● Crypto incident investigations
Onchain Files turns crypto incidents into evidence-backed investigation files: what happened, where the money went, and what can actually be proven.
Machines collect and connect the evidence. A human investigator reviews every file before it is published.
NEAR Intents exploit
Signal
"Immediately transferred to Kucoin and bridged to Bitcoin." · ZachXBT Attributed
Onchain evidence
7 signed withdrawals · 3,865,021 USDT Verified
Money trail
How it works
Public signals from X, project announcements and security researchers become preliminary cases within minutes.
Posts, alerts, announcements → claim
Every claim is checked against the chain. Each finding is labelled verified, inferred, attributed, project-reported or unknown.
Claim → transactions, contracts, balances
Wallets, swaps, bridges and exchange deposits are followed across chains, and the file keeps watching after the news moves on.
Transfers → wallet map → money flow
From signal to file
Each stage below is shown with what it produced for Case #001.
PeckShield and ZachXBT flag a $3.8M+ drain of a BSC hot wallet.
7 withdrawals found, starting Sep 30: 13 hours before the announcement.
BSC → Ethereum → Chainflip and THORChain → one Bitcoin collector.
34.59 BTC held in 5 addresses, monitored for movement.
The internet says.
The chain shows.
01 · The claim
"The funds were immediately transferred to Kucoin and bridged to Bitcoin."
ZachXBT, Oct 1, 2026, as reported by Protos
02 · The evidence
800 BNB reached a wallet labelled KuCoin. That is part of the money, not all of it.
4.26 BTC came from the drain wallets' Ethereum deposits through THORChain, proven by memos on both chains.
20.48 BTC matches their Chainflip deposits. Another 9.96 BTC came from payers not yet identified, so a KuCoin route for that part can't be ruled out.
750 BNB went back into the NEAR Intents vault during the drain.
03 · The unknown
Who signed the withdrawals.
Who the operators are.
Where NEAR Intents delivered the 750 BNB.
Every file opens the same way: what was reported, what we verified, and what cannot yet be established.
Follow the money · Case #001
A solid line is a transfer we read onchain. A green line is a cross-chain link proven by records on both chains. A dashed line is our inference, and says so.
Open the interactive map in Case #001 → Click any edge for its transactions, amounts, times and evidence.
The system
The radar finds the signal. The engines build the case. A human investigator reviews every file before it is published.
↓
↓
↓
↓
Anatomy of a file
What happened, when, and to whom.
Which addresses are involved, and how they connect.
Where the funds went, across every chain.
Onchain events and public statements, in order.
Every link, the record behind it, and its status.
What could not be established, listed explicitly.
Transaction hashes and every outside source cited.
Current holdings, last movement and updates.
Evidence standard
Every claim in an Onchain File carries exactly one status. A claim moves up only when new evidence arrives, and the change is recorded.
Verified
Read onchain by us: a transaction, balance, event or contract code. A direct link is a cross-chain connection proven by records on both chains.
Inferred
Our deduction from patterns, such as matching timing and amounts. The method is always stated.
Attributed
Someone else's claim or label: explorer labels, other investigators. The source is always named.
Project-reported
A statement from the affected project or its team.
Unknown
What could not be established. Listed in every file, never left out.
The files
The next file opens when the next incident surfaces. Each file is reviewed by a human investigator before publication.
Who it's for
A complete evidence trail for your own incident, ready to hand to exchanges and investigators.
A structured starting point instead of a blank block explorer.
Transaction hashes, timestamps and deposit paths, with the uncertainty marked.
What can be stated as fact, what is claimed, and by whom.
The blockchain remembers. Onchain Files makes it searchable.
Onchain Files doesn't decide who is guilty. It makes the money trail impossible to ignore.
Onchain Files