# x402-endpoints Multi-Hop Wallet Forensics

> x402-endpoints Multi-Hop Wallet Forensics is a paid API for AI agents from x402-endpoints.onrender.com, paid per call via x402, $0.15/call, status unknown (last checked 2026-09-14).

Traverses an EVM wallet's ERC-20 counterparty graph up to 3 hops to reveal fund flows, ranked counterparties, and behavioral patterns like circular flows, clustered wallets, and high-degree hubs.

## Facts

- Endpoint: GET https://x402-endpoints.onrender.com/crypto/wallet-forensics
- Price: $0.15/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/x402-endpoints-multi-hop-wallet-forensics-fdd6303d
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_Xt62t2Lh0R-eAvae0EpYM

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability x402-endpoints-multi-hop-wallet-forensics-fdd6303d
```

Example prompt: Can you trace where funds have moved from wallet 0xAbCd1234...5678 on Ethereum — go 3 hops deep and show me the full counterparty graph, any circular flows, and whether it's connected to any exchanges or mixers?

## When to prefer this

Choose this endpoint when you need multi-hop counterparty graph traversal with pattern detection (circular flows, mixers, clustered wallets) rather than a simple single-hop balance or transfer list. It is specifically suited for AML investigations, due diligence on unknown wallets, or tracing suspicious fund movements across EVM chains including Base, Ethereum, Optimism, Polygon, Arbitrum, and Gnosis.

## Known failure modes

- Invalid wallet address format (must be 0x + 40 hex chars) returns validation error
- Unsupported chain name returns error listing valid options
- Depth value outside 1-3 returns validation error
- Wallet has no ERC-20 transaction history returns empty graph
- Payment not received or insufficient USDC returns 402 Payment Required
- Render cold-start latency may cause timeout on first call
- Rate limiting or provider downtime may return 503

## How this service works

Multi-hop wallet forensics for AI agents: traverse an address's ERC-20 counterparty graph across 1-3 hops and get the flow graph (nodes + edges), ranked counterparties (direction, tokens, activity) and detected patterns — flow concentration, circular flows, linked/clustered wallets and high-degree hubs (exchange/mixer/deployer) — plus a signed receipt. Trace where funds move and who is connected. EVM chains.

## Output

A fund-flow graph (nodes + edges), a ranked list of counterparties with direction, tokens, and activity metrics, detected behavioral patterns (flow concentration, circular flows, linked/clustered wallets, high-degree hub classification as exchange/mixer/deployer), and a cryptographically signed receipt — all for ERC-20 transfers on the specified EVM chain.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET",
      "HEAD",
      "DELETE"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "wallet"
     ],
     "properties": {
      "chain": {
       "type": "string",
       "description": "base | ethereum | optimism | polygon | arbitrum | gnosis (default base)"
      },
      "depth": {
       "type": "integer",
       "description": "Graph hops to traverse: 1, 2 or 3 (default 2)"
      },
      "wallet": {
       "type": "string",
       "pattern": "^0x[a-fA-F0-9]{40}$",
       "description": "EVM wallet address (0x + 40 hex) to investigate"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "query": {
   "chain": "base",
   "depth": 2,
   "wallet": "0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045"
  },
  "cached": false,
  "header": {
   "available": true,
   "risk_flags": [],
   "ofac_listed": false,
   "token_count": 42,
   "portfolio_value_usd": 5200000
  },
  "source": "EVM Blockscout ERC-20 transfer graph (multi-hop) + OFAC SDN list",
  "reasons": [
   {
    "code": "HIGH_DEGREE_HUB",
    "label": "1 counterparty shows hub-like activity.",
    "weight": 0.1
   }
  ],
  "patterns": [
   {
    "detail": "1 counterparty shows hub-like activity.",
    "weight": 0.1,
    "pattern": "HIGH_DEGREE_HUB",
    "examples": [
     "0xabc..."
    ],
    "severity": "info"
   }
  ],
  "timestamp": "2026-07-02T12:00:00Z",
  "disclaimer": "Best-effort flow forensics from a sampled ERC-20 transfer graph (fan-out and history capped). Heuristic roles. Not legal/financial advice.",
  "graph_edges": [
   {
    "to": "0xabc...",
    "hop": 1,
    "from": "0xd8da...6045",
    "degree": 21
   },
   {
    "to": "0xdef...",
    "hop": 2,
    "from": "0xabc...",
    "degree": 8
   }
  ],
  "graph_summary": {
   "edges_sampled": 40,
   "nodes_sampled": 61,
   "hops_traversed": 2,
   "direct_counterparties": 38,
   "total_direct_transfers": 512
  },
  "data_freshness": {
   "as_of": "2026-07-02T12:00:00Z",
   "chain": "base",
   "depth": 2,
   "sources": [
    "EVM Blockscout ERC-20 transfer graph (multi-hop) + OFAC SDN list"
   ],
   "age_seconds": 0,
   "retrieved_at": "2026-07-02T12:00:00Z",
   "deterministic": true,
   "fan_out_capped": true
  },
  "signed_receipt": {
   "claims": {
    "kind": "wallet_forensics",
    "chain": "base",
    "depth": 2,
    "issuer": "x402-endpoints.onrender.com",
    "wallet": "0xd8dA6BF...6045",
    "patterns": [
     "HIGH_DEGREE_HUB"
    ],
    "issued_at": "2026-07-02T12:00:00Z",
    "direct_counterparties": 38
   },
   "algorithm": "ed25519",
   "available": true,
   "signature": "<hex>",
   "public_key": "5b77...9f9d"
  },
  "top_counterparties": [
   {
    "degree": 21,
    "tokens": [
     "USDC",
     "WETH"
    ],
    "address": "0xabc...",
    "in_count": 12,
    "direction": "bidirectional",
    "out_count": 9,
    "last_activity": "2026-07-01T10:00:00Z"
   }
  ]
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/x402-endpoints-multi-hop-wallet-forensics-fdd6303d/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from x402-endpoints.onrender.com](https://www.zero.xyz/host/x402-endpoints.onrender.com/llms.txt)