DeFi exploit detection — at every stage.
Defimon detects DeFi attacks across major chains from the early steps and streams them as structured JSON over WebSocket. Built for DeFi incident response.
Just want the free alerts? Join the public Telegram channel
deploy
The attacker's contract lands
suspicious_contract_deployed
tier=tornado_direct · deployer nonce=0
T+3
AI triage detects the victim
confirmed_exploit
WebSocket
T+?
The drain that could be avoided
confirmed_attack
WebSocket + Defimon Signals
how it works
Connect once, act on everything
0x01
Connect
Open a WebSocket to the feed with your API key. One key works for both streams across all major chains.
0x02
Stream
Receive every detected attack as a single JSON object the instant it's found — or subscribe to the curated, LLM-confirmed stream for lower noise.
0x03
Act
Parse the payload and route it into your own systems — hedge a position, snapshot state, page on-call, or trigger a circuit breaker.
const ws = new WebSocket(
"wss://ws.defimon.xyz/ws/attacks?api_key=YOUR_API_KEY"
);
ws.onmessage = (event) => {
const attack = JSON.parse(event.data);
// Machine-readable: act on it however you like
if (attack.balance_change > 100_000) {
hedge(attack.victim_address, attack.network);
}
};the payload
One JSON object per attack
Raw, real-time. Fires the instant a suspicious transaction is detected — fully enriched with the victim protocol, TVL, and per-address balance changes.
why teams wire it in
Fast, enriched, verified
pre-drain
Early detection
Attacker contracts and malicious governance proposals are flagged the moment they land on-chain — before the drain.
TVL + balances
Full on-chain enrichment
Every payload carries the victim protocol, TVL, token symbols, and per-address USD balance changes. No extra lookups required.
2 streams
Raw and LLM-confirmed
The raw stream fires instantly. A curated second stream drops MEV and arbitrage false positives and attaches a written explanation.
featured by quicknode
The story behind the speed
Defimon runs on QuickNode Streams — told by our infrastructure provider.
case study
Defimon: Real-Time DeFi Security with Streams
How Defimon cut block-to-detection latency 4x — from ~2 seconds to under 0.5 seconds — while scaling coverage from 3 to 8 EVM chains on QuickNode Streams.
Read on QuickNode ↗
engineering deep dive
How We Detect DeFi Exploits in Under a Second
Our CTO walks through the pipeline behind the feed: push-based Streams with JavaScript filters at the node level, and millions of tracked addresses in a Key-Value Store.
Read on QuickNode ↗pricing
Three ways to watch the chain
From a free public channel to a real-time machine-readable feed.
for enthusiasts
Defimon Alerts
Public Telegram channel
No account needed.
for traders
Defimon Signals
Premium Telegram channel
Prefer Telegram for the WebSocket feed? Pay with Telegram Stars in the bot →
the alternatives
How the feed compares
Designed for DeFi protocol teams and incident response.
| Defimon WebSocket | Any public source such as X | Build your own | |
|---|---|---|---|
| Pre-drain detection | |||
| Detection latency | sub-second | Up to ~24h delay | Varies — high effort |
| Machine-readable JSON | |||
| LLM-confirmed streams | Exploits + pre-drain | ||
| Protocol & TVL enrichment | Partial | ||
| Per-address balance changes | |||
| Networks covered | Major chains | Major chains | Per-chain infra |
| Maintenance burden | None | None | Constant |
| Cost | $200/mo | Free | $$$ infra + eng |
from the blog
Recent security analysis
Term Finance $8.5M Governance Takeover
Term Finance's vault DAOs had empty electorates, so $25 of deposits bought 100% of the vote in five vaults. The attacker self-approved proposals, zeroed a 7-day delay and drained 2,841.74 WETH and 1,679,639 USDC.
Read the report →The Sandbox SAND Delegate Hijack and Unbacked Mint
The SAND OFT's own approveAndCall let an attacker name themselves LayerZero delegate, forge inbound verification, mint 329 trillion unbacked SAND on Base and empty the Ethereum adapter.
Read the report →Allbridge $191K Phantom CCTP Deposit Exploit
Allbridge's new CCTP router on Base credited a forged Circle message as a real deposit. The attacker booked a phantom $1M, flash-loaned the shortfall and took the router's entire 191,156 USDC.
Read the report →faq
Frequently asked
Put Defimon in your stack
Defimon detects exploits on major chains before they execute and streams them to you: human-readable alerts in Telegram, or structured JSON over WebSocket for your own systems.
signals $50/mo · websocket $200/mo · channel free
@DefimonAlerts