Can Defimon catch an attack before it happens?

Sometimes, yes — that is what the early-detection rules are for. suspicious_contract_deployed fires when a contract that looks like attack tooling is deployed, and suspicious_governance_proposal fires when a proposal carries a malicious payload. Both land before any value moves. They are tuned for recall, so treat the raw alert as a watch item and the LLM confirmation as the signal.

How fast are the alerts?

The raw /ws/attacks feed fires the instant a suspicious transaction is detected — typically sub-second. The curated /ws/confirmed_attacks stream arrives a few seconds to a couple of minutes later, after an LLM confirms the exploit is genuine.

What's the difference between the two feeds?

/ws/attacks delivers every detected attack immediately (higher volume, some false positives like MEV/arbitrage). /ws/confirmed_attacks is a curated, lower-noise stream of attacks an LLM pipeline has confirmed as genuine exploits, with a human-readable explanation attached. One API key works for both.

How do I authenticate?

Pass your API key as a query parameter: wss:// /ws/attacks?api_key=YOUR_KEY. You get the key the moment your payment confirms — shown on screen and emailed to you.

Which networks are covered?

Major chains, currently Ethereum, BNB Chain, Arbitrum, Polygon, Optimism, Base, Avalanche, and Hyperliquid, with more added over time. Each payload includes the network it fired on.

How do I pay, and can I cancel?

The WebSocket feed is $200/month, paid in crypto (USDT on Tron/Ethereum, or USDC) via CoinPayments — no card required. It's a fixed 30-day period with no auto-charge; simply subscribe again to extend. Prefer Telegram? You can also pay with Telegram Stars in our subscription bot.

Do I need the Telegram bot?

No. The web checkout issues your API key directly. The bot is just an alternative way to subscribe (and to pay with Telegram Stars). A WebSocket subscription also includes access to the Defimon Signals channel.

Defimon

Free alerts Get API access

DeFi exploit detection — at every stage.

Defimon detects DeFi attacks across major chains from the early steps and streams them as structured JSON over WebSocket. Built for DeFi incident response.

Get API access View sample payloads

Feed: Live
Whitehat rescues: $2M+
Built by: Decurity

wss://ws.defimon.xyz/ws/confirmed_attacks

deploy
The attacker's contract lands
suspicious_contract_deployed
tier=tornado_direct · deployer nonce=0
T+3
AI triage detects the victim
confirmed_exploit
WebSocket
T+?
The drain that could be avoided
confirmed_attack
WebSocket + Defimon Signals

Streaming from

Ethereum
BNB Chain
Arbitrum
Polygon
Optimism
Base
Avalanche
Hyperliquid

how it works

Connect once, act on everything

One API key opens both streams on every chain we cover. Each detection arrives as a single JSON object, ready for your own automation.

0x01
Connect
Open a WebSocket to the feed with your API key. One key works for both streams across all major chains.
0x02
Stream
Receive every detected attack as a single JSON object the instant it's found — or subscribe to the curated, LLM-confirmed stream for lower noise.
0x03
Act
Parse the payload and route it into your own systems — hedge a position, snapshot state, page on-call, or trigger a circuit breaker.

connect.jsjavascript

const ws = new WebSocket(
  "wss://ws.defimon.xyz/ws/attacks?api_key=YOUR_API_KEY"
);

ws.onmessage = (event) => {
  const attack = JSON.parse(event.data);

  // Machine-readable: act on it however you like
  if (attack.balance_change > 100_000) {
    hedge(attack.victim_address, attack.network);
  }
};

the payload

One JSON object per attack

Two streams, one schema. The confirmed stream is a strict superset of the raw one, so the same parser handles both.

Payload reference

{
  "network": "mainnet",
  "severity": "CRITICAL",
  "attack_type": "suspicious_contract_call_with_profit",
  "transaction_hash": "0x074ec9317d8336db37e8c348fbdd7515573ff4088239c77ab429f522509aeeb1",
  "exploit_address": "0x06f585f74e0da633ae813a0f23fb9900b61d0fcd",
  "attacker_address": "0x0f18d8b44a740272f0be4d08338d2b165b7edd17",
  "victim_address": "0xff1f2b4adb9df6fc8eafecdcbf96a2b351680455",
  "block_number": 25043217,
  "block_timestamp": 1781439960,
  "balance_change": 2186380.94,
  "matched_traces": "",
  "protocols": {
    "is_full_enrichment": true,
    "hacker_profit": 2186380.94,
    "victim_info": {
      "name": "Aztec Connect",
      "symbol": null,
      "tvl": null,
      "site_url": "https://aztec.network",
      "protocol_id": 318,
      "is_protocol": true
    },
    "balance_changes": [
      { "address": "0x0f18d8b44a740272f0be4d08338d2b165b7edd17", "balance_change_usd": 2186380.94, "is_eoa": true },
      { "address": "0xff1f2b4adb9df6fc8eafecdcbf96a2b351680455", "balance_change_usd": -2186381.94, "is_eoa": false, "name": "Aztec Connect", "is_protocol": true }
    ]
  }
}

Raw, real-time. Fires the instant a suspicious transaction is detected — fully enriched with the victim protocol, TVL, and per-address balance changes.

Read the full payload reference

why teams wire it in

Fast, enriched, verified

Each one maps to a field in the payload, so you can check it against the stream yourself.

Early detection

Attacker contracts and malicious governance proposals are flagged the moment they land on-chain — before the drain.

suspicious_contract_deployed

Full on-chain enrichment

Every payload carries the victim protocol, TVL, token symbols, and per-address USD balance changes. No extra lookups required.

protocols.balance_changes[]

Raw and LLM-confirmed

The raw stream fires instantly. A curated second stream drops MEV and arbitrage false positives and attaches a written explanation.

llm_explanation

featured by quicknode

The story behind the speed

Defimon runs on QuickNode Streams — told by our infrastructure provider.

case study

Defimon: Real-Time DeFi Security with Streams

How Defimon cut block-to-detection latency 4x on QuickNode Streams while expanding coverage across chains.

Read on QuickNode

Why DeFi Exploit Detection Has to Be Sub-Second — by Arseniy Reutov, CTO & Co-founder of Decurity

engineering deep dive

How We Detect DeFi Exploits in Under a Second

Our CTO walks through the pipeline behind the feed: push-based Streams with JavaScript filters at the node level, and millions of tracked addresses in a Key-Value Store.

Read on QuickNode

pricing

Three ways to watch the chain

From a free public channel to a real-time machine-readable feed.

for enthusiasts

Defimon Alerts

Public Telegram channel

Free

+DeFi incidents & exploits (~24h delay)

+On-chain messages from attackers

+Security monitoring of Immunefi protocols

+Community-driven discussion

No account needed.

for traders

Defimon Signals

Premium Telegram channel

$50/ mo

+Human-readable, LLM-verified exploit alerts

+Automatic victim-protocol detection

+Root-cause analysis, near real-time

+Protocol & TVL context, trading signals

Telegram Stars · CryptoBot · Tribute

for DeFi teams

WebSocket Feed

Machine-readable API

$200/ mo

+Structured JSON over WebSocket

+Early detection alerts

+Full enrichment: victim, TVL, balance changes

+Major chains, one API key, sub-second detection

+Includes Defimon Signals channel access

Pay in crypto · Cancel anytime

Prefer Telegram? The WebSocket feed can also be paid for with Telegram Stars.

Open the subscription bot

the alternatives

How the feed compares

Designed for DeFi protocol teams and incident response.

Feature	Defimon WebSocket	Any public source such as X	Build your own
Pre-drain detection
Detection latency	sub-second	Up to ~24h delay	Varies — high effort
Machine-readable JSON
LLM-confirmed streams	Exploits + pre-drain
Protocol & TVL enrichment		Partial
Per-address balance changes
Networks covered	Major chains	Major chains	Per-chain infra
Maintenance burden	None	None	Constant
Cost	$200 / mo	Free	$$$ infra + eng

incident reports

Recent security analysis

Root-cause write-ups of the incidents the feed watches for.

All reports

faq

Frequently asked

Field-level detail lives in the payload reference.

confirmed_attack means an exploit has executed and value has moved. confirmed_exploit means an LLM has reviewed a newly deployed contract and confirmed it is attack tooling — before the drain. Both arrive on /ws/confirmed_attacks, so a WebSocket consumer gets both; tell them apart by attack_type, which is suspicious_contract_deployed for early detection. confirmed_exploit is WebSocket-only and is not published to the Defimon Signals channel.

Network, severity, attack type, transaction hash, attacker/victim/exploit addresses, USD balance change, and rich enrichment — victim protocol, TVL, and per-address balance changes. The confirmed feed adds an llm_explanation. Early-detection payloads are the exception: nothing has moved, so balance_change is 0, protocols is null, and matched_traces carries the reason the contract was flagged. See the full spec for every field.

Put Defimon in your stack

Defimon detects exploits on major chains before they execute and streams them to you: human-readable alerts in Telegram, or structured JSON over WebSocket for your own systems.

Get real-time alerts Join the channel

websocket $200 / mo · signals $50 / mo · channel free