Custom Suspicious Transaction Monitoring System for Blockchain

Note: when your smart contract processes tens of thousands of transactions daily, it's hard to distinguish a regular user from an attacker using a flash loan. A single attack can lead to losses of $500k or more. Without a suspicious transaction monitoring system, you find out about a hack via Twitter when it's already too late. Our real-time blockchain transaction monitoring system provides cryptocurrency anomaly detection for DeFi AML compliance, preventing flash loan attacks and detecting MEV. Integrate via Tenderly webhooks and Chainlink Oracle security for anti-money laundering crypto protection. We build custom systems that detect anomalies in real time and send alerts. With over 6 years in Web3 and 30+ custom detectors deployed, we ensure robust protection for projects from $1M TVL. Investment in a custom detector starts at $5,000 per month, potentially saving millions in prevented attacks. This system can save up to $2M per attack, with a monthly investment starting at $5,000.

How It Works

1. Connect: Integrate via Tenderly webhooks or your own RPC node.
2. Analyze: Our microservices process transactions and detect anomalies.
3. Alert: Notifications sent to Telegram, Slack, or PagerDuty.
4. Act: Optional automated contract pausing via Chainlink Automation.

Key Problems We Solve

Detecting Reentrancy and Flash Loan Attacks

A typical flash loan attack lasts less than 10 seconds. A regular block explorer shows the transaction 30 seconds later, when funds are already withdrawn. Our monitoring system analyzes the mempool and contract state via an RPC pool. If more than 3 internal calls to the same contract from the same sender occur within 1 block, the system triggers an alert. For example, we detected an attack on Aave v3 (Ethereum) 2 seconds before completion, allowing the client to manually pause the contract. Preventing a breach can save up to $2M.

Identifying Mixer and Sanctioned Address Transactions

We load OFAC, Chainalysis, and custom signature lists via Chainlink Keepers. Every incoming transaction is checked against Tornado Cash hash databases and mixer contracts. If an address interacted with a mixer, its risk score increases. For a DEX client, we blocked 15 addresses in the first month, reducing suspicious orders by 40%.

Monitoring Large Transfers and Unusual Gas Patterns

Transfers above $100k from a newly created account (age <7 days) are a typical drain indicator. We also track anomalies in gas price: if an account pays 200 gwei instead of the average 50 gwei, it may indicate an attempt to front-run blocks (MEV). On a custom detector for a Polygon client, we reduced false positives by 60% compared to public APIs.

Real-Time Blockchain Transaction Monitoring Architecture

The architecture is based on microservices with a RabbitMQ queue. Each anomaly type has its own detector service (Node.js/TypeScript) that subscribes to events from the queue. Services are stateless, enabling horizontal scaling under load.

// Example webhook from Tenderly const { Webhook } = require('@tenderly/webhook'); const wh = new Webhook({ webhookSecret: process.env.WEBHOOK_SECRET }); app.post('/tenderly', (req, res) => { const tx = req.body.transaction; if (tx.gas_price > 100e9 && tx.value > 1e21) { alert(`High gas + large transfer: ${tx.hash}`); } res.status(200).send(); }); 

Alerts are sent to Telegram, Slack, or PagerDuty. For critical cases (ongoing attack), we use Chainlink Automation for automatic contract pausing.

Comparison with Off-the-Shelf Solutions

Ready-made solutions like Chainalysis or Elliptic provide good high-level analysis but are not tailored to your business logic. Our custom detector handles 5000 tx/s—10x faster than public APIs—and allows custom rules specific to your contract: e.g., whitelist addresses, adjust thresholds based on pool liquidity.

Attack Types and Detection Methods

What's Included

• Source code of all detectors (private repository).
• Configuration files (Docker, Kubernetes).
• Grafana dashboard with metrics (latency, throughput, false positive rate).
• Documentation for setup and operation (10+ pages).
• Team training (2-hour workshop).
• Support for 30 days after launch.

Common Mistakes When Implementing Monitoring

• Not accounting for gas price spikes (alerts trigger on every large transaction after hype).
• Ignoring internal transactions (call traces). 30% of attacks use them to bypass filters.
• Lack of automatic rollback for false alerts—developers get used to ignoring alerts. Set up deduplication and escalation.

We guarantee the system will cover all your business requirements. We assess your project in 2 days—get in touch. To learn more, contact us. Receive a free consultation.

detector: name: reentrancy chain: ethereum rpc_endpoint: your Infura endpoint threshold: 3 alert: channels: [telegram, slack] cooldown: 60s