Most investigators work with sender, recipient, amount, and timestamp. That covers the surface. Event logs — the structured records contracts emit during execution — contain the actual detail: which tokens moved inside a contract call, which approvals were granted, which pools a swap routed through, which identifiers link two sides of a bridge transaction.
How event logs are structured
Every event log has three parts:
- Topic 0 — the event signature hash. A keccak256 hash of the event name and parameter types. For an ERC-20 Transfer, the signature is always the same hash regardless of which token contract emitted it. This identifies what type of event occurred.
- Topics 1-3 — indexed parameters. The values the developer marked as searchable. For a Transfer event, topic 1 is the sender, topic 2 is the recipient. Left-padded to 32 bytes in hex.
- Data — non-indexed parameters. Everything else. For a Transfer, this contains the amount. For a Swap, it may contain input/output amounts and other parameters encoded sequentially.
Decoding is mechanical: identify the event signature, extract the indexed topics, decode the data field. Block explorers with verified contracts do this automatically. For unverified contracts, you decode manually using signature databases like 4byte.directory.
Five events that matter
Transfer events. Every ERC-20 token movement emits one. A single transaction the dashboard shows as one transfer may contain a dozen Transfer events — revealing intermediate movements the platform collapsed.
Approval events. Emitted when a wallet grants spending permission to a contract. Invisible in fund-flow views but critical. A wallet that approved a malicious contract has active risk even if no funds moved yet.
Swap events. DEX contracts emit events for each pool interaction. A multi-hop Uniswap swap produces separate Swap events per pool — showing exact routing, intermediate tokens, and amounts at each step.
Deposit and Withdrawal events. Lending protocols, vaults, and staking contracts emit these. They document how DeFi positions are opened and closed — the relationship between deposited and borrowed assets.
Cross-chain message events. Bridge contracts emit events with destination chain IDs, recipient addresses, and nonce values. These are the most reliable way to link two sides of a bridge transfer — far better than amount and timing correlation.
How I read them
Open the Logs tab in the block explorer. Identify event types from topic 0. Read every Transfer event — note from/to pairs and amounts, compare against what the analytics tool showed. Check for Approval events that don't show up in fund-flow views. Decode protocol-specific events using the contract's ABI.
The differences between what you find in the logs and what the tool showed are exactly the details that matter. This skill transfers directly across all EVM chains — Ethereum, Polygon, Arbitrum, BSC, and the rest.