Sigvex
EVMAnalysis3 min read

EVM Wallet Forensics

Results page for an EVM wallet forensics run — 11 tabs from Timeline to Evidence, with risk score and counterparty analysis.

Open EVM Wallet AnalysisAll guides
evmwalleteoaforensics

What it is

The results page for a completed EVM wallet forensics run. The page has 11 tabs: Timeline, Findings, Dust, Fund Flow, Counterparties, Approvals, Attacks, Post-Mortem, Reconstruction, Compliance, and Evidence. A risk score summarises the wallet across the forensic components.

Why it exists

Wallet investigation needs more than a transaction list — it needs timeline correlation, approval risk, counterparty profiles, post-mortem narrative, and an evidence package for reporting. Each of those is a distinct view, so the page exposes them as a consistent tab set instead of one scrolling dump.

Who uses it

  • Forensics analyst — investigates a suspect wallet from multiple angles.
  • Compliance officer — reviews the Compliance tab and exports the Evidence package.

How to open it

  1. From /evm-eoa-analyze after a successful run.
  2. From the Wallets inventory — click a wallet card.
  3. Direct URL — /evm-eoa?network=<chain>&address=<0x…>.

Using the page

  1. Risk score — summary score with per-component breakdown.
  2. Timeline — chronological list of wallet events.
  3. Findings — detector hits for this wallet.
  4. Dust — dust-attack indicators.
  5. Fund Flow — canvas-rendered flow graph of inbound and outbound value.
  6. Counterparties — profiled interaction partners with risk signals.
  7. Approvals — outstanding ERC-20 / ERC-721 approvals and their risk.
  8. Attacks — attack patterns matched against the wallet’s activity.
  9. Post-Mortem — narrative reconstruction of a security event.
  10. Reconstruction — step-by-step attack reconstruction.
  11. Compliance — sanctions and compliance screening report.
  12. Evidence — evidence items packaged for reporting.

Inputs and outputs

Input Source Required
network Query string yes
address Query string yes
Output Format Destination
Forensics report In-page tabs HTML
Evidence package Rendered items Evidence tab

Controls reference

  • Tabs: Timeline, Findings, Dust, Fund Flow, Counterparties, Approvals, Attacks, Post-Mortem, Reconstruction, Compliance, Evidence.
  • Risk score breakdown — per-component values including counterparty and approval risk.

Limits

  • Requires a signed-in account.
  • Requires both network and address query parameters pointing at a wallet that has a completed analysis.
  • Each tab loads lazily; some tabs are populated asynchronously after the initial render.

Troubleshooting

Symptom or error Cause Action
Tab stuck on “Loading…” Upstream API slow or failed Switch away and back, or reload.
Fund Flow canvas empty Wallet has no value flow in the window None — no data is a valid result.
Compliance tab empty No sanctions or compliance matches None — this is expected for most wallets.