chainpeek: check a wallet for a drain: tokens pulled out in transactions it did not send
check_wallet_drainDetect unauthorized token pulls from a wallet by scanning recent blocks and reviewing transfers, allowances, nonces, and evidence to return a drained, review, or clean verdict.
Instructions
chainpeek: Check a wallet for a drain: find tokens pulled out without its signature. For live approvals with revoke transactions use audit_token_approvals. Returns a verdict (drained | review | clean) for wallet over the latest 2,000 blocks: each transfer out of USDC and USDT (or up to 5 tokens) is sent, authorized (EIP-3009, as x402 uses), wallet_code, pulled (someone else's transaction) or unknown, with the puller and its live allowance, the nonce before and after, and evidence. Drained: a pull to an address the wallet did not pay itself, or pulls of half of a token's holding. Review: other pulls, a balance that fell with an unmoved nonce, smart-account or EIP-7702 wallets. Gasless orders look like pulls. Bad input is a 422, a failed read a 502 (neither charged). Typically 2-10 s. Price: USD 0.002. Free: 10 chain reads per IP per UTC day. Docs: https://tanod.dev/learn/wallet-drain-check-api.html
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| chain | Yes | base or ethereum (the chains with built-in USDC and USDT here). | |
| tokens | No | 1 to 5 tokens: USDC, USDT or contract addresses. Default: USDC and USDT. | |
| wallet | Yes | The wallet to check (0x + 40 hex). | |
| lookback_blocks | No | Latest blocks read (1-2,000; default 2,000, about 67 minutes on Base and 6.7 hours on Ethereum). |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| risk | No | ||
| chain | No | ||
| error | No | Only on an error result: an object {code, message}, or the reason string of an x402 PaymentRequired object. | |
| nonce | No | ||
| rules | No | ||
| counts | No | ||
| limits | No | ||
| tokens | No | ||
| wallet | No | ||
| history | No | ||
| reasons | No | ||
| verdict | No | ||
| rpc_calls | No | ||
| transfers | No | ||
| wallet_code | No | ||
| transfers_total | No |