A darknet lead on zkSync Era starts with an address and a network label. Record both, because the same 0x string exists on other EVM networks and a trace on the wrong chain proves nothing.
Reading the flow
The free check shows the ETH balance in USD and the activity count from the public explorer. A busy count means there is a trail to follow. Then open the explorer and walk through the counterparties one hop at a time.
Accounts that sign and accounts that pay
Native account abstraction lets a paymaster cover gas for a transaction. The sender and the fee payer can therefore be different addresses. Note both in the trace and do not merge them into one actor.