Wallets/trace

Where did the money go?

$0.02per call after 25 free a day

Follows a wallet's money through its recent transactions: net SOL and token change and the other side of each, where most money went, and drain patterns with evidence.

Run when a wallet was drained or money went missing, or before trusting an address someone gave you: follows the money and flags sweeper, pass-through and lookalike-address patterns.

Keeps the model from guessing. Shows each transaction's direction, amount and other side in one call, plus the drain patterns (sweeper fee payers, pass-through, address poisoning) with the transactions that show them, instead of a guess from a list of IDs.

Call it

Transport	How
HTTP	`POST /api/tools/trace` with a JSON body of the inputs below.
MCP	`tools/call` with name `trace` on `/mcp`.

Inputs

Name	What it's looking for	Where to get it
`wallet` string (base58 address), required	The wallet to follow.	The user's wallet, or an address from their report. Never make one up.
`how_many` number, optional	How many recent transactions to read, newest first (1-50, default 25).	More covers a longer stretch of time.
`before` string (signature), optional	Start below this transaction, to page further back.	next_before from the previous answer.
`network` "mainnet-beta" \| "devnet", optional	Default "mainnet-beta" (real money).	"devnet" only for test wallets.

Returned fields

Every field the tool returns, what it is, and exactly how it's worked out.

Field	What it is	How it's worked out
`wallet` string	The wallet that was followed.	Your input, cleaned up.
`summary` string	What happened, in plain words, with the flags.	Built from the fields below.
`period` { from, to }	The time span the transactions cover (UTC).	Oldest and newest block times.
`sol_now` string \| null	SOL the wallet holds now. null if it couldn't be read.	getBalance.
`flows[]` array	One entry per transaction, newest first: tx_id, time, result, direction (in / out / both / none), sol_change, token_changes (token, symbol, change, decimals), counterparty, fee_payer, wallet_signed, programs, memo.	The wallet's own balance changes from each transaction's before/after balances; counterparty is the address whose change mirrors the wallet's biggest move; a fee-only change is direction none.
`top_destinations[]` array	Where most money went (up to 3, tokens first): address, transactions, sol_out, tokens_out (token, symbol, amount), and kind (wallet that can sign, program-controlled address, program, token account, or unknown).	Outgoing flows grouped by counterparty; kind from the account's owner and whether the address is on the ed25519 curve.
`flags[]` array	Patterns found, each with name, level (warn / info), detail and the tx_ids that show it: fee_paid_by_other_wallet, passed_straight_through, lookalike_dust, emptied.	Fixed rules on the flows (see each detail). None says who anyone is.
`unread` number	Transactions listed for the wallet that couldn't be loaded; they're left out, never guessed.	Signatures minus loaded transactions.
`next_before` string \| null	Pass as before to read the next, older page.	The oldest transaction returned; null when there are no more.

Limits

Facts, not accusations: each flag says what the transactions show and what else can cause it.
No exchange or entity labels: Pulse has no verified source for them, so a destination is described only by what the chain says it is.