IntentWatch
Threat hunting/Replay/sep24-lookalike
24 Sep 2026 00:00 → 26 Sep 2026 00:00 UTC offline replay, committed fixtures SHIELD-shaped, unofficial
Benign lookalike

Benign lookalike: 768K USDT spike to a new recipient, 24 Sep 2026

A single HOT Bridge payout on BNB Chain that trips the same spike-to-new-recipient composite (R1B) as the first large withdrawal of the 30 Sep - 1 Oct drain, with a larger ratio (4.33x vs 2.38x). No incident is known for it. Nothing else on BNB Chain corroborates it, so the incident stays at paranoid and a SHIELD consumer would answer delay for that recipient, never pause.

scenario sep24-lookalike window 2.0 days chains Ethereum, BNB Chain rules 16 enabled events in window 6,353 generated 2026-11-04T22:13:37Z

Dashboard

Total alerts
12
1 high11 medium
Level 12 or above
1
on 1 transaction
Incidents
5
1 paranoid4 normal
Highest SHIELD mode
paranoid
recommended by any incident in the window
Events analyzed
6,353
Ethereum 4,297BNB Chain 2,056

Analyst notes what this example shows

  • R1B fires (4.33x the 48h max, recipient first seen at this payout); W1 was 2.38x. On the payout alone, the two look alike.
  • A relayer submitted the payout (tx.from differs from the recipient), so R4 and R3B stay silent; all seven drain withdrawals were self-submitted by their recipient.
  • No test payout preceded it (R3) and no burst followed (R10): the recipient got this one payout and nothing else in the recorded month.
  • One high alert on one transaction: the incident stays paranoid, scoped to the recipient address, and never reaches under_attack. A consumer answers allow at the payout and delay for that recipient afterwards.
  • Caveat: the recorded NEAR blocks start on 27 Sep, so the NEAR-side rules (R6, R8, R8B, R9B) cannot judge this payout. In the drain they were the earliest signal.

Timeline everything on one time axis (UTC); each payout lane has its own scale

Alert severity criticalhighmediumlow payout, no alert SHIELD mode normal paranoid under attack reference event Hover a mark for details, click it to drill down
SHIELD modehighest mode recommended by any incident active at the time normal paranoid normal Alert level evolutionalerts per 1h, all chains, stacked by severity 5 0 BNB Chaintreasury stablecoin payouts (USD) 500K 1M 0 768K lookalike Ethereumtreasury stablecoin payouts (USD) 1M 2M 0 24 Sep 00:00 24 Sep 06:00 24 Sep 12:00 24 Sep 18:00 25 Sep 00:00 25 Sep 06:00 25 Sep 12:00 25 Sep 18:00 26 Sep 00:00

Kill chain alerts by stage of a bridge drain, rules ranked by alerts (IntentWatch's own taxonomy, loosely after MITRE ATT&CK tactics)

  1. Stage 1 Probing 0alerts silent: R6B, R6C
  2. Stage 2 Ledger tampering 0alerts silent: R8, R6
  3. Stage 3 Withdrawal 0alerts silent: R8B
  4. Stage 4 Treasury drain 12alerts first 24 Sep 07:50
  5. Stage 5 Fund movement 0alerts silent: R7B, R7
LevelRuleWhat it detectsAlerts in windowFirst (UTC)
1. Probing0 alerts · silent: R6B R6C
2. Ledger tampering0 alerts · silent: R8 R6
3. Withdrawal0 alerts · silent: R8B
4. Treasury drain12 alerts · silent: R2 R3B R9B R10 R4
8 R5 Payout over $500K to a recipient first seen less than 7 days ago
7
 24 Sep 07:50
8 R1 Treasury payout far above recent maximum
2
 24 Sep 20:54
8 R3 Small test payout followed by a large payout to the same recipient
2
 24 Sep 09:15
12 R1B Treasury payout spike to a recipient first seen less than 7 days ago
1
 24 Sep 20:54
5. Fund movement0 alerts · silent: R7B R7

Payouts of interest and what a SHIELD consumer would have answered

Recipient of every row: 0x7c96279e...3e1c. Decisions come from the mock consumer (incidents/shield.py) for a request on the payout's chain and token: at the payout (incidents that existed before it), and one minute later for the same recipient. No locker queries SHIELD; this shows what the signal would have said, not what would have happened. Click a row for its alerts (a row without alerts opens the tx in the explorer), a rule for that alert, a decision for the incident behind it.

LabelTime (UTC)AmountTxAlerts on this txAt the payout1 min later
768K lookalike 2026-09-24 20:54:54 768,574.37 USDT 0x718e5ea9...74dd R1BR1R5 allow delay

Events

Security events 12 alerts in the window (80 in the whole replay), most severe first; click a column header to sort, a row for the full document

12 hits
2026-09-24 20:54:54 BNB Chain R1B_PAYOUT_SPIKE_TO_NEW_RECIPIENTTreasury drain bsc hot_bridge paid 768,574.37 usdt to 0x7c96279ec1e888aa56b9b836e0db26ca48573e1c: 4.33x the 48h max of 177,431.92, recipient first seen 0s ago 12 0x718e5ea9...74dd
Click a field to copy its value.
timestamp2026-09-24T20:54:54Z
rule.idR1B_PAYOUT_SPIKE_TO_NEW_RECIPIENT
rule.level12
rule.severityhigh
rule.descriptionTreasury payout spike to a recipient first seen less than 7 days ago
rule.groupsevm, treasury, payout, spike, composite
rule.tacticTreasury drain
rule.weight3.0
data.tx0x718e5ea9a5e54426da72acb778c033508004b1e797ada87bc528599c800e74dd
data.block123824491
data.ts2026-09-24T20:54:54Z
data.chainbsc
data.kindpayout
data.amount768574.366767755535445594
data.symbolusdt
data.from0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to0x7c96279ec1e888aa56b9b836e0db26ca48573e1c
data.tx_submitter0xcf495cea699b8beca4073279eda66882ccfa273c
data.vaulthot_bridge
data.tokenbsc:usdt
data.address0x7c96279ec1e888aa56b9b836e0db26ca48573e1c
scope.chainbsc
scope.bridgehot
scope.tokenusdt
scope.address0x7c96279ec1e888aa56b9b836e0db26ca48573e1c
evidence.value_fieldamount_usd
evidence.value768574.366767755535445594
evidence.baseline_max177431.920814326836413666
evidence.baseline_tx0x19539afd3b82325e360c250a203d28628437eae5ac71a0f317fbb273ec20b116
evidence.baseline_ts2026-09-23T14:15:10Z
evidence.baseline_window48h
evidence.baseline_events854
evidence.ratio4.33
evidence.factor2.0
evidence.min_value50000
evidence.address0x7c96279ec1e888aa56b9b836e0db26ca48573e1c
evidence.first_seen2026-09-24T20:54:54Z
evidence.first_seen_tx0x718e5ea9a5e54426da72acb778c033508004b1e797ada87bc528599c800e74dd
evidence.first_seen_kindpayout
evidence.age0:00:00
evidence.max_age7d
evidence.history_start2026-09-01T00:00:14Z
evidence.parentsR1_VAULT_PAYOUT_SPIKE, R5_NEW_RECIPIENT_LARGE_PAYOUT
matched[0]kind=payout eq payout
shield.modeparanoid
shield.capabilityraise_mode
shield.scopechain, bridge, token, address
2026-09-24 07:50:11 Ethereum R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain 500,165 usdt to 0xb5428d020e9da0f9a5ebcf4c606352b9b6301da7, first seen 5m 36s ago (payout) 8 0x40bc2f67...d64f
Click a field to copy its value.
timestamp2026-09-24T07:50:11Z
rule.idR5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level8
rule.severitymedium
rule.descriptionPayout over $500K to a recipient first seen less than 7 days ago
rule.groupsevm, treasury, payout, new_address
rule.tacticTreasury drain
rule.weight1.5
data.tx0x40bc2f677153ffeb73ad5bbd9e7aa3d778b678316b2b33363d0231ef6573d64f
data.block26045942
data.ts2026-09-24T07:50:11Z
data.chainethereum
data.kindpayout
data.amount500165
data.symbolusdt
data.from0x2cff890f0378a11913b6129b2e97417a2c302680
data.to0xb5428d020e9da0f9a5ebcf4c606352b9b6301da7
data.vaultnear_intents
data.tokenethereum:usdt
data.address0xb5428d020e9da0f9a5ebcf4c606352b9b6301da7
scope.chainethereum
scope.bridgenear_intents
scope.tokenusdt
scope.address0xb5428d020e9da0f9a5ebcf4c606352b9b6301da7
evidence.address0xb5428d020e9da0f9a5ebcf4c606352b9b6301da7
evidence.first_seen2026-09-24T07:44:35Z
evidence.first_seen_tx0x9642618c5535b9afecba0c7ac59131ee5ddec7fb114c72035d83ae0d0fa95543
evidence.first_seen_kindpayout
evidence.age0:05:36
evidence.max_age7d
evidence.history_start2026-09-01T00:02:11Z
matched[0]kind=payout eq payout
matched[1]vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]amount_usd=500165 gt 500000
shield.capabilityflag_observation
shield.scopeaddress
2026-09-24 08:26:47 Ethereum R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain 1,000,215 usdt to 0xcf184835bdb51ea5847386f03ab90b20c1dbf714, first seen 6m 36s ago (payout) 8 0x44da16c2...f27a
Click a field to copy its value.
timestamp2026-09-24T08:26:47Z
rule.idR5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level8
rule.severitymedium
rule.descriptionPayout over $500K to a recipient first seen less than 7 days ago
rule.groupsevm, treasury, payout, new_address
rule.tacticTreasury drain
rule.weight1.5
data.tx0x44da16c2d695fd7ff114136861b91e4e63ff56b18f4ce2ee6363a4694599f27a
data.block26046123
data.ts2026-09-24T08:26:47Z
data.chainethereum
data.kindpayout
data.amount1000215
data.symbolusdt
data.from0x2cff890f0378a11913b6129b2e97417a2c302680
data.to0xcf184835bdb51ea5847386f03ab90b20c1dbf714
data.vaultnear_intents
data.tokenethereum:usdt
data.address0xcf184835bdb51ea5847386f03ab90b20c1dbf714
scope.chainethereum
scope.bridgenear_intents
scope.tokenusdt
scope.address0xcf184835bdb51ea5847386f03ab90b20c1dbf714
evidence.address0xcf184835bdb51ea5847386f03ab90b20c1dbf714
evidence.first_seen2026-09-24T08:20:11Z
evidence.first_seen_tx0x682ec2fef6d25981e905f258c6a826e0d952498d96dff5d3c13e5b6a4870ad91
evidence.first_seen_kindpayout
evidence.age0:06:36
evidence.max_age7d
evidence.history_start2026-09-01T00:02:11Z
matched[0]kind=payout eq payout
matched[1]vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]amount_usd=1000215 gt 500000
shield.capabilityflag_observation
shield.scopeaddress
2026-09-24 09:15:23 Ethereum R3_TEST_THEN_DRAINTreasury drain 0x953ebe695ca59085f88b3f009bb78b9e45ff3404 received a test payout 9m 24s before this 816,869.22 usdt payout 8 0x5d83f361...bece
Click a field to copy its value.
timestamp2026-09-24T09:15:23Z
rule.idR3_TEST_THEN_DRAIN
rule.level8
rule.severitymedium
rule.descriptionSmall test payout followed by a large payout to the same recipient
rule.groupsevm, treasury, payout, sequence
rule.tacticTreasury drain
rule.weight1.5
data.tx0x5d83f3612d349e6a265dedf4fe529dfb06e78521ccedc349394d9d4a30c1bece
data.block26046363
data.ts2026-09-24T09:15:23Z
data.chainethereum
data.kindpayout
data.amount816869.22
data.symbolusdt
data.from0x2cff890f0378a11913b6129b2e97417a2c302680
data.to0x953ebe695ca59085f88b3f009bb78b9e45ff3404
data.vaultnear_intents
data.tokenethereum:usdt
data.address0x953ebe695ca59085f88b3f009bb78b9e45ff3404
scope.chainethereum
scope.bridgenear_intents
scope.tokenusdt
scope.address0x953ebe695ca59085f88b3f009bb78b9e45ff3404
evidence.group.to_addr0x953ebe695ca59085f88b3f009bb78b9e45ff3404
evidence.within24h
evidence.steps[{"step": "test_payout", "tx": "0x18d8143b2135879326cda4ecc9c670a2f547ec59f2d50311c70dacd44c928d79", "ts": "2026-09-24T09:05:59Z", "amount": "10"}, {"step": "large_payout", "tx": "0x5d83f3612d349e6a265dedf4fe529dfb06e78521ccedc349394d9d4a30c1bece", "ts": "2026-09-24T09:15:23Z", "amount": "816869.22"}]
evidence.first_step_age0:09:24
evidence.prior_events[{"step": "test_payout", "tx": "0x18d8143b2135879326cda4ecc9c670a2f547ec59f2d50311c70dacd44c928d79", "ts": "2026-09-24T09:05:59Z", "amount": "10"}]
matched[0]kind=payout eq payout
matched[1]vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]symbol=usdt in ['usdt', 'usdc']
shield.capabilityflag_observation
shield.scopeaddress
2026-09-24 09:15:23 Ethereum R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain 816,869.22 usdt to 0x953ebe695ca59085f88b3f009bb78b9e45ff3404, first seen 9m 24s ago (payout) 8 0x5d83f361...bece
Click a field to copy its value.
timestamp2026-09-24T09:15:23Z
rule.idR5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level8
rule.severitymedium
rule.descriptionPayout over $500K to a recipient first seen less than 7 days ago
rule.groupsevm, treasury, payout, new_address
rule.tacticTreasury drain
rule.weight1.5
data.tx0x5d83f3612d349e6a265dedf4fe529dfb06e78521ccedc349394d9d4a30c1bece
data.block26046363
data.ts2026-09-24T09:15:23Z
data.chainethereum
data.kindpayout
data.amount816869.22
data.symbolusdt
data.from0x2cff890f0378a11913b6129b2e97417a2c302680
data.to0x953ebe695ca59085f88b3f009bb78b9e45ff3404
data.vaultnear_intents
data.tokenethereum:usdt
data.address0x953ebe695ca59085f88b3f009bb78b9e45ff3404
scope.chainethereum
scope.bridgenear_intents
scope.tokenusdt
scope.address0x953ebe695ca59085f88b3f009bb78b9e45ff3404
evidence.address0x953ebe695ca59085f88b3f009bb78b9e45ff3404
evidence.first_seen2026-09-24T09:05:59Z
evidence.first_seen_tx0x18d8143b2135879326cda4ecc9c670a2f547ec59f2d50311c70dacd44c928d79
evidence.first_seen_kindpayout
evidence.age0:09:24
evidence.max_age7d
evidence.history_start2026-09-01T00:02:11Z
matched[0]kind=payout eq payout
matched[1]vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]amount_usd=816869.22 gt 500000
shield.capabilityflag_observation
shield.scopeaddress
2026-09-24 09:41:59 Ethereum R3_TEST_THEN_DRAINTreasury drain 0xc82a8109b88691eac7c1d1b509a58981546e158c received a test payout 7m 24s before this 524,548.68 usdt payout 8 0x1cb543d5...24d0
Click a field to copy its value.
timestamp2026-09-24T09:41:59Z
rule.idR3_TEST_THEN_DRAIN
rule.level8
rule.severitymedium
rule.descriptionSmall test payout followed by a large payout to the same recipient
rule.groupsevm, treasury, payout, sequence
rule.tacticTreasury drain
rule.weight1.5
data.tx0x1cb543d5653847638288b7022862cacd632a9655447aaa9f2467f94a9bae24d0
data.block26046495
data.ts2026-09-24T09:41:59Z
data.chainethereum
data.kindpayout
data.amount524548.682027
data.symbolusdt
data.from0x2cff890f0378a11913b6129b2e97417a2c302680
data.to0xc82a8109b88691eac7c1d1b509a58981546e158c
data.vaultnear_intents
data.tokenethereum:usdt
data.address0xc82a8109b88691eac7c1d1b509a58981546e158c
scope.chainethereum
scope.bridgenear_intents
scope.tokenusdt
scope.address0xc82a8109b88691eac7c1d1b509a58981546e158c
evidence.group.to_addr0xc82a8109b88691eac7c1d1b509a58981546e158c
evidence.within24h
evidence.steps[{"step": "test_payout", "tx": "0xe56dcf43e395cddda3291ca4909066f283553a2b40efcf5c871bf377ec2112e1", "ts": "2026-09-24T09:34:35Z", "amount": "10"}, {"step": "large_payout", "tx": "0x1cb543d5653847638288b7022862cacd632a9655447aaa9f2467f94a9bae24d0", "ts": "2026-09-24T09:41:59Z", "amount": "524548.682027"}]
evidence.first_step_age0:07:24
evidence.prior_events[{"step": "test_payout", "tx": "0xe56dcf43e395cddda3291ca4909066f283553a2b40efcf5c871bf377ec2112e1", "ts": "2026-09-24T09:34:35Z", "amount": "10"}]
matched[0]kind=payout eq payout
matched[1]vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]symbol=usdt in ['usdt', 'usdc']
shield.capabilityflag_observation
shield.scopeaddress
2026-09-24 09:41:59 Ethereum R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain 524,548.68 usdt to 0xc82a8109b88691eac7c1d1b509a58981546e158c, first seen 7m 24s ago (payout) 8 0x1cb543d5...24d0
Click a field to copy its value.
timestamp2026-09-24T09:41:59Z
rule.idR5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level8
rule.severitymedium
rule.descriptionPayout over $500K to a recipient first seen less than 7 days ago
rule.groupsevm, treasury, payout, new_address
rule.tacticTreasury drain
rule.weight1.5
data.tx0x1cb543d5653847638288b7022862cacd632a9655447aaa9f2467f94a9bae24d0
data.block26046495
data.ts2026-09-24T09:41:59Z
data.chainethereum
data.kindpayout
data.amount524548.682027
data.symbolusdt
data.from0x2cff890f0378a11913b6129b2e97417a2c302680
data.to0xc82a8109b88691eac7c1d1b509a58981546e158c
data.vaultnear_intents
data.tokenethereum:usdt
data.address0xc82a8109b88691eac7c1d1b509a58981546e158c
scope.chainethereum
scope.bridgenear_intents
scope.tokenusdt
scope.address0xc82a8109b88691eac7c1d1b509a58981546e158c
evidence.address0xc82a8109b88691eac7c1d1b509a58981546e158c
evidence.first_seen2026-09-24T09:34:35Z
evidence.first_seen_tx0xe56dcf43e395cddda3291ca4909066f283553a2b40efcf5c871bf377ec2112e1
evidence.first_seen_kindpayout
evidence.age0:07:24
evidence.max_age7d
evidence.history_start2026-09-01T00:02:11Z
matched[0]kind=payout eq payout
matched[1]vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]amount_usd=524548.682027 gt 500000
shield.capabilityflag_observation
shield.scopeaddress
2026-09-24 09:48:23 Ethereum R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain 648,087.07 usdc to 0xefa117fc408c83e82427fcc22a7d06302c542346, first seen 36h 3m ago (payout) 8 0x691f936e...388a
Click a field to copy its value.
timestamp2026-09-24T09:48:23Z
rule.idR5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level8
rule.severitymedium
rule.descriptionPayout over $500K to a recipient first seen less than 7 days ago
rule.groupsevm, treasury, payout, new_address
rule.tacticTreasury drain
rule.weight1.5
data.tx0x691f936e904859c6df98e34bbef2931737b0bb0d3527fdfdd068ddbe37b8388a
data.block26046527
data.ts2026-09-24T09:48:23Z
data.chainethereum
data.kindpayout
data.amount648087.073128
data.symbolusdc
data.from0x2cff890f0378a11913b6129b2e97417a2c302680
data.to0xefa117fc408c83e82427fcc22a7d06302c542346
data.vaultnear_intents
data.tokenethereum:usdc
data.address0xefa117fc408c83e82427fcc22a7d06302c542346
scope.chainethereum
scope.bridgenear_intents
scope.tokenusdc
scope.address0xefa117fc408c83e82427fcc22a7d06302c542346
evidence.address0xefa117fc408c83e82427fcc22a7d06302c542346
evidence.first_seen2026-09-22T21:44:47Z
evidence.first_seen_tx0xe034625ccb9a1249ebbf665bf42ec55a99d80689f1eff62467d17b070403bb7a
evidence.first_seen_kindpayout
evidence.age1 day, 12:03:36
evidence.max_age7d
evidence.history_start2026-09-01T00:02:11Z
matched[0]kind=payout eq payout
matched[1]vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]amount_usd=648087.073128 gt 500000
shield.capabilityflag_observation
shield.scopeaddress
2026-09-24 20:54:54 BNB Chain R1_VAULT_PAYOUT_SPIKETreasury drain bsc hot_bridge paid 768,574.37 usdt to 0x7c96279ec1e888aa56b9b836e0db26ca48573e1c: 4.33x the 48h max of 177,431.92 8 0x718e5ea9...74dd
Click a field to copy its value.
timestamp2026-09-24T20:54:54Z
rule.idR1_VAULT_PAYOUT_SPIKE
rule.level8
rule.severitymedium
rule.descriptionTreasury payout far above recent maximum
rule.groupsevm, treasury, payout, spike
rule.tacticTreasury drain
rule.weight1.5
data.tx0x718e5ea9a5e54426da72acb778c033508004b1e797ada87bc528599c800e74dd
data.block123824491
data.ts2026-09-24T20:54:54Z
data.chainbsc
data.kindpayout
data.amount768574.366767755535445594
data.symbolusdt
data.from0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to0x7c96279ec1e888aa56b9b836e0db26ca48573e1c
data.tx_submitter0xcf495cea699b8beca4073279eda66882ccfa273c
data.vaulthot_bridge
data.tokenbsc:usdt
data.address0x7c96279ec1e888aa56b9b836e0db26ca48573e1c
scope.chainbsc
scope.bridgehot
scope.tokenusdt
scope.address0x7c96279ec1e888aa56b9b836e0db26ca48573e1c
evidence.value_fieldamount_usd
evidence.value768574.366767755535445594
evidence.baseline_max177431.920814326836413666
evidence.baseline_tx0x19539afd3b82325e360c250a203d28628437eae5ac71a0f317fbb273ec20b116
evidence.baseline_ts2026-09-23T14:15:10Z
evidence.baseline_window48h
evidence.baseline_events854
evidence.ratio4.33
evidence.factor2.0
evidence.min_value50000
matched[0]kind=payout eq payout
matched[1]vault=hot_bridge in ['hot_bridge', 'near_intents']
matched[2]symbol=usdt in ['usdt', 'usdc']
shield.capabilityflag_observation
shield.scopechain, bridge, token
2026-09-24 20:54:54 BNB Chain R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain 768,574.37 usdt to 0x7c96279ec1e888aa56b9b836e0db26ca48573e1c, first seen 0s ago (payout) 8 0x718e5ea9...74dd
Click a field to copy its value.
timestamp2026-09-24T20:54:54Z
rule.idR5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level8
rule.severitymedium
rule.descriptionPayout over $500K to a recipient first seen less than 7 days ago
rule.groupsevm, treasury, payout, new_address
rule.tacticTreasury drain
rule.weight1.5
data.tx0x718e5ea9a5e54426da72acb778c033508004b1e797ada87bc528599c800e74dd
data.block123824491
data.ts2026-09-24T20:54:54Z
data.chainbsc
data.kindpayout
data.amount768574.366767755535445594
data.symbolusdt
data.from0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to0x7c96279ec1e888aa56b9b836e0db26ca48573e1c
data.tx_submitter0xcf495cea699b8beca4073279eda66882ccfa273c
data.vaulthot_bridge
data.tokenbsc:usdt
data.address0x7c96279ec1e888aa56b9b836e0db26ca48573e1c
scope.chainbsc
scope.bridgehot
scope.tokenusdt
scope.address0x7c96279ec1e888aa56b9b836e0db26ca48573e1c
evidence.address0x7c96279ec1e888aa56b9b836e0db26ca48573e1c
evidence.first_seen2026-09-24T20:54:54Z
evidence.first_seen_tx0x718e5ea9a5e54426da72acb778c033508004b1e797ada87bc528599c800e74dd
evidence.first_seen_kindpayout
evidence.age0:00:00
evidence.max_age7d
evidence.history_start2026-09-01T00:00:14Z
matched[0]kind=payout eq payout
matched[1]vault=hot_bridge in ['hot_bridge', 'near_intents']
matched[2]amount_usd=768574.366767755535445594 gt 500000
shield.capabilityflag_observation
shield.scopeaddress
2026-09-25 12:39:15 BNB Chain R1_VAULT_PAYOUT_SPIKETreasury drain bsc hot_bridge paid 129,910.36 usdc to 0x5a8e12d1f7148886fe35f6fa04f5a2c2b60ac354: 2.95x the 48h max of 44,096.75 8 0x5639d2a3...243f
Click a field to copy its value.
timestamp2026-09-25T12:39:15Z
rule.idR1_VAULT_PAYOUT_SPIKE
rule.level8
rule.severitymedium
rule.descriptionTreasury payout far above recent maximum
rule.groupsevm, treasury, payout, spike
rule.tacticTreasury drain
rule.weight1.5
data.tx0x5639d2a3e563f0bd28a00d30d39e69857a9ca4dfd84c7bbb92d43f88d8d8243f
data.block123950370
data.ts2026-09-25T12:39:15Z
data.chainbsc
data.kindpayout
data.amount129910.358654115058441374
data.symbolusdc
data.from0x233c5370ccfb3cd7409d9a3fb98ab94de94cb4cd
data.to0x5a8e12d1f7148886fe35f6fa04f5a2c2b60ac354
data.tx_submitter0xcf495cea699b8beca4073279eda66882ccfa273c
data.vaulthot_bridge
data.tokenbsc:usdc
data.address0x5a8e12d1f7148886fe35f6fa04f5a2c2b60ac354
scope.chainbsc
scope.bridgehot
scope.tokenusdc
scope.address0x5a8e12d1f7148886fe35f6fa04f5a2c2b60ac354
evidence.value_fieldamount_usd
evidence.value129910.358654115058441374
evidence.baseline_max44096.745538880876640867
evidence.baseline_tx0x85dffb92b092175ce3a8dfedf003296098edf3b1c97cc68bf276b04289408073
evidence.baseline_ts2026-09-24T04:06:07Z
evidence.baseline_window48h
evidence.baseline_events138
evidence.ratio2.95
evidence.factor2.0
evidence.min_value50000
matched[0]kind=payout eq payout
matched[1]vault=hot_bridge in ['hot_bridge', 'near_intents']
matched[2]symbol=usdc in ['usdt', 'usdc']
shield.capabilityflag_observation
shield.scopechain, bridge, token
2026-09-25 13:24:23 Ethereum R5_NEW_RECIPIENT_LARGE_PAYOUTTreasury drain 796,054.47 usdc to 0x30ccf020619a9d2bb1e7477a353f90f4144fdbb2, first seen 6d 19h ago (payout) 8 0x746a9d36...48ac
Click a field to copy its value.
timestamp2026-09-25T13:24:23Z
rule.idR5_NEW_RECIPIENT_LARGE_PAYOUT
rule.level8
rule.severitymedium
rule.descriptionPayout over $500K to a recipient first seen less than 7 days ago
rule.groupsevm, treasury, payout, new_address
rule.tacticTreasury drain
rule.weight1.5
data.tx0x746a9d36c635e9571d4f479c3f4b7a1bba5666b6d32b264eb66c24b4c1cc48ac
data.block26054747
data.ts2026-09-25T13:24:23Z
data.chainethereum
data.kindpayout
data.amount796054.467841
data.symbolusdc
data.from0x2cff890f0378a11913b6129b2e97417a2c302680
data.to0x30ccf020619a9d2bb1e7477a353f90f4144fdbb2
data.vaultnear_intents
data.tokenethereum:usdc
data.address0x30ccf020619a9d2bb1e7477a353f90f4144fdbb2
scope.chainethereum
scope.bridgenear_intents
scope.tokenusdc
scope.address0x30ccf020619a9d2bb1e7477a353f90f4144fdbb2
evidence.address0x30ccf020619a9d2bb1e7477a353f90f4144fdbb2
evidence.first_seen2026-09-18T17:28:23Z
evidence.first_seen_tx0x09a88bbc406902bbb2fcb598a9114b6f74dc34be79020d58e8d1c051502ababf
evidence.first_seen_kindpayout
evidence.age6 days, 19:56:00
evidence.max_age7d
evidence.history_start2026-09-01T00:02:11Z
matched[0]kind=payout eq payout
matched[1]vault=near_intents in ['hot_bridge', 'near_intents']
matched[2]amount_usd=796054.467841 gt 500000
shield.capabilityflag_observation
shield.scopeaddress

Incidents

5 incidents with alerts in the window, highest mode first. Each is SHIELD-shaped (intentwatch.incident/v1, unofficial: SHIELD's Incident API is partner-only). Alerts sharing an asset or address within 24h are one incident; two high alerts on different transactions within 2h escalate it to under_attack, unless all of them come from a rate rule (R2), which moves it onto the route and stops at paranoid.

On NEAR: incidents at paranoid or above are written to the IntentWatch incident registry registry.surs51.testnet (testnet, deployed) by a detector that holds only a function-call key limited to report_incident with a 0.25 NEAR gas allowance (read from chain 2026-10-31 19:05:23 UTC: least privilege ok). No model is connected: the summary module is ready to connect and has recorded nothing for this replay.

Agent guard wallet on testnet

The contract (contracts/agent_guard, Rust near-sdk) holds an AI agent's funds. Its only key for the agent is a function-call key limited to request_transfer (read from chain 2026-11-04 15:47:30 UTC: least privilege ok). It enforces 0.1 NEAR per transfer and 0.5 NEAR per day, then asks the incident registry about the route the agent declares and the account the money really goes to: under_attack or a paused destination is refused, paranoid is held for 60 min and re-checked, and any trouble reaching the registry is a refusal. Deployed at guard.surs51.testnet (tx). Code upgraded 2026-11-01 16:37:35 UTC (tx); a receipt recorded before that is an answer of the earlier build. Code upgraded 2026-11-04 15:46:26 UTC (tx); a receipt recorded before that is an answer of the earlier build. The "Contract answers" column comes from a mirror of the contract logic, tested against the contracts with shared vectors, assuming the detector reported each escalation as it happened; the receipts column is what the deployed contract answered on testnet, and intentwatch guard verify reads those back from chain. The chain, bridge and token are what the agent declares: an agent that lies about them and pays an account nobody has flagged is bounded by the limits only, unless the owner has set an allowlist of receivers, which the contract checks first, along with the owner's stop switch and hourly cap. Click a row for the exact call the agent signs.

Moment (UTC)Agent asksDeclared route and real receiverContract answersTestnet receipt
2026-09-24 20:54 Payment on the route, now paranoid
0.01 NEAR		 bsc/hot/usdt
0x7c96279e...3e1c
really pays surs51.testnet		 held route is paranoid (incident IW-20260924-205454-d17c87): held until the delay ends refused 8FghMZpmKa...He9Y
The request_transfer call the agent signs
{
  "args": {
    "amount": "10000000000000000000000",
    "receiver_id": "surs51.testnet",
    "route": {
      "address": "0x00000000000000000000000000000000000a11ce",
      "bridge": "hot",
      "chain": "bsc",
      "token": "usdt"
    }
  },
  "deposit": "0",
  "gas_tgas": 100,
  "method": "request_transfer",
  "receiver_id": "guard.surs51.testnet"
}
2026-09-24 20:54 The same payment on a route nothing covers
0.01 NEAR		 bsc/hot/usdc
0x00000000...11ce
really pays surs51.testnet		 sent route clear, within limits sent 4DSpDZagW7...bzCA
The request_transfer call the agent signs
{
  "args": {
    "amount": "10000000000000000000000",
    "receiver_id": "surs51.testnet",
    "route": {
      "address": "0x00000000000000000000000000000000000a11ce",
      "bridge": "near_intents",
      "chain": "ethereum",
      "token": "usdc"
    }
  },
  "deposit": "0",
  "gas_tgas": 100,
  "method": "request_transfer",
  "receiver_id": "guard.surs51.testnet"
}
2026-09-24 20:54 A payment over the per-transfer limit
0.2 NEAR		 bsc/hot/usdc
0x00000000...11ce
really pays surs51.testnet		 refused amount exceeds the per-transfer limit refused 2LXCMG3o2K...zUdG
The request_transfer call the agent signs
{
  "args": {
    "amount": "200000000000000000000000",
    "receiver_id": "surs51.testnet",
    "route": {
      "address": "0x00000000000000000000000000000000000a11ce",
      "bridge": "near_intents",
      "chain": "ethereum",
      "token": "usdc"
    }
  },
  "deposit": "0",
  "gas_tgas": 100,
  "method": "request_transfer",
  "receiver_id": "guard.surs51.testnet"
}
2026-09-24 20:54 A payment to a fresh account, with the owner's allowlist on
0.01 NEAR		 bsc/hot/usdc
0x00000000...11ce
really pays 5fd214f06a...f46a
owner allows only surs51.testnet		 refused the receiver is not on the owner's allowlist refused FvmP6yX4y7...Emq5
The request_transfer call the agent signs
{
  "args": {
    "amount": "10000000000000000000000",
    "receiver_id": "5fd214f06a0de3e6bcdf6f325ab29b494f9904f491c24e1db62c9069fdb0f46a",
    "route": {
      "address": "0x00000000000000000000000000000000000a11ce",
      "bridge": "near_intents",
      "chain": "ethereum",
      "token": "usdc"
    }
  },
  "deposit": "0",
  "gas_tgas": 100,
  "method": "request_transfer",
  "receiver_id": "guard.surs51.testnet"
}
paranoid IW-20260924-205454-d17c87 high 3 alerts · score 6.0 · BNB Chain · opened 2026-09-24 20:54:54 UTC · active 0s show ▾hide ▴
normal
09-24 20:54
paranoid
09-24 20:54
under attack
-
Recommended capability
raise_mode
Scope
chain: bscbridge: hottoken: usdtaddress: 0x7c96279e...3e1c
Opened by
R1B_PAYOUT_SPIKE_TO_NEW_RECIPIENT
Flagged stablecoin payouts
1 totalling 768,574.37 USD

On-chain record not recorded

No recorded report for this incident. Incident hash af5dac8a7d13e313...40e5 (sha256 of the canonical incident JSON; intentwatch registry hashes recomputes it).

The report_incident call the detector would sign 
{
  "args": {
    "report": {
      "alerts": 3,
      "attestation_hash": null,
      "capability": "raise_mode",
      "incident_hash": "af5dac8a7d13e313a4e914816caf41d441aba8ef1b4a12ec725bc4479ba540e5",
      "incident_id": "IW-20260924-205454-d17c87",
      "mode": "paranoid",
      "opened_at_ms": 1790283294000,
      "paused_destinations": [],
      "scope": {
        "address": "0x7c96279ec1e888aa56b9b836e0db26ca48573e1c",
        "bridge": "hot",
        "chain": "bsc",
        "token": "usdt"
      },
      "summary_hash": null
    }
  },
  "deposit": "0",
  "gas_tgas": 10,
  "method": "report_incident",
  "receiver_id": "registry.surs51.testnet"
}

Model-written summary none recorded

Not recorded for this replay. intentwatch triage record asks a NEAR-hosted TEE model for a summary and stores the evidence (response signature, Intel TDX quote and collateral, NVIDIA GPU verdict) that the replay then re-verifies offline. It needs a NEAR AI Cloud key.

Rules in this incident
12R1B_PAYOUT_SPIKE_TO_NEW_RECIPIENT×18R1_VAULT_PAYOUT_SPIKE×18R5_NEW_RECIPIENT_LARGE_PAYOUT×1
Mode changes and actions click a row for the alerts that led to it
Time (UTC)ChangeReason
2026-09-24 20:54:54normal1 observation(s)
2026-09-24 20:54:54paranoidhigh alert R1B_PAYOUT_SPIKE_TO_NEW_RECIPIENT
Raw incident JSON (alert evidence omitted: see Events, or incidents.jsonl)
{
  "schema": "intentwatch.incident/v1 (shield-compatible, unofficial)",
  "incident_id": "IW-20260924-205454-d17c87",
  "opened_at": "2026-09-24T20:54:54Z",
  "updated_at": "2026-09-24T20:54:54Z",
  "recommended_mode": "paranoid",
  "capability": "raise_mode",
  "scope": {
    "chain": "bsc",
    "bridge": "hot",
    "token": "usdt",
    "address": "0x7c96279ec1e888aa56b9b836e0db26ca48573e1c"
  },
  "score": 6.0,
  "max_severity": "high",
  "mode_history": [
    {
      "ts": "2026-09-24T20:54:54Z",
      "mode": "normal",
      "capability": "flag_observation",
      "scope": {
        "chain": "bsc",
        "bridge": "hot",
        "token": "usdt",
        "address": "0x7c96279ec1e888aa56b9b836e0db26ca48573e1c"
      },
      "reason": "1 observation(s)",
      "alert_id": "R1_VAULT_PAYOUT_SPIKE:712304584995"
    },
    {
      "ts": "2026-09-24T20:54:54Z",
      "mode": "paranoid",
      "capability": "raise_mode",
      "scope": {
        "chain": "bsc",
        "bridge": "hot",
        "token": "usdt",
        "address": "0x7c96279ec1e888aa56b9b836e0db26ca48573e1c"
      },
      "reason": "high alert R1B_PAYOUT_SPIKE_TO_NEW_RECIPIENT",
      "alert_id": "R1B_PAYOUT_SPIKE_TO_NEW_RECIPIENT:7d177a63dbfc"
    }
  ],
  "recommended_actions": [],
  "alerts": [
    {
      "alert_id": "R1B_PAYOUT_SPIKE_TO_NEW_RECIPIENT:7d177a63dbfc",
      "rule": "R1B_PAYOUT_SPIKE_TO_NEW_RECIPIENT",
      "severity": "high",
      "ts": "2026-09-24T20:54:54Z",
      "tx": "0x718e5ea9a5e54426da72acb778c033508004b1e797ada87bc528599c800e74dd"
    },
    {
      "alert_id": "R1_VAULT_PAYOUT_SPIKE:712304584995",
      "rule": "R1_VAULT_PAYOUT_SPIKE",
      "severity": "medium",
      "ts": "2026-09-24T20:54:54Z",
      "tx": "0x718e5ea9a5e54426da72acb778c033508004b1e797ada87bc528599c800e74dd"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:1bf78ebe2074",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-09-24T20:54:54Z",
      "tx": "0x718e5ea9a5e54426da72acb778c033508004b1e797ada87bc528599c800e74dd"
    }
  ],
  "summary": "3 alerts (R1B_PAYOUT_SPIKE_TO_NEW_RECIPIENT, R1_VAULT_PAYOUT_SPIKE, R5_NEW_RECIPIENT_LARGE_PAYOUT) on bsc; opened 2026-09-24T20:54:54Z by R1B_PAYOUT_SPIKE_TO_NEW_RECIPIENT; mode paranoid; 1 flagged stablecoin payouts totalling 768,574.37 USD."
}
normal IW-20260922-053835-d9edc6 medium 8 alerts · score 12.0 · Ethereum · opened 2026-09-22 05:38:35 UTC · active 52h 9m show ▾hide ▴
normal
09-22 05:38
paranoid
-
under attack
-
Recommended capability
flag_observation
Scope
chain: ethereumbridge: near_intentstoken: usdcaddress: 0x204823d2...e3f8
Opened by
R5_NEW_RECIPIENT_LARGE_PAYOUT
Flagged stablecoin payouts
8 totalling 3,953,034.04 USD

On-chain record below paranoid

Only incidents at paranoid or above go on chain. Incident hash e2cd0c7d196395f9...5686.

Model-written summary none recorded

Summaries are written for incidents at paranoid or above.

Rules in this incident
8R5_NEW_RECIPIENT_LARGE_PAYOUT×68R3_TEST_THEN_DRAIN×18R10_RECIPIENT_PAYOUT_BURST×1
Mode changes and actions click a row for the alerts that led to it
Time (UTC)ChangeReason
2026-09-22 05:38:35normal1 observation(s)
Raw incident JSON (alert evidence omitted: see Events, or incidents.jsonl)
{
  "schema": "intentwatch.incident/v1 (shield-compatible, unofficial)",
  "incident_id": "IW-20260922-053835-d9edc6",
  "opened_at": "2026-09-22T05:38:35Z",
  "updated_at": "2026-09-24T09:48:23Z",
  "recommended_mode": "normal",
  "capability": "flag_observation",
  "scope": {
    "chain": "ethereum",
    "bridge": "near_intents",
    "token": "usdc",
    "address": "0x204823d2995230ec1660512013c96d6f06bee3f8"
  },
  "score": 12.0,
  "max_severity": "medium",
  "mode_history": [
    {
      "ts": "2026-09-22T05:38:35Z",
      "mode": "normal",
      "capability": "flag_observation",
      "scope": {
        "chain": "ethereum",
        "bridge": "near_intents",
        "token": "usdc",
        "address": "0x204823d2995230ec1660512013c96d6f06bee3f8"
      },
      "reason": "1 observation(s)",
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:e5362e2bc825"
    }
  ],
  "recommended_actions": [],
  "alerts": [
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:e5362e2bc825",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-09-22T05:38:35Z",
      "tx": "0x703a200c25cb9e35f85a1b04adec2e58f4ff87abf9b0a23c9154f1b771046ef7"
    },
    {
      "alert_id": "R3_TEST_THEN_DRAIN:dd5294d5fb37",
      "rule": "R3_TEST_THEN_DRAIN",
      "severity": "medium",
      "ts": "2026-09-22T09:33:59Z",
      "tx": "0x8d48c34355914adae306e9a77a23425d4bb725877df498d94a59fc8e89abf801"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:074cc5f86716",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-09-22T13:42:47Z",
      "tx": "0xc4072c7c8dfcab12f291adaf674a5c9a8241fcffbff0d5c760ad1933dd2cbdd7"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:7b71eacd6630",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-09-22T17:05:35Z",
      "tx": "0x3a86bc269b4550d5b58476150a7beab3c95f1e010aa72fbab8b1ac3b4a6a8de9"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:ad6b88f4e288",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-09-22T18:11:35Z",
      "tx": "0x4eb5ad3e8dff33bde98d68df107962a715f544ce8473fe8ee18b1588c0b522c9"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:b64b73445aab",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-09-23T01:04:35Z",
      "tx": "0xf78874abb3b7e32a114274c8edeb34bb54d32f3cc42a81781e8915279f92d79c"
    },
    {
      "alert_id": "R10_RECIPIENT_PAYOUT_BURST:b5fbab4a500a",
      "rule": "R10_RECIPIENT_PAYOUT_BURST",
      "severity": "medium",
      "ts": "2026-09-23T18:17:11Z",
      "tx": "0x2d19e32fda4a438637486a54271e4b3930df17868ebd367128f047eda28e9f0c"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:699dc7428abc",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-09-24T09:48:23Z",
      "tx": "0x691f936e904859c6df98e34bbef2931737b0bb0d3527fdfdd068ddbe37b8388a"
    }
  ],
  "summary": "8 alerts (R10_RECIPIENT_PAYOUT_BURST, R3_TEST_THEN_DRAIN, R5_NEW_RECIPIENT_LARGE_PAYOUT) on ethereum; opened 2026-09-22T05:38:35Z by R5_NEW_RECIPIENT_LARGE_PAYOUT; mode normal; 8 flagged stablecoin payouts totalling 3,953,034.04 USD."
}
normal IW-20260924-075011-d1a902 medium 6 alerts · score 9.0 · Ethereum · opened 2026-09-24 07:50:11 UTC · active 1h 51m show ▾hide ▴
normal
09-24 07:50
paranoid
-
under attack
-
Recommended capability
flag_observation
Scope
chain: ethereumbridge: near_intentstoken: usdtaddress: 0xb5428d02...1da7
Opened by
R5_NEW_RECIPIENT_LARGE_PAYOUT
Flagged stablecoin payouts
4 totalling 2,841,797.90 USD

On-chain record below paranoid

Only incidents at paranoid or above go on chain. Incident hash 3c9c79337e002f3a...dceb.

Model-written summary none recorded

Summaries are written for incidents at paranoid or above.

Rules in this incident
8R5_NEW_RECIPIENT_LARGE_PAYOUT×48R3_TEST_THEN_DRAIN×2
Mode changes and actions click a row for the alerts that led to it
Time (UTC)ChangeReason
2026-09-24 07:50:11normal1 observation(s)
Raw incident JSON (alert evidence omitted: see Events, or incidents.jsonl)
{
  "schema": "intentwatch.incident/v1 (shield-compatible, unofficial)",
  "incident_id": "IW-20260924-075011-d1a902",
  "opened_at": "2026-09-24T07:50:11Z",
  "updated_at": "2026-09-24T09:41:59Z",
  "recommended_mode": "normal",
  "capability": "flag_observation",
  "scope": {
    "chain": "ethereum",
    "bridge": "near_intents",
    "token": "usdt",
    "address": "0xb5428d020e9da0f9a5ebcf4c606352b9b6301da7"
  },
  "score": 9.0,
  "max_severity": "medium",
  "mode_history": [
    {
      "ts": "2026-09-24T07:50:11Z",
      "mode": "normal",
      "capability": "flag_observation",
      "scope": {
        "chain": "ethereum",
        "bridge": "near_intents",
        "token": "usdt",
        "address": "0xb5428d020e9da0f9a5ebcf4c606352b9b6301da7"
      },
      "reason": "1 observation(s)",
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:1e1cad6de945"
    }
  ],
  "recommended_actions": [],
  "alerts": [
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:1e1cad6de945",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-09-24T07:50:11Z",
      "tx": "0x40bc2f677153ffeb73ad5bbd9e7aa3d778b678316b2b33363d0231ef6573d64f"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:8095ff6f4e9e",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-09-24T08:26:47Z",
      "tx": "0x44da16c2d695fd7ff114136861b91e4e63ff56b18f4ce2ee6363a4694599f27a"
    },
    {
      "alert_id": "R3_TEST_THEN_DRAIN:cbe1fe60acac",
      "rule": "R3_TEST_THEN_DRAIN",
      "severity": "medium",
      "ts": "2026-09-24T09:15:23Z",
      "tx": "0x5d83f3612d349e6a265dedf4fe529dfb06e78521ccedc349394d9d4a30c1bece"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:f909d9cffeee",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-09-24T09:15:23Z",
      "tx": "0x5d83f3612d349e6a265dedf4fe529dfb06e78521ccedc349394d9d4a30c1bece"
    },
    {
      "alert_id": "R3_TEST_THEN_DRAIN:730bff2d8593",
      "rule": "R3_TEST_THEN_DRAIN",
      "severity": "medium",
      "ts": "2026-09-24T09:41:59Z",
      "tx": "0x1cb543d5653847638288b7022862cacd632a9655447aaa9f2467f94a9bae24d0"
    },
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:36a6ff6b0abf",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-09-24T09:41:59Z",
      "tx": "0x1cb543d5653847638288b7022862cacd632a9655447aaa9f2467f94a9bae24d0"
    }
  ],
  "summary": "6 alerts (R3_TEST_THEN_DRAIN, R5_NEW_RECIPIENT_LARGE_PAYOUT) on ethereum; opened 2026-09-24T07:50:11Z by R5_NEW_RECIPIENT_LARGE_PAYOUT; mode normal; 4 flagged stablecoin payouts totalling 2,841,797.90 USD."
}
normal IW-20260925-123915-98e633 medium 1 alert · score 1.5 · BNB Chain · opened 2026-09-25 12:39:15 UTC · active 0s show ▾hide ▴
normal
09-25 12:39
paranoid
-
under attack
-
Recommended capability
flag_observation
Scope
chain: bscbridge: hottoken: usdcaddress: 0x5a8e12d1...c354
Opened by
R1_VAULT_PAYOUT_SPIKE
Flagged stablecoin payouts
1 totalling 129,910.36 USD

On-chain record below paranoid

Only incidents at paranoid or above go on chain. Incident hash 5b4ec483ed27fb4a...ddc6.

Model-written summary none recorded

Summaries are written for incidents at paranoid or above.

Rules in this incident
8R1_VAULT_PAYOUT_SPIKE×1
Mode changes and actions click a row for the alerts that led to it
Time (UTC)ChangeReason
2026-09-25 12:39:15normal1 observation(s)
Raw incident JSON (alert evidence omitted: see Events, or incidents.jsonl)
{
  "schema": "intentwatch.incident/v1 (shield-compatible, unofficial)",
  "incident_id": "IW-20260925-123915-98e633",
  "opened_at": "2026-09-25T12:39:15Z",
  "updated_at": "2026-09-25T12:39:15Z",
  "recommended_mode": "normal",
  "capability": "flag_observation",
  "scope": {
    "chain": "bsc",
    "bridge": "hot",
    "token": "usdc",
    "address": "0x5a8e12d1f7148886fe35f6fa04f5a2c2b60ac354"
  },
  "score": 1.5,
  "max_severity": "medium",
  "mode_history": [
    {
      "ts": "2026-09-25T12:39:15Z",
      "mode": "normal",
      "capability": "flag_observation",
      "scope": {
        "chain": "bsc",
        "bridge": "hot",
        "token": "usdc",
        "address": "0x5a8e12d1f7148886fe35f6fa04f5a2c2b60ac354"
      },
      "reason": "1 observation(s)",
      "alert_id": "R1_VAULT_PAYOUT_SPIKE:b85e619b8840"
    }
  ],
  "recommended_actions": [],
  "alerts": [
    {
      "alert_id": "R1_VAULT_PAYOUT_SPIKE:b85e619b8840",
      "rule": "R1_VAULT_PAYOUT_SPIKE",
      "severity": "medium",
      "ts": "2026-09-25T12:39:15Z",
      "tx": "0x5639d2a3e563f0bd28a00d30d39e69857a9ca4dfd84c7bbb92d43f88d8d8243f"
    }
  ],
  "summary": "1 alerts (R1_VAULT_PAYOUT_SPIKE) on bsc; opened 2026-09-25T12:39:15Z by R1_VAULT_PAYOUT_SPIKE; mode normal; 1 flagged stablecoin payouts totalling 129,910.36 USD."
}
normal IW-20260925-132423-477747 medium 1 alert · score 1.5 · Ethereum · opened 2026-09-25 13:24:23 UTC · active 0s show ▾hide ▴
normal
09-25 13:24
paranoid
-
under attack
-
Recommended capability
flag_observation
Scope
chain: ethereumbridge: near_intentstoken: usdcaddress: 0x30ccf020...dbb2
Opened by
R5_NEW_RECIPIENT_LARGE_PAYOUT
Flagged stablecoin payouts
1 totalling 796,054.47 USD

On-chain record below paranoid

Only incidents at paranoid or above go on chain. Incident hash df4b802b1c206d3f...b540.

Model-written summary none recorded

Summaries are written for incidents at paranoid or above.

Rules in this incident
8R5_NEW_RECIPIENT_LARGE_PAYOUT×1
Mode changes and actions click a row for the alerts that led to it
Time (UTC)ChangeReason
2026-09-25 13:24:23normal1 observation(s)
Raw incident JSON (alert evidence omitted: see Events, or incidents.jsonl)
{
  "schema": "intentwatch.incident/v1 (shield-compatible, unofficial)",
  "incident_id": "IW-20260925-132423-477747",
  "opened_at": "2026-09-25T13:24:23Z",
  "updated_at": "2026-09-25T13:24:23Z",
  "recommended_mode": "normal",
  "capability": "flag_observation",
  "scope": {
    "chain": "ethereum",
    "bridge": "near_intents",
    "token": "usdc",
    "address": "0x30ccf020619a9d2bb1e7477a353f90f4144fdbb2"
  },
  "score": 1.5,
  "max_severity": "medium",
  "mode_history": [
    {
      "ts": "2026-09-25T13:24:23Z",
      "mode": "normal",
      "capability": "flag_observation",
      "scope": {
        "chain": "ethereum",
        "bridge": "near_intents",
        "token": "usdc",
        "address": "0x30ccf020619a9d2bb1e7477a353f90f4144fdbb2"
      },
      "reason": "1 observation(s)",
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:9b71b323d63a"
    }
  ],
  "recommended_actions": [],
  "alerts": [
    {
      "alert_id": "R5_NEW_RECIPIENT_LARGE_PAYOUT:9b71b323d63a",
      "rule": "R5_NEW_RECIPIENT_LARGE_PAYOUT",
      "severity": "medium",
      "ts": "2026-09-25T13:24:23Z",
      "tx": "0x746a9d36c635e9571d4f479c3f4b7a1bba5666b6d32b264eb66c24b4c1cc48ac"
    }
  ],
  "summary": "1 alerts (R5_NEW_RECIPIENT_LARGE_PAYOUT) on ethereum; opened 2026-09-25T13:24:23Z by R5_NEW_RECIPIENT_LARGE_PAYOUT; mode normal; 1 flagged stablecoin payouts totalling 796,054.47 USD."
}

Rules

Ruleset config/rules + local/rules; YAML, explainable and deterministic; click a rule for its logic

LevelRuleDescriptionStageGroupsIn window
8 R1_VAULT_PAYOUT_SPIKER1_vault_payout_spike.yaml Treasury payout far above recent maximumA single stablecoin payout from a bridge treasury is more than `factor` times the largest payout of the same (chain, vault, token) over the trailing 48h. Payouts that fired this rule are kept out of the baseline, so a drain cannot raise its own threshold. On the September BNB Chain baseline this fired ~1/day, mostly for recurring large recipients (ratios 2.05-6.1x, W1 was 2.38x), so it is medium on its own; R1B escalates spikes to new recipients. Treasury drain evmtreasurypayoutspike 2 
{
  "source": "evm.erc20_transfer",
  "match": {
    "kind": "payout",
    "vault": [
      "hot_bridge",
      "near_intents"
    ],
    "symbol": [
      "usdt",
      "usdc"
    ]
  },
  "condition": {
    "type": "ratio_to_rolling_max",
    "group_by": [
      "chain",
      "vault",
      "token"
    ],
    "window": "48h",
    "factor": 2.0,
    "min_value": 50000,
    "value_field": "amount_usd"
  },
  "shield": {
    "capability": "flag_observation",
    "scope": [
      "chain",
      "bridge",
      "token"
    ]
  }
}
12 R1B_PAYOUT_SPIKE_TO_NEW_RECIPIENTR1_vault_payout_spike.yaml Treasury payout spike to a recipient first seen less than 7 days agoComposite (Wazuh-style): R1 (payout > 2x the 48h max) and R5 (recipient first seen < 7 days ago, payout > $500K) fire on the same payout. Treasury drain evmtreasurypayoutspikecomposite 1 
{
  "source": "evm.*",
  "match": {
    "kind": "payout"
  },
  "if_all": [
    "R1_VAULT_PAYOUT_SPIKE",
    "R5_NEW_RECIPIENT_LARGE_PAYOUT"
  ],
  "shield": {
    "mode": "paranoid",
    "capability": "raise_mode",
    "scope": [
      "chain",
      "bridge",
      "token",
      "address"
    ]
  }
}
12 R2_VAULT_OUTFLOW_VELOCITYR2_vault_outflow_velocity.yaml (rate rule: cannot escalate alone) Treasury outflow velocity above its 7-day p99The trailing 1h stablecoin outflow of a (chain, vault, token) exceeds 2x the p99 of hourly outflow over the trailing 7 days (empty hours count as zero), and at least $1M. Throttled to one alert per hour per group. Velocity is about the treasury, so it never taints the recipient of the last payout. A rolling sum fires on the flow: its transaction is only where the sum crossed the line, so two alerts are one flow measured twice, and it cannot escalate alone. Treasury drain evmtreasurypayoutvelocity 0
No alerts in this window. 
{
  "source": "evm.erc20_transfer",
  "match": {
    "kind": "payout",
    "vault": [
      "hot_bridge",
      "near_intents"
    ],
    "symbol": [
      "usdt",
      "usdc"
    ]
  },
  "condition": {
    "type": "rolling_sum_vs_percentile",
    "group_by": [
      "chain",
      "vault",
      "token"
    ],
    "window": "1h",
    "bucket": "1h",
    "baseline": "7d",
    "percentile": 99,
    "factor": 2.0,
    "min_value": 1000000,
    "min_buckets": 72,
    "value_field": "amount_usd"
  },
  "ignore": "1h",
  "ignore_key": [
    "chain",
    "vault",
    "token"
  ],
  "shield": {
    "mode": "paranoid",
    "capability": "raise_mode",
    "scope": [
      "chain",
      "bridge",
      "token"
    ]
  }
}
8 R3_TEST_THEN_DRAINR3_test_then_drain.yaml Small test payout followed by a large payout to the same recipientThe same recipient gets at least one payout under $100 and then, within 24h, a payout over $100K from a treasury, and had at most 3 payouts in the 7 days before. Honest users test too: on the September Ethereum baseline this fired ~1/day even after excluding established counterparties, so it is medium on its own; R3B escalates it when the recipient also submitted the payout itself. Treasury drain evmtreasurypayoutsequence 2 
{
  "source": "evm.erc20_transfer",
  "match": {
    "kind": "payout",
    "vault": [
      "hot_bridge",
      "near_intents"
    ],
    "symbol": [
      "usdt",
      "usdc"
    ]
  },
  "condition": {
    "type": "sequence",
    "group_by": [
      "to_addr"
    ],
    "within": "24h",
    "max_prior": {
      "count": 3,
      "within": "7d"
    },
    "steps": [
      {
        "name": "test_payout",
        "match": {
          "amount_usd": {
            "lt": 100
          }
        }
      },
      {
        "name": "large_payout",
        "match": {
          "amount_usd": {
            "gt": 100000
          }
        }
      }
    ]
  },
  "shield": {
    "capability": "flag_observation",
    "scope": [
      "address"
    ]
  }
}
12 R3B_SELF_SUBMITTED_TEST_THEN_DRAINR3_test_then_drain.yaml Test-then-drain payout that the recipient submitted itselfComposite (Wazuh-style): R3 and R4 fire on the same payout. A fresh recipient that tested with a small payout and then pulled a large one by submitting the payout tx itself. Treasury drain evmtreasurypayoutsequencecomposite 0
No alerts in this window. 
{
  "source": "evm.erc20_transfer",
  "match": {
    "kind": "payout"
  },
  "if_all": [
    "R3_TEST_THEN_DRAIN",
    "R4_SELF_SUBMITTED_LARGE_PAYOUT"
  ],
  "shield": {
    "mode": "paranoid",
    "capability": "raise_mode",
    "scope": [
      "chain",
      "bridge",
      "token",
      "address"
    ]
  }
}
5 R4_SELF_SUBMITTED_LARGE_PAYOUTR4_self_submitted_large_payout.yaml (score only) Large payout submitted by its own recipientThe payout tx was sent by the recipient itself (tx.from == transfer.to) instead of a relayer. HOT's design allows self-submission, so this is a weak signal: score only, it never opens an incident by itself. Treasury drain evmtreasurypayoutsubmitter 0
No alerts in this window. 
{
  "source": "evm.erc20_transfer",
  "match": {
    "kind": "payout",
    "vault": [
      "hot_bridge",
      "near_intents"
    ],
    "amount_usd": {
      "gt": 100000
    },
    "extra.tx_submitter": {
      "eq_field": "to_addr"
    }
  }
}
8 R5_NEW_RECIPIENT_LARGE_PAYOUTR5_new_recipient_large_payout.yaml Payout over $500K to a recipient first seen less than 7 days agoThe recipient's first interaction with any watched treasury (as sender or receiver, any chain) is less than 7 days old. Needs 7 days of observed history before it can fire. Treasury drain evmtreasurypayoutnew_address 7 
{
  "source": "evm.*",
  "match": {
    "kind": "payout",
    "vault": [
      "hot_bridge",
      "near_intents"
    ],
    "amount_usd": {
      "gt": 500000
    }
  },
  "condition": {
    "type": "first_seen",
    "field": "to_addr",
    "track": [
      "from_addr",
      "to_addr"
    ],
    "max_age": "7d",
    "observe": {
      "vault": {
        "exists": true
      }
    }
  },
  "shield": {
    "capability": "flag_observation",
    "scope": [
      "address"
    ]
  }
}
12 R6_INTENTS_CALLBACK_ANOMALYR6_intents_callback_anomaly.yaml Abnormal resolve callback or oversized event on intents.nearOn the Verifier contract: a failed resolve callback (e.g. mt_resolve_deposit), a log that was rejected for exceeding NEAR's 16,384-byte limit or is close to it, or a single event entry carrying more than 32 token/amount pairs. Ledger tampering nearverifiercallback 0
No alerts in this window. 
{
  "source": [
    "near.receipt",
    "near.nep245",
    "near.dip4"
  ],
  "match": {
    "contract": "intents.near",
    "any": [
      {
        "kind": "callback_failure",
        "extra.methods": {
          "regex": "resolve"
        }
      },
      {
        "extra.rejected_log_size": {
          "gt": 15000
        }
      },
      {
        "extra.max_log_size": {
          "gt": 15000
        }
      },
      {
        "extra.n_token_pairs": {
          "gt": 32
        }
      }
    ]
  },
  "shield": {
    "mode": "paranoid",
    "capability": "raise_mode",
    "scope": [
      "chain",
      "bridge",
      "token"
    ]
  }
}
8 R6B_TOKEN_ID_LENGTH_OUTLIERR6B_token_id_length_outlier.yaml Token id length above the p99.9 of observed Verifier eventsThe longest token id in a Verifier multi-token event is longer than 99.9% of token ids seen so far (needs 2,000 samples first). Unusually long ids inflate event logs. Probing nearverifiertoken_id 0
No alerts in this window. 
{
  "source": "near.nep245",
  "match": {
    "contract": "intents.near"
  },
  "condition": {
    "type": "percentile_outlier",
    "field": "extra.max_token_id_len",
    "percentile": 99.9,
    "min_samples": 2000
  }
}
8 R6C_EXTREME_TOKEN_AMOUNTR6C_extreme_token_amount.yaml Token amount near the u128 limit on intents.near or the HOT omni contractA multi-token event moves more than 2^120 raw units of one token (within 2^8 of u128::MAX). No real token supply comes close (wNEAR, with 24 decimals, has ~1.2e33 raw units in total), so such amounts are crafted values that probe overflow, accounting or log-size limits. One alert per token per day. Medium on its own: it says nothing about whether the value was credited. Probing nearverifieramount 0
No alerts in this window. 
{
  "source": "near.nep245",
  "match": {
    "contract": [
      "intents.near",
      "v2_1.omni.hot.tg"
    ],
    "amount_raw": {
      "gt": 1329227995784915872903807060280344576
    }
  },
  "ignore": "24h",
  "ignore_key": [
    "token"
  ],
  "shield": {
    "capability": "flag_observation",
    "scope": [
      "chain",
      "bridge",
      "token"
    ]
  }
}
12 R7_TAINTED_REENTRYR7_tainted_reentry.yaml Address tainted by a flagged payout deposits into a treasuryAn address that received a payout flagged by R1B/R3B/R9B (or got funds from such an address, one hop) later deposits into any NEAR Intents / HOT treasury on any EVM chain. Fund movement evmtreasurydeposittaint 0
No alerts in this window. 
{
  "source": "evm.*",
  "match": {
    "kind": "deposit",
    "vault": {
      "exists": true
    }
  },
  "condition": {
    "type": "tainted",
    "taint_from": [
      "R1B_PAYOUT_SPIKE_TO_NEW_RECIPIENT",
      "R3B_SELF_SUBMITTED_TEST_THEN_DRAIN",
      "R9B_PAYOUT_FROM_FLAGGED_NEAR_ACCOUNT"
    ],
    "taint_field": "address",
    "hops": 1,
    "check": [
      "from_addr"
    ]
  },
  "shield": {
    "mode": "paranoid",
    "capability": "raise_mode",
    "scope": [
      "chain",
      "bridge",
      "address"
    ]
  }
}
12 R7B_TAINTED_PAYOUTR7_tainted_reentry.yaml Treasury pays an address tainted by a flagged payout on another chain or vaultAfter R1B/R3B/R9B flag a payout, any *other* treasury (or the same treasury on another chain) pays that recipient. EVM addresses are the same across chains, so taint follows them. Fund movement evmtreasurypayouttaint 0
No alerts in this window. 
{
  "source": "evm.*",
  "match": {
    "kind": "payout",
    "vault": {
      "exists": true
    }
  },
  "condition": {
    "type": "tainted",
    "taint_from": [
      "R1B_PAYOUT_SPIKE_TO_NEW_RECIPIENT",
      "R3B_SELF_SUBMITTED_TEST_THEN_DRAIN",
      "R9B_PAYOUT_FROM_FLAGGED_NEAR_ACCOUNT"
    ],
    "taint_field": "address",
    "hops": 1,
    "check": [
      "to_addr"
    ],
    "cross_only": true
  },
  "shield": {
    "mode": "paranoid",
    "capability": "pause_destination",
    "scope": [
      "address"
    ]
  }
}
15 R8_DEPOSIT_LEDGER_MISMATCHR8_deposit_ledger_mismatch.yaml Verifier credited a deposit that the token contract refundedShadow ledger at transaction granularity. For one NEAR tx and token, intents.near's internal balance change (mt_mint - mt_burn) must not exceed what it actually kept on the token contract (deposited - refunded). Evaluated when the token contract emits the refund. Ledger tampering nearverifierledger 0
No alerts in this window. 
{
  "source": "near.nep245",
  "condition": {
    "type": "deposit_ledger_mismatch",
    "verifier": "intents.near",
    "token_contracts": [
      "v2_1.omni.hot.tg"
    ]
  },
  "shield": {
    "mode": "under_attack",
    "capability": "raise_mode",
    "scope": [
      "chain",
      "bridge",
      "token"
    ]
  }
}
15 R8B_UNBACKED_CREDIT_WITHDRAWNR8_deposit_ledger_mismatch.yaml Account withdraws from intents.near after receiving an unbacked creditFollow-up to R8. The Verifier accounts that received a credit the token contract refunded (R8 evidence `credited_accounts`), or an account they moved funds to inside the Verifier (one hop), withdraw from intents.near. This is the step where an unbacked balance leaves the Verifier, before any treasury on another chain pays it out. Withdrawal nearverifierledgerwithdrawaltaint 0
No alerts in this window. 
{
  "source": "near.nep245",
  "match": {
    "contract": "intents.near",
    "kind": "withdrawal",
    "status": "success"
  },
  "condition": {
    "type": "tainted",
    "taint_from": [
      "R8_DEPOSIT_LEDGER_MISMATCH"
    ],
    "taint_field": "evidence.credited_accounts",
    "hops": 1,
    "check": [
      "from_addr"
    ],
    "observe": {
      "chain": "near",
      "contract": "intents.near"
    }
  },
  "shield": {
    "mode": "under_attack",
    "capability": "raise_mode",
    "scope": [
      "chain",
      "bridge",
      "token"
    ]
  }
}
12 R9B_PAYOUT_FROM_FLAGGED_NEAR_ACCOUNTR9_withdrawal_link.yaml Treasury payout authorized by a NEAR account that NEAR rules flaggedCross-chain link. A HOT treasury payout's calldata nonce equals the memo of the HOT omni mt_burn on NEAR that authorized it. If the NEAR account that burned was involved in an R6 or R8 alert (or received funds from such an account, one hop), the EVM payout inherits the flag and its recipient is tainted for R7 / R7B. Treasury drain evmtreasurypayoutxchain 0
No alerts in this window. 
{
  "source": [
    "evm.erc20_transfer",
    "near.nep245",
    "near.dip4"
  ],
  "match": {
    "kind": "payout",
    "vault": "hot_bridge",
    "extra.withdraw_nonce": {
      "exists": true
    }
  },
  "condition": {
    "type": "withdrawal_link",
    "mode": "tainted_origin",
    "taint_from": [
      "R6_INTENTS_CALLBACK_ANOMALY",
      "R8_DEPOSIT_LEDGER_MISMATCH"
    ],
    "hops": 1
  },
  "shield": {
    "mode": "paranoid",
    "capability": "pause_destination",
    "scope": [
      "address"
    ]
  }
}
8 R10_RECIPIENT_PAYOUT_BURSTR10_recipient_payout_burst.yaml Burst of large treasury payouts to one new counterpartyWazuh-style frequency rule: three or more stablecoin payouts over $250K from the same treasury to the same recipient within 2h, where the recipient had at most 3 such payouts in the 7 days before the burst. Regular counterparties of the NEAR Intents Ethereum treasury receive bursts like this every day; `max_prior` keeps those regular counterparties out. Splitting a drain into several payouts below the R1 / R5 thresholds still trips it. One alert per recipient per 6h. Treasury drain evmtreasurypayoutfrequency 0
No alerts in this window. 
{
  "source": "evm.erc20_transfer",
  "match": {
    "kind": "payout",
    "vault": [
      "hot_bridge",
      "near_intents"
    ],
    "symbol": [
      "usdt",
      "usdc"
    ],
    "amount_usd": {
      "gt": 250000
    }
  },
  "condition": {
    "type": "frequency",
    "group_by": [
      "chain",
      "vault",
      "to_addr"
    ],
    "count": 3,
    "within": "2h",
    "max_prior": {
      "count": 3,
      "within": "7d"
    }
  },
  "ignore": "6h",
  "ignore_key": [
    "chain",
    "vault",
    "to_addr"
  ],
  "shield": {
    "capability": "flag_observation",
    "scope": [
      "chain",
      "bridge",
      "token",
      "address"
    ]
  }
}
15 R9_UNMATCHED_HOT_PAYOUTR9_withdrawal_link.yaml (disabled) HOT treasury payout without a matching NEAR burnReconciliation. Every HOT treasury payout should match a HOT omni mt_burn on NEAR with the same nonce, token and amount. Disabled by default: it needs complete NEAR coverage of the HOT omni contract (live mode). The replay holds sampled NEAR blocks, where most honest payouts would look unmatched. Treasury drain evmtreasurypayoutxchainreconciliation 0
No alerts in this window. 
{
  "source": [
    "evm.erc20_transfer",
    "near.nep245"
  ],
  "match": {
    "kind": "payout",
    "vault": "hot_bridge",
    "extra.withdraw_nonce": {
      "exists": true
    }
  },
  "condition": {
    "type": "withdrawal_link",
    "mode": "unmatched"
  },
  "shield": {
    "mode": "under_attack",
    "capability": "raise_mode",
    "scope": [
      "chain",
      "bridge",
      "token"
    ]
  }
}
5 R100_ROUND_AMOUNT_PAYOUTR100_round_amount_payout.yaml (disabled) (score only) Large payout of an exact round amountExample of a local extension. Exact round amounts above $100K are a weak signal; score only. Treasury drain localevmpayout 0
No alerts in this window. 
{
  "source": "evm.erc20_transfer",
  "match": {
    "kind": "payout",
    "vault": {
      "exists": true
    }
  },
  "condition": {
    "type": "round_amount",
    "step": 100000,
    "min_value": 100000
  }
}

Data & provenance

Fixtures recorded public chain data

112,368 normalized events replayed (whole replay window 01 Sep - 26 Sep 2026). Recorded 2026-10-26T18:32:21.957424Z with intentwatch fetch-fixtures --scenario oct1 into tests/fixtures/oct1.

PartRangeRecords
NEARblocks 68 anchor txs, 576 blocks 576
Manifest entry
{
  "anchors": 68,
  "blocks": 576,
  "chain": "near",
  "kind": "blocks"
}
Ethereumrange via etherscan 2026-09-01T00:00 → 2026-10-01T16:00
blocks 25878705-26098520 (out)		 59,988
Manifest entry
{
  "chain": "ethereum",
  "collector": "etherscan",
  "directions": [
    "out"
  ],
  "from_block": 25878705,
  "from_ts": "2026-09-01T00:00:00Z",
  "kind": "range",
  "native": false,
  "records": 59988,
  "to_block": 26098520,
  "to_ts": "2026-10-01T16:00:00Z"
}
Ethereumrange via etherscan 2026-09-30T12:00 → 2026-10-01T16:00
blocks 26090155-26098520 (in, native)		 10,571
Manifest entry
{
  "chain": "ethereum",
  "collector": "etherscan",
  "directions": [
    "in"
  ],
  "from_block": 26090155,
  "from_ts": "2026-09-30T12:00:00Z",
  "kind": "range",
  "native": true,
  "records": 10571,
  "to_block": 26098520,
  "to_ts": "2026-10-01T16:00:00Z"
}
Ethereumknown_txs 2 known txs 2
Manifest entry
{
  "chain": "ethereum",
  "kind": "known_txs",
  "records": 2,
  "txs": 2
}
BNB Chainrange via evm_rpc 2026-09-01T00:00 → 2026-10-01T16:00
blocks 119243646-125128702 (out+in)		 76,585
Manifest entry
{
  "chain": "bsc",
  "collector": "evm_rpc",
  "directions": [
    "out",
    "in"
  ],
  "from_block": 119243646,
  "from_ts": "2026-09-01T00:00:00Z",
  "kind": "range",
  "native": false,
  "records": 76585,
  "to_block": 125128702,
  "to_ts": "2026-10-01T16:00:00Z"
}
BNB Chainknown_txs 5 known txs 5
Manifest entry
{
  "chain": "bsc",
  "kind": "known_txs",
  "records": 5,
  "txs": 5
}
BNB Chainscan 2026-09-30T18:56 → 2026-09-30T18:58
blocks -		 1
Manifest entry
{
  "chain": "bsc",
  "from_ts": "2026-09-30T18:56:00Z",
  "kind": "scan",
  "note": "10 USDT test withdrawal",
  "records": 1,
  "to_ts": "2026-09-30T18:58:30Z",
  "txs": [
    "0x4f426e23cda7ab58fd146f4f81489575563770c5d25b49d156870dc1dc1428d5"
  ]
}
BNB Chainscan 2026-09-30T20:04 → 2026-09-30T20:06
blocks -		 1
Manifest entry
{
  "chain": "bsc",
  "from_ts": "2026-09-30T20:04:00Z",
  "kind": "scan",
  "note": "11 USDT test withdrawal",
  "records": 1,
  "to_ts": "2026-09-30T20:06:30Z",
  "txs": [
    "0xc002bd17fb1d46833088c4deb2e05949fc33bdbd9f95ff53295af0c8f68bfdbf"
  ]
}

Blind spots and caveats

  • Confidential Intents (private shard): only entry and exit are visible.
  • HOT / MPC off-chain entitlement accounting: not visible; only its on-chain effects are.
  • Non-EVM treasuries (BTC, SOL, TON, Stellar, ...) are not collected; native BNB flows on BNB Chain are not either.
  • NEAR is sampled: the incident replay holds the blocks around the attacker's own NEAR transactions, which were picked by hand from the post-mortem, plus about a minute of benign context. A live run has no such list.
  • Hindsight: rules were designed after the post-mortem and tuned with the replay at hand, so timing on the incident is a best case. The out-of-sample scenario is the real test.
  • Detection, not prevention: nothing here submits to SHIELD or blocks anything on NEAR Intents or HOT.

Sources: https://bscscan.com/tx/0x718e5ea9a5e54426da72acb778c033508004b1e797ada87bc528599c800e74dd

IntentWatch · external, read-only detection over public on-chain data · incidents are SHIELD-shaped but unofficial · built at NEAR HACKATHON