FundTrace
Read-only on-chain fund-flow triage
When funds move unexpectedly, the first question is always the same: where did the value go, and through whom? FundTrace answers the first pass. It takes one address and a block range, pulls every ERC-20 transfer the address was party to, and produces a structured report.
Use cases
FundTrace is triage. It builds the transfer set an analyst would otherwise assemble by hand, one explorer page at a time.
Incident first pass
A wallet or treasury moved funds unexpectedly. Get the transfer set, the counterparties ranked by count and by value, and the token totals in one report.
Counterparty review
Check what an address actually did with yours over a window: how much moved in, how much moved out, and whether value looks held or relayed.
Treasury activity review
Summarize a period of treasury operations into per-token inflows, outflows, and net movement, without writing explorer queries.
Evidence collection
Every transfer row carries its block and transaction hash, so a finding can be re-checked against the raw chain data or another endpoint.
What you get
Two report files per run — Markdown to read, JSON for machines — and every row carries the transaction hash it came from, so any line can be checked on-chain. See a real, unedited report.
| File | For | Contents |
|---|---|---|
| reports/<address>-<timestamp>.md | People | A readable report: per-token totals, top counterparties by count and by value, flagged patterns with their evidence, and the endpoint used. |
| reports/<address>-<timestamp>.json | Machines | The same result as structured JSON, for pipelines and later comparison between runs. |
What it reports
- Transfer set. Every ERC-20 Transfer event across the chosen block range where the address is sender or recipient.
- Per-token totals. Inbound, outbound, and net amounts, computed per token. Tokens are never summed across units, and no fiat value is reported.
- Counterparties. The other party in each transfer, ranked two ways: by number of transfers, and by value in the single most active token.
- Pattern flags. Pass-through flow, rapid fan-out, round-trip counterparties, and round-number transfers, each with a severity, a plain summary, and its on-chain evidence.
Every flag is a heuristic and a lead, not a finding. Where the method can be wrong is documented in products/fundtrace/docs/methodology.md.
How it works
-
Read the transfers.
Two eth_getLogs queries cover the address as sender and as recipient; results are merged and de-duplicated on transaction hash and log index.
-
Decode and aggregate.
Each log is decoded to sender, recipient, and amount. Token symbol and decimals are read from the token contract. All arithmetic stays in raw token units.
-
Flag and report.
Simple flow patterns are computed over the window, then the Markdown and JSON reports are written.
Command line, Node.js 20 or newer, no npm dependencies. Source and options: products/fundtrace.
Pricing
Per triage, scoped by the address and block range under review.
| Engagement | Price | Scope |
|---|---|---|
| Standard triage | from $500 | One address and block range, delivered as the Markdown and JSON reports, plus a short written summary of the flags. |
| Extended triage | $1,500–2,500 | Wider ranges, multiple addresses, archive-endpoint work for older history, and a walkthrough call over the findings. |
Final price depends on the block span and how many endpoints and addresses are involved. Wide historical windows are slower and cost more to produce. Reports are preliminary, evidence-grade intelligence derived from public chain data — not court-admissible attribution or expert-witness output. Pricing reflects that ceiling.
Limits
What FundTrace does not do
- It is not a recovery service. It does not prevent, remediate, or recover anything, and it makes no outbound contact.
- It is not legal, financial, or investment advice.
- It covers ERC-20 transfers only. Native-value transfers, internal transfers created by contracts, and NFT transfers are not attributable here, so value can move through a path this tool does not observe.
- It performs no attribution. An address is an address; FundTrace does not label, cluster, or identify counterparties.
- Output is preliminary intelligence, not court-grade evidence. It is built from public data and is not suitable as expert testimony or as the sole basis for a legal claim; court-grade attribution requires licensed forensic data.
- Patterns are heuristics that can produce both false positives and false negatives. A relay can be a treasury sweep or a market maker; rapid dispersal can be a payment batch or an exchange hot wallet.
- Endpoints can be incomplete. Free public endpoints are not archives; an empty result over an old range is inconclusive unless the endpoint used is a known archive.
- Thresholds change the flags. Change them deliberately and say so when citing a result.