# Defimon

> Defimon is a real-time DeFi exploit detection feed. It detects on-chain attacks across major chains and streams them as structured JSON over WebSocket — a raw, sub-second feed and an LLM-confirmed feed — each payload enriched with the victim protocol, TVL, and per-address USD balance changes. Built by the security team at Decurity. Free public Telegram alerts, a $50/mo Signals channel, and a $200/mo machine-readable WebSocket feed.

## Product
- [Defimon home](https://defimon.xyz/): What the feed is, how it works, live sample payloads, pricing.
- [Subscribe](https://defimon.xyz/subscribe): Self-serve crypto checkout for the $200/mo WebSocket feed and the $50/mo Signals channel.
- [Docs: websocket attack message](https://defimon.xyz/docs/websocket_attack_message.md): Reference documentation (Markdown).

## Security guides
- [Top 10 DeFi Hacks of 2026 (So Far)](https://defimon.xyz/blog/top-10-defi-hacks-2026.md): The biggest crypto hacks of 2026 ranked by loss: Liquid Network $320M, KelpDAO $292M, Drift $285M, and more, with the root cause of each.
- [DeFi Security Monitoring Tools Compared (2026)](https://defimon.xyz/blog/defi-security-monitoring-tools-compared.md): Hypernative, Hexagate, Forta, BlockSec and Defimon compared on real-time threat detection, integration, and the pricing most vendor pages leave out.
- [Automating DeFi Incident Response with a WebSocket Exploit Feed](https://defimon.xyz/blog/automating-defi-incident-response.md): Wire a real-time exploit feed into incident response: raw vs confirmed streams, reconnect handling, filtering by your own contracts, and what to auto-pause.
- [Bridge Exploits Explained: Why Cross-Chain Is DeFi's Weakest Link](https://defimon.xyz/blog/bridge-exploits-explained.md): The four ways cross-chain bridges get hacked: validator compromise, message verification bugs, false deposits and custody failure, from Ronin to 2026.
- [Oracle Manipulation Attacks in DeFi: How Price Oracles Get Exploited](https://defimon.xyz/blog/oracle-manipulation-attacks-defi.md): Ostium lost $23.75M to a manipulated settlement price. How oracle attacks work: spot-reserve pumps, rogue updates, stale feeds, and the fixes that hold.
- [Flash Loan Attacks Explained: How They Work and How to Detect Them](https://defimon.xyz/blog/flash-loan-attacks-explained.md): How flash loan attacks work and the risks they pose: $211M borrowed from Morpho and Venus with zero collateral, and how the pattern is caught in a second.

## Incident reports
- [Liquid Network $320M Range-Proof Cache Exploit](https://defimon.xyz/blog/liquid-network-hack-september-2026.md): An Elements range-proof cache bug let an attacker mint unbacked L-BTC and peg out about 3,996 BTC, some $320M, from Blockstream's Liquid Network.
- [Term Finance $8.5M Governance Takeover](https://defimon.xyz/blog/term-finance-hack-august-2026.md): An attacker bought 100% of Term Finance's vault governance for $25, voted out a 7-day timelock and drained $8.5M in WETH and USDC from six vaults.
- [The Sandbox SAND Delegate Hijack and Unbacked Mint](https://defimon.xyz/blog/sandbox-hack-august-2026.md): An approveAndCall call made SAND's own contract hand LayerZero delegate rights to an attacker, minting 329T unbacked SAND and draining the adapter.
- [Allbridge $191K Phantom CCTP Deposit Exploit](https://defimon.xyz/blog/allbridge-hack-august-2026.md): Allbridge's CCTP module credited an attested Circle message without checking that USDC was minted. A forged $1M deposit drained the Base router of $191K.
- [Maya Protocol Six-Bug Trade Account Exploit](https://defimon.xyz/blog/maya-protocol-hack-august-2026.md): A 23-message MsgDeposit made MAYAChain think it had been robbed. The uncapped slash subsidy booked 49.45M CACAO into a near-empty pool. CACAO fell 88.7%.
- [Harmony 4 Billion ONE Unauthorized Mint Exploit](https://defimon.xyz/blog/harmony-hack-august-2026.md): Harmony counted signature slots, not valid signatures. That let an attacker mint 4 billion ONE (26% of supply) and cash out 97% on exchanges.
- [Ravencoin Consensus Exploit Forces Three-Day Chain Rollback](https://defimon.xyz/blog/ravencoin-hack-august-2026.md): A missing header height check let attackers add Ravencoin blocks without real proof-of-work for days. The KAWPOW flaw, the emergency patch, and the rollback.
- [Coldcard $116M Seed Entropy Exploit](https://defimon.xyz/blog/coldcard-hack-july-2026.md): A 2021 Coldcard firmware build error bypassed the STM32 hardware RNG, leaving seeds with as little as 40 bits of entropy. How attackers swept $116M in BTC.
- [Guru.fund $96K Vault Approval Exploit](https://defimon.xyz/blog/guru-fund-hack-july-2026.md): How a whitelisted adapter in Guru.fund's shared deposit path let attackers make each vault approve and drain itself: about $96K across eight funds.
- [Verus Bridge $7.54M Forged Import Exploit](https://defimon.xyz/blog/verus-bridge-hack-july-2026.md): The Verus-Ethereum bridge lost $7.54M on July 23, 2026, to a forged cross-chain import, two weeks after refilling reserves recovered from May's $11.58M hack.
- [Ostium $23.75M Oracle Manipulation Exploit](https://defimon.xyz/blog/ostium-hack-july-2026.md): How an attacker opened BTC longs at $5,000 and closed near $60,000 to drain $23.75M from Ostium on Arbitrum, whose oracle trusted whoever submitted the price.
- [Foom.cash $1.84M Whitehat Rescue: Groth16 Trusted Setup Exploit](https://defimon.xyz/blog/foom-cash-whitehat-rescue-february-2026.md): Foom.cash shipped a Groth16 verifier with an unfinished trusted setup, making every withdrawal proof forgeable. Defimon rescued $1.84M before an attacker could.
- [Yearn yETH $9M Numerical Solver Exploit](https://defimon.xyz/blog/yearn-yeth-hack-november-2025.md): How Yearn's yETH pool lost $9M: numerical instability in its fixed-point solver collapsed the invariant to a constant-sum curve, letting the attacker over-mint.
- [Balancer V2 $128M Rounding Exploit](https://defimon.xyz/blog/balancer-v2-hack-november-2025.md): A rounding bug in Balancer V2's rate scaling, live since 2021, deflated the pool invariant and cost Composable Stable Pools $128M across 9 chains.
- [Typus Finance $3.44M Oracle Manipulation Attack](https://defimon.xyz/blog/typus-finance-hack-october-2025.md): How Typus Finance lost $3.44M on Sui: a missing authorization check in its custom oracle module let the attacker set any price and drain the TLP pool.
- [Abracadabra Money $1.8M Exploit - Logic Flaw Bypasses Solvency](https://defimon.xyz/blog/abracadabra-hack-october-2025.md): How Abracadabra lost $1.8M in MIM: an empty cook() action reset CauldronV4's solvency check flag, letting the attacker borrow with no collateral at all.
- [NewGold Protocol $2M Flash Loan Attack - Triple Vulnerability Exploit](https://defimon.xyz/blog/newgold-protocol-hack-september-2025.md): How NewGold Protocol lost $2M on BNB Chain: a $211M flash loan crashed its single-pool price oracle and broken fee logic drained the pool in one transaction.
- [Shibarium $3M Validator Compromise and Flash Loan Bridge Exploit](https://defimon.xyz/blog/shibarium-hack-september-2025.md): How Shibarium's bridge lost $3M: a 4.6M BONE flash loan plus 10 of 12 compromised validator keys let the attacker sign fraudulent checkpoints and drain it.