OpenZeppelin Defender Alternatives After the 2026 Shutdown
Quick answer. Hosted Defender shut down on July 1, 2026. OpenZeppelin points users to its open-source Monitor and Relayer, self-hosted or run by its Managed Service; other modules need separate replacements.
Video transcript
OpenZeppelin Defender shut down on July 1, 2026. No single product replaces it, so each module needs its own replacement.
OpenZeppelin announced the sunset on June 30, 2025, and new sign-ups closed that day. Existing users got a year to migrate before hosted Defender retired.
Monitor maps to OpenZeppelin Monitor, Tenderly or a security platform. Relayers and Actions map to OpenZeppelin Relayer, Tenderly Web3 Actions or KeeperHub. Deploys use the Upgrades Plugins, and proposals move to a Safe.
The open-source tools have no license fee, but you run the servers, RPC endpoints and on-call yourself. Managed services from OpenZeppelin or Guardian add people who watch and respond.
A relayer that can pause, upgrade or move funds holds a privileged key. Put the relayer, its key store and its RPC providers in your next pentest scope.
Guardian Managed Security monitors your contracts on every block. Your alerts can also stream into Guardian's 24/7 MDR team, which works to a 15-minute SLA on Critical alerts.
Then finish the migration. Revoke roles held by old Defender Relayer addresses, rotate secrets, prove monitors fire on a fork, re-test the pause path, and wire Critical alerts to a pager.
Read the full module map and migration checklist below, or talk to Guardian about replacing Defender with people, not just tools.
On June 30, 2025, OpenZeppelin announced a phased sunset of Defender, the hosted platform many teams used to monitor contracts, relay transactions and automate admin operations.
New sign-ups closed that day. Existing users got a year to migrate, and July 1, 2026 was set as the final shutdown.
No single product replaces it. Here is the replacement for each module, the gaps the open-source tools leave, and a migration checklist.
A naming note: Guardian Defender is Guardian's post-audit bounty contest, and is unrelated.
What Retired and When
| Date | What happened |
|---|---|
| June 30, 2025 | Sunset announced; new Defender sign-ups disabled |
| June 2025 to July 2026 | Service, support and critical patches continue; open-source tools run in parallel |
| July 1, 2026 | Hosted Defender retires: the final shutdown |
As of November 2026, Defender's documentation is no longer published on docs.openzeppelin.com.
The open-source tools are licensed under AGPL v3, so modifications you distribute must stay open source.
They ship as Docker images, and OpenZeppelin's sunset FAQ lists HashiCorp Vault and AWS KMS for key management.
The interface moves to a CLI, SDK and API. OpenZeppelin says most core capabilities are kept or improved, while some features cannot be maintained in open source.
Its Managed Service offers "fully hosted and operated Relayer and Monitor instances", with 24/7 oversight and a dedicated support SLA. Pricing is not published.
Every Module and Its Replacement
OpenZeppelin's 2025 Defender documentation listed nine modules. Sentinels and Autotasks, their 2023 names, had become Monitor and Actions.
| Defender module | What it did | Replacement options |
|---|---|---|
| Monitor | Detected contract activity and anomalies, with alerts | OpenZeppelin Monitor; Tenderly Monitor; Hypernative, Hexagate or BlockSec Phalcon |
| Actions | Ran automated onchain and offchain operations | OpenZeppelin Relayer plugins; Tenderly Web3 Actions; KeeperHub |
| Relayers | Sent transactions to the chain automatically | OpenZeppelin Relayer, self-hosted or through the Managed Service |
| Deploy | Managed deployments and upgrades | OpenZeppelin Upgrades Plugins plus your own deploy scripts |
| Transaction Proposals | Created transactions for onchain execution | Safe, with Safe Utils to verify transaction hashes |
| Access Control | Managed accounts, roles and permissions | OpenZeppelin Role Manager |
| Code Inspector and Audit | Automated code analysis; audit issue tracking | No named successor; an audit provider and your issue tracker |
| Address Book | Shared names for accounts and contracts | A versioned file in your repository |
Replacing Monitor
OpenZeppelin Monitor
The direct successor: a Rust service you run yourself, for EVM networks, Stellar and Solana (Midnight is partly supported).
Monitors, networks and triggers are JSON files. Conditions match functions, events and transaction properties, with expressions and AND/OR logic.
Alerts go to Slack, Discord, email, Telegram, webhooks or custom scripts. OpenZeppelin says you can "set automated responses with Relayer".
Defender's Monitor also listed PagerDuty and Opsgenie, and offered templates. Now you route paging through a webhook, write your own rules, and own uptime, RPC endpoints and storage.
Tenderly Monitor
A hosted option. Tenderly pairs alerts and invariants with Web3 Actions, custom responses that can "top up accounts, pause execution". It lists 100+ supported networks.
Security platforms
If you used Defender Monitor mainly to catch attacks, a threat detection platform is the closer fit.
- Hypernative: onchain monitoring with automated response, including automatic contract pauses.
- Hexagate: acquired by Chainalysis in December 2024; pauses, transaction blocking and GateSigner checks before signing.
- BlockSec Phalcon: scans transactions at the mempool stage and says it blocks attacks automatically.
We compare these and others in Best Smart Contract Monitoring Tools in 2026.
Replacing Relayers and Actions
OpenZeppelin Relayer
The Relayer signs and submits transactions on EVM chains, Solana and Stellar.
It handles key management, nonces, fee estimation, status tracking and network policies, with an SDK, metrics and TypeScript plugins.
The repository includes example setups for HashiCorp Vault, Google Cloud KMS, Azure Key Vault and Turnkey signers.
Tenderly Web3 Actions
If your Defender Actions responded to alerts, such as topping up a keeper or pausing a market, Tenderly runs them inside its Monitor product.
KeeperHub
KeeperHub describes itself as "reliable onchain execution for AI agents and protocol teams".
Workflows run on a schedule or on onchain events. The service handles retries, nonce management, RPC failover and gas pricing, and Turnkey provides the wallet infrastructure.
A note on relayer keys
A relayer that can pause, upgrade, mint or move funds holds a privileged key. Self-hosting moves custody of that key, and its server, to you.
Put the relayer, its key store and its RPC providers in your next pentest scope. Keep its onchain roles as narrow as the job allows.
Deploy and Upgrade Gaps
This is where the open-source stack is thinnest.
- Upgrades: the Upgrades Plugins for Hardhat and Foundry check each implementation is upgrade safe and compatible.
- Approvals: propose upgrades and admin calls through a Safe; verify each hash with Safe Utils.
- Roles: OpenZeppelin Role Manager covers role-based permissions with multi-level hierarchies.
- Code review: OpenZeppelin has named no successor to Code Inspector. Every upgrade still needs review.
- One view: no single dashboard joins monitors, relayers, proposals and logs. Decide where that trail lives.
Managed Options
The open-source tools give you detection and automation. They do not give you people.
OpenZeppelin Managed Service hosts and runs the Relayer and Monitor for you, with 24/7 oversight, a dedicated support SLA and security patching.
Guardian Managed Security monitors your contracts on every block: privileged calls, role changes, upgrades, multisig transactions and large fund movements.
Monitors are customized to your protocol and run beside out-of-the-box detectors, with custom actions including automated pauses. Offchain, Guardian's Sentry watches domains, DNS, certificates, cloud and code host.
Your existing monitoring can stream into Guardian's global 24/7 MDR team, which works to a 15-minute SLA on Critical alerts.
Guardian also reviews every multisig transaction before it is signed. For how that differs from a tool, see What Is Web3 MDR?
Migration Checklist
- Rebuild every monitor from exported Defender configs, or from ABIs, privileged functions and runbooks.
- Prove the monitors fire: replay past transactions or run the triggering calls on a fork.
- Revoke stale roles held by Defender Relayer addresses: pauser, keeper, minter, proposer, upgrader.
- Rotate secrets: the RPC keys, webhook URLs and credentials your Defender Actions used.
- Re-test the pause path: confirm who can pause, from which key, and run it on a fork.
- Wire Critical alerts to a pager through a webhook, and confirm a named person answers at 3 AM.
- Monitor the monitor: alert if it stops processing blocks or falls behind the chain head.
- Secure the new stack: put the Monitor, Relayer, key stores and RPC providers in pentest scope.
- Check the license: AGPL v3 requires modifications you distribute to stay open source.
- Update the paperwork: runbooks, access reviews and compliance evidence that still name Defender.
Frequently Asked Questions
When did OpenZeppelin Defender shut down?
Hosted Defender retired on July 1, 2026. OpenZeppelin announced the sunset on June 30, 2025, and disabled new sign-ups the same day, giving existing users a year to migrate.
What is the official replacement for OpenZeppelin Defender?
OpenZeppelin's open-source Monitor and Relayer, licensed under AGPL v3 and self-hosted from Docker images. OpenZeppelin also offers a Managed Service with fully hosted and operated Relayer and Monitor instances.
What replaces Defender Sentinels and Autotasks?
Sentinels became Monitor, now replaced by OpenZeppelin Monitor, Tenderly or a security platform. Autotasks became Actions, now replaced by OpenZeppelin Relayer plugins, Tenderly Web3 Actions or KeeperHub.
Is OpenZeppelin Monitor free?
The code is open source under AGPL v3, so there is no license fee. But you run it: servers, RPC endpoints, storage, uptime and on-call.
Sources
- OpenZeppelin: Doubling Down on Open Source and Phasing Out Defender (June 30, 2025)
- OpenZeppelin: Defender Sunset FAQ (June 30, 2025)
- OpenZeppelin: Open Source Stack
- OpenZeppelin: Defender documentation, archived May 16, 2025 (Internet Archive)
- OpenZeppelin: Defender Sentinel documentation, archived March 16, 2023 (Internet Archive)
- OpenZeppelin: openzeppelin-monitor on GitHub
- OpenZeppelin: Monitor documentation
- OpenZeppelin: openzeppelin-relayer on GitHub
- OpenZeppelin: Upgrades Plugins documentation
- Tenderly: Simulator, Console, Monitor and Node
- KeeperHub: Reliable onchain execution
- Safe: Safe{Wallet} multisig
- Hypernative: Proactive Onchain Security for Enterprises
- Chainalysis: Hexagate
- Cointelegraph: Chainalysis acquires Web3 security firm Hexagate (December 19, 2024)
- BlockSec: Phalcon
- Guardian: Managed Security
- Guardian: Guardian Announces Managed Security
Replace Defender with people, not just tools
Guardian Managed Security watches your contracts on every block and puts an engineer on every alert, with a 15-minute SLA on Critical alerts.