Recipe 29 of 32
Where did the stolen funds go? Trace outbound from a hack address
Call /wallets/{address}/trace with direction=out, a high min_usd and window=all to follow a hack address's largest outgoing transfers hop by hop, with each wallet's label.
GET /v1/onchain/wallets/{address}/trace?direction=out starts at the hack address and follows its biggest recipients, then
theirs, up to depth hops and width recipients per wallet. min_usd keeps only large transfers. Nodes carry the
label we hold, so you see where the trail reaches an exchange, a protocol or more of the attacker's wallets. The full parameter list is on Trace a wallet's funds.
Quick answer
# where the Bybit exploiter's money went: two hops, three recipients per wallet, transfers of 100,000 USD and up
curl -H "X-API-Key: $VIKE_API_KEY" \
"https://data.vike.io/v1/onchain/wallets/0x47666Fab8bd0Ac7003bce3f5C3585383F09486E2/trace?direction=out&depth=2&width=3&window=all&min_usd=100000"Example response
Captured from the live API on 2026-10-24 at 17:19 UTC. The full response has 11 nodes and 10 edges; trimmed to the root, its 3
recipients, the first 3 edges and the stats block.
The root's three largest recipients took $253.8M, $28.0M and $27.3M, and all three are labelled bybit with
wallet_type: flagged. Under direction=out every edge is out_usd, money that moved from from to to.
total_volume_usd is a node's volume inside this graph, not its whole history.
{
"root": "0x47666Fab8bd0Ac7003bce3f5C3585383F09486E2",
"depth": 2,
"width": 3,
"window": "all",
"min_usd": 100000.0,
"direction": "out",
"nodes": [
{
"address": "0x47666fab8bd0ac7003bce3f5c3585383f09486e2",
"depth": 0,
"total_volume_usd": 309107848.795678,
"label": "bybit",
"wallet_type": "cex"
},
{
"address": "0xa4b2fd68593b6f34e51cb9edb66e71c1b4ab449e",
"depth": 1,
"total_volume_usd": 780269838.185841,
"label": "bybit",
"wallet_type": "flagged"
},
{
"address": "0x36ed3c0213565530c35115d93a80f9c04d94e4cb",
"depth": 1,
"total_volume_usd": 55149550.0,
"label": "bybit",
"wallet_type": "flagged"
},
{
"address": "0xbc3e5e8c10897a81b63933348f53f2e052f89a7e",
"depth": 1,
"total_volume_usd": 29859954.621205997,
"label": "bybit",
"wallet_type": "flagged"
}
],
"edges": [
{
"from": "0x47666fab8bd0ac7003bce3f5c3585383f09486e2",
"to": "0xa4b2fd68593b6f34e51cb9edb66e71c1b4ab449e",
"volume_usd": 253789048.8,
"out_usd": 253789048.8,
"in_usd": 0.0,
"tx_count": 3
},
{
"from": "0x47666fab8bd0ac7003bce3f5c3585383f09486e2",
"to": "0x36ed3c0213565530c35115d93a80f9c04d94e4cb",
"volume_usd": 28003600.0,
"out_usd": 28003600.0,
"in_usd": 0.0,
"tx_count": 1
},
{
"from": "0x47666fab8bd0ac7003bce3f5c3585383f09486e2",
"to": "0xbc3e5e8c10897a81b63933348f53f2e052f89a7e",
"volume_usd": 27315200.0,
"out_usd": 27315200.0,
"in_usd": 0.0,
"tx_count": 1
}
],
"stats": {
"node_count": 11,
"edge_count": 10,
"max_depth_reached": 2
}
}Variations
A fresh hack. For a hack in the last month, go wide and deep over 30 days.
# five hops, ten recipients per wallet, last 30 days
curl -H "X-API-Key: $VIKE_API_KEY" \
"https://data.vike.io/v1/onchain/wallets/0x47666Fab8bd0Ac7003bce3f5C3585383F09486E2/trace?direction=out&depth=5&width=10&window=30d&min_usd=100000"Where the trail leaves the attacker. List the nodes that are not flagged: exchanges, protocols and unlabelled wallets.
# nodes whose wallet_type is not flagged
curl -s -H "X-API-Key: $VIKE_API_KEY" \
"https://data.vike.io/v1/onchain/wallets/0x47666Fab8bd0Ac7003bce3f5C3585383F09486E2/trace?direction=out&depth=2&width=3&window=all&min_usd=100000" \
| jq '[.nodes[] | select(.wallet_type != "flagged") | {address, depth, label, wallet_type, total_volume_usd}]'Risk flags of the nodes. Send the node addresses to the batch route. NODES is the comma-separated address list from the trace.
# entity, wallet_type and risk_flag of every node
curl -X POST -H "X-API-Key: $VIKE_API_KEY" \
"https://data.vike.io/v1/onchain/labels/batch?addresses=$NODES"Every large recipient, one hop. The counterparties ranking lists up to 50 addresses the hack wallet dealt with, over all history.
# the hack address's top 50 counterparties by USD
curl -H "X-API-Key: $VIKE_API_KEY" \
"https://data.vike.io/v1/onchain/wallets/0x47666Fab8bd0Ac7003bce3f5C3585383F09486E2/counterparties?window=all&limit=50"Before you rely on it
Only the biggest branches, up to 300 wallets
Each wallet is expanded to its top width recipients by USD, and transfers below min_usd are ignored, so funds
split into many small transfers drop out of the graph. A call expands at most 300 wallets and then returns what it
has built: depth=5&width=10 can reach that limit. Read stats.max_depth_reached to see how far it got.
What the trail cannot see
Coin moved inside a contract call is not in the data. A mixer or a bridge contract becomes a node like any other:
its own top recipients are other users, not the attacker, and money bridged to another chain is not followed
there. The hack address itself reads label: bybit and wallet_type: cex; its
risk_flag of exploit is in /labels/batch, not in the trace.
A misspelled window falls back to 30 days
window accepts 24h, 7d, 30d, 90d and all. Any other value reads 30 days with a 200, which hides an
old hack's trail. A misspelled direction or chain is a 400.
Ask your agent
Connected to the Vike MCP server (https://vike.io/mcp) in Claude, ChatGPT or Cursor, ask it in plain words.
The wallet_trace tool answers it, at 4 credits a call.
Trace where the money from 0x47666Fab8bd0Ac7003bce3f5C3585383F09486E2 went, two hops, transfers over $100,000, all history