# TxRay: Agentic Postmortem of Live Blockchain Attacks

arXiv: https://arxiv.org/abs/2602.01317 · HTML: https://mlsanity.com/paper/2602.01317/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Builds on 19 of its 35 references that are in the map.
- First posted on arXiv 1 Feb 2026.

## Builds on (most cited first, 19 of 19)

- [Automatic Root Cause Analysis via Large Language Models for Cloud Incidents](https://mlsanity.com/paper/2305.15778/) (2023)
- [Do you still need a manual smart contract audit?](https://mlsanity.com/paper/2306.12338/) (2023)
- [SoK: Decentralized Finance (DeFi) Attacks](https://mlsanity.com/paper/2208.13035/) (2022)
- [Blockchain Large Language Models](https://mlsanity.com/paper/2304.12749/) (2023)
- [Large Language Models for Blockchain Security: A Systematic Literature Review](https://mlsanity.com/paper/2403.14280/) (2024)
- [AI Agent Smart Contract Exploit Generation](https://mlsanity.com/paper/2507.05558/) (2025)
- [Large Language Models for Security Operations Centers: A Comprehensive Survey](https://mlsanity.com/paper/2509.10858/) (2025)
- [PoCo: Agentic Proof-of-Concept Exploit Generation for Smart Contracts](https://mlsanity.com/paper/2511.02780/) (2025)
- [GenDFIR: Advancing Cyber Incident Timeline Analysis Through Retrieval Augmented Generation and Large Language Models](https://mlsanity.com/paper/2409.02572/) (2024)
- [Smart-LLaMA-DPO: Reinforced Large Language Model for Explainable Smart Contract Vulnerability Detection](https://mlsanity.com/paper/2506.18245/) (2025)
- [SmartPoC: Generating Executable and Validated PoCs for Smart Contract Bug Reports](https://mlsanity.com/paper/2511.12993/) (2025)
- [DFIR-Metric: A Benchmark Dataset for Evaluating Large Language Models in Digital Forensics and Incident Response](https://mlsanity.com/paper/2505.19973/) (2025)
- [AiRacleX: Automated Detection of Price Oracle Manipulations via LLM-Driven Knowledge Mining and Prompt Generation](https://mlsanity.com/paper/2502.06348/) (2025)
- [Decompiling Smart Contracts with a Large Language Model](https://mlsanity.com/paper/2506.19624/) (2025)
- [Empirical Review of Smart Contract and DeFi Security: Vulnerability Detection and Automated Repair](https://mlsanity.com/paper/2309.02391/) (2023)
- [LLM-Powered Detection of Price Manipulation in DeFi](https://mlsanity.com/paper/2510.21272/) (2025)
- [Is the Digital Forensics and Incident Response Pipeline Ready for Text-Based Threats in LLM Era?](https://mlsanity.com/paper/2407.17870/) (2024)
- [Blockchain Address Poisoning](https://mlsanity.com/paper/2501.16681/) (2025)
- [An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models](https://mlsanity.com/paper/2509.01271/) (2025)

## Built on by (most cited first, 2 of 2)

- [Transferable Self-Evolving Playbooks for Agentic Security Auditing](https://mlsanity.com/paper/2606.16420/) (2026)
- [EVAGE: Autonomous MEV Generation and Adaptation via Multi-Agent Harness](https://mlsanity.com/paper/2609.27424/) (2026)

## Abstract (arXiv)

Decentralized Finance (DeFi) has turned blockchains into financial infrastructure, allowing anyone to trade, lend, and build protocols without intermediaries, but this openness exposes pools of value controlled by code. Within five years, the DeFi ecosystem has lost over 15.75B USD to reported exploits. Many exploits arise from permissionless opportunities that any participant can trigger using only public state and standard interfaces, which we call Anyone-Can-Take (ACT) opportunities. Despite on-chain transparency, postmortem analysis remains slow and manual: investigations start from limited evidence, sometimes only a single transaction hash, and must reconstruct the exploit lifecycle by recovering related transactions, contract code, and state dependencies. We present TxRay, a Large Language Model (LLM) agentic postmortem system that uses tool calls to reconstruct live ACT attacks from limited evidence. Starting from one or more seed transactions, TxRay recovers the exploit lifecycle, derives an evidence-backed root cause, and generates a runnable, self-contained Proof of Concept (PoC) that deterministically reproduces the incident. TxRay self-checks postmortems by encoding incident-specific semantic oracles as executable assertions. To evaluate PoC correctness and quality, we develop PoCEvaluator, an independent agentic execution-and-review evaluator. On 114 incidents from DeFiHackLabs, TxRay produces an expert-aligned root cause and an executable PoC for 105 incidents, achieving 92.11% end-to-end reproduction. Under PoCEvaluator, 98.1% of TxRay PoCs avoid hard-coding attacker addresses, a +22.9pp lift over DeFiHackLabs. In a live deployment, TxRay delivers validated root causes in 40 minutes and PoCs in 59 minutes at median latency. TxRay's oracle-validated PoCs enable attack imitation, improving coverage by 15.6% and 65.5% over STING and APE.