wss://ws.defimon.xyz/ws/attacks
Stream on-chain exploits the moment they happen.
Defimon detects DeFi attacks across major chains and streams them as structured JSON over WebSocket — raw and LLM-confirmed. Built for DeFi incident response.
Just want the free alerts? Join the public Telegram channel
// how it works
Connect once, act on everything
01
Connect
Open a WebSocket to the feed with your API key. One key works for both streams across all major chains.
02
Stream
Receive every detected attack as a single JSON object the instant it's found — or subscribe to the curated, LLM-confirmed stream for lower noise.
03
Act
Parse the payload and route it into your own systems — hedge a position, snapshot state, page on-call, or trigger a circuit breaker. No scraping, no parsing Telegram.
const ws = new WebSocket(
"wss://ws.defimon.xyz/ws/attacks?api_key=YOUR_API_KEY"
);
ws.onmessage = (event) => {
const attack = JSON.parse(event.data);
// Machine-readable: act on it however you like
if (attack.balance_change > 100_000) {
hedge(attack.victim_address, attack.network);
}
};// the payload
One JSON object per attack
No parsing screenshots. No scraping a channel. Structured, enriched payloads your code can act on in milliseconds.
Raw, real-time. Fires the instant a suspicious transaction is detected — fully enriched with the victim protocol, TVL, and per-address balance changes.
// why teams wire it in
Fast, enriched, verified
sub-second
Detection latency
Exploits are flagged the moment they execute and pushed straight to your socket. No polling, no scraping.
TVL + balances
Full on-chain enrichment
Every payload carries the victim protocol, TVL, token symbols, and per-address USD balance changes. No extra lookups required.
2 streams
Raw and LLM-confirmed
The raw stream fires instantly. A curated second stream drops MEV and arbitrage false positives and attaches a written explanation.
// featured by quicknode
The story behind the speed
Defimon runs on QuickNode Streams — told by our infrastructure provider.
case study
Defimon: Real-Time DeFi Security with Streams
How Defimon cut block-to-detection latency 4x — from ~2 seconds to under 0.5 seconds — while scaling coverage from 3 to 8 EVM chains on QuickNode Streams.
Read on QuickNode ↗
engineering deep dive
How We Detect DeFi Exploits in Under a Second
Our CTO walks through the pipeline behind the feed: push-based Streams with JavaScript filters at the node level, and millions of tracked addresses in a Key-Value Store.
Read on QuickNode ↗// pricing
Three ways to watch the chain
From a free public channel to a real-time machine-readable feed.
for enthusiasts
Defimon Alerts
Public Telegram channel
No account needed.
for traders
Defimon Signals
Premium Telegram channel
Prefer Telegram for the WebSocket feed? Pay with Telegram Stars in the bot →
// the alternatives
How the feed compares
Designed for DeFi protocol teams and incident response.
| Defimon WebSocket | Any public source such as X | Build your own | |
|---|---|---|---|
| Detection latency | sub-second | Up to ~24h delay | Varies — high effort |
| Machine-readable JSON | |||
| LLM-confirmed stream | |||
| Protocol & TVL enrichment | Partial | ||
| Per-address balance changes | |||
| Networks covered | Major chains | Major chains | Per-chain infra |
| Maintenance burden | None | None | Constant |
| Cost | $200/mo | Free | $$$ infra + eng |
// from the blog
Recent security analysis
DeFi Security Monitoring Tools Compared (2026)
How real-time DeFi security monitoring tools compare in 2026: enterprise platforms (Hypernative, Hexagate), inline firewalls (Forta Firewall, BlockSec), and self-serve machine-readable feeds (Defimon), by approach, coverage, integration, and pricing.
Read the report →Automating DeFi Incident Response with a WebSocket Exploit Feed
A production integration guide for the Defimon WebSocket feed: raw vs confirmed streams, reconnect handling, filtering alerts against your contracts and exposure, and what to automate versus page a human for.
Read the report →Ostium $23.75M Oracle Manipulation Exploit
Ostium, a perpetuals DEX on Arbitrum, lost $23.75M when an attacker with price-submission authority opened BTC longs at $5,000 and closed them near $60,000, draining the vault that backs every trade.
Read the report →// faq
Frequently asked
Put the feed in your stack
Connect in minutes. Every attack across major chains, as JSON, in under a second.
@DefimonAlerts