What happens when something moves that shouldn’t?
Treasury wallets, protocol authority, and multisig signers are the accounts that matter. VikingIntel watches them continuously, so the first unexpected movement becomes an evidence-backed response — not a post-mortem.
Watch the accounts your protocol depends on.
Treasury, authority, cold storage, and bridged-asset vaults — continuously monitored with behavior-based detection rules. The watch runs before an incident exists to be reported.
- NormalTreasury_112.4M USDC · 4 signers
- WatchingAuthority multisigowner set · threshold 3
- NormalCold wallet 7xKX…4nQpidle 8 months
- NormalLiquidity pool vaultbridged assets
- AlertUnexpected treasury transfer12.4M USDC · treasury_1 → 8qLm…2kDe
- AlertNew recipientfirst transaction to address · in 214 days of history
- AlertDormant wallet activationcold wallet 7xKX…4nQp · idle 8 months · moved 2.1M SOL
- WatchSuspicious funding1,240 wallets funded from a single source in 6 min
- WatchBridge movement4M USDC → Solana ↔ Ethereum bridge · out-of-pattern
- AlertAuthority changemultisig_3 tx on signer-management program · capability flagged
Illustrative example — mock signals with mock amounts and addresses.
The patterns that precede an exploit.
Unexpected treasury transfers, new recipients, dormant wallets waking, authority changes, suspicious funding, bridge movement. Each signal arrives with severity, a reason, and the context you need to act.
Launches and airdrops pay real people — not one wallet farm with many keypairs.
Before a distribution goes out, screen the claimant list for coordinated wallets: shared funders, matching execution fingerprints, synchronized timing. Every flag carries its own evidence so an exclusion decision can be defended to your community.
- Screen the claimant snapshot through the sybil engine
- Review clusters member-by-member, not blanket-scored
- Export a versioned evidence report for the gating decision
Trace passes through a known exchange — signal cut, not counted.
Compromised wallet and 6 downstream wallets share an uncommon fee-payer sequence.
Splitting window of 90 seconds across 84 addresses.
- Observed — 12.4M USDC left treasury_1 at 14:32:04Z, authority was intact.
- Attributed — the destination matches a verified exchange entity in the registry. Shown, not assumed.
- Inferred — the 84 split addresses may share an operator. Awaiting confirmation.
A treasury incident becomes a case file.
When a transfer looks wrong, VikingIntel reconstructs the timeline, traces the funds, enriches the investigation with available public-source evidence, flags authority-changing transactions, and records the evidence — so a multisig decision can be made with facts, not screenshots.
The conclusion lands with a structured case record, not a screenshot.
Findings are labeled observed, derived, attributed, or inferred; deterministic facts outrank inference; and the case exports a reviewable report with an investigation ID and methodology version.
- Investigation ID
- inv_8f3a2c
- Methodology
- engine v1.1.0 · signal-family model
- Typed findings
- Observed · Derived · Attributed · Inferred
Put your treasury under watch.
Create an account and start monitoring, or talk to us about a guided rollout for your protocol.