Forensics (Know Your Wallet)
Athena Sentinel's wallet synopsis — labels, taint exposure with evidence, counterparties, timeline and a multi-hop fund-flow graph. Hobbyist tooling for $ATHENA holders.
What it is
Forensics is Athena Sentinel’s know-your-wallet view. Paste any EVM address and the page builds a synopsis: who the address is (labels and entity), what it has done (activity, balances, largest movements), how exposed it is to tainted funds (a score with the evidence behind it), who it transacts with, and, on demand, a multi-hop fund-flow graph. It lives at /forensics and is fully token-gated.
Athena Sentinel is a research toy for $ATHENA holders. Labels come from public, licence-safe datasets and heuristics; prices and histories come from free data sources with page caps. Everything can be incomplete or plain wrong. It is not a compliance product, not legal advice, and not a reason to act against anyone.
Chains
| Chain | History source | Notes |
|---|---|---|
| Ethereum, Base, Arbitrum, Robinhood Chain | Public explorer API | Busy wallets hit a page cap — the synopsis says so under “Coverage”. |
| BNB Chain, HyperEVM | Keyed history provider | Available once the operator configures the provider; until then the page reports no history. |
Reading the synopsis
Exposure
A 0–100 score and a band (clear, low, elevated, high, severe) from the published risk model. The bars show how much of the wallet’s priced inflow (or outflow) came from, or went to, addresses in each tainted category — sanctions, sanctioned exchanges, mixers, hack proceeds, scam drainers, darknet markets, ransomware, and funds frozen by a stablecoin issuer. Each bar is backed by rows in the Evidence table. The confidence figure reflects how much of the window was actually covered and how fresh the label set is.
Behavioural flags
| Flag | Meaning |
|---|---|
| Fresh wallet | Young address with very few transactions. |
| Mixer-funded | First funder is a mixer, or a material share of inflow came from one. |
| Pass-through | Repeated episodes where most of an inflow left again within the hour. |
| Touched a drainer | Transacted with an address labelled as a scam / drainer. |
| Frozen by issuer | The address itself has been blacklisted by Tether or Circle. |
| Direct sanctioned counterparty | Transacted directly with a sanctioned entity or exchange. |
Counterparties and the taint frontier
Top counterparties are ranked by USD volume. When one of them has no label of its own but sits a known number of hops downstream of a tainted seed, the row says so (“2 hops from Hack proceeds”). That comes from the taint frontier, a nightly precompute that walks outward from every tainted label, so most lookups can answer “has this wallet touched tainted funds” without building a graph.
Coverage
Every synopsis ends with what it saw: the history source, whether the free source truncated it, the time window, when labels were last synced, and how many provider calls the lookup cost. Treat a truncated synopsis as a partial view.
The fund-flow graph
“Explore” expands the wallet’s neighbourhood hop by hop under fixed budgets (nodes, edges, calls per hop). Exchanges, deposit addresses, DEXes, bridges, protocols, tokens and contracts are shown but never traversed, so the graph follows money between wallets rather than exploding into a protocol’s user base. Taint is propagated along the money in proportion to USD, and the graph reports its own exposure for the root wallet. Hover a node for its summary; click it to open that wallet’s synopsis. The JSON and CSV exports contain the full node and edge lists.
Graphs are kept for a week and their snapshots for a month; the same parameters on the same wallet reuse the existing investigation.
Where labels come from
Only sources whose licences allow it: the US Treasury OFAC SDN list, the public GraphSense tag packs, the DeFiHackLabs exploit reproductions, the Ransomwhere dataset, stablecoin freeze events read directly from the chain, and a small set of hand-curated, on-chain-verified seeds (mixer pools, exchange hot wallets, bridge contracts). Each label carries its source and a confidence, which weights how much it contributes. Labels refresh nightly.
Related: Security alerts · Risk model.