How to Track Crypto Hacks in Real Time

Video transcript

Was there a crypto hack today? If so, it has probably been flagged in public already.

In Guardian's timing of 30 exploits, the first public alert came a median of 35 minutes after the first exploit transaction.

First alerts come from security firms' accounts on X, onchain analysts and independent researchers. Follow a few, and look for a transaction hash you can check.

DefiLlama's hacks dashboard keeps the running record, Rekt adds write-ups and a loss leaderboard, and SEAL's Radar adds advisories and weekly stats.

Before you act, open the transaction on a block explorer. Check the team's official channels and a second, independent source. Never sign anything from a link in a hack post.

Public feeds cover everyone. Your own monitoring covers you, sooner. In six post-mortems that say when the team or its monitoring first knew, the median was 4 minutes.

With Managed Security, Guardian monitors your contracts on every block and matches vulnerability disclosures against your system. When something fires, an engineer who knows your system responds, around the clock.

Watch advisories for the code you run, not only hacks. The Managed Security walkthrough shows a 5.7 million dollar Cosmos EVM exploit, months after the fix.

Read the full article for the trackers, rumor checks and alert checklist. Or talk to Guardian at guardian.security, and hear about your own incident first.

Was there a crypto hack today? If so, it has probably been flagged in public already.

In Guardian's timing of 30 exploits from 2024 to 2026, the first public alert came a median of 35 minutes after the first exploit transaction. Twenty-one of the 30 were flagged within an hour.

Here is where to look, how to tell a real exploit from a rumor, and how teams watch their own contracts.

Where Hacks Are Reported First

In that dataset, the first public alerts came from security firms' alert accounts on X, onchain analysts and independent researchers.

Firms whose accounts posted first alerts include Cyvers, PeckShield, CertiK, BlockSec's Phalcon and Blockaid.

Follow a few and turn on notifications. Look for posts that include a transaction hash or an address: that is what lets you check the claim.

Treat loss figures as estimates. Eight days after Binance's October 29 drain, sources still differed:

• Binance's own report: about $6.34B
• DefiLlama: $6.36B
• Rekt's leaderboard: $6.43B

Trackers and Databases

Alerts tell you something is happening. Trackers record what happened.

DefiLlama's dataset is also open through a public API. On November 6, 2026, its newest entries were dated November 5, and some recent ones had no amount yet.

Rekt's leaderboard lists each incident's loss, date and auditor. Its Binance write-up ran on November 6, eight days after the October 29 drain.

SEAL's Radar invites readers to subscribe "to stay ahead of crypto's cyberthreats". Recent posts include an advisory on fake whitehat researchers targeting Solana protocols.

Real Exploit or Rumor?

Check a report before you act on it. SEAL's smart contract exploit runbook lists three tells.

• Funds moving to the protocol's own multisig or treasury are likely authorized.
• A single affected user may be phishing, not a protocol exploit.
• Wrong numbers in the app, with correct chain state, point to the front end.

Then run four checks:

1. Open the transaction on the chain's block explorer. No hash, no confirmation.
2. Look for the affected team's statement on its official channels.
3. Find a second, independent source.
4. Sign nothing from a link in a "hack" post.

On that last point, SEAL's communication templates have teams warn users not to approve transactions from sites claiming to be the protocol.

Silence from the team is not proof of a rumor. In Guardian's timing, the median team statement came about two hours after the first exploit transaction.

If your own funds are under attack right now, contact SEAL 911, the Security Alliance's free emergency hotline.

Monitoring Your Own Contracts

Public feeds cover everyone. Your own monitoring covers you, sooner.

In the six post-mortems in Guardian's study that say when the team or its monitoring first knew, the median was 4 minutes.

What to watch

• Privileged calls, and role or ownership changes
• Upgrades and configuration changes
• Multisig transactions, queued and executed
• Large fund movements
• The oracles, bridges and protocols you depend on

Tools

OpenZeppelin Monitor is open source and runs on your own infrastructure. It watches onchain activity and sends alerts to Slack, Discord, Telegram, email or webhooks.

Tenderly Alerts, on a paid plan, trigger on function calls, events, balance changes and more, and can start Tenderly's Web3 Actions.

Commercial platforms add automated responses, such as pauses. Our comparison of smart contract monitoring tools covers nine, and what onchain monitoring is covers the basics.

An alert only helps if someone awake can act on it.

Setting Up Alerts

1. Follow a few security firms' alert accounts and turn on notifications.
2. Bookmark DefiLlama's hacks dashboard for confirmed incidents.
3. Subscribe to SEAL's Radar for advisories and weekly stats.
4. Put monitors on your own contracts and your dependencies.
5. Watch security advisories for the code you run, not only hacks.
6. Write down who gets paged, who can pause, and how to reach signers.

How Guardian Helps

Guardian Managed Security monitors your contracts on every block: privileged calls, role and ownership changes, upgrades, multisig transactions and large fund movements.

Monitors are customized to your protocol and run alongside Guardian's out-of-the-box detectors for suspicious contracts and known exploit patterns.

Offchain, Sentry watches your domains, DNS, certificates, cloud and code host.

When something fires, a Guardian engineer who knows your system responds, around the clock. The outcome is response, not notification.

Guardian also ingests vulnerability disclosures in real time and matches them against your system. Where one reaches you, an engineer confirms the exposure and works with you to patch it.

The Managed Security walkthrough gives an example: a $5.7M Cosmos EVM exploit in August 2026, months after the fix.

Frequently Asked Questions

How can I find out if there was a crypto hack today?

Check security firms' alert accounts on X, then confirm with the transaction on a block explorer and the affected team's official channels. For confirmed incidents, DefiLlama's hacks dataset lists the date, amount, chain and a short description of each.

What is the best crypto hack tracker?

For a dated record, start with DefiLlama's hacks dashboard, also open through a public API. Rekt adds write-ups and a leaderboard ranked by loss, and SEAL's Radar adds advisories and weekly incident stats.

How can I tell if a reported hack is real?

Find the transaction hash and open it on a block explorer, then look for the team's statement on its official channels. Funds moving to the protocol's own multisig may be authorized, and a single affected user may point to phishing.

How fast are crypto hacks reported?

In Guardian's timing of 30 exploits from 2024 to 2026, the first public alert came a median of 35 minutes after the first exploit transaction. The median team statement came about two hours in.

Sources

• Guardian: How Fast Are Crypto Hacks Detected? Data From 30 Exploits
• DefiLlama: Hacks dashboard
• DefiLlama: Hacks dataset API (pulled November 6, 2026)
• Rekt: Leaderboard (accessed November 6, 2026)
• Rekt: Binance, Rekt (November 6, 2026)
• Binance: 29 October 2026 Binance Security Incident, Initial Findings and Response Update (November 3, 2026)
• Security Alliance: Radar (accessed November 6, 2026)
• SEAL Frameworks: Smart Contract Exploit runbook
• SEAL Frameworks: Incident Response Template, Communications
• OpenZeppelin: openzeppelin-monitor (GitHub)
• Tenderly: Intro to Alerts (documentation)
• Guardian: Managed Security
• Guardian: Managed Security walkthrough