Quorum

An autonomous agent that hunts crypto scams on its own. It triages every token, unmasks the operators behind them, and blocks them through a risk API before users get hurt.

Comment

The problem, and why it matters

Crypto lost 17 billion dollars to scams and 3.4 billion to hacks in 2025. Most of it is rug pulls: someone deploys a token, pumps it, and drains it within hours. Every exchange and wallet is legally required to screen tokens and funds for this, but the tooling today is dashboards that a human analyst has to sit and operate. One investigation takes hours. There are millions of tokens. Humans do not scale, and the scammers count on it.

What it does

Quorum is an autonomous security analyst for Web3. It does not wait for you to paste a wallet. It continuously scores every token on chain, dispatches itself to the worst threats, investigates them, and blocks them. Four surfaces, one agent:

  • Monitor. Scores 65,639 ERC-20 tokens across 25 million real Ethereum transactions and surfaces a live threat feed, with no human input.
  • Investigate. The agent writes its own SQL through Emergence CRAFT and measures holder concentration, deployer dominance, wash trading, and a lifecycle that spikes and collapses in a day. It returns a verdict, a 0 to 100 risk score, and a detection rule you can ship.
  • Campaigns. It fingerprints bytecode across all 65k tokens and resolves the operators behind them. One clustering pass surfaced 15 rug-kit operators responsible for 319 rug tokens and 24,639 victim wallets.
  • Protect. A risk API that wallets, exchanges, and protocols call before every transaction. One integration screens every user on every token automatically and returns block, warn, or allow.

How we built it

  • Reasoning: Nebius Token Factory (nvidia nemotron) is the agent brain.
  • Data: Emergence CRAFT, a semantic text-to-SQL layer over real Ethereum data in Snowflake, accessed over MCP.
  • Backend: FastAPI with server-sent events, so the investigation streams live.
  • Agent loop: a hand-written tool-calling loop with CRAFT tools including bytecode clone detection and operator scanning. The agent orients itself in the semantic layer first, then queries in domain language.
  • Detection signals are grounded in AML research (FlowScope, DenseFlow).

Challenges we ran into

The dataset is a real but sampled slice of Ethereum, roughly 1 to 3 percent of blocks. We measured that early and found multi-hop fund tracing across wallets breaks at that sampling rate. So we pivoted from flow tracing to signals that survive sampling: address-level behavior and exact bytecode fingerprints. That pivot is what led to the operator detection, which became our strongest finding. The reasoning model is thorough but slow, so we added a forced synthesis step and cached results so a live demo never stalls.

What we learned

Bytecode is a weak identity key on its own, because legit tokens share templates. So we cross-reference every cluster with real rug behavior before calling it an operator. That is the difference between a naive claim and a defensible one.

What's next

Live feeds (pump.fun launches and DexScreener liquidity data) behind the same agent, and running Quorum over an exchange's own governed data through CRAFT as an in-house compliance analyst.

Demo Link: https://www.loom.com/share/2b51f75a2dd94d8c8c25a0d80d88e681

Built With

  • emergence-craft
  • ethereum
  • fastapi
  • javascript
  • mcp
  • nebius-token-factory
  • nvidia-nemotron
  • openai-api
  • python
  • server-sent-events
  • snowflake
  • sql
  • svg
  • uv
Share this project:

Updates