Chainstack Self-Hosted is now available! Launch production-grade blockchain nodes on infrastructure you control.    Get started
  • Pricing
  • Docs

Ethereum RPC for forensics & compliance analytics: best providers 2026

Created May 20, 2026 Updated May 22, 2026
Eth Compliance logo

Ethereum is the world’s leading programmable blockchain and the primary evidentiary record for on-chain financial forensics. Choosing the right Ethereum RPC provider for forensics and compliance analytics is therefore an infrastructure decision with direct legal and regulatory consequences — one that most Ethereum RPC comparison articles ignore entirely. Over $3 trillion in cumulative DeFi volume, the majority of regulated stablecoins, and virtually every major tokenized asset program run on Ethereum, making it the chain that compliance teams, blockchain analytics firms, and law enforcement investigators most frequently need to interrogate.

The forensics and compliance workload is structurally different from DeFi or trading infrastructure. You are not competing for block inclusion or chasing sub-millisecond latency. You are running sustained, archive-depth queries: replaying historical transaction execution with debug_traceTransaction, reconstructing years of token flows via eth_getLogs, querying account state at specific historical block heights, and building reproducible audit trails that must hold up under legal or regulatory scrutiny. This workload demands archive nodes, debug and trace API access, high sustained throughput, and — increasingly — vendor-side compliance attestations that satisfy security review boards.

This guide compares six Ethereum RPC providers for forensics and compliance analytics use cases: Chainstack, Quicknode, Alchemy, Infura, dRPC, and GetBlock. Each is evaluated on archive and trace access, compliance certifications, pricing for debug-heavy workloads, dedicated throughput options, and data sovereignty capabilities.

💡 Already using Chainstack? Jump straight to the Ethereum tooling documentation or deploy your archive endpoint in the Chainstack console in minutes.

Forensics & compliance analytics on Ethereum: RPC requirements

Latency requirements

Forensics and compliance workloads are primarily batch-tolerant. You are not competing with MEV bots for a 10ms advantage. What matters is throughput consistency: a provider that handles 200 concurrent archive reads without rate-limiting is more valuable than one with an impressive eth_blockNumber latency benchmark.

The exception is real-time sanctions screening — systems that monitor the mempool or watch incoming blocks for flagged addresses need fast WebSocket subscriptions with reliable reconnection. For that component, p95 latency under 200ms and a stable eth_subscribe connection are reasonable requirements.

Throughput requirements

  • Sustained historical indexing: 50–300 RPS of archive reads across multiple block ranges simultaneously
  • Batch reconstruction jobs: burst of 500–1,000+ debug_traceTransaction calls when replaying a contract’s full history
  • Real-time monitoring: moderate (~10–50 RPS) but continuous and 24/7

Standard shared public endpoints collapse under sustained indexing load. You need a dedicated node, an Unlimited Node add-on, or a self-hosted deployment to run these workloads reliably.

Key RPC methods for forensics & compliance analytics

  • debug_traceTransaction — the primary forensics method. Returns the full EVM execution trace of a transaction: every internal call, storage read/write, gas step, and revert path. Essential for reconstructing internal token movements that do not appear in event logs. Requires an archive node with the debug API namespace enabled. Rate-limited or entirely unavailable on most shared endpoints — always verify your provider exposes the debug_* namespace before building a pipeline around it.
  • debug_traceBlockByNumber / debug_traceBlock — traces all transactions in a block simultaneously. More efficient than calling debug_traceTransaction per transaction for bulk block reconstruction. Same archive + debug namespace requirement.
  • trace_transaction — OpenEthereum/Erigon-style transaction trace. Returns call tree, reward, and state difference in the Parity trace format. Less verbose than the Geth debug_* output but faster for simple call tracing. Available on nodes running the Erigon client; check whether your provider supports the trace_* namespace alongside debug_*.
  • trace_filter — filters traces by from-address, to-address, or block range. Essential for efficiently identifying all interactions involving a flagged address without scanning every block individually. Not available on all providers — confirm support before relying on it.
  • trace_block — retrieves all traces for a given block. Useful for systematic block-by-block reconstruction of on-chain activity involving a specific address cluster.
  • eth_getLogs — retrieves event logs by address, topic, and block range. The primary method for token transfer tracking across ERC-20, ERC-721, and ERC-1155 contracts. Works on full nodes for recent blocks; archive access extends this to genesis. Note: eth_getLogs does not require an archive node — it works on full nodes for any log within their retained state window. Archive is only needed for queries reaching further back than your provider’s full-node retention depth (typically 128 blocks to full state, but log history varies by provider).
  • eth_getTransactionByHash — retrieves transaction parameters: sender, receiver, value, input data, nonce. Present in every forensics workflow as the first lookup when investigating a flagged transaction.
  • eth_getTransactionReceipt — retrieves execution result with full event logs, gas used, revert reason, and contract address (for deployment transactions). Required for confirming final state and collecting all emitted events.
  • eth_getBalance / eth_getStorageAt / eth_call at a historical block number — queries historical account or contract state. These three methods all require archive access when the target block is older than the node’s pruning window. Used to establish a wallet’s balance at a specific point in time, replay a contract function call against historical chain state, or verify storage slot values before and after a suspected exploit.

Full Ethereum API reference: docs.chainstack.com/reference/ethereum-getting-started

Archive node access: non-negotiable

Every forensics and compliance workflow targeting historical Ethereum data requires archive access. Without it:

  • debug_traceTransaction fails for transactions older than ~128 blocks
  • eth_getBalance / eth_getStorageAt / eth_call at historical block numbers fail
  • trace_* methods fail for historical blocks outside the node’s state window

Archive nodes store complete historical state from genesis. Full Ethereum archive storage exceeds 3 TB at time of writing and grows continuously. They cost more to operate and are more expensive for providers to offer — which is why many “archive” offerings are partial or rate-limited. Always confirm your provider’s archive coverage includes the debug_* and trace_* namespaces, not just historical log access.

Infrastructure requirements

  • Archive node with debug + trace APIs enabled
  • WebSocket endpoint for real-time monitoring and eth_subscribe
  • High RPS allowance or dedicated endpoint — shared infrastructure throttles under sustained indexing
  • Contractual SLA — regulatory reporting often requires documented uptime guarantees for the infrastructure it depends on
  • SOC 2 Type II or equivalent — minimum auditable attestation for compliance team vendor onboarding in most regulated organizations

Chainstack for forensics & compliance analytics on Ethereum

Chainstack addresses the forensics and compliance use case more completely than any other managed RPC provider, because it combines archive depth and debug/trace access at the API layer with the compliance certifications that regulated teams require at the vendor layer — without separating them behind different plan tiers or sales engagements.

Archive and debug access: All Chainstack plans above Developer include archive node access with both the debug_* and trace_* namespaces enabled. This is not locked behind an enterprise negotiation. Pricing is flat: 1 RU per request regardless of method. A debug_traceTransaction call on a complex 500-internal-call DeFi transaction costs exactly 1 RU — the same as eth_blockNumber. Competitors using method-weight multipliers charge 20–26× more for the same debug calls, which at forensics scale means a 10× to 20× budget difference.

Dedicated Nodes: For high-volume forensics workloads — bulk historical reconstruction pipelines, automated compliance screening — Dedicated Nodes eliminate the shared infrastructure concern entirely. A private Ethereum archive node (Erigon is the recommended client for full trace_* namespace support) with guaranteed throughput and no rate-limit surprises mid-investigation. Paired with the Unlimited Node add-on ($149–$3,199/month for 25–500 RPS flat-rate tiers), sustained indexing runs without per-request billing anxiety.

Global Nodes: For teams distributing forensics compute across regions or requiring geographic failover, Global Nodes provide geo-routed, load-balanced access to Ethereum archive nodes with a >99.99% uptime SLA. When a compliance report is due to a regulator, that SLA matters.

SOC 2 Type II certification: Chainstack holds SOC 2 Type II certification as of December 2025. This covers security, availability, and confidentiality controls — the minimum auditable attestation that most compliance team vendor questionnaires and their outside counsel will accept when onboarding a third-party infrastructure provider.

Chainstack Self-Hosted: For organizations that cannot route forensic blockchain data through any third-party cloud — law enforcement agencies, regulated custodians operating under MiCA or GENIUS Act data residency obligations, sovereign wealth funds with strict vendor data exposure policies — Chainstack Self-Hosted deploys the same Erigon archive node stack on your own infrastructure: AWS GovCloud, Azure Government, or on-premises hardware. The debug_* and trace_* namespaces, the same RPC surface, the same throughput characteristics — inside your own network perimeter with no third-party data path. It operates similarly to Dedicated Nodes in isolation terms, but at the infrastructure level rather than the cloud tenancy level. The managed Chainstack SOC 2 Type II applies to the managed product; self-hosted customers run their own compliance attestation with Chainstack providing architecture documentation to support the process.

Code example: tracing transactions for forensics analysis

from web3 import Web3
# Replace with your Chainstack Ethereum archive endpoint
RPC_URL = "https://ethereum-mainnet.core.chainstack.com/YOUR_API_KEY"
w3 = Web3(Web3.HTTPProvider(RPC_URL))
tx_hash = "0xYOUR_TRANSACTION_HASH"
# Full execution trace — requires archive node with debug API enabled
trace = w3.manager.request_blocking(
    "debug_traceTransaction",
    [tx_hash, {"tracer": "callTracer"}]
)
print(f"Top-level call type: {trace['type']}")
print(f"From: {trace['from']}")
print(f"To:   {trace['to']}")
print(f"Internal calls: {len(trace.get('calls', []))}")
# Token transfer log scan (ERC-20 Transfer event topic)
TRANSFER_TOPIC = w3.keccak(text="Transfer(address,address,uint256)").hex()
logs = w3.eth.get_logs({
    "fromBlock": 18_000_000,
    "toBlock":   18_001_000,
    "topics": [TRANSFER_TOPIC],
    # "address": "0xTOKEN_CONTRACT"  # Optional: scope to one contract
})
print(f"nTransfer events in block range: {len(logs)}")
for log in logs[:5]:
    print(f"  Tx: {log['transactionHash'].hex()}, block: {log['blockNumber']}")

🔒 Archive requirement: debug_traceTransaction requires an archive node with the debug namespace enabled. All Chainstack paid-plan endpoints include this — 1 RU per call, no method surcharge. See the Ethereum tooling documentation for full SDK setup and client library examples.

🤖 You can also access Chainstack Ethereum RPC directly from Claude, Cursor, Codex, Gemini, or Windsurf using Chainstack MCP. Learn more about Chainstack MCP.

Provider comparison

The table below summarizes public positioning as of May 2026. The “Why it matters for forensics & compliance” column evaluates each provider specifically through the lens of investigative and compliance workloads — not general developer experience.

ProviderPricing modelFree tierDedicated nodesArchive & traceWhy it matters for forensics & compliance
Chainstack1 RU/request (no method multipliers)3M RU/monthYes (paid plans)Yes — debug + trace namespaces enabledSOC 2 Type II, flat debug pricing, full archive + trace — most complete managed option
QuicknodeCredit-based (method-weighted)30-day trial onlyDedicated clustersArchive: yes; trace: yes on paid plansSOC 2 Type II + ISO 27001 dual certification — strongest compliance posture of any managed provider
AlchemyCU-based (20–26× multiplier on debug calls)30M CU/monthNo standard optionArchive: yes; debug: very expensive per callSOC 2 Type II, but debug CU costs are prohibitive at forensics scale
InfuraAPI credits (method-weighted)100K req/dayNo standard optionArchive: yes; debug: yes on paid plansLongest track record on Ethereum; no standalone Infura SOC 2 publication
dRPCFlat per 1M requestsFree public tier (no SLA)NoArchive: inconsistent; trace: provider-dependentLow cost for log scanning; no compliance certifications or contractual SLA
GetBlockSubscription-basedLimitedShared onlyArchive: yes; trace: yes on paid plansReasonable archive coverage; no published compliance certifications

Chainstack

Chainstack dashboard

Chainstack’s managed Ethereum offering runs on Erigon as the preferred archive client for forensics workloads. This matters for two reasons: Erigon simultaneously exposes the trace_* namespace (OpenEthereum-compatible format used by Chainalysis, Elliptic, and TRM Labs) and the Geth-compatible debug_* namespace on the same endpoint, without requiring separate endpoint configurations. Some providers give you one namespace or the other — requiring you to manage two endpoints and two billing accounts for a complete forensics stack.

Pricing is the standout advantage at forensics scale: 1 RU per request regardless of method. Debug and trace calls — the most computationally expensive methods — cost identically to basic reads. The Growth plan ($49/month, 20M RU) covers light forensics work; the Enterprise plan ($990+/month, 400M+ RU) supports production compliance pipelines. The Unlimited Node add-on at $149–$3,199/month converts billing to flat-rate RPS (25–500 RPS), eliminating per-request cost accumulation on bulk historical sweeps. Dedicated Nodes remove shared-infrastructure rate limits entirely for the highest-volume workloads.

The vendor compliance story is complete: SOC 2 Type II certified (December 2025), with 99.99%+ uptime SLA on Global Nodes and contractual SLA terms available through Chainstack for Enterprise. The SOC 2 report is available for third-party vendor questionnaires.

Limitations: The Developer free plan (3M RU/month) exhausts within hours of any sustained archive scanning. Dedicated Nodes require a paid plan; the self-hosted deployment option requires enterprise engagement rather than self-service provisioning. Chainstack does not hold ISO 27001 alongside its SOC 2 Type II certification, which may matter for vendors whose compliance frameworks require both.

Fit by workload:

  • Bulk historical trace indexing: Excellent — flat debug pricing, Unlimited Node add-on for sustained RPS, full archive + debug + trace namespaces
  • Real-time sanctions monitoring: Excellent — WebSocket endpoints, 99.99% SLA, Global Nodes geo-routing
  • Regulated compliance infrastructure: Excellent — SOC 2 Type II, contractual SLA, Dedicated Nodes for isolated throughput

Quicknode

Quicknode dashboard

Quicknode holds both SOC 2 Type II and ISO 27001 certifications simultaneously — the only managed Ethereum RPC provider that satisfies both in combination. If your security team’s vendor questionnaire requires ISO 27001 alongside SOC 2 (common in financial services and enterprise procurement), Quicknode is currently the only managed option that clears both bars without additional negotiation.

Archive access and the debug/trace namespaces are available on paid plans. Dedicated clusters (not just shared endpoints) eliminate the rate-limit uncertainty that forensics pipelines cannot afford at scale. Quicknode’s add-on ecosystem includes graph indexing and notification products that complement compliance data pipelines — useful for building automated alert systems around flagged addresses.

The pricing concern for forensics is real: Quicknode uses a credit-based system with method weighting. Heavy methods like debug_traceTransaction consume significantly more credits than basic reads. Teams running sustained trace-heavy pipelines should model costs carefully against the base credit rate before committing. The 30-day trial is the only free access — there is no ongoing free tier.

Limitations: No ongoing free tier (30-day trial only). Method-weighted credits make trace-heavy workloads more expensive than they appear from the base rate. ISO 27001 is Quicknode’s advantage over Chainstack; flat-rate debug pricing is Chainstack’s counter-advantage for cost-sensitive forensics pipelines.

Fit by workload:

  • Bulk historical trace indexing: Strong — dedicated clusters eliminate rate limits, archive + trace confirmed, but credit costs scale fast
  • Real-time sanctions monitoring: Excellent — low-latency endpoints, dedicated cluster option, ISO 27001 + SOC 2 Type II dual certification
  • Regulated compliance infrastructure: Excellent — dual certification is the strongest compliance posture in the managed category

Alchemy

Alchemy dashboard

Alchemy is the most widely recognized Ethereum RPC provider by developer mindshare, and it does provide archive node access and the debug API namespace on paid plans. SOC 2 Type II is certified. For general Ethereum development, Alchemy’s enhanced APIs — alchemy_getAssetTransfers, Notify webhooks, the Transfers API — are genuinely useful. For forensics at scale, the compute unit (CU) pricing model is the problem.

Alchemy’s method weighting applies 20–26× multipliers to heavy methods. debug_traceTransaction consumes approximately 496 CUs per call (verify current rates at Alchemy’s pricing page — method weights can change). A forensics pipeline running 10,000 trace calls per day burns through ~5 million CUs daily — that is the free tier’s entire monthly allowance exhausted in six days, before any other API activity. At Alchemy’s paid tiers, the math on trace-heavy forensics workloads consistently runs 10–15× more expensive than flat-rate providers.

Alchemy’s proprietary enhanced APIs introduce a second concern for compliance use cases: methodology reproducibility. Compliance audit trails and legal chains of evidence need to be reproducible against standard Ethereum RPC. Proprietary APIs create vendor lock-in and reproducibility questions that compliance teams need to address.

Limitations: CU method multipliers make debug_traceTransaction workloads prohibitively expensive at forensics scale. No standard dedicated node offering. Proprietary API dependency creates reproducibility risk for compliance methodologies.

Fit by workload:

  • Bulk historical trace indexing: Moderate — archive access confirmed, but CU costs are prohibitive for trace-heavy pipelines
  • Real-time sanctions monitoring: Good — Notify webhooks, fast endpoints, SOC 2 Type II
  • Regulated compliance infrastructure: Good — SOC 2 Type II certified, but CU model limits cost predictability for debug-intensive workloads

Infura

Infura dashboard

Infura, owned by ConsenSys, is the original managed Ethereum RPC provider and carries institutional name recognition that matters in forensics contexts. Compliance teams building chains of evidence, legal teams documenting investigation methodology, and regulators reviewing blockchain analytics provider lists are familiar with Infura as a known quantity. Its MetaMask lineage and decade-long operating history are traceable in ways that newer providers cannot match.

Archive access is available on paid plans starting at the Core tier. The debug_* namespace is available on paid plans. The trace_* namespace (OpenEthereum/Parity format) requires specific endpoint configuration — not all plan configurations expose both debug and trace simultaneously, so verify the specific namespace availability for your plan before building a pipeline. Free tier is 100K requests per day, adequate for development and testing but insufficient for any production forensics workload.

Infura’s pricing uses a credit model with method weighting, making sustained debug/trace workloads more expensive than flat-rate providers. No standard dedicated node option is available — enterprise options exist through direct sales engagement with ConsenSys.

Limitations: Method-weighted credits make bulk debug_traceTransaction workloads expensive at scale. No published standalone Infura SOC 2 Type II certification (ConsenSys holds enterprise certifications that may extend to Infura in certain commercial agreements — verify for your specific vendor questionnaire). No standard dedicated node path.

Fit by workload:

  • Bulk historical trace indexing: Good — archive and debug access confirmed on paid plans, but method pricing scales costs
  • Real-time sanctions monitoring: Good — WebSocket available, long-standing uptime track record
  • Regulated compliance infrastructure: Moderate — institutional recognition strong, but standalone SOC 2 documentation requires clarification

dRPC

dRPC dashboard

dRPC operates a distributed node network with flat per-million-request pricing, making it one of the most cost-effective options for high-volume event log scanning. For forensics teams whose primary workload is eth_getLogs-based token transfer extraction — without deep trace requirements — dRPC’s pricing structure is genuinely attractive.

For forensics workloads requiring the debug_* or trace_* namespaces, dRPC’s distributed network model introduces a consistency problem: archive coverage and namespace availability depend on the underlying node operators, and are not uniformly guaranteed across all requests. A pipeline that needs reproducible access to debug_traceTransaction cannot rely on inconsistent availability from a distributed provider pool.

No published SOC 2 or ISO 27001 certifications. No dedicated node offering. No contractual SLA documentation on the public pricing page. For compliance teams whose vendor onboarding process requires auditable security attestation — standard in financial services, legal, and government contexts — dRPC does not currently satisfy that requirement.

Limitations: No compliance certifications. Inconsistent debug/trace availability across distributed nodes. No contractual SLA. Not suitable for regulated compliance infrastructure or investigation chains of evidence.

Fit by workload:

  • Bulk historical trace indexing (log scanning only): Good — flat pricing, high throughput for eth_getLogs across large block ranges
  • Bulk historical trace indexing (debug/trace-heavy): Limited — inconsistent namespace availability across distributed nodes
  • Real-time sanctions monitoring: Moderate — WebSocket available but reliability undocumented; no SLA
  • Regulated compliance infrastructure: Limited — no compliance certifications, no contractual SLA

GetBlock

GetBlock dashboard

GetBlock has operated since 2019 and provides a stable Ethereum RPC service with archive access and trace support on paid subscription plans. Subscription-based pricing (rather than per-request) can be advantageous for teams with predictable sustained query volumes — knowing your monthly cost in advance is useful for compliance budget planning.

Archive and trace access are confirmed available on paid plans. The subscription pricing model avoids the “surprise bill” risk that per-request billing creates on spike-heavy forensics workloads. However, concurrent request limits on standard plans may constrain bulk pipelines running hundreds of simultaneous archive reads.

GetBlock does not publish SOC 2 or ISO 27001 certifications. For regulated entities whose vendor management programs require external security attestation — standard practice in banking, insurance, asset management, and government — this is a disqualifying factor regardless of technical capability.

Limitations: No published compliance certifications. Concurrent request limits may constrain bulk forensics pipelines. Limited public documentation on dedicated node SLA terms.

Fit by workload:

  • Bulk historical trace indexing: Good — archive + trace available on paid plans, subscription pricing is predictable
  • Real-time sanctions monitoring: Moderate — WebSocket available; no published uptime SLA
  • Regulated compliance infrastructure: Limited — no compliance certifications

Provider scoring — Ethereum forensics & compliance analytics

Click any row to expand scoring breakdown  Â·  Criteria weighted for forensics & compliance workloads

Chainstack (cloud) 92 / 100
Archive + trace (debug & trace namespaces)25 / 25
Compliance certifications (SOC 2 / ISO 27001)18 / 20
Debug pricing transparency (flat vs. multiplier)20 / 20
Dedicated throughput + contractual SLA19 / 20
Data sovereignty options10 / 15
Quicknode 79 / 100
Archive + trace (debug & trace namespaces)20 / 25
Compliance certifications (SOC 2 / ISO 27001)20 / 20
Debug pricing transparency (flat vs. multiplier)12 / 20
Dedicated throughput + contractual SLA19 / 20
Data sovereignty options8 / 15
Infura 63 / 100
Archive + trace (debug & trace namespaces)18 / 25
Compliance certifications (SOC 2 / ISO 27001)12 / 20
Debug pricing transparency (flat vs. multiplier)13 / 20
Dedicated throughput + contractual SLA14 / 20
Data sovereignty options6 / 15
Alchemy 60 / 100
Archive + trace (debug & trace namespaces)17 / 25
Compliance certifications (SOC 2 / ISO 27001)17 / 20
Debug pricing transparency (flat vs. multiplier)8 / 20
Dedicated throughput + contractual SLA12 / 20
Data sovereignty options6 / 15
GetBlock 48 / 100
Archive + trace (debug & trace namespaces)18 / 25
Compliance certifications (SOC 2 / ISO 27001)0 / 20
Debug pricing transparency (flat vs. multiplier)15 / 20
Dedicated throughput + contractual SLA10 / 20
Data sovereignty options5 / 15
dRPC 43 / 100
Archive + trace (debug & trace namespaces)12 / 25
Compliance certifications (SOC 2 / ISO 27001)0 / 20
Debug pricing transparency (flat vs. multiplier)18 / 20
Dedicated throughput + contractual SLA8 / 20
Data sovereignty options5 / 15

Scoring criteria: Archive + trace /25 · Compliance certifications /20 · Debug pricing transparency /20 · Dedicated throughput + SLA /20 · Data sovereignty /15

Real-world performance benchmark

Ethereum is tracked on the Chainstack performance dashboard alongside Arbitrum, Base, BNB, and other major chains. The dashboard shows method-level latency across providers and regions in real time — including eth_getLogs, eth_call, and eth_subscribe response times that matter for the real-time monitoring component of compliance workloads.

⚡ Benchmark before committing: For forensics-specific methods like debug_traceTransaction, real-world latency varies significantly by node client, archive depth, and whether you are on a shared or dedicated endpoint. Run a targeted benchmark from your target region before committing to a provider — a simple Python loop or k6 script against your candidate endpoints surfaces meaningful differences in trace response times that aggregate dashboard metrics may not capture.

Getting started with forensics & compliance analytics on Chainstack

Set up your Ethereum archive endpoint

  1. Log in to the Chainstack console or create an account
  2. Create a new project or select an existing one
  3. Click Add node → select Ethereum → Mainnet
  4. Under Hosting, select your preferred region; for dedicated forensics infrastructure, select Dedicated node type
  5. Under Node type, confirm Archive is selected (required for all trace and historical state methods)
  6. Deploy and copy your HTTPS and WSS endpoints from the node dashboard

Query historical token transfers with eth_getLogs

from web3 import Web3

RPC_URL = "https://ethereum-mainnet.core.chainstack.com/YOUR_API_KEY"
w3 = Web3(Web3.HTTPProvider(RPC_URL))

# ERC-20 Transfer(address,address,uint256) topic
TRANSFER_TOPIC = w3.keccak(text="Transfer(address,address,uint256)").hex()

# Scan a block range for all ERC-20 transfers from/to a flagged address
FLAGGED_ADDRESS = w3.to_checksum_address("0xYOUR_FLAGGED_ADDRESS")

# Encode as a 32-byte topic (left-padded)
def as_topic(addr):
    return "0x" + addr[2:].lower().zfill(64)

logs = w3.eth.get_logs({
    "fromBlock": 19_000_000,
    "toBlock":   19_010_000,
    "topics": [
        TRANSFER_TOPIC,
        [as_topic(FLAGGED_ADDRESS), None],  # flagged address as sender OR
    ]
})

print(f"Outbound transfers from flagged address: {len(logs)}")
for log in logs:
    print(f"  Block {log['blockNumber']} | Tx: {log['transactionHash'].hex()}")
    print(f"  Token contract: {log['address']}")

💡 The Ethereum tooling documentation covers complete setup for ethers.js, Web3.py, Hardhat, and Foundry — including archive-specific configuration.

🤖 You can also access Chainstack Ethereum RPC directly from Claude, Cursor, Codex, Gemini, or Windsurf using Chainstack MCP. Learn more about Chainstack MCP.

Conclusion

For forensics and compliance analytics on Ethereum in 2026, the key infrastructure decision is not which provider has the best latency benchmark — it is which provider gives you complete archive and debug/trace access, predictable costs for debug-heavy workloads, and the compliance certifications your vendor management team requires.

  • Bulk historical trace indexing at scale: Chainstack Dedicated Nodes with the Unlimited Node add-on — flat debug pricing, no shared RPS limits
  • Data sovereignty required (law enforcement, regulated custodians): Chainstack Self-Hosted — same archive + debug + trace stack on your own infrastructure, no third-party data routing
  • ISO 27001 required alongside SOC 2: Quicknode — the only managed provider with both certifications currently published
  • Real-time sanctions screening with strong SLA: Chainstack Global Nodes or Quicknode dedicated clusters — both provide the WebSocket reliability and uptime SLA that continuous monitoring requires
  • Cost-effective log scanning without trace requirements: dRPC — flat per-million pricing works well when your workload is eth_getLogs-based without debug/trace dependency
  • Institutional name recognition in legal chains of evidence: Infura — decade-long track record on Ethereum with ConsenSys backing
  • Balanced production forensics stack (managed cloud): Chainstack — flat debug pricing, full archive + debug + trace, SOC 2 Type II certification, and Dedicated Nodes without enterprise-only gating

Additional resources

SHARE THIS ARTICLE
Gen Tron Sm 530x281 logo

Chainstack introduces TRON support

Chainstack now supports TRON, one of the fastest-growing chains with high throughput, instant finality, and seamless EVM compatibility.

Andrey Novosad18 150x150 logo
Petar Stoykov
Mar 24
Customer Stories

Cyvers

Cyvers hit 335% ROI on infrastructure with Chainstack Archive Nodes and Debug & Trace.

Zeedex

Most optimal and cost-effective solution helping the team to focus on core product development.

SMARTy Pay

Automating infrastructure network operations with databases and the blockchain application.