Methodology

What the numbers on Polytrop mean and how they are measured.

How Polytrop works

For every incident, the addresses holding the stolen funds are collected, by hand or automatically, and become its sources. Polytrop watches every new block, and when a source or any address after it sends funds, the receiving address is flagged within seconds and watched too. Services that screen incoming transfers see the flag before the funds reach them.

Sources

The addresses that held the stolen funds when the incident was reported. A case can have several, on more than one chain. Polytrop follows everything they send.

Flagged addresses

Addresses Polytrop marked as holding funds from the incident. A hop is one transfer away from a source: hop 1 received funds straight from a source, hop 2 from a hop 1 address, and so on.

Incident total

How much was stolen in the incident, as reported publicly. It is not measured by Polytrop.

Traced

The stolen funds Polytrop is following: the sum of the first transfers out of the sources, in USD at the time of each transfer.

Sent

For one source, the amount that left it in its first transfers out. The traced amount is the sum of "sent" over the sources.

USD amounts

Each transfer is valued at the token's price when it happened. $?? means no amount was recorded.

Warned ahead

When stolen funds reach an address, Polytrop flags it within seconds. The funds usually stay there for a while before they move on. Warned ahead is the time between the flag and the moment the funds leave that address.

If the address a deposit came from is already flagged, a service that checks it sees the warning before it credits the funds, and can hold them, ask questions or report them. Warned ahead is how much time it had to do so: the longer, the better.

An example: an address receives stolen funds and is flagged at 10:00. At 13:30 the funds leave it for an exchange. Warned ahead is 3.5 hours: the exchange could have seen the flag three and a half hours before the deposit arrived.

Where the funds are

Reached services: funds that reached an address labelled as a service, counted in four groups: exchanges and payment services, DeFi swaps and bridges, mixers, and other services. Polytrop's trail stops there. Frozen: funds on addresses that the token issuer or an authority has blocked or seized; they can no longer be moved. On tainted addresses: the rest of the traced funds, still on flagged addresses.