Abstract: A simulation method implemented at least in part at a node of a blockchain network enables detection of suspected malicious behaviour. When a purchase of a token of interest by a user is detected, information about other queued transactions awaiting committal to the blockchain is retrieved, and a batch of probing transactions is constructed using the information about the queued transactions. The batch includes a probing transaction representing a sale of the token by the user. At the node, the state of the blockchain is overridden so that the user's wallet and other wallets appear to contain bytecode executable to aggregate multiple transactions into a single call, and the batch of transactions is thus executed in a single call. The results are evaluated to determine whether the sale of the token by the user was successful. If the evaluation is not successful, remedial action may be taken.