Nemesis

An autonomous crypto incident response agent built for what happens after a wallet is compromised

Comment

Inspiration

A friend of mine had his wallet compromised and spent days manually trying to understand what happened and where the funds went. That made me wonder why incident response couldn't begin with the one thing most victims already have: their wallet address.

What it does

Nemesis investigates compromised wallets. It identifies the likely theft transaction, traces stolen funds across wallets and chains, monitors further movement, and surfaces actionable evidence that can support recovery and escalation.

How we built it

Nemesis uses Google ADK with Gemini 3.5 Flash for agent reasoning, while onchain data is collected and verified through Alchemy, Bitquery and other blockchain data sources. The backend runs on Google Cloud Run, with Firestore for persistent cases and Pub/Sub for monitoring.

Challenges we ran into

The biggest challenge was making real fund tracing reliable. Blockchain activity gets messy very quickly, especially when stolen funds split across several wallets or move through contracts and bridges. We also had to make investigations fast enough that users weren't waiting several minutes for a result.

Accomplishments that we're proud of

Nemesis works on real blockchain data rather than a simulated demo. We tested it against the Bybit exploit and it was able to investigate the wallet, identify the likely incident, trace fund movement and create a persistent case for continued monitoring.

What we learned

We learned that tracing the first transaction is only part of incident response. The useful part is continuing to follow the money and turning what happens next into evidence someone can actually act on.

What's next for Nemesis

Next, we want to expand Nemesis across more chains, improve cross chain tracing, add more entity attribution, and make recovery and escalation workflows even more actionable.

Built With

Share this project:

Updates

Submission history