Real-time monitoring
Ingests on-chain activity continuously and alerts when a monitored address moves, so a trace can start while funds are still in flight.
Blockchain forensics
Tracing stolen funds across blockchains.
txScout is a tool I built to make my own on-chain investigations repeatable instead of manual. It scores wallet risk against sanctions and threat intelligence, follows money through mixers and exchanges, and shows the evidence behind every conclusion.
Risk scoring and fund-flow tracing on a single address.
What it does
Four capabilities.
Explainable risk scoring
Labels addresses against OFAC sanctions, mixer, exchange and known scam or hack intelligence. Every score returns the weighted signals that produced it.
Graph-based fund tracing
Follows money through wallets, mixers and exchange deposits, rendered as a graph rather than a list of transaction hashes.
Multi-chain
Investigations run across Ethereum and Solana, since funds rarely stay on the chain they left from.
What I've used it for
Real cases, not benchmarks.
A forensics tool is only worth the cases it can actually follow, so the first thing I did was point it at a known exploit and see whether it held up.
Euler Finance
2023 exploittxScout traced the attack from the attacker's wallet through to the Tornado Cash mixer using only publicly available on-chain data. No privileged access, no paid intelligence feeds, no insider information.
- Source data
- Public chain only
- Path
- Attacker wallet to mixer
- Reconstructed
- End to end
Further cases are in progress, including live traces followed as funds move.
Where it fits
The kind of work it suits.
Post-incident tracing
After an exploit, establishing where funds went and which addresses and off-ramps they touched.
Counterparty checks
Understanding what an address has been exposed to before interacting with it, and why that exposure was flagged.
Threat-actor mapping
Building a picture of the wallets a single actor controls by following the behaviour rather than the labels.
Independent research
Investigating incidents without a commercial intelligence subscription, using only what is publicly on-chain.
Why it's built this way
The evidence is the work.
Most blockchain analytics is expensive and closed. You are handed a risk number with no way to see what produced it, which for an investigator is exactly backwards. A score you cannot interrogate is a score you cannot defend, and defending the finding is most of the job.
So txScout was built the other way round. Every conclusion walks back to the specific transactions supporting it, and every trace can be followed by eye instead of reconstructed by hand. The scoring is deliberately transparent rather than proprietary, because the reasoning is the part worth having.
Underneath it is a modular ingestion-to-alerting pipeline with pluggable backends, SQLite or PostgreSQL for storage and NetworkX or Neo4j for the graph, so the same investigation can run on a laptop or on a server without changing how it works.