Key Highlights
- Etherscan launched Etherscan Flow, a tool that converts complex transaction sequences into visual maps of fund movements across addresses and contracts.
- The tool uses live Etherscan API data to verify every fund movement and allows users to build or edit transaction flows.
- Etherscan demonstrated the tool through a RedSonic Vault exploit, tracing 9.252513 ETH transferred to the attacker through seven entities and eight fund movements.
Ethereum blockchain explorer Etherscan has launched Etherscan Flow, a tool designed to convert complex sequences of transactions into a single visual map showing how funds moved across addresses and contracts. Every hop in the map is verified against on-chain data.
In an announcement posted on X on September 8, 2026, Etherscan stated that the feature allows users to build a flow from scratch or instruct an agent to construct one using the Etherscan Flow skill. Findings can be shared on X with a tag to the official account.
What users need to know
Users set up the skill with the command npx skills add https://github.com/etherscan/skills –skill etherscan-flow. Once installed, an agent can be prompted with the instruction “trace <TX_HASH> with etherscan-flow.” The skill draws on live Etherscan API data and returns a case JSON file that can be imported at https://etherscan.io/flow.
All saved flows are accessible after login at https://etherscan.io/login?cmd=last. Users can continue editing a working copy or publish a read-only snapshot that others can open from a URL. Roles, labels, and notes generated during the analysis should be treated as analytical outputs rather than independently established facts.
Application to exploit analysis
Etherscan illustrated the tool with an examination of an exploit on the RedSonic Vault. The mapped flow identified seven entities and eight fund movements involving Balancer, a Diamond vault, and Lido. The resulting visualization indicated a flash-loan share-price manipulation that transferred 9.252513 ETH to the attacker address. The attack transaction and relevant contract addresses were referenced in the accompanying thread.
In a separate demonstration, the tool connected a 5.9436 ETH drain that occurred in 2026 to two depositors and four SAFEs that had been opened in 2020.
Etherscan Flow mentioned that it can also generate activity profiles for individual addresses. One example prompt, “Profile based on past hour activity with etherscan-flow,” produced a summary showing 58 searcher bots receiving 0.0426 ETH across 147 transactions while 0.3286 ETH left the address in 82 transactions directed to a single contract. The resulting flow is viewable at the link provided in the announcement thread.
Etherscan says the entities and fund movements displayed in an Etherscan Flow is grounded in live data retrieved through its API.
Earlier Etherscan updates
The announcement follows the company’s April 15 introduction of the Token Holders Overview (Beta) feature. That earlier update placed holder concentration figures, tier distribution data, and a Gini score on the ERC-20 token holders tab for tokens carrying Neutral or OK reputation scores.
The overview appeared on the Holders tab for qualifying tokens, and users could examine additional tokens such as USDT, USDC, and stETH through Etherscan’s token directory. Minor changes were also made at that time to the existing token holder chart, with further adjustments described as planned. The feature was released in beta, and community feedback was requested.
Also Read: Robinhood Takes Minority Stakes in Crypto.com and Its Prediction-Markets Spinout
