ARGUS(e)UTxO forensic transaction viewer

Built after watching a wallet drainage exploit rip through the newly rebranded SecondFi (formerly Yoroi) — because tracing where the funds went shouldn't require reading raw transaction dumps by hand.

ARGUS eUTxO forensic graph tracing a wallet's transaction flow across addresses

What happened

A code exploit in SecondFi, the wallet recently rebranded from Yoroi, let an attacker drain funds directly from user wallets. Several DeFi investors were affected, some losing upwards of $500K combined. In the aftermath, tracing where the stolen funds moved meant manually stepping through UTxOs on a block explorer that wasn't built for this — no graph, no clustering, no way to see the flow of funds at a glance.

I had exposure to the same wallet and went looking for a tool to trace it myself. Nothing existed that treated Cardano's eUTxO model as the graph it actually is. ARGUS is the tool I needed and couldn't find.

What I built

A visual transaction viewer built specifically around the (e)UTxO model, not adapted from account-based tooling. Every UTxO is a node, every transaction is an edge, and the graph is the primary interface — not a table with a graph bolted on.

The goal is forensic, not exploratory: given a starting address or transaction hash, follow the money as it splits, merges, and moves across wallets, without losing the thread.

How it works

UTxO graph traversal — walk the transaction chain forward and backward from any address or hash
Wallet clustering — flag UTxOs likely controlled by the same actor based on spend patterns
Flow annotations — mark exchange deposits, mixers, and known exploit addresses along the trail
Exportable trace — turn a followed path into a readable record for reporting

Inside the graph

ARGUS wallet activity timeline showing dwell time, send/receive cadence, and hour-of-day activity heuristics for a traced address — **Activity Timeline** — dwell time, cadence, and hour-of-day activity for an address, read as heuristics rather than certainties. Quiet hours can hint at an operator's timezone; a rhythmless cadence can hint it isn't a person at all.

ARGUS bubble view of wallet clusters, sized by ADA volume, with a seed cluster highlighted — **Wallet Clustering** — addresses that on-chain behavior suggests share a controller, grouped into bubbles sized by volume. Click through any cluster to see exactly why its members were linked.

ARGUS full transaction graph tracing UTxOs and transactions across dozens of addresses from a seed wallet, with a time-span scrubber — **Transaction Graph** — the core interface: every UTxO a node, every transaction an edge, walked forward and backward across hops from the seed address, with a time scrubber to replay how the flow unfolded.

Where it stands

ARGUS is still at the concept stage — the SecondFi incident is the case I'm building and testing against. eUTxO makes the underlying data easier to trace than an account model in some ways, since every input and output is explicit, but rendering that as a graph that's actually readable at scale is the open problem.

Next: a working prototype against real exploit transaction data, then generalizing beyond a single incident.

Get in touch for updates