Use cases
When to trace funds — scenarios we built for
More than wallet drains: decode a suspicious transaction for $5, screen an address before you send, or run a full $20 case file when assets already left. Each card opens a pre-filled example on the trace hub.
$20 scan
Wallet drain & hack
Full incident case file from $20: fund-flow graph, labeled destinations, verification checklist, and share-safe victim brief for exchange abuse desks.
Read use case →$5 scan
Single transaction decode
Paste one transaction hash. Decode native, token, and NFT movements, labeled counterparties, and plain-English summary — scoped to that tx only.
Read use case →$20 scan
Exchange abuse report
Follow outbound flows toward labeled exchange deposits and export language, hashes, and timelines suitable for platform abuse forms — after you verify the checklist.
Read use case →$5 scan
Solana swap decode
Paste one Solana signature from Solscan. Decode SOL and SPL legs, Jupiter/PUMP routes, and marketplace actions — scoped to that signature only.
Read use case →$20 scan
Solana wallet drain
SOL, SPL tokens, and NFTs left your Phantom or Solflare wallet without authorization. Index outbound flows, labeled CEX deposits, and a verification checklist — no wallet connect.
Read use case →$10 scan
Solana SPL delegate audit
Scan active SPL token-account delegates before or after a scare. Risk-ranked table with Solscan links — not Revoke.cash (EVM only).
Read use case →$20 scan
Solana NFT drain
Metaplex, compressed NFTs, or marketplace-listed assets left your wallet without authorization. Index outbound NFT flows, collection proof table, and labeled destinations.
Read use case →Victims & families
Wallet drains, NFT drainer sweeps, and phishing setup txs — indexed into a verification checklist and share-safe brief.
Investigators & treasury
Outbound traces, CEX deposit follows, bridge hops, and wallet surveys — start from a fund-flow graph instead of manual explorer tabs.
Prevention
Single-transaction decode before you act, address screens, and approval audits — Revoke.cash on EVM, SPL delegate review on Solana.
Victim incidents
Wallet drain / hack
NFT or token outflows from a compromised wallet — incident report, verification checklist, victim-safe brief.
Try example →incidentDrain — one UTC day only
Same wallet scoped to the busiest drain day — faster index, tighter counts.
Try example →incidentWallet drain (Ethereum)
Mainnet outbound NFT/token activity — ETH pipeline demo.
Try example →incidentSolana wallet activity sample
Public swap/NFT-active wallet for Solana incident pipeline demo.
Try example →incidentSolana NFT drain sample
Public NFT-active wallet for Solana incident / NFT outbound demo.
Try example →incidentNFT approval / drainer sweep
Bulk NFT outflows in a short window — consistent with approval abuse or automated drainer execution.
Try example →incidentPhishing / approval setup
Zero-value native txs and approval patterns — review before reusing the wallet; revoke stale approvals.
Try example →incidentTrace to exchange deposit
Follow outbound flow to a labeled exchange recipient — abuse pack copy for platform filings.
Try example →incidentMixer / privacy pool touch
Honest limits when funds hit a mixer — onward tracing is often not possible on-chain.
Try example →incidentBridge in outbound path
Bridge contract in the flow — check the destination chain for the same wallet or labeled entity.
Try example →Transactions
Single transaction explanation
Decode one transaction — what moved, labeled counterparties, plain-English step summary.
Try example →single txSolana swap decode (PUMP AMM)
Public PUMP AMM swap signature — scoped single-tx demo, not a drain verdict.
Try example →single txConfirm a payment landed
Did your transfer succeed? Who received tokens or native gas?
Try example →Investigator & treasury
Trace outbound funds
Follow where assets left a wallet — investigator-style, outgoing transfers only.
Try example →wallet surveyWallet activity survey
Recent inbound and outbound activity — what has this address been doing, without assuming a drain.
Try example →address screenSolana NFT wallet sample
NFT transfers and marketplace listings on a public sample wallet — address screen demo.
Try example →outbound traceTreasury / insider outbound
Investigator-style outbound trace from a treasury or hot wallet — no victim-drain assumptions.
Try example →Prevention & screening
Screen address before send
Quick label lookup and recent public activity before you transfer assets or sign approvals.
Try example →approval auditApproval & allowance audit
Find the contracts that can still move your tokens and NFTs — risk-ranked, with one-click revoke links.
Try example →approval auditSolana SPL delegate audit
Scan active SPL token-account delegates — prevention and post-scare cleanup.
Try example →address screenRug / scam counterparty check
Screen a counterparty or decode the payment tx before you send more funds.
Try example →Coming soon
Protocol / contract exploit
One transaction, many victims — decode exploit-scale outflows (uses single-tx pipeline today).
On roadmapExchange hack — victim deposit trace
Trace victim deposits toward labeled hot wallets — emphasis on CEX path and abuse filings.
On roadmapBulk CSV screen, sanctions enterprise screen, protocol exploit templates, and LE export packages are on the roadmap. Contact us for early access.
Learn before you pay
New to on-chain tracing? Read How to trace funds on the blockchain, then see how Tracefunds works (Scope → Trace → Verify). Recovery services that DM you first are a common follow-on scam — see our recovery scam red flags guide. Terms: glossary.