wss://ws.defimon.xyz/ws/attacks
Stream on-chain exploits the moment they happen.
Defimon detects DeFi attacks across major chains and streams them as structured JSON over WebSocket — raw and LLM-confirmed. Built for DeFi incident response.
Just want the free alerts? Join the public Telegram channel
// how it works
Connect once, act on everything
01
Connect
Open a WebSocket to the feed with your API key. One key works for both streams across all major chains.
02
Stream
Receive every detected attack as a single JSON object the instant it's found — or subscribe to the curated, LLM-confirmed stream for lower noise.
03
Act
Parse the payload and route it into your own systems — hedge a position, snapshot state, page on-call, or trigger a circuit breaker. No scraping, no parsing Telegram.
const ws = new WebSocket(
"wss://ws.defimon.xyz/ws/attacks?api_key=YOUR_API_KEY"
);
ws.onmessage = (event) => {
const attack = JSON.parse(event.data);
// Machine-readable: act on it however you like
if (attack.balance_change > 100_000) {
hedge(attack.victim_address, attack.network);
}
};// the payload
One JSON object per attack
No parsing screenshots. No scraping a channel. Structured, enriched payloads your code can act on in milliseconds.
Raw, real-time. Fires the instant a suspicious transaction is detected — fully enriched with the victim protocol, TVL, and per-address balance changes.
// why teams wire it in
Fast, enriched, verified
sub-second
Detection latency
Exploits are flagged the moment they execute and pushed straight to your socket. No polling, no scraping.
TVL + balances
Full on-chain enrichment
Every payload carries the victim protocol, TVL, token symbols, and per-address USD balance changes. No extra lookups required.
2 streams
Raw and LLM-confirmed
The raw stream fires instantly. A curated second stream drops MEV and arbitrage false positives and attaches a written explanation.
// featured by quicknode
The story behind the speed
Defimon runs on QuickNode Streams — told by our infrastructure provider.
case study
Defimon: Real-Time DeFi Security with Streams
How Defimon cut block-to-detection latency 4x — from ~2 seconds to under 0.5 seconds — while scaling coverage from 3 to 8 EVM chains on QuickNode Streams.
Read on QuickNode ↗
engineering deep dive
How We Detect DeFi Exploits in Under a Second
Our CTO walks through the pipeline behind the feed: push-based Streams with JavaScript filters at the node level, and millions of tracked addresses in a Key-Value Store.
Read on QuickNode ↗// pricing
Three ways to watch the chain
From a free public channel to a real-time machine-readable feed.
for enthusiasts
Defimon Alerts
Public Telegram channel
No account needed.
for traders
Defimon Signals
Premium Telegram channel
Prefer Telegram for the WebSocket feed? Pay with Telegram Stars in the bot →
// the alternatives
How the feed compares
Designed for DeFi protocol teams and incident response.
| Defimon WebSocket | Any public source such as X | Build your own | |
|---|---|---|---|
| Detection latency | sub-second | Up to ~24h delay | Varies — high effort |
| Machine-readable JSON | |||
| LLM-confirmed stream | |||
| Protocol & TVL enrichment | Partial | ||
| Per-address balance changes | |||
| Networks covered | Major chains | Major chains | Per-chain infra |
| Maintenance burden | None | None | Constant |
| Cost | $200/mo | Free | $$$ infra + eng |
// from the blog
Recent security analysis
The Sandbox SAND Delegate Hijack and Unbacked Mint
The SAND OFT's own approveAndCall let an attacker name themselves LayerZero delegate, forge inbound verification, mint 329 trillion unbacked SAND on Base and empty the Ethereum adapter.
Read the report →Allbridge $191K Phantom CCTP Deposit Exploit
Allbridge's new CCTP router on Base credited a forged Circle message as a real deposit. The attacker booked a phantom $1M, flash-loaned the shortfall and took the router's entire 191,156 USDC.
Read the report →Maya Protocol Six-Bug Trade Account Exploit
An attacker chained six MAYAChain bugs so a false theft alert paid an uncapped 49.45M CACAO subsidy into a pool holding 0.11 LINK, then took 99.93% of it and withdrew 48.87M CACAO.
Read the report →// faq
Frequently asked
Put Defimon in your stack
Defimon detects exploits on major chains the moment they execute and streams them to you: human-readable alerts in Telegram, or structured JSON over WebSocket for your own systems.
// signals $50/mo · websocket $200/mo · channel free
@DefimonAlerts