Crypto Whale Tracking Bot Development for Real-Time On-Chain Alerts

Develop a Whale Tracking Bot for Real-Time On-Chain Alerts and Notifications

Imagine you're trading on a DEX, and suddenly a whale enters a liquidity pool with $10 million. You find out an hour later — the price has already moved. Such scenarios are common without proper monitoring. We solve this: our bot tracks large transactions in real time, classifies them, and sends alerts to Telegram or Discord.

A "whale" in on-chain analytics is an address with a position or transaction volume significant relative to the liquidity of a specific protocol or token. Whale tracking is useful in several scenarios: trading signals (a large address starts accumulating — interesting), protocol risk management (one holder accumulates >10% supply — dump risk), compliance (tracking addresses from sanction lists). According to a Nansen study, addresses labeled 'Smart Money' generate positive returns in 70% of cases. The absence of a bot can be costly: missing a whale entry can cost thousands of dollars in lost profit. Our bot reduces alert latency by 80% compared to traditional polling methods, giving you a critical edge.

How to Classify Whale Transactions?

A transaction goes through several processing stages. First, identify the source and recipient via a label resolver (Nansen, Etherscan, Arkham). Second, analyze the movement type: if the sender is a CEX hot wallet and the recipient is a new wallet, it's cex_withdraw. If both addresses are known protocols, it's likely dex_swap. Third, check internal transfers via clustering. The classifier uses a decision tree with 15 features, achieving 95% accuracy on test data.

Data Sources and Architecture

On-chain (primary): Ethereum (eth_getLogs + eth_subscribe(logs) for ERC-20 Transfer events), Solana (Helius webhooks with filtering by program ID), DEX events: Uniswap V3 Swap, Curve TokenExchange, dYdY order fills.

Analytical (secondary): Nansen API — address labeling (Smart Money, CEX hot wallets, known DeFi whales), Arkham Intelligence API — entity-level attribution, Etherscan labels API — exchange wallets, protocols, DeBank API — current portfolio of an address.

The bot architecture ensures fault tolerance: WebSocket subscription via Tenderly or own node, message queue (Redis Streams), classifier with label cache (TTL 24h), signal generator, and notification dispatcher. The system can handle up to 1,000 transactions per second.

We recommend combining WebSocket and webhook for minimal latency. Savings on RPC requests compared to polling can reach $2,000 per month. For typical projects, development starts at $5,000 and ranges up to $20,000 depending on complexity and number of networks.

Significant Transaction Detector

interface WhaleTx {
  txHash: string;
  from: string;
  to: string;
  tokenAddress: string;
  amountUSD: number;
  labels: {
    from: string | null; // "Binance Hot Wallet", "Smart Money #42"
    to: string | null;
  };
  txType: "cex_deposit" | "cex_withdraw" | "dex_swap" | "wallet_transfer" | "unknown";
}

async function classifyTransaction(tx: RawTransferEvent): Promise<WhaleTx | null> {
  const amountUSD = await priceService.toUSD(tx.token, tx.amount);
  if (amountUSD < WHALE_THRESHOLD_USD) return null;

  const [fromLabel, toLabel] = await Promise.all([
    labelResolver.resolve(tx.from),
    labelResolver.resolve(tx.to),
  ]);

  const txType = inferTxType(fromLabel, toLabel);

  return { txHash: tx.hash, from: tx.from, to: tx.to,
           tokenAddress: tx.token, amountUSD, labels: { from: fromLabel, to: toLabel }, txType };
}

function inferTxType(fromLabel: string | null, toLabel: string | null): WhaleTx["txType"] {
  if (CEX_LABELS.some((l) => toLabel?.includes(l))) return "cex_deposit";
  if (CEX_LABELS.some((l) => fromLabel?.includes(l))) return "cex_withdraw";
  if (DEX_LABELS.some((l) => fromLabel?.includes(l) || toLabel?.includes(l))) return "dex_swap";
  return "unknown";
}

Why Deduplication and Clustering Matter?

One of the challenging tasks is understanding that several addresses belong to the same entity. Heuristics: dust attack / common input ownership (for UTXO chains), nonce-based clustering (addresses funded from the same source), temporal correlation (addresses that always move funds in the same block). For EVM: if address A frequently sends gas to address B before B's transactions — A and B likely share an owner.

Without deduplication, the bot generates up to 90% noise. A single transaction can produce multiple events (e.g., a Uniswap Swap includes Transfer from trader to pool and Transfer from pool to trader). We group events by txHash and send one notification. Cooldown on address (5 min) and blacklist of technical contracts (protocol multisigs, staking contracts) further reduce noise.

Telegram Notification

async function sendWhaleAlert(tx: WhaleTx, bot: TelegramBot) {
  const emoji = tx.txType === "cex_deposit" ? "🔴" : tx.txType === "cex_withdraw" ? "🟢" : "🔵";
  const fromStr = tx.labels.from ?? shortenAddress(tx.from);
  const toStr = tx.labels.to ?? shortenAddress(tx.to);

  const message = [
    `${emoji} <b>Whale Alert</b>`,
    ``,
    `<b>Amount:</b> $${formatUSD(tx.amountUSD)}`,
    `<b>From:</b> ${fromStr}`,
    `<b>To:</b> ${toStr}`,
    `<b>Type:</b> ${tx.txType}`,
    ``,
    `<a href="https://etherscan.io/tx/${tx.txHash}">View on Etherscan</a>`,
  ].join("\n");

  await bot.sendMessage(CHANNEL_ID, message, { parse_mode: "HTML" });
}

Thresholds and Noise Filtering

Activation thresholds: for top tokens from $500k, for long-tail from $50k. A watchlist of specific addresses with individual thresholds can be set. Filtering rules:

• Deduplication: one transaction → one notification (by txHash)
• Cooldown on address: if address A already alerted 5 minutes ago — skip
• Blacklist of technical addresses: protocol treasury multisigs, staking contracts
• Aggregation: if 10+ alerts of the same type arrive within 60 seconds — send a summary

Development Process

1. Requirements analysis and selection of target networks (Ethereum, Solana, BNB Chain)
2. Infrastructure setup: RPC nodes, WebSocket subscriptions, queues
3. Implementation of classifier and label resolver
4. Integration of Telegram/Discord bot with formatting
5. Testing on historical data and deployment

What's Included and Timelines

• Event listener with reconnect and catchup for missed blocks
• Label cache with TTL (Nansen/Arkham data changes rarely, cache for 24h)
• Transaction classifier with extensible rules
• Telegram/Discord notification with formatting and deduplication
• Dashboard with alert history and threshold configuration
• Watchlist support for specific addresses (VIP tracking)

Development time: from 2 to 6 weeks depending on the set of networks and classification complexity. Pricing starts at $5,000 and is calculated individually. Our team holds Solidity and Rust certifications, with over 50 successful DeFi projects. With 5+ years of blockchain development experience, we have been serving the crypto community since 2019. We guarantee code quality and post-launch support. Our whale tracking bot provides real-time on-chain analytics with transaction classification and label resolution, sending alerts to Telegram and Discord. Contact us to discuss the details of your bot and start receiving profitable signals.

Blockchain Infrastructure Deployment: Nodes, RPC, Indexing

Subgraph fell at 3:47 AM. By morning users saw outdated balances, transactions "hung" in the UI, support received 47 tickets in an hour. Cause: the handler in the subgraph failed on a transaction with a non-standard event log — and the entire index stopped. We have encountered such situations dozens of times. Our experience shows: blockchain infrastructure does not forgive gaps in observability. Guaranteeing uptime without multi-layered monitoring and fault-tolerant architecture is impossible. Over 8 years working with Ethereum, Polygon, and Solana, we have developed an approach that allows predictable deployment of infrastructure of any scale — from a single node to a multichain grid with dozens of subgraphs.

RPC Layer Architecture

Every dApp interaction with the blockchain goes through RPC — the JSON-RPC API provided by a node. Three options:

Managed providers — Alchemy, QuickNode, Infura, Ankr. Minimal operational costs, SLA, built-in monitoring. Limits: rate limits (Alchemy Free: 300 RU/sec), vendor lock, potential downtime during provider incidents. For most projects — the right choice at the start.

Self-owned nodes — full control, no rate limits, no third-party dependence. Cost: archive Ethereum node requires 2.5–3TB SSD, a strong server, and DevOps support. Sync from scratch on Ethereum via Geth/Nethermind — 3–7 days. Justified under high load or latency requirements.

Hybrid — self-owned node as primary, managed provider as fallback. Standard for protocols with high TVL. Proper load balancing can reduce costs by 20–30% compared to pure managed setup. Under high monthly request volume, hybrid saves significantly.

How to Set Up an RPC Layer Without a Single Point of Failure?

At least two providers, DNS round-robin with health check every 5 seconds, automatic fallback when latency >500 ms. In practice, this gives 99.99% availability during any provider failure. For protocols with high TVL, we recommend a custom HA-proxy (nginx or Envoy) in front of two managed providers.

Why Is a Hybrid RPC Scheme More Cost-Effective Than Pure Managed?

At high request volumes, managed providers can be very expensive; a hybrid using a self-owned node as primary and a managed fallback cuts costs significantly without losing SLA.

Ethereum Node Clients

Execution clients: Geth (most used), Nethermind (C#, fast sync), Besu (Java, enterprise), Erigon (fastest sync, efficient archive mode ~2TB instead of 3TB).

Consensus clients (post-Merge): Lighthouse (Rust), Prysm (Go), Teku (Java), Nimbus (Nim). Each node after The Merge requires a pair of execution + consensus clients.

For DevOps: eth-docker — Docker Compose configurations for all client combinations. Setting up monitoring via Grafana + Prometheus is mandatory; a standard dashboard is available in each client's repository.

The Graph: Event Indexing

The Graph Protocol — decentralized indexing. A subgraph describes which events from which contracts to index and how to transform them into a GraphQL schema.

Subgraph structure:

• subgraph.yaml — manifest: contract addresses, startBlock, events to handle
• schema.graphql — GraphQL schema of entities
• src/mapping.ts — AssemblyScript event handlers

dataSources:
  - kind: ethereum
    name: UniswapV3Pool
    network: mainnet
    source:
      address: "0x88e6A0c2dDD26FEEb64F039a2c41296FcB3f5640"
      abi: UniswapV3Pool
      startBlock: 12370624
    mapping:
      eventHandlers:
        - event: Swap(indexed address,indexed address,int256,int256,uint160,uint128,int24)
          handler: handleSwap

AssemblyScript handlers — not TypeScript. No nullable types, no closures, no many standard APIs. An error in the handler stops the subgraph indexing on that transaction. Important: add try-catch for operations that can fail (e.g., store.get() for an entity that may not exist).

How to Avoid Subgraph Indexing Stops?

Graph Node logs are monitored in real-time; on hasIndexingErrors = true an alert fires and an automatic node restart (via systemd or Kubernetes). Typical downtime on error — 150–300 seconds to recover. Additionally, for production we set up a watchdog that restarts Graph Node if subgraph lag exceeds 50 blocks.

Choosing Between Hosted Service and Decentralized Network

Graph Hosted Service (free, centralized) is deprecated in favor of Subgraph Studio + Graph Network. For production: deploy on Graph Network with GRT curation signal — the subgraph gets indexers proportional to curation.

Alternatives to The Graph: Ponder (TypeScript, self-hosted, easier to debug), Envio (ultra-fast indexer, supports EVM + non-EVM), Subsquid (TypeScript, own network), Moralis Streams (managed, webhook-based). Our experience shows: for high-load projects with unique logic, Ponder or Envio are more effective — they give full control over the process and do not require GRT tokenomics.

Webhooks and Real-Time Notifications

Alchemy Webhooks and QuickNode Streams allow receiving events in real-time via HTTP webhook or WebSocket. For monitoring addresses, new transactions, mints — this is faster than polling RPC.

Tenderly — platform for monitoring and alerts. You can set up an alert for a specific contract event, balance change, function call with certain parameters. Transaction simulation via Tenderly API is invaluable for debugging.

Monitoring and Observability

Minimum monitoring stack for a protocol:

On-chain: OpenZeppelin Defender Sentinel — watches contract events, triggers webhook or Autotask when conditions are met. Forta Network — community-maintained bots detect anomalies (large withdrawals, flash loans, governance attacks).

Infrastructure: Grafana + Prometheus for nodes, Datadog or Grafana Cloud for managed metrics. Alerts on: node is 10+ blocks behind, RPC latency >500ms, subgraph lag >100 blocks.

Uptime: Better Uptime or PagerDuty on RPC endpoint and subgraph health endpoint (The Graph provides _meta { hasIndexingErrors, block { number } }).

Why Is Monitoring Without Tenderly Insufficient?

Tenderly provides transaction simulation and detailed traces — critical for debugging subgraph and smart contract errors. Forta focuses on network anomalies, not your infrastructure. The combination of Tenderly plus a custom Grafana dashboard covers 90% of incident scenarios.

Multichain Infrastructure

A protocol on 5 chains = 5 separate RPC endpoints, 5 subgraphs, 5 monitoring configs. Manageable but requires deployment automation.

For subgraph multi-network deployment: graph deploy --network mainnet, graph deploy --network arbitrum-one etc. with a unified codebase and network-specific addresses in separate config files.

Chainlink CCIP and LayerZero for cross-chain messaging require monitoring of both chains and transactions on intermediate relayers. A reorg on the source chain after a confirmed mint on the target chain is a classic bridge problem. Solution: wait for finality (on Ethereum ~15 minutes after Merge for economic finality) before confirming on the target chain.

Infrastructure Setup Process

1. Audit current stack — determine chains, request volume, latency and availability requirements.
2. Architecture design — select providers, load balancing, redundancy.
3. Subgraph development — manifest → schema → handlers → testing on local Graph Node → deploy to testnet → mainnet.
4. Monitoring configuration — Tenderly alerts, Grafana dashboard, PagerDuty integration.
5. Documentation and runbook — what to do when: subgraph falls behind, RPC downtime, node desync.
6. Handover to operations — team training, access transfer, first month support.

What's Included

• Deployment of managed or self-hosted Ethereum, Polygon, BNB Chain nodes
• RPC layer setup with primary/fallback and load balancing
• Subgraph development and deployment for your protocol
• Monitoring connection (Tenderly, Grafana, alerts)
• Runbook and operations documentation
• Team training (up to 4 hours online)
• 30-day support after delivery

Timeline

All projects are managed in a GitHub/GitLab repository with CI/CD; configuration code stays with you. Order infrastructure deployment — we'll show how to cut costs by 20–30% without losing reliability. Get a consultation — we'll demonstrate how we deployed infrastructure for a protocol with large TVL on Ethereum and Arbitrum. Contact us.