Defimon: Real-Time DeFi Security with Streams
Defimon이 어떻게 블록 감지 지연 시간을 4배 단축하고, 체인 수를 3개에서 8개로 확장하며, 인프라 관리 업무를 팀 단위의 작업에서 엔지니어 한 명이 담당할 수 있는 수준으로 줄였는지.
- 4x fasterBlock-to-detection latency, from 2s to under 0.5s
- 8 chainsMonitored in real-time, up from 3
- $48K/year savedInfrastructure costs eliminated entirely
In DeFi, the window between an exploit landing onchain and a protocol team being alerted can be critical. Defimon exists to close that window with instant security alerts and automated incident response. Built by the security team at Decurity which is trusted by 1inch, Gearbox, and the Arbitrum Foundation, it monitors EVM chains 24/7 and fires Telegram alerts to the protocol teams, security companies and risk curators before hacks make the news. That speed is the product. So when the infrastructure keeping it alive started getting in the way, something had to change.
과제
Legacy streaming data pipelines are hard to adapt to the onchain monitoring
Defimon tracks millions of wallet addresses and contract interactions in real-time. Their original setup, Apache Flink SQL pipelines running on AWS, held this watchlist in memory. As coverage expanded, out-of-memory errors became a trigger to look for the alternatives. The system couldn't scale with the scope of what needed monitoring.
$4,000 a month for 3 chains, with a team of 4 to keep it running
Infrastructure cost approximately $4,000 per month on AWS to cover just three networks and required three to four engineers: pulling RPC data manually, managing SQL schemas, debugging pipeline failures. The team's expertise was in detection logic. They were spending it on infrastructure plumbing.
Block latency that degraded alert quality
Manual RPC polling produced around two seconds of latency per block. For a product where detection timing determines whether a protocol team gets warned in time, that was a structural problem.
해결책
Defimon replaced their self-managed pipeline with Quicknode Streams. The migration was near-instant. Existing detection logic carried over, and the team was up and running without having to rebuild from scratch.
The memory problem, solved at the source
Streams' upstream filtering and native integrations with Key-Value Store lists lets Defimon define exactly which data reaches their system, by address, contract, or event type, before it ever touches their pipeline. The watchlist no longer lives in RAM as a growing, crashing list. Adding or removing monitored addresses became a configuration change, not an engineering task.
One pipeline. Eight chains.
Ethereum, BNB Smart Chain, Arbitrum, Base, Polygon, Avalanche, Optimism, and HyperEVM all run through a single Streams integration. Adding a new chain no longer means new infrastructure. It means updating a config. The team went from three chains managed across a fragmented AWS setup to eight chains managed by one person.
"블록체인 노드 수준에서 실행되는 유연한 JS 필터를Streams Quicknode Streams , 우리는 서비스 중단 없이 비즈니스 로직을 개선하고 배포할 수 있을 뿐만 아니라, 악용 시도를 즉시 탐지할 수 있습니다."— Arseniy Reutov, CTO & Co-founderDecurity