{"data":{"alerts":[{"id":"sna_5778cb0009129676","chainId":8453,"network":"Base","wallet":"0x0b0b9574d5b038f6fd906325e699020423adf446","tier":"census","ktId":"kt_0d4ef4e6dd2b85dd8e474616","buildId":null,"detector":"behaviour.shift","severity":"medium","class":"drift","title":"0x0b0b…f446 broke its own pattern: new destination, new call type and 1 more signal","summary":"On Base, 0x0b0b9574d5b038f6fd906325e699020423adf446 (85 transactions of baseline) sent a transaction to 0xb24dcde777c4ad9ac385ec9500b3dc527a4f91ad using 0xb4384a64, neither of which it has used before. active at 07:00 UTC, an hour with under 1% of its history. A changed pattern can be a new strategy, a new operator or a stolen key. This is a signal, not a verdict.","evidence":[{"tx":"0x66c01cd8717d4d205ca5e3ef5f6fbad2540cec0aecdf7d6a096908b65ddb91b1","note":"new destination; new call type; active at 07:00 UTC, an hour with under 1% of its history","url":"https://basescan.org/tx/0x66c01cd8717d4d205ca5e3ef5f6fbad2540cec0aecdf7d6a096908b65ddb91b1"}],"details":{"signals":["new destination","new call type","active at 07:00 UTC, an hour with under 1% of its history"],"hourShare":0,"baselineTxs":85,"dormantDays":0,"tipRatioX100":100,"novelSelector":true,"novelDestination":true,"baselineTipRatioP90X100":100},"block":52760166,"blockTime":"2026-10-18T07:47:59.000Z","alertedAt":"2026-10-18T07:47:59.452Z","latencyMs":452,"processingMs":385,"fastPath":false,"incidentId":null,"seq":14,"review":null},{"id":"sna_1a0ec307648f9852","chainId":8453,"network":"Base","wallet":"0x103040545ac5031a11e8c03dd11324c7333a13c7","tier":"census","ktId":"kt_923def3640e6d88549e36a58","buildId":null,"detector":"behaviour.shift","severity":"medium","class":"drift","title":"0x1030…13c7 broke its own pattern: new destination, new call type and 1 more signal","summary":"On Base, 0x103040545ac5031a11e8c03dd11324c7333a13c7 (623 transactions of baseline) sent a transaction to 0x8004baa17c55a88189ae136b182e5fda19de9b63 using 0x3c036a7e, neither of which it has used before. active at 23:00 UTC, an hour with under 1% of its history. A changed pattern can be a new strategy, a new operator or a stolen key. This is a signal, not a verdict.","evidence":[{"tx":"0x6ed9841f00f124077a842994acb86cb88c17f993066efe1f6ffebd37bbb6e9be","note":"new destination; new call type; active at 23:00 UTC, an hour with under 1% of its history","url":"https://basescan.org/tx/0x6ed9841f00f124077a842994acb86cb88c17f993066efe1f6ffebd37bbb6e9be"}],"details":{"signals":["new destination","new call type","active at 23:00 UTC, an hour with under 1% of its history"],"hourShare":0.0032,"baselineTxs":623,"dormantDays":0,"tipRatioX100":19,"novelSelector":true,"novelDestination":true,"baselineTipRatioP90X100":100},"block":52746083,"blockTime":"2026-10-17T23:58:33.000Z","alertedAt":"2026-10-17T23:58:33.217Z","latencyMs":217,"processingMs":147,"fastPath":false,"incidentId":null,"seq":13,"review":null},{"id":"sna_dd05e732241495cc","chainId":1,"network":"Ethereum","wallet":"0x46794192410a7898e192dabff6005fd1e18854d7","tier":"census","ktId":"kt_a078476d271d7da644e7d40b","buildId":null,"detector":"key.delegation","severity":"high","class":"secret_leak","title":"0x4679…54d7 delegated its account to 0x2c6f…571d (EIP-7702)","summary":"On Ethereum, 0x46794192410a7898e192dabff6005fd1e18854d7 signed an EIP-7702 authorisation that makes its account run the code of 0x2c6f01799fa9db1e7f2797e5ba892b72b865571d, a contract whose source is not verified. The wallet sent the transaction itself. Delegating to a malicious contract hands it the whole account, and is a common way keys are abused after a phishing signature; smart-wallet upgrades look the same, so a human should check.","evidence":[{"tx":"0x05f6c385be669e993bfaa88cc9d5d8e8b434ec36a1155952911f42e7700163cb","note":"EIP-7702 authorisation signed by the wallet","url":"https://etherscan.io/tx/0x05f6c385be669e993bfaa88cc9d5d8e8b434ec36a1155952911f42e7700163cb"}],"details":{"sentBy":"0x46794192410a7898e192dabff6005fd1e18854d7","delegate":"0x2c6f01799fa9db1e7f2797e5ba892b72b865571d","authChainId":1,"signedByWallet":true,"delegateListedBy":[],"delegateVerified":false,"delegateIsContract":true},"block":26214918,"blockTime":"2026-10-17T21:19:11.000Z","alertedAt":"2026-10-17T21:19:17.266Z","latencyMs":6266,"processingMs":2846,"fastPath":false,"incidentId":"KAR-2026-0021","seq":12,"review":null},{"id":"sna_2ccffbebf4629d10","chainId":8453,"network":"Base","wallet":"0x103040545ac5031a11e8c03dd11324c7333a13c7","tier":"census","ktId":"kt_923def3640e6d88549e36a58","buildId":null,"detector":"behaviour.shift","severity":"medium","class":"drift","title":"0x1030…13c7 broke its own pattern: new destination, new call type and 1 more signal","summary":"On Base, 0x103040545ac5031a11e8c03dd11324c7333a13c7 (620 transactions of baseline) sent a transaction to 0x271f9fa7f8907acf178ccfb470076d9129d8f0eb using 0xe2b8996f, neither of which it has used before. active at 19:00 UTC, an hour with under 1% of its history. A changed pattern can be a new strategy, a new operator or a stolen key. This is a signal, not a verdict.","evidence":[{"tx":"0x1c0ee354b94fcfd95a01b7663fc80ed47632bf51dfeb8e8c9f0fdc09245064b0","note":"new destination; new call type; active at 19:00 UTC, an hour with under 1% of its history","url":"https://basescan.org/tx/0x1c0ee354b94fcfd95a01b7663fc80ed47632bf51dfeb8e8c9f0fdc09245064b0"}],"details":{"signals":["new destination","new call type","active at 19:00 UTC, an hour with under 1% of its history"],"hourShare":0.0032,"baselineTxs":620,"dormantDays":0.1,"tipRatioX100":100,"novelSelector":true,"novelDestination":true,"baselineTipRatioP90X100":100},"block":52737586,"blockTime":"2026-10-17T19:15:19.000Z","alertedAt":"2026-10-17T19:15:19.303Z","latencyMs":303,"processingMs":221,"fastPath":false,"incidentId":null,"seq":11,"review":null},{"id":"sna_bcbec5d4613fa816","chainId":8453,"network":"Base","wallet":"0x17277b29bdd80f44c9bf5f03ac837c9767cf643a","tier":"census","ktId":"kt_0c20a51dc2b6fec310882538","buildId":null,"detector":"key.delegation","severity":"high","class":"secret_leak","title":"0x1727…643a delegated its account to 0x98a6…2d00 (EIP-7702)","summary":"On Base, 0x17277b29bdd80f44c9bf5f03ac837c9767cf643a signed an EIP-7702 authorisation that makes its account run the code of 0x98a6f5d46001e10c0a36fc3a14d79752026b2d00, a contract whose source is not verified. The transaction was sent by 0x000b300b0eb3d6cd66b53aa6fa557a6cd8c6ce99: a sponsor submitted an authorisation the wallet signed. Delegating to a malicious contract hands it the whole account, and is a common way keys are abused after a phishing signature; smart-wallet upgrades look the same, so a human should check.","evidence":[{"tx":"0x3680be347ab1b27e100cd5fdcb7bbe0c6875b5183591ca228d51b1f97e61750f","note":"EIP-7702 authorisation signed by the wallet","url":"https://basescan.org/tx/0x3680be347ab1b27e100cd5fdcb7bbe0c6875b5183591ca228d51b1f97e61750f"}],"details":{"sentBy":"0x000b300b0eb3d6cd66b53aa6fa557a6cd8c6ce99","delegate":"0x98a6f5d46001e10c0a36fc3a14d79752026b2d00","authChainId":8453,"signedByWallet":false,"delegateListedBy":[],"delegateVerified":false,"delegateIsContract":true},"block":52735707,"blockTime":"2026-10-17T18:12:41.000Z","alertedAt":"2026-10-17T18:12:41.721Z","latencyMs":721,"processingMs":653,"fastPath":false,"incidentId":"KAR-2026-0020","seq":10,"review":null},{"id":"sna_cc0b2743b67d3642","chainId":8453,"network":"Base","wallet":"0x7189ae5e0c7b48e173a8d006264c5fb6b411fee2","tier":"census","ktId":"kt_df15f535a7d6117d35d1c531","buildId":null,"detector":"approval.unverified","severity":"medium","class":"malicious_approval","title":"0x7189…fee2 granted an unlimited allowance to 0x8540…3a91, a contract whose source is not verified on Sourcify","summary":"On Base, 0x7189ae5e0c7b48e173a8d006264c5fb6b411fee2 approved 0x854048098dbe227355d43a433624695520ce3a91 (unlimited spender) on 0xaeadc7084bc3c482921a8ad7eadc65f70e06106d. The spender is a contract whose source is not verified on Sourcify. A contract nobody can read, or an account, holding an unlimited allowance can move the whole balance. Some legitimate protocols ship unverified contracts, so this is a signal for a human to check.","evidence":[{"tx":"0x62aecc6a421cd0f8819e1cfe0fe2a79521a5ef7f8c7236a8d93df156c5b38134","note":"unlimited approval to a spender that is a contract whose source is not verified on Sourcify","url":"https://basescan.org/tx/0x62aecc6a421cd0f8819e1cfe0fe2a79521a5ef7f8c7236a8d93df156c5b38134"}],"details":{"kind":"erc20","token":"0xaeadc7084bc3c482921a8ad7eadc65f70e06106d","amount":"115792089237316195423570985008687907853269984665640564039457584007913129639935","sentBy":"0x7189ae5e0c7b48e173a8d006264c5fb6b411fee2","spender":"0x854048098dbe227355d43a433624695520ce3a91","unlimited":true,"approvedBefore":false,"signedByWallet":true,"spenderListedBy":[],"spenderVerified":false,"spenderIsContract":true},"block":52733049,"blockTime":"2026-10-17T16:44:05.000Z","alertedAt":"2026-10-17T16:44:06.314Z","latencyMs":1314,"processingMs":1212,"fastPath":false,"incidentId":null,"seq":9,"review":null},{"id":"sna_262928b23d3b6374","chainId":1,"network":"Ethereum","wallet":"0xdf63a5df29f1a1098eb3d341597e811f00bdbaa9","tier":"census","ktId":"kt_701f34017029f86211ec30db","buildId":null,"detector":"key.delegation","severity":"medium","class":"secret_leak","title":"0xdf63…baa9 delegated its account to 0x63c0…e32b (EIP-7702)","summary":"On Ethereum, 0xdf63a5df29f1a1098eb3d341597e811f00bdbaa9 signed an EIP-7702 authorisation that makes its account run the code of 0x63c0c19a282a1b52b07dd5a65b58948a07dae32b, a contract with verified source. The wallet sent the transaction itself. Delegating to a malicious contract hands it the whole account, and is a common way keys are abused after a phishing signature; smart-wallet upgrades look the same, so a human should check.","evidence":[{"tx":"0x22c5905dd10bb3b5813df3815baad0db30669576f72527090691f10adbf06eae","note":"EIP-7702 authorisation signed by the wallet","url":"https://etherscan.io/tx/0x22c5905dd10bb3b5813df3815baad0db30669576f72527090691f10adbf06eae"}],"details":{"sentBy":"0xdf63a5df29f1a1098eb3d341597e811f00bdbaa9","delegate":"0x63c0c19a282a1b52b07dd5a65b58948a07dae32b","authChainId":1,"signedByWallet":true,"delegateListedBy":[],"delegateVerified":true,"delegateIsContract":true},"block":26213281,"blockTime":"2026-10-17T15:50:23.000Z","alertedAt":"2026-10-17T15:50:25.443Z","latencyMs":2443,"processingMs":932,"fastPath":false,"incidentId":null,"seq":8,"review":null},{"id":"sna_f2e9caf0b986d6ac","chainId":8453,"network":"Base","wallet":"0x73b4c9335fa239f9c6df3d28d5bf5d3cdf4de736","tier":"census","ktId":"kt_d48cca5be18b545a1a9bb4c9","buildId":null,"detector":"behaviour.shift","severity":"medium","class":"drift","title":"0x73b4…e736 broke its own pattern: new destination, new call type and 1 more signal","summary":"On Base, 0x73b4c9335fa239f9c6df3d28d5bf5d3cdf4de736 (90 transactions of baseline) sent a transaction to 0x833589fcd6edb6e08f4c7c32d4f71b54bda02913 using 0x095ea7b3, neither of which it has used before. active at 12:00 UTC, an hour with under 1% of its history. A changed pattern can be a new strategy, a new operator or a stolen key. This is a signal, not a verdict.","evidence":[{"tx":"0xeed6c88c421a1448b3c5eb97c31e8f1f4a8af12df66959d5440387937b5defe7","note":"new destination; new call type; active at 12:00 UTC, an hour with under 1% of its history","url":"https://basescan.org/tx/0xeed6c88c421a1448b3c5eb97c31e8f1f4a8af12df66959d5440387937b5defe7"}],"details":{"signals":["new destination","new call type","active at 12:00 UTC, an hour with under 1% of its history"],"hourShare":0,"baselineTxs":90,"dormantDays":0,"tipRatioX100":115,"novelSelector":true,"novelDestination":true,"baselineTipRatioP90X100":100},"block":52725110,"blockTime":"2026-10-17T12:19:27.000Z","alertedAt":"2026-10-17T12:19:28.003Z","latencyMs":1003,"processingMs":904,"fastPath":false,"incidentId":null,"seq":7,"review":null},{"id":"sna_5cd3e186d5842a61","chainId":8453,"network":"Base","wallet":"0xb269dc2c211dfcd926222b4b2b82a731d22fb1a6","tier":"census","ktId":"kt_1a7163e60d8be2f254868ef2","buildId":null,"detector":"behaviour.shift","severity":"medium","class":"drift","title":"0xb269…b1a6 broke its own pattern: new destination, new call type and 1 more signal","summary":"On Base, 0xb269dc2c211dfcd926222b4b2b82a731d22fb1a6 (46 transactions of baseline) sent a transaction to 0xb24dcde777c4ad9ac385ec9500b3dc527a4f91ad using 0x07448a75, neither of which it has used before. active at 12:00 UTC, an hour with under 1% of its history. A changed pattern can be a new strategy, a new operator or a stolen key. This is a signal, not a verdict.","evidence":[{"tx":"0xfccdae808b8a8ff101c7c9983a7f7aa4092360a7e9953c616db7ae7843feabe6","note":"new destination; new call type; active at 12:00 UTC, an hour with under 1% of its history","url":"https://basescan.org/tx/0xfccdae808b8a8ff101c7c9983a7f7aa4092360a7e9953c616db7ae7843feabe6"}],"details":{"signals":["new destination","new call type","active at 12:00 UTC, an hour with under 1% of its history"],"hourShare":0,"baselineTxs":46,"dormantDays":0,"tipRatioX100":100,"novelSelector":true,"novelDestination":true,"baselineTipRatioP90X100":100},"block":52724548,"blockTime":"2026-10-17T12:00:43.000Z","alertedAt":"2026-10-17T12:00:43.516Z","latencyMs":516,"processingMs":394,"fastPath":false,"incidentId":null,"seq":6,"review":null},{"id":"sna_5c58071009ed3145","chainId":1,"network":"Ethereum","wallet":"0x2da40ce78682262d8024c76f614490c73b174340","tier":"census","ktId":"kt_3115197d0736d0a2dcc56eed","buildId":null,"detector":"key.delegation","severity":"medium","class":"secret_leak","title":"0x2da4…4340 delegated its account to 0x6900…e139 (EIP-7702)","summary":"On Ethereum, 0x2da40ce78682262d8024c76f614490c73b174340 signed an EIP-7702 authorisation that makes its account run the code of 0x69007702764179f14f51cdce752f4f775d74e139, a contract with verified source. The transaction was sent by 0x657eecaf94a46f00c68551c787876cebd569f0d9: a sponsor submitted an authorisation the wallet signed. Delegating to a malicious contract hands it the whole account, and is a common way keys are abused after a phishing signature; smart-wallet upgrades look the same, so a human should check.","evidence":[{"tx":"0xefcc621358f105bf5ef5bd4b316c3845cd8c1ab9a3757dbd10df315d05a49a6a","note":"EIP-7702 authorisation signed by the wallet","url":"https://etherscan.io/tx/0xefcc621358f105bf5ef5bd4b316c3845cd8c1ab9a3757dbd10df315d05a49a6a"}],"details":{"sentBy":"0x657eecaf94a46f00c68551c787876cebd569f0d9","delegate":"0x69007702764179f14f51cdce752f4f775d74e139","authChainId":1,"signedByWallet":false,"delegateListedBy":[],"delegateVerified":true,"delegateIsContract":true},"block":26208512,"blockTime":"2026-10-16T23:53:11.000Z","alertedAt":"2026-10-16T23:53:14.671Z","latencyMs":3671,"processingMs":1151,"fastPath":false,"incidentId":null,"seq":5,"review":null},{"id":"sna_f7fe903b0a32d6d7","chainId":1,"network":"Ethereum","wallet":"0x2da40ce78682262d8024c76f614490c73b174340","tier":"census","ktId":"kt_3115197d0736d0a2dcc56eed","buildId":null,"detector":"key.delegation","severity":"medium","class":"secret_leak","title":"0x2da4…4340 delegated its account to 0x7702…176c (EIP-7702)","summary":"On Ethereum, 0x2da40ce78682262d8024c76f614490c73b174340 signed an EIP-7702 authorisation that makes its account run the code of 0x7702cb554e6bfb442cb743a7df23154544a7176c, a contract with verified source. The transaction was sent by 0x370a7e2d300c14d79d4a7ee07aaca46c4b3012cf: a sponsor submitted an authorisation the wallet signed. Delegating to a malicious contract hands it the whole account, and is a common way keys are abused after a phishing signature; smart-wallet upgrades look the same, so a human should check.","evidence":[{"tx":"0x0e8e7c804d193c86bf42786e73a1f35e89420730deb1c9226ba4f29484466156","note":"EIP-7702 authorisation signed by the wallet","url":"https://etherscan.io/tx/0x0e8e7c804d193c86bf42786e73a1f35e89420730deb1c9226ba4f29484466156"}],"details":{"sentBy":"0x370a7e2d300c14d79d4a7ee07aaca46c4b3012cf","delegate":"0x7702cb554e6bfb442cb743a7df23154544a7176c","authChainId":1,"signedByWallet":false,"delegateListedBy":[],"delegateVerified":true,"delegateIsContract":true},"block":26208131,"blockTime":"2026-10-16T22:36:35.000Z","alertedAt":"2026-10-16T22:36:37.735Z","latencyMs":2735,"processingMs":1135,"fastPath":false,"incidentId":null,"seq":4,"review":null},{"id":"sna_861a78352f0885d1","chainId":8453,"network":"Base","wallet":"0x7a3e312ec6e20a9f62fe2405938eb9060312e334","tier":"census","ktId":"kt_c16ce1913c1ffa06ec082776","buildId":null,"detector":"behaviour.shift","severity":"medium","class":"drift","title":"0x7a3e…e334 broke its own pattern: new destination, new call type and 1 more signal","summary":"On Base, 0x7a3e312ec6e20a9f62fe2405938eb9060312e334 (519 transactions of baseline) sent a transaction to 0x6131b5fae19ea4f9d964eac0408e4408b66337b5 using 0xe21fd0e9, neither of which it has used before. active at 20:00 UTC, an hour with under 1% of its history. A changed pattern can be a new strategy, a new operator or a stolen key. This is a signal, not a verdict.","evidence":[{"tx":"0xd9543a174413fd0845b29d2f4674cf257b0be35a03909d56426d4feda8028c55","note":"new destination; new call type; active at 20:00 UTC, an hour with under 1% of its history","url":"https://basescan.org/tx/0xd9543a174413fd0845b29d2f4674cf257b0be35a03909d56426d4feda8028c55"}],"details":{"signals":["new destination","new call type","active at 20:00 UTC, an hour with under 1% of its history"],"hourShare":0.0058,"baselineTxs":519,"dormantDays":0,"tipRatioX100":0,"novelSelector":true,"novelDestination":true,"baselineTipRatioP90X100":0},"block":52696714,"blockTime":"2026-10-16T20:32:55.000Z","alertedAt":"2026-10-16T20:32:55.455Z","latencyMs":455,"processingMs":352,"fastPath":false,"incidentId":null,"seq":3,"review":null},{"id":"sna_f6312ba1eb8971ce","chainId":8453,"network":"Base","wallet":"0x7a3e312ec6e20a9f62fe2405938eb9060312e334","tier":"census","ktId":"kt_c16ce1913c1ffa06ec082776","buildId":null,"detector":"behaviour.shift","severity":"medium","class":"drift","title":"0x7a3e…e334 broke its own pattern: new destination, new call type and 1 more signal","summary":"On Base, 0x7a3e312ec6e20a9f62fe2405938eb9060312e334 (514 transactions of baseline) sent a transaction to 0x430e239b96d9a8fbafdbed30405d8f14d0b36631 using 0x, neither of which it has used before. active at 19:00 UTC, an hour with under 1% of its history. A changed pattern can be a new strategy, a new operator or a stolen key. This is a signal, not a verdict.","evidence":[{"tx":"0xc181cfc8ce80c09a9750734111eafa38858ccb9426186cfdc436f3b19dfdf30c","note":"new destination; new call type; active at 19:00 UTC, an hour with under 1% of its history","url":"https://basescan.org/tx/0xc181cfc8ce80c09a9750734111eafa38858ccb9426186cfdc436f3b19dfdf30c"}],"details":{"signals":["new destination","new call type","active at 19:00 UTC, an hour with under 1% of its history"],"hourShare":0.0097,"baselineTxs":514,"dormantDays":0,"tipRatioX100":0,"novelSelector":true,"novelDestination":true,"baselineTipRatioP90X100":0},"block":52694204,"blockTime":"2026-10-16T19:09:15.000Z","alertedAt":"2026-10-16T19:09:15.543Z","latencyMs":543,"processingMs":416,"fastPath":false,"incidentId":null,"seq":2,"review":null},{"id":"sna_d6c0aca069b23f71","chainId":8453,"network":"Base","wallet":"0x103040545ac5031a11e8c03dd11324c7333a13c7","tier":"census","ktId":"kt_923def3640e6d88549e36a58","buildId":null,"detector":"behaviour.shift","severity":"medium","class":"drift","title":"0x1030…13c7 broke its own pattern: new destination, new call type and 1 more signal","summary":"On Base, 0x103040545ac5031a11e8c03dd11324c7333a13c7 (500 transactions of baseline) sent a transaction to 0x857fe6150401bfb4641fe0d2b2621cc3b05543cd using 0x802b2246, neither of which it has used before. active at 18:00 UTC, an hour with under 1% of its history. A changed pattern can be a new strategy, a new operator or a stolen key. This is a signal, not a verdict.","evidence":[{"tx":"0x1e249236ebe053b05fbb226146cb5718d3d22a67e0868fc6c7e2a19e864f1ca9","note":"new destination; new call type; active at 18:00 UTC, an hour with under 1% of its history","url":"https://basescan.org/tx/0x1e249236ebe053b05fbb226146cb5718d3d22a67e0868fc6c7e2a19e864f1ca9"}],"details":{"signals":["new destination","new call type","active at 18:00 UTC, an hour with under 1% of its history"],"hourShare":0,"baselineTxs":500,"dormantDays":1.1,"tipRatioX100":100,"novelSelector":true,"novelDestination":true,"baselineTipRatioP90X100":100},"block":52693169,"blockTime":"2026-10-16T18:34:45.000Z","alertedAt":"2026-10-16T18:34:45.424Z","latencyMs":424,"processingMs":362,"fastPath":false,"incidentId":null,"seq":1,"review":null}],"next":14},"disclaimer":"Sentinel is a read-only, rule-based watch over agent wallets on public mainnets. An alert is a signal for a human to check, with the evidence transactions attached, not a verdict and not an accusation. Open scam lists have false positives; moving funds to a new wallet looks like a drain. Latency is measured against the block timestamp (one-second resolution)."}