wss://ws.defimon.xyz/ws/attacks
Stream on-chain exploits the moment they happen.
Defimon detects DeFi attacks across 8 chains and streams them as structured JSON over WebSocket — raw and LLM-confirmed. Built for DeFi incident response.
Just want the free alerts? Join the public Telegram channel
// how it works
Connect once, act on everything
01
Connect
Open a WebSocket to the feed with your API key. One key works for both streams across all 8 networks.
02
Stream
Receive every detected attack as a single JSON object the instant it's found — or subscribe to the curated, LLM-confirmed stream for lower noise.
03
Act
Parse the payload and route it into your own systems — hedge a position, snapshot state, page on-call, or trigger a circuit breaker. No scraping, no parsing Telegram.
const ws = new WebSocket(
"wss://ws.defimon.xyz/ws/attacks?api_key=YOUR_API_KEY"
);
ws.onmessage = (event) => {
const attack = JSON.parse(event.data);
// Machine-readable: act on it however you like
if (attack.balance_change > 100_000) {
hedge(attack.victim_address, attack.network);
}
};// the payload
One JSON object per attack
No parsing screenshots. No scraping a channel. Structured, enriched payloads your code can act on in milliseconds.
Raw, real-time. Fires the instant a suspicious transaction is detected — fully enriched with the victim protocol, TVL, and per-address balance changes.
// why teams wire it in
Fast, enriched, verified
<300ms
Detection latency
Exploits are flagged within milliseconds of execution and pushed straight to your socket. No polling, no scraping.
TVL + balances
Full on-chain enrichment
Every payload carries the victim protocol, TVL, token symbols, and per-address USD balance changes. No extra lookups required.
2 streams
Raw and LLM-confirmed
The raw stream fires instantly. A curated second stream drops MEV and arbitrage false positives and attaches a written explanation.
// featured by quicknode
The story behind the speed
Defimon runs on QuickNode Streams — told by our infrastructure provider.
case study
Defimon: Real-Time DeFi Security with Streams
How Defimon cut block-to-detection latency 4x — from ~2 seconds to under 0.5 seconds — while scaling coverage from 3 to 8 EVM chains on QuickNode Streams.
Read on QuickNode ↗
engineering deep dive
How We Detect DeFi Exploits in Under a Second
Our CTO walks through the pipeline behind the feed: push-based Streams with JavaScript filters at the node level, and millions of tracked addresses in a Key-Value Store.
Read on QuickNode ↗// pricing
Three ways to watch the chain
From a free public channel to a real-time machine-readable feed.
for enthusiasts
Defimon Alerts
Public Telegram channel
No account needed.
for traders
Defimon Signals
Premium Telegram channel
Prefer Telegram for the WebSocket feed? Pay with Telegram Stars in the bot →
// the alternatives
How the feed compares
Designed for DeFi protocol teams and incident response.
| Defimon WebSocket | Any public source such as X | Build your own | |
|---|---|---|---|
| Detection latency | <300ms | Up to ~24h delay | Varies — high effort |
| Machine-readable JSON | |||
| LLM-confirmed stream | |||
| Protocol & TVL enrichment | Partial | ||
| Per-address balance changes | |||
| Networks covered | 8 | 8 | Per-chain infra |
| Maintenance burden | None | None | Constant |
| Cost | $200/mo | Free | $$$ infra + eng |
// from the blog
Recent security analysis
Automating DeFi Incident Response with a WebSocket Exploit Feed
A production integration guide for the Defimon WebSocket feed: raw vs confirmed streams, reconnect handling, filtering alerts against your contracts and exposure, and what to automate versus page a human for.
Read the report →Bridge Exploits Explained: Why Cross-Chain Is DeFi's Weakest Link
How cross-chain bridges get drained: validator key compromise, message verification bugs, false deposit events and custody failure, from Ronin and Wormhole to Shibarium and KelpDAO.
Read the report →Oracle Manipulation Attacks in DeFi: How Price Oracles Get Exploited
How DeFi price oracles get manipulated: spot-reserve pricing, missing update authorization, stale feeds and donation attacks, with real incidents and the on-chain patterns that expose them in real time.
Read the report →// faq
Frequently asked
Put the feed in your stack
Connect in minutes. Every attack across 8 chains, as JSON, in under a second.
@DefimonAlerts