trace_theft
Trace stolen funds from a victim's transaction to the trail's end, using modes for authentic transfers, cross-chain bridges, or TRON relay hops.
Instructions
Follow stolen funds from the victim's transaction to where the trail dies. moved: what actually left a wallet, marking which transfers are authentic — ERC-20 Transfer logs are attacker-controlled text, so only the transaction signer is authoritative. bridge: read a cross-chain exit; aggregators write the destination into their own calldata because the far side needs it, and chain ids are checked against a table before any field is called an amount. tron: walk a TRON account, detecting relay hops — an account forwarding what it received, within seconds, is a pass-through and not a destination.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| mode | Yes | moved | bridge | tron | |
| chain | No | ||
| txHash | No | ||
| address | No | TRON T-address for mode tron | |
| maxHops | No |