On-Chain Security Monitoring
On-chain monitoring is your early warning system — the difference between losing $50K and losing $5M when a protocol gets exploited. This guide covers transaction monitoring tools, whale alert patterns, MEV watchers, wallet health monitoring, and multi-sig security best practices.
🔧 Transaction Monitoring Tools
Forta Network
Decentralized monitoring network with 500+ pre-built detection bots. Anyone can run a node and earn FORT. Best for broad protocol-level coverage. Alerts are less actionable than Defender but cover more chains.
OpenZeppelin Defender
The most popular tool for DeFi developers. Monitors transactions and can actually execute automated responses — pause a contract, transfer tokens, upgrade proxy. Best for protocol teams. The 'Autotasks' feature lets you run serverless code on any transaction matching your rules.
Whale Alert
Tracks large on-chain movements. Primarily used for crypto markets intelligence (whale buying/selling) but also useful for spotting large protocol drains. Automated API allows programmatic response.
MEV Watcher Bots
MEV watchers track extractive value extraction in real-time. Unusual MEV patterns — a bot suddenly doing 10x volume on a specific pool, or new arbitrage routes appearing — can signal market manipulation or an impending exploit. EigenPhi tracks liquidations and MEV across L2s.
🐋 Whale Alert Patterns to Watch
Not all whale movements are exploits — some are legitimate large transfers, market makers moving inventory, or protocol treasury operations. Learn to distinguish between them.
Suspicious Patterns
Normal Patterns
📊 Security Monitoring Dashboard — Interactive Mockup
What a real-time security monitoring dashboard looks like. Toggle between alert types to see what each signal means.
| Time | Tx Hash | From | To | Value | Risk |
|---|---|---|---|---|---|
| Simulate by toggling the attack scenarios below | |||||
🎮 Simulation Controls — Trigger Alert Scenarios
💼 Wallet Health Monitoring
For protocol operators and large DeFi participants, wallet health monitoring is the frontline of defense.
Admin Key Activity Tracking
Monitor all transactions from protocol admin addresses. Flag: transactions to non-standard addresses, unusual function calls (especially to unverified contracts), activity after dormancy periods. Set up PagerDuty alerts for any admin interaction outside business hours.
Timelock Countdown Monitoring
If your protocol uses a timelock, monitor the timelock queue for upcoming transactions. Know exactly what's scheduled to execute and when. If an unexpected transaction appears in the queue, you have a window to investigate before execution. Tools: Tenderly Alerting, Forta, or custom indexing script.
TVL & Deposit Flow Tracking
Sudden TVL drops are often the first visible sign of an exploit. Track TVL in real-time and alert on drops >5% in a single block. Also watch for unusual deposit/withdrawal ratios — an attacker may be moving funds in/out as part of positioning before an attack.
Approval & Allowance Revocation
Set up alerts for new approvals to unknown contracts, especially for large token amounts. If you see a new approval to an unverified contract, revoke immediately. Tools: revoke.cash, approved.zone, or Rabby wallet extension. Check approvals monthly minimum.
🔐 Multi-Sig Security Best Practices
Hardware Wallets for All Signers
Every signer should use a dedicated hardware wallet (Ledger, Trezor Model T) that has never touched a hot computer. The hardware wallet private key never leaves the device — even if your laptop has malware, the seed phrase can't be stolen via keylogger.
Geographic Distribution of Signers
Signers should be in different jurisdictions, ideally with different language backgrounds, to resist social engineering. An attacker who compromises one signer via a translated phishing email still needs to compromise other signers independently.
Timelock on All Critical Operations
Every transaction from the multisig should have a timelock delay — minimum 24 hours, ideally 48–72 hours. This gives users time to exit if a suspicious transaction is queued. The timelock window is your users' escape hatch; don't let them bypass it.
Out-of-Band Confirmation for Large Txs
For transactions above a threshold (e.g., $1M+), require signers to confirm via a secondary channel (Signal message + email + on-chain) before signing. Attackers can compromise email, but compromising both email AND Signal AND convincing the signer to call the 'protocol team' is much harder.
Monitor for Key Rotation & New Signers
Set up alerts for any change to the multisig signers — new signer added, signer removed, threshold changed. Any of these is a critical event. An attacker who compromises a signer account might try to add themselves as a signer. Alert immediately on any signer change.
🛑 Emergency Shutdown Triggers
Every serious DeFi protocol should have documented emergency shutdown procedures. These are the scenarios that should trigger them.
Smart Contract Vulnerability Confirmed
A critical vulnerability has been identified — either by internal team, external researcher, or active exploitation in progress. Action: Pause all markets immediately, notify users, begin emergency governance vote.
Oracle Failure / Price Manipulation
Price feed has been manipulated or has become stale/unreliable. Assets may be incorrectly collateralized. Action: Pause affected markets, switch to backup oracle or pause all markets, notify users.
Governance Attack in Progress
Malicious governance proposal is passing or has passed, and the attacker can execute. Action: Alert all users, attempt to pause via emergency multisig before execution window closes.
Key Compromise / Social Engineering
One or more multisig signers report potential key compromise. Action: Pause protocol pending key rotation, do not execute any pending transactions from compromised keys.
👤 Personal Monitoring Stack
For DeFi participants with significant positions, here's the minimum viable monitoring stack.