Incident Analysis
Incident Analysis turns an attacker's address into a forensics report. You create an incident, ChainHint traces where the money went, prices every transfer on the day it moved, and a language model writes the report from those figures. On paid plans the result exports as a PDF with a freeze-request evidence packet for exchanges.
How an analysis runs
Create the incident
Enter the attacker's address, its chain and the incident date. It is saved as a draft.
Trace
A breadth-first trace follows outgoing transfers hop by hop and records exchanges, mixers, bridges and DEX swaps on the way.
Report
A language model writes the report from the trace. It may only quote figures the trace produced.
Export
On paid plans: a PDF of the graph, timeline and report, with a freeze-request evidence packet.
How far a trace goes
Depth is counted in hops — each step from one address to the next. The number of addresses caps how wide the trace can fan out; cases are investigations you can run. Every plan traces all twelve chains.
| Plan | Hops | Addresses | Cases |
|---|---|---|---|
| Free | 3 | 50 | 1 |
| Investigator | 4 | 500 | Unlimited |
| Agency | 6 | 2,000 | Unlimited |
The trace stops at a bridge or an instant-swap service: it flags the exit and names the destination chain, and you continue with a new trace there. It does not follow funds onto another chain by itself.
What the report contains
Summary
Two or three sentences on what happened.
Attack classification
The attack type, a MITRE ATT&CK technique where one applies, a confidence from 0 to 1, and how the attack most likely worked.
Timeline
Dated events, each with its transaction hash where known.
Where the funds went
A plain-language account of the destinations the trace reached.
Endpoints
Each destination with its type — exchange, mixer, bridge or unknown — and entity name where known.
Recovery assessment
Likelihood and time sensitivity: funds still at an exchange can be frozen, funds in a mixer usually cannot.
Recommended actions
Ordered by urgency, with the compliance contact to write to when funds reached a known exchange.
Every number comes from the trace
The model is given a list of verified figures — amounts, address and transfer counts — and may only copy them. It may not add, round, average or estimate. Before the report is saved, each figure is checked against the trace; a sentence carrying a number that does not reconcile is removed, and a recommended action with an invented number is dropped whole. Where no verified figure exists, the report says it in words: "the largest destination", "most of the traced funds".
Attack classification
The report assigns one of six types, with the MITRE ATT&CK technique where one applies and a confidence between 0 and 1. The classification rests on patterns in the transactions, not on news coverage.
Loss calculation
Every transfer is valued with DeFiLlama historical prices for the day it moved — not one price for the whole trace. A trace that runs over weeks or months would otherwise report what the assets were worth on a single arbitrary date. Both native tokens (ETH, BTC, SOL, BNB…) and ERC-20 / SPL tokens are included, and tokens are priced strictly by contract address, never by the symbol they report about themselves.
A token with no historical price for a given day is left unpriced rather than valued at today's price, and the graph records which days it could and could not price. Each transfer also carries its value at today's price, so you can switch between "value when moved" and "value today" without re-running the trace.
Freeze-request evidence packet
The PDF export (Investigator and Agency) includes a packet written to accompany a freeze request that you, your lawyer or law enforcement send to an exchange or token issuer. It lists the subject address, chain, incident date and first traced outflow, and every transfer with its transaction hash and block time so each line can be checked on a public explorer.
It states plainly what it is not: dollar figures are valuations at a stated price source, not settlement amounts; entity labels are attributions, not findings that anyone committed an offence; AI-written sections are marked as such. ChainHint does not freeze assets and does not contact exchanges, issuers or anyone else on your behalf.
A real trace: the Bybit hack
ChainHint's public trace of the February 2025 Bybit hack follows 833 transfers across 356 addresses and 6 hops, from Feb 21, 2025 to Jan 11, 2026. The first hop out of the attacker's address moved ETH ($1.1B), stETH ($240M), cmETH ($43.4M), mETH ($23.2M). 2 of the transfers are DEX swaps. The graph, the addresses and the report are open on the Bybit case page.
When the trace finds nothing
An empty trace means ChainHint found no outgoing transfers within the plan's depth, or a data provider did not answer — the incident says which. Absence of data is not a clean verdict. It is never reported as "funds are clean".
