Which Tracefunds use case should I pick after a wallet drain?

Use Wallet drain & hack ($20 incident report) for unauthorized outflows. If you only have one suspicious transaction hash, start with Single transaction decode ($5), then upgrade if funds left in other transfers the same day.

What is the difference between outbound trace and incident mode?

Outbound trace ($20) lists only money leaving a wallet — investigator-neutral. Incident mode ($20) scopes to a drain window, adds victim-safe brief tone, verification checklist, and exchange abuse pack copy.

When should I screen an address vs run a full case file?

Address screen ($10) is for pre-send due diligence before you transfer assets. Full case files ($20) are for after loss or when you need a fund-flow graph and share-ready evidence.

Does Tracefunds support Solana, Monad, and HyperEVM use cases?

Yes — Solana swap decode, wallet drain, NFT drain, and SPL delegate audit each have dedicated use case pages. Monad and Ethereum have chain-specific wallet drain pages. HyperEVM (Hyperliquid chain 999) has a dedicated HyperEVM wallet drain use case.

Which use case for NFT drains on Ethereum vs Solana?

Use EVM NFT drain ($20) for ERC-721/1155 on Ethereum, Base, or Arbitrum. Use Solana NFT drain for Metaplex or compressed NFTs on Solana — different explorers and report pipelines.

Use cases

When to trace funds — scenarios we built for

Each card explains a scenario, links to a free guide when relevant, and opens a pre-filled trace on the hub. From $5 single-tx decode to $20 full case files on Ethereum, Solana, Arbitrum, Hyperliquid, and Monad.

$5 — Quick scan

One transaction hash or signature

$5 scan

Single transaction decode

Paste one transaction hash. Decode native, token, and NFT movements, labeled counterparties, and plain-English summary — scoped to that tx only.

Read scenario →

$5 scan

Solana swap decode

Paste one Solana signature from Solscan. Decode SOL and SPL legs, Jupiter/PUMP routes, and marketplace actions — scoped to that signature only.

Read scenario →

$10 — Standard scan

Address screen or approval audit

$10 scan

Solana SPL delegate audit

Scan active SPL token-account delegates before or after a scare. Risk-ranked table with Solscan links — not Revoke.cash (EVM only).

Read scenario →

$10 scan

Address risk screen

Pre-send due diligence: label lookup for phishing, mixer, and exchange hits plus a sample of recent public activity — no wallet connect.

Read scenario →

$10 scan

EVM approval audit

Scan standing ERC-20 and NFT operator approvals on Ethereum and EVM chains. Risk-ranked table with Revoke.cash links — prevention and post-scare cleanup.

Read scenario →

$20 — Full case file

Wallet drain, outbound trace, or survey

$20 scan

Wallet drain & hack

Full incident case file from $20: fund-flow graph, labeled destinations, verification checklist, and share-safe victim brief for exchange abuse desks.

Read scenario →

$20 scan

Exchange abuse report

Follow outbound flows toward labeled exchange deposits and export language, hashes, and timelines suitable for platform abuse forms — after you verify the checklist.

Read scenario →

$20 scan

Solana wallet drain

SOL, SPL tokens, and NFTs left your Phantom or Solflare wallet without authorization. Index outbound flows, labeled CEX deposits, and a verification checklist — no wallet connect.

Read scenario →

$20 scan

Solana NFT drain

Metaplex, compressed NFTs, or marketplace-listed assets left your wallet without authorization. Index outbound NFT flows, collection proof table, and labeled destinations.

Read scenario →

$20 scan

Trace suspect address

Paste a receiving or drainer address. Outbound-only $20 report: every transfer leaving that wallet, fund-flow graph, labeled CEX/bridge paths when known — investigator-neutral.

Read scenario →

$20 scan

Ethereum wallet drain

Mainnet wallet hacked? Index outbound ETH, tokens, and NFT transfers from your 0x address — fund-flow graph, CEX deposit labels, verification checklist, and abuse pack copy.

Read scenario →

$20 scan

Monad wallet drain

MON, tokens, or NFTs left your Monad wallet without authorization. Index outbound flows on Monad mainnet — fund-flow graph, labeled destinations, and verification checklist.

Read scenario →

$20 scan

EVM NFT drain

OpenSea, Blur, or wallet collections swept without authorization on Ethereum, Base, or Arbitrum. NFT proof table, outbound graph, and labeled marketplace or CEX destinations.

Read scenario →

$20 scan

HyperEVM wallet drain

Assets drained on HyperEVM (Hyperliquid chain 999)? Index outbound EVM transfers — fund-flow graph, HyperEVMScan verification links, and honest bridge limits.

Read scenario →

Victims & families

Wallet drains, NFT drainer sweeps, and phishing setup txs — indexed into a verification checklist and share-safe brief.

Read guide →

Investigators & treasury

Outbound traces, CEX deposit follows, bridge hops, and wallet surveys — start from a fund-flow graph instead of manual explorer tabs.

Read guide →

Prevention

Single-transaction decode before you act, address screens, and approval audits — Revoke.cash on EVM, SPL delegate review on Solana.

Read guide →

Pre-filled examples

Jump straight to the trace hub with sample addresses or hashes — including outbound traces, address screens, and EVM approval audits not listed above. Payment still required for live reports.

Victim incidents

incident

Wallet drain / hack

NFT or token outflows from a compromised wallet — incident report, verification checklist, victim-safe brief.

Try example →incident

Drain — one UTC day only

Same wallet scoped to the busiest drain day — faster index, tighter counts.

Try example →incident

Wallet drain (Ethereum)

Mainnet outbound NFT/token activity — ETH pipeline demo.

Try example →incident

Solana wallet activity sample

Public swap/NFT-active wallet for Solana incident pipeline demo.

Try example →incident

Solana NFT drain sample

Public NFT-active wallet for Solana incident / NFT outbound demo.

Try example →incident

NFT approval / drainer sweep

Bulk NFT outflows in a short window — consistent with approval abuse or automated drainer execution.

Try example →incident

Phishing / approval setup

Zero-value native txs and approval patterns — review before reusing the wallet; revoke stale approvals.

Try example →incident

Trace to exchange deposit

Follow outbound flow to a labeled exchange recipient — abuse pack copy for platform filings.

Try example →incident

Mixer / privacy pool touch

Honest limits when funds hit a mixer — onward tracing is often not possible on-chain.

Try example →incident

Bridge in outbound path

Bridge contract in the flow — check the destination chain for the same wallet or labeled entity.

Try example →

Transactions

single tx

Single transaction explanation

Decode one transaction — what moved, labeled counterparties, plain-English step summary.

Try example →single tx

Solana swap decode (PUMP AMM)

Public PUMP AMM swap signature — scoped single-tx demo, not a drain verdict.

Try example →single tx

Confirm a payment landed

Did your transfer succeed? Who received tokens or native gas?

Try example →

Investigator & treasury

outbound trace

Trace suspect address

Follow where assets left a wallet — investigator-style, outgoing transfers only.

Try example →wallet survey

Wallet activity survey

Recent inbound and outbound activity — what has this address been doing, without assuming a drain.

Try example →address screen

Solana NFT wallet sample

NFT transfers and marketplace listings on a public sample wallet — address screen demo.

Try example →outbound trace

Treasury / insider outbound

Investigator-style outbound trace from a treasury or hot wallet — no victim-drain assumptions.

Try example →

Prevention & screening

address screen

Screen address before send

Quick label lookup and recent public activity before you transfer assets or sign approvals.

Try example →approval audit

Approval & allowance audit

Find the contracts that can still move your tokens and NFTs — risk-ranked, with one-click revoke links.

Try example →approval audit

Solana SPL delegate audit

Scan active SPL token-account delegates — prevention and post-scare cleanup.

Try example →address screen

Rug / scam counterparty check

Screen a counterparty or decode the payment tx before you send more funds.

Try example →

Coming soon

Protocol / contract exploit

One transaction, many victims — decode exploit-scale outflows (uses single-tx pipeline today).

On roadmap

Coming soon

Exchange hack — victim deposit trace

Trace victim deposits toward labeled hot wallets — emphasis on CEX path and abuse filings.

On roadmap

Bulk CSV screen, sanctions enterprise screen, protocol exploit templates, and LE export packages are on the roadmap. Contact us for early access.

Learn before you pay

New to on-chain tracing? Start with Where did my crypto go?, then how Tracefunds works (Scope → Trace → Verify). Recovery services that DM you first are a common follow-on scam — see recovery scam red flags. All guides: /guides.

Run a trace All guides Pricing