Post-Exploit Forensic Analysis: How to Trace Stolen Funds Across DeFi Protocols After the KyberSwap Attack

The KyberSwap Elastic exploit of November 2023, which drained approximately $48 million from liquidity pools across multiple chains, provides a compelling case study for understanding post-exploit forensic analysis in DeFi. When a protocol is breached, the immediate aftermath involves a race against time: attackers move stolen funds through increasingly sophisticated laundering pathways while security researchers, protocol teams, and on-chain analysts work to trace and potentially freeze the assets. This advanced tutorial walks through the methodologies and tools used by professional blockchain forensic analysts, providing a technical framework that security researchers and protocol operators can apply when responding to exploits.

The Objective

The goal of post-exploit forensic analysis is threefold: first, to determine the root cause of the exploit and identify the specific vulnerability that was leveraged; second, to trace the movement of stolen funds across blockchains, bridges, and mixing services; and third, to identify opportunities for fund recovery through cooperation with exchanges, law enforcement, and other protocols. The KyberSwap case demonstrates all three objectives in action, with the attacker moving funds across Ethereum, Polygon, Avalanche, and other networks before eventually engaging in on-chain negotiations with the protocol team.

This tutorial assumes familiarity with smart contract basics, Ethereum transaction structure, and common DeFi attack vectors. You will need access to a block explorer like Etherscan, a blockchain analytics platform such as Tenderly or Forta, and basic command-line proficiency for working with on-chain data extraction tools.

Prerequisites

Before beginning a forensic analysis, assemble your toolkit. Install Foundry, a Solidity development framework that includes Cast — a command-line tool for making Ethereum RPC calls. You will also need access to archive node data through a service like Alchemy or Infura, as you need to query historical contract states at specific block numbers. A blockchain visualization tool like Nansen or Dune Analytics provides the macro-level view of fund flows, while Tenderly’s transaction simulator allows you to replay exploit transactions step-by-step.

For the KyberSwap analysis specifically, you need access to block explorers for at least four chains: Ethereum (etherscan.io), Polygon (polygonscan.com), Avalanche (snowtrace.io), and Arbitrum (arbiscan.io). The attacker deployed identical exploit contracts across multiple networks, and tracing the complete fund flow requires correlating data across all of them.

Set up a tracking spreadsheet or database to log each significant transaction, including the transaction hash, from address, to address, value transferred, block number, and timestamp. This log becomes your primary reference as the analysis grows in complexity.

Step-by-Step Walkthrough

Step 1: Identify the initial exploit transaction. Begin by locating the first transaction that drained funds from the compromised protocol. For KyberSwap, this was a series of transactions on November 22, 2023 targeting KyberSwap Elastic liquidity pools. Use the protocol’s official communications or blockchain alert services like Forta to identify the relevant transaction hashes. In Etherscan, examine the internal transactions of the exploit transaction to understand which contract functions were called and what state changes occurred.

Step 2: Replay the transaction in a simulator. Load the exploit transaction into Tenderly’s transaction debugger. This tool allows you to step through every EVM opcode executed during the transaction, examining the state of every contract storage slot at each point in execution. Pay particular attention to the call stack: what external contracts did the exploit contract interact with? What token transfers occurred? What storage variables were modified?

For the KyberSwap exploit, the analysis revealed that the attacker manipulated the concentrated liquidity tick math in KyberSwap Elastic, crafting specific swap amounts that caused the protocol to miscalculate liquidity positions. By carefully controlling the swap amounts and directions, the attacker drained value from liquidity pools without triggering the normal arbitrage mechanisms that would have limited the damage.

Step 3: Trace fund movements using graph analysis. Once you understand the exploit mechanics, shift focus to tracking where the stolen funds went. Start with the attacker’s primary address and trace every outbound transaction. Use Etherscan’s token approval and transfer filters to track ERC-20 movements, and check for ETH transfers to identify bridge interactions or exchange deposits.

Most sophisticated attackers use several laundering stages. The first stage typically involves consolidating stolen tokens into a single currency — usually ETH or a major stablecoin. The second stage involves distributing funds across multiple wallets to create complexity. The third stage routes funds through bridges to other blockchains. The fourth stage may involve mixing services like Tornado Cash or over-the-counter trades.

Step 4: Identify exchange deposit addresses. If the attacker deposits funds into a centralized exchange, this represents the best opportunity for fund recovery. Compare the destination addresses against known exchange deposit addresses, which are cataloged by blockchain analytics firms. If you identify an exchange deposit, immediately contact the exchange’s compliance team with the relevant transaction details. Most major exchanges have procedures for freezing funds linked to known exploits.

Step 5: Document and report. Compile your findings into a comprehensive report that includes the exploit mechanism, affected contracts, transaction timeline, fund flow diagram, and any identified exchange connections. Share this report with the protocol team, relevant blockchain security firms, and law enforcement if requested. The KyberSwap team published their own post-mortem identifying 2,367 affected liquidity providers and a total value of approximately $56.2 million in affected assets.

Troubleshooting

Forensic analysis rarely proceeds smoothly. Attackers frequently use techniques designed to frustrate tracing, including chain-hopping through decentralized bridges, using flash loans to create complex transaction chains, and leveraging privacy protocols. When you encounter a break in the trail — funds entering a mixing service or an untraceable bridge — document the point of loss and move on to other threads.

Be prepared for time-zone challenges when coordinating with exchanges and international law enforcement. The KyberSwap attacker operated across multiple time zones and moved funds 24/7, while the response team had to coordinate with parties across Asia, Europe, and North America. Establish communication channels with key exchanges in advance as part of any protocol’s incident response plan.

False positives are common in fund tracing. Just because funds move from an address associated with the attacker to an exchange does not mean that the exchange user is the attacker — the funds may have been sold OTC to an unwitting buyer. Avoid making public accusations without thorough verification.

Mastering the Skill

Becoming proficient in blockchain forensic analysis requires practice across multiple exploit types. Study historical hacks — from the DAO exploit of 2016 through the major 2023 incidents — and practice tracing fund flows using publicly available transaction data. Each exploit type teaches different tracing techniques: flash loan attacks require understanding DEX mechanics, bridge exploits require cross-chain analysis skills, and social engineering attacks like address poisoning require different investigative approaches entirely.

Consider participating in bug bounty programs and audit competitions, not just as a hunter but as an observer. Watching how protocols respond to vulnerability disclosures provides insight into their incident response maturity, which directly impacts the effectiveness of forensic analysis after a real exploit. The crypto security landscape evolves rapidly, with attackers developing new techniques and defenders building new tools in a constant arms race. Staying current with the latest exploits, as documented by security firms like CertiK, PeckShield, and Trail of Bits, is essential for maintaining forensic competency. As the November 2023 hacking spree demonstrated, with $363 million stolen in a single month, the demand for skilled blockchain forensic analysts will only continue to grow.

Disclaimer: This article is for educational and informational purposes only. It does not constitute legal, financial, or professional advice. Blockchain forensic analysis should be conducted by qualified professionals in compliance with applicable laws and regulations.