🔗 Query billions of Hyperliquid rows with SQLSQL Explorer now in beta
Try beta now
How Defimon cut block detection latency 4x, expanded from 3 chains to 8, and reduced infrastructure management from a team effort to one engineer.
In DeFi, the window between an exploit landing onchain and a protocol team being alerted can be critical. Defimon exists to close that window with instant security alerts and automated incident response. Built by the security team at Decurity which is trusted by 1inch, Gearbox, and the Arbitrum Foundation, it monitors EVM chains 24/7 and fires Telegram alerts to the protocol teams, security companies and risk curators before hacks make the news. That speed is the product. So when the infrastructure keeping it alive started getting in the way, something had to change.
Legacy streaming data pipelines are hard to adapt to the onchain monitoring
Defimon tracks millions of wallet addresses and contract interactions in real-time. Their original setup, Apache Flink SQL pipelines running on AWS, held this watchlist in memory. As coverage expanded, out-of-memory errors became a trigger to look for the alternatives. The system couldn't scale with the scope of what needed monitoring.
$4,000 a month for 3 chains, with a team of 4 to keep it running
Infrastructure cost approximately $4,000 per month on AWS to cover just three networks and required three to four engineers: pulling RPC data manually, managing SQL schemas, debugging pipeline failures. The team's expertise was in detection logic. They were spending it on infrastructure plumbing.
Block latency that degraded alert quality
Manual RPC polling produced around two seconds of latency per block. For a product where detection timing determines whether a protocol team gets warned in time, that was a structural problem.
Defimon replaced their self-managed pipeline with Quicknode Streams. The migration was near-instant. Existing detection logic carried over, and the team was up and running without having to rebuild from scratch.
The memory problem, solved at the source
Streams' upstream filtering and native integrations with Key-Value Store lists lets Defimon define exactly which data reaches their system, by address, contract, or event type, before it ever touches their pipeline. The watchlist no longer lives in RAM as a growing, crashing list. Adding or removing monitored addresses became a configuration change, not an engineering task.
One pipeline. Eight chains.
Ethereum, BNB Smart Chain, Arbitrum, Base, Polygon, Avalanche, Optimism, and HyperEVM all run through a single Streams integration. Adding a new chain no longer means new infrastructure. It means updating a config. The team went from three chains managed across a fragmented AWS setup to eight chains managed by one person.
Push data, not polling
Replacing manual RPC calls with Streams' push model cut block latency from around two seconds to under 0.5 seconds. Telegram exploit alerts now fire in under one second.
4x faster detection
Block latency dropped from around two seconds to under 0.5 seconds per block. Telegram alerts fire in under one second from detection.
Our globally distributed, auto-scaling, multi-cloud network will carry you from MVP all the way to enterprise. The industry's best trust us, and so can you.
Use our guides to learn more about smart contracts, NFTs, building decentralized apps, and more.
Read the guidesLearn how to call RPC methods using code examples across Python, Ruby, JavaScript, and cURL.
Read the docsEvery protocol. Every chain. Every block.
Defimon doesn't monitor a subset of protocols. Every protocol is monitored, every exploit detected across the chains that matter most to DeFi. No gaps, no exceptions.
One engineer. Eight chains. Zero ops burden.
Infrastructure that required three to four people to maintain now runs with one, focused entirely on detection logic rather than pipeline management.
The engineering time that used to go toward keeping infrastructure alive now goes where it always should have: improving detection and staying ahead of what's coming next.
"Quicknode Streams with flexible JS filters running at the blockchain node level allow us to enhance and deploy the business logic without downtime and catch exploits instantly. "