till_trace_theft
FOLLOW STOLEN FUNDS from the victim's transaction to where the trail dies. Three modes. moved: what actually left a wallet in one transaction, marking which transfers are AUTHENTIC — ERC-20 Transfer logs are attacker-controlled text, so only the transaction signer is authoritative and forged events are flagged rather than followed. bridge: read a cross-chain exit; aggregators write the destination chain and receiver into their own calldata because the far side needs them, and chain ids are checked against a table before any field is called an amount (0x2b6653dc reads as a plausible token amount and is in fact TRON mainnet). tron: walk a TRON account's flow, detecting relay hops — an account forwarding the amount it received, within seconds, is a pass-through and not a destination. Reports hops, never identity or intent.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| mode | Yes | moved | bridge | tron | |
| chain | No | EVM chain for moved/bridge — base (default) | ethereum | optimism | polygon | arbitrum | gnosis | |
| txHash | No | transaction hash (modes: moved, bridge) | |
| address | No | TRON address, T-form (mode: tron) | |
| maxHops | No | tron mode: how far to walk (default 3) |