Attacker wallet pre-strike probe (low-gas failing txs)

Evidence summary #

Gray — requires mempool + CTI cluster feed integration not publicly available. Permissioned pool access (KYC) makes traditional mempool probing less useful for an attacker — they cannot call investment functions without KYC approval. No probe activity evidence in public data.

Sources #

Methodology #

Detect whether a wallet in a threat-actor cluster is sending low-gas or intentionally-failing transactions to this protocol (pre-strike reconnaissance pattern).

See the full factor methodology and distribution across all protocols →