The alarm that fires before the drain finishes

What is actually flagged

Not every large transfer is an exploit, and an alarm that fires on all of them is an alarm you turn off. The patterns that earn a CRITICAL flag are narrower:

• Large outflows from a project treasury or contract, sized relative to what that address normally moves rather than against a fixed threshold.
• Multisig owner changes — signers added or removed, thresholds lowered.
• Control shifts — ownership or admin transfers on contracts that hold value.

Flags are raised on confirmation, not on a pending transaction, because a mempool alert that resolves to nothing is how a monitoring system loses its credibility.

Eleven chains

Ethereum, Solana, BNB Chain, Base, Arbitrum, Polygon, Optimism, Avalanche, Tron, Bitcoin and Hyperliquid. Separate alert rules apply to wallets and to contracts, because normal behaviour for each is different.

The part most trackers leave out

Knowing a protocol is being drained is only actionable if you can act. Every alert is cross-referenced against the perpetual futures universe on the connected venues, so the alert tells you whether a tradeable market exists for the affected token — and the chart is one click away.

Where the address list comes from

The watched set is a maintained registry of project-to-address mappings — treasuries, deployers, multisigs and contracts — rather than a list of whale wallets. That is a deliberate choice: a whale moving funds is noise, while a project's own treasury moving unexpectedly is the event worth waking up for.