The latest articles on DEV Community by ChainHint (@chainhint). https://dev.to/chainhint https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F3869979%2Fe10d7609-e659-4185-accc-7d1476da0b8d.png https://dev.to/chainhint en ChainHint Thu, 09 Apr 2026 20:58:57 +0000 https://dev.to/chainhint/how-i-traced-the-bybit-15b-hack-on-chain-and-built-a-tool-to-do-it-36ia https://dev.to/chainhint/how-i-traced-the-bybit-15b-hack-on-chain-and-built-a-tool-to-do-it-36ia <p>Every time a major crypto hack happens — Bybit ($1.5B), Ronin ($625M), WazirX ($235M) — the funds move on-chain in plain sight. The entire trail is public. Anyone can see it on Etherscan.</p> <p>But <em>following</em> that trail across multiple hops, multiple chains, through mixers and bridges? That requires tools that cost $30K+/year.</p> <p>So I built ChainHint.</p> <h2> What it does </h2> <ul> <li>Multi-hop BFS fund tracing across 11 EVM chains + Bitcoin, Solana, TON</li> <li>Real-time OFAC sanctions screening via Chainalysis integration</li> <li>Mixer &amp; Tornado Cash detection</li> <li>Entity resolution across 3.9M+ labeled addresses (CEX, DEX, bridges, known exploiters)</li> <li>AI-powered incident reports with MITRE ATT&amp;CK threat mapping</li> <li>Wallet monitoring with automated alerts</li> </ul> <h2> The stack </h2> <ul> <li> <strong>Frontend</strong>: Lovable (React)</li> <li> <strong>Backend</strong>: Supabase (PostgreSQL + Edge Functions + pg_cron)</li> <li> <strong>Tracing</strong>: Moralis BFS + Bitquery GraphQL V2</li> <li> <strong>Entity data</strong>: Arkham Intel API + Dune Analytics + dawsbot/eth-labels</li> <li> <strong>AI reports</strong>: Claude API (Haiku) with MITRE ATT&amp;CK prompting</li> <li> <strong>Payments</strong>: NOWPayments (no Stripe in Ukraine)</li> </ul> <h2> The hard parts </h2> <p>The trickiest problem was entity resolution at scale. We ingest labeled addresses from multiple sources, normalize them (BTC addresses can't be lowercased — learned that the hard way), and resolve them in real-time during tracing.</p> <p>The second hard part: Arkham's API has aggressive rate limits. We ended up with a 3s timeout per request, max 10 concurrent lookups, and careful error distinction between timeouts and network errors.</p> <h2> Try it </h2> <p>Free tier available at <a href="https://chainhint.com" rel="noopener noreferrer">https://chainhint.com</a></p> <p>Happy to answer questions about the forensics approach, the BFS algorithm, or the Supabase edge function architecture.</p> blockchain security cryptocurrency webdev