Stream on-chain exploits the moment they happen.
Defimon detects DeFi attacks across 8 chains and streams them as structured JSON over WebSocket — raw and LLM-confirmed. Built for DeFi incident response.
Just want the free alerts? Join the public Telegram channel
How it works
From handshake to action in three steps — and a few lines of code.
Connect
Open a WebSocket to the feed with your API key. One key works for both streams across all 8 networks.
Stream
Receive every detected attack as a single JSON object the instant it's found — or subscribe to the curated, LLM-confirmed stream for lower noise.
Act
Parse the payload and route it into your own systems — hedge a position, snapshot state, page on-call, or trigger a circuit breaker. No scraping, no parsing Telegram.
const ws = new WebSocket(
"wss://ws.defimon.xyz/ws/attacks?api_key=YOUR_API_KEY"
);
ws.onmessage = (event) => {
const attack = JSON.parse(event.data);
// Machine-readable: act on it however you like
if (attack.balance_change > 100_000) {
hedge(attack.victim_address, attack.network);
}
};One JSON object per attack
No parsing screenshots. No scraping a channel. Structured, enriched payloads your code can act on in milliseconds.
Raw, real-time. Fires the instant a suspicious transaction is detected — fully enriched with the victim protocol, TVL, and per-address balance changes.
Intelligence that matters
Every second counts in DeFi. Get the edge you need.
Sub-Second Detection
Exploits are detected within milliseconds of execution and pushed straight to your socket — the fastest signal in the industry.
Full On-Chain Enrichment
Every payload carries the victim protocol, TVL, token symbols, and per-address USD balance changes — no extra lookups required.
LLM-Confirmed Signal
A second, curated stream where an LLM pipeline filters out MEV and arbitrage false positives and attaches a human-readable explanation.
Featured by QuickNode
Defimon runs on QuickNode Streams — here's the story behind the speed, straight from our infrastructure provider.
Defimon: Real-Time DeFi Security with Streams
How Defimon cut block-to-detection latency 4x — from ~2 seconds to under 0.5 seconds — while scaling coverage from 3 to 8 EVM chains on QuickNode Streams.
How We Detect DeFi Exploits in Under a Second
Our CTO walks through the pipeline behind the feed: push-based Streams with JavaScript filters at the node level, and millions of tracked addresses in a Key-Value Store.
Three ways to watch the chain
From a free public channel to a real-time machine-readable feed.
Defimon Alerts
Public Telegram channel
No account needed.
Defimon Signals
Premium Telegram channel
Telegram Stars · CryptoBot · Tribute
Prefer Telegram for the WebSocket feed? Pay with Telegram Stars in the bot →
Why the feed wins
Designed for DeFi protocol teams and incident response.
| Defimon WebSocket | Any public source such as X | Build your own | |
|---|---|---|---|
| Detection latency | <300ms | Up to ~24h delay | Varies — high effort |
| Machine-readable JSON | |||
| LLM-confirmed stream | |||
| Protocol & TVL enrichment | Partial | ||
| Per-address balance changes | |||
| Networks covered | 8 | 8 | Per-chain infra |
| Maintenance burden | None | None | Constant |
| Cost | $200/mo | Free | $$$ infra + eng |
Recent Security Analysis
In-depth reports on the latest DeFi security incidents
Bridge Exploits Explained: Why Cross-Chain Is DeFi's Weakest Link
How cross-chain bridges get drained: validator key compromise, message verification bugs, false deposit events and custody failure, from Ronin and Wormhole to Shibarium and KelpDAO.
Oracle Manipulation Attacks in DeFi: How Price Oracles Get Exploited
How DeFi price oracles get manipulated: spot-reserve pricing, missing update authorization, stale feeds and donation attacks, with real incidents and the on-chain patterns that expose them in real time.
Flash Loan Attacks Explained: How They Work and How to Detect Them
What flash loan attacks are, why the loan itself is never the vulnerability, and how exploits that borrow nine figures with zero collateral are detected on-chain within 300 milliseconds.
Frequently asked
Be Among The First to Know
In DeFi, a small delay costs millions.
Get the threat intelligence to rely on.
