Incident triage
A team that needs fast public facts about an address or a transaction can use Farbeam to build a first timeline. It suits the first minutes, before a specialist tool or a responder takes over. It is not a forensics product. It has no clustering, no attribution and no flow graph.
#Workflow
- Write down what you know: chain, hash or address, UTC time.
- Look up the transaction with the transaction tool or
GET /tx. Confirm status, parties, method and decoded token transfers. - Look up each new address with the wallet tool. Read
tx_sent,is_contract, balances and the label. - Read activity with
GET /wallets/{address}/activity. It covers curated tokens over at most 5,000 blocks on one EVM chain, so readblocks_scanned. - Pull stored large transfers with
GET /transfers?address=.... - Add a temporary rule for each address of interest, and test it in the rule tester.
- Move to an explorer for full history and traces. Contact the exchanges and bridges involved through their own process.
#Temporary rules
Tested with POST /rules/validate against the newest stored rows. The first rule uses a real address from the trace below, and it was tested at 2026-11-04T19:33:33Z. The others were tested at 2026-11-04T19:21:20Z.
| Rule | Purpose | Matches |
|---|---|---|
from == "0x3d927af0b7ebbf5c593f45e324f9d0c23bc5d4b4" or to == "0x3d927af0b7ebbf5c593f45e324f9d0c23bc5d4b4" | One address of interest | 0 of 2,000. The test window had moved past the 19:08 rows |
to_type == "bridge" and usd >= 1m | Large moves into labeled bridges | 0 |
from == "0x0000000000000000000000000000000000000000" and usd >= 1m | Large mints | 4 |
to == "0x0000000000000000000000000000000000000000" and usd >= 1m | Large burns | 4 |
from_type == "dex" or to_type == "dex" | Labeled DEX contracts | 8 |
The test covers only the newest 2,000 stored rows, about 20 minutes of data on 2026-11-04, so 0 matches for an address does not mean it was quiet for 7 days. GET /transfers?address=... reads all 7 days. An account holds 10 rules, and a rule holds up to 1,000 characters. Set the cooldown to 60 seconds during an incident, because the default of 300 seconds drops matches. Delete temporary rules afterwards.
#Real sample
This trace is ordinary activity, not an incident. It shows the method. All values come from calls at 2026-11-04T19:24:40Z to 19:24:48Z.
| Step | Call | Result |
|---|---|---|
| Start | GET /tx/ethereum/0x635ceb54...48091 | Success in block 26343447. Method transfer. 12,000,000 USDC from 0x3d92...d4b4 to the wallet labeled Coinbase 10. Fee 0.000040372 ETH |
| Sender | GET /wallets/0x3d927a...d4b4 | No label. tx_sent 1 on Ethereum, 0 on the other five chains. is_contract false. Tracked value $0.01 |
| Sender activity | GET /wallets/0x3d927a...d4b4/activity?chain=ethereum | 5,000 blocks scanned, 2 items |
| Inflow | Second item | 12,000,000 USDC in block 26343432 from 0x3356...5836, 15 blocks before the outflow |
The facts: the address received 12,000,000 USDC, and 15 blocks later it sent the same amount to a labeled exchange wallet. It has sent one transaction. The trace does not show who owns it, or why the funds moved. An address like this could be an exchange deposit address, which would be routine. See how to read a flow graph for the by-hand method.
#Timeline format
Record each fact with its source. That keeps the timeline honest as more people read it.
| Time (UTC) | Fact | Source |
|---|---|---|
| Block 26343432 | 0x3d92...d4b4 received 12,000,000 USDC from 0x3356...5836 | /wallets/.../activity |
| 2026-11-04T19:08:59Z, block 26343447 | 0x3d92...d4b4 sent 12,000,000 USDC to Coinbase 10 | /tx/ethereum/... |
| Open | Who controls 0x3d92...d4b4 | Not known |
#What this will not do
- It cannot name who is behind an address. No clustering and no attribution graph exist today. Planned
- It cannot follow funds through a mixer, a bridge or a swap. It reads ERC-20
Transferlogs of curated tokens. An attacker's token outside the list does not appear in activity, though a transaction lookup does decode every ERC-20 transfer in that transaction. - It cannot see internal ETH transfers.
- It holds 7 days of stored rows, and scans at most 5,000 blocks. On Arbitrum 5,000 blocks is less than half an hour.
- It cannot stop or recover anything. For an active incident, contact the responders, the protocol team and the exchanges directly.
- It is not evidence of wrongdoing. A public record of transfers does not establish intent.
Please report wrong or harmful labels through the contact form.