So engineers

at Block Inc, great engineers there, they identified a pattern, which I call wave one.

And this was a variety of markers that looked like they were being attacked.

Again, we can't just, if a DeFi protocol is exploited, we just point our analysis at the smart contract and watch where the funds flow.

These are all dispersed, right? We can't really tell whether an address is a cold card address or any other type of address, let alone a vulnerable one, right? So the way that Block identified this pattern was burst transactions, full sweeps, dormant coins that for many years that plausibly looked like they were in self-custody cold storage, but none created before March 17th, 2021.

and a few other markers in there, like how the RBF and other flags are set in the transactions.

I took that those markers and ran it across our whole stack and developed what we call wave one.

You need good entropy to