Multi-agent on-chain anomaly detector for EVM wallets and contracts, powered by Xiaomi MiMo V2.5 Pro.
DeFi treasury managers and crypto-native funds hold $10B+ across thousands of wallets, but tooling for behavioral anomaly detection is primitive. Most teams rely on Etherscan alerts that fire on every transfer, drowning the signal in noise. They miss the actual exploit pattern: a wallet drained over 12 hours via rotating intermediate hops, or a governance contract that silently executed a back-doored proposal weeks before the rug. ChainSentry replaces the analyst with a 5-agent pipeline; MiMo provides the deep reasoning step that distinguishes routine activity from exploit precursors.
┌──────────┐ ┌──────────┐ ┌──────────────┐ ┌──────────┐ ┌──────────┐
│ Sentry │→ │ Profiler│→ │ MiMo Reasoner│→ │ Severity│→ │ Notifier│
│ │ │ │ │ (long-chain) │ │ │ │ │
└──────────┘ └──────────┘ └──────────────┘ └──────────┘ └──────────┘
│ │ │ │ │
└─────────────┴────────────────┴───────────────┴─────────────┘
shared event bus
| Agent | Job | Model |
|---|---|---|
| Sentry | Watch a wallet set via JSON-RPC, snapshot every transfer, approval, and contract call | rule-based |
| Profiler | Build a 30-day behavior graph per wallet, score deviation from baseline (counterparty entropy, gas pattern, time-of-day) | statistical |
| MiMo Reasoner | Long-chain reasoning over deviation + on-chain context (token allowances, recent governance, bridge activity), produce verdict with severity 0-10 | MiMo V2.5 Pro |
| Severity | Apply policy rules (treasury size, time-since-deploy, multisig threshold), assign tier critical/high/med/low | deterministic |
| Notifier | Push alerts to Telegram, Discord webhook, or PagerDuty depending on tier | deterministic |
The Reasoner agent runs long-chain CoT for every event. Concretely:
- Multi-hop trace — follow the value path 4 hops deep across DEX swaps and bridges to detect drain patterns
- Contextual evidence — read recent governance proposals, multisig signer set changes, oracle updates that could legitimize the activity
- Counter-evidence search — explicitly look for routine reasons (treasury rebalance, vesting unlock, known custodian rotation) before raising severity
- Verdict synthesis — return a single severity score with the chain of reasoning attached for incident review
MiMo handles the reasoning chain end-to-end in a single inference pass.
- Python 3.12, asyncio
- web3.py + multicall for batched RPC reads
- Xiaomi MiMo V2.5 Pro via OpenAI-compatible endpoint
- SQLite for incident journal, Redis for hot state
- systemd service deployment
- ✅ Core pipeline: production
- 🟡 MiMo Reasoner: integrated, A/B testing against rule-based baseline
- 🔜 Public dashboard: pending validation suite
git clone https://github.com/indrarg8899/chainsentry
cd chainsentry
pip install -r requirements.txt
cp .env.example .env # add MIMO_API_KEY and provider keys
python -m chainsentry.run --mode watchMIT