_ts": "2026-09-30T20:04:00Z", "kind": "scan", "note": "11 USDT test withdrawal", "records": 1, "to_ts": "2026-09-30T20:06:30Z", "txs": [ "0xc002bd17fb1d46833088c4deb2e05949fc33bdbd9f95ff53295af0c8f68bfdbf" ] }
NEARsample	2026-09-08T00:00 → 2026-09-29T00:00 40 random windows of 20 blocks, seed 20261101	798
Manifest entry { "blocks": 798, "blocks_per_window": 20, "chain": "near", "from_block": 214728860, "from_ts": "2026-09-08T00:00:00Z", "kind": "sample", "seed": 20261101, "to_block": 217701689, "to_ts": "2026-09-29T00:00:00Z", "window_starts": [ 214735920, 214764620, 214867060, 214881820, 214956400, 214993220, 215042020, 215205840, 215206080, 215270400, 215299880, 215335860, 215385660, 215443480, 215473700, 215549180, 215688400, 215706380, 215878000, 215981740, 216024420, 216033200, 216169000, 216289380, 216340220, 216435560, 216455600, 216459040, 216516260, 216582540, 216763000, 216794980, 216870400, 216893120, 217069360, 217136940, 217290240, 217307080, 217329180, 217666580 ] }

Blind spots and caveats

Confidential Intents (private shard): only entry and exit are visible.
HOT / MPC off-chain entitlement accounting: not visible; only its on-chain effects are.
Non-EVM treasuries (BTC, SOL, TON, Stellar, ...) are not collected; native BNB flows on BNB Chain are not either.
NEAR is sampled: the incident replay holds the blocks around the attacker's own NEAR transactions, which were picked by hand from the post-mortem, plus about a minute of benign context. A live run has no such list.
Hindsight: rules were designed after the post-mortem and tuned with the replay at hand, so timing on the incident is a best case. The out-of-sample scenario is the real test.
Detection, not prevention: nothing here submits to SHIELD or blocks anything on NEAR Intents or HOT.

Sources: https://docs.near-intents.org/security-compliance/treasury-addresses

IntentWatch · external, read-only detection over public on-chain data · incidents are SHIELD-shaped but unofficial · built at NEAR HACKATHON