FOR INVESTIGATORS
Reconstruct the story, not the address graph.
An incident is a narrative: what was attempted, what committed, what rolled back, where value went. Evidence-grade reconstruction with every claim bound to the transaction that carries it.
concept CASE FILE · INCIDENT RECONSTRUCTION evidence-grade
02:14:07 rolled back
exhibit A · probe Attempted withdrawal with a forged receipt object — aborted at the terminal check. Paid gas to learn the guard exists.
tx ▸ bound 02:14:52 rolled back
exhibit B · probe Same call, different receipt. Aborted at the same boundary. The attack is converging on one check.
tx ▸ bound 02:16:33 committed
exhibit C · breach Third variant committed: flash-funded deposit inflated the share price before withdrawal.
tx ▸ bound 02:17:01 committed
exhibit D · exit Proceeds split across 4 fresh addresses; 3 hops later, consolidated at one bridge.
tx ▸ bound 02:31:44 tracked
exhibit E · now Value currently sits behind the bridge — every hop bound to the transaction that carries it.
tx ▸ bound
The two failed probes are the finding: the exploit rehearsed before it
succeeded — visible eleven minutes early to anyone reading meaning instead of bytes. Every
sentence above binds to its transaction, including what the evidence does not establish.
What exactly happened, in order?
What did the attacker try that failed?
already real underneath
Every sentence the system writes is bound to per-transaction evidence — including explicit statements of what the evidence does not establish.