What Is Onchain Monitoring? A Guide for Security Teams

By the Guardian team Updated November 2026 6 min read

Quick answer. Onchain monitoring watches live contracts, roles, multisigs, fund flows, oracles and governance, alerting or acting when something changes or looks like an attack. Audited protocols still need it: an audit reviews one commit, and the system keeps changing.

Watch: What Is Onchain Monitoring? A Guide for Security Teams 1:46

Video transcript

An audit reviews your code at one commit. Onchain monitoring watches what happens next, block by block.

Teams can know within minutes. Response is slower. In exploits Guardian timed, containment came a median of 88 minutes after the first exploit transaction.

Monitoring has three parts. Data from transactions, logs and state feeds detection, built from your rules and known attack patterns. Then response: a page or an automated pause.

Start with the powers that move funds or change code: roles, upgrades, multisig signers, timelocks, large outflows and oracle prices.

Events are only a start. Also compare live state to a baseline, and alert if the monitor itself goes quiet.

Audits matter. Guardian has reported and resolved over 300 Critical vulnerabilities. But roles, proxies and signers keep changing after the audited commit, and monitoring sees those changes as they land.

Regulators are starting to write this down. ADGM's draft DeFi guidance says monitoring should not rely solely on periodic review.

Build or buy. Self-host an open source tool, buy a platform, or use a managed service where people triage and respond around the clock.

Guardian's Managed Security maps every path to your funds in a live threat model, then monitors every block and reviews multisig transactions before signing. Guardian engineers respond around the clock.

Read the full guide, or talk to Guardian about Managed Security at guardian.security.

An audit reviews your code at one commit. Onchain monitoring watches what happens to it after that, block by block.

Teams can know within minutes. In Guardian's timing of 30 exploits from 2024 to 2026, six post-mortems say when the team or its monitoring first knew: a median of 4 minutes in.

Response was slower. In the 19 incidents with a pause or containment time, the median came 88 minutes after the first exploit transaction. See how fast crypto hacks are detected.

This guide covers what monitoring is, what it watches, how it differs from audits and bounties, and how to build or buy it.

What Onchain Monitoring Is

Onchain monitoring reads chain data as blocks are produced and compares it with rules and models. Then it alerts a person or triggers an action.

It has three parts:

Data: transactions, event logs, contract state and, on some chains, pending transactions.
Detection: rules you write for your own contracts, plus models for known attack patterns.
Response: a page to an on-call person, or an automated action such as a pause.

Chain data is public, so monitoring needs no access to your systems. Attackers read the same data.

The two kinds of detection catch different things. Generic detectors catch known exploit patterns. Rules built from your own roles and runbooks catch a legitimate power used the wrong way.

What It Watches

Start with the powers that can move funds or change code. Widely used libraries and wallets emit standard events when those powers change.

Signal	What to watch	Why it matters
Roles	RoleGranted, RoleRevoked, RoleAdminChanged (OpenZeppelin AccessControl)	Someone gained or lost upgrade, pause or mint power
Ownership	OwnershipTransferred (OpenZeppelin Ownable)	Control of an owner-gated contract moved
Upgrades	Upgraded, AdminChanged, BeaconUpgraded (ERC-1967 proxies)	Live code is no longer the audited code
Multisigs	AddedOwner, RemovedOwner, ChangedThreshold (Safe)	Different or fewer keys can now act
Timelocks	CallScheduled, MinDelayChange (OpenZeppelin TimelockController)	A change is queued, or your warning window shrank
Fund flows	Large transfers; outflows from vaults and treasuries	Money leaving faster than normal use explains
Oracles	Feed address, time since update, deviation from market	A stale, swapped or manipulated price
Governance	Proposals, votes, use of emergency powers	Control can change through a vote
Attack setup	New contracts that call yours; pending transactions	An attack can show before the drain

Events are a start, not the whole job. Custom contracts can change state without a standard event, so also compare live state against a known baseline.

Two habits close common gaps. Decode every multisig and timelock transaction that touches your contracts. And alert when the monitor itself goes quiet.

Offchain systems need watching too. Onchain monitors miss a hijacked domain or a leaked cloud key until it reaches the chain.

Monitoring vs Audits vs Bounties

Each control covers a different moment. None replaces the others.

Control	When it runs	What it catches	What it misses
Audit	Before launch or an upgrade, at one commit	Flaws in the reviewed code	Changes after that commit; keys and operations
Bug bounty	Whenever researchers look	Flaws researchers choose to report	Attackers who never report
Onchain monitoring	Every block, after deployment	Changes and attacks as they happen	Bugs nobody has triggered yet

Audits matter: Guardian has reported and resolved 300+ Critical vulnerabilities. But the live system keeps changing after the audited commit.

Roles get granted, proxies get upgraded, signers rotate and integrations change. Monitoring is the control that sees those changes as they land.

Who Needs It

Protocols

Any team running contracts that hold value, upgradeable proxies, admin roles or a multisig.

Watch your own contracts, and the oracles, bridges and protocols you depend on.

Institutions

Funds, banks and exchanges with DeFi positions face a harder version. They rely on protocols they do not control.

Regulators are starting to write this down. On October 6, 2026, ADGM's FSRA published draft DeFi Risk Management Guidance for consultation, with comments due by November 30, 2026.

It covers Authorised Persons and Recognised Bodies that engage with DeFi.

The draft says "Monitoring should not rely solely on periodic review". Threshold-based alerts, escalation triggers and clear ownership of monitoring outputs should be in place (2.7.5).

Firms using third-party tools should understand their methodology, coverage and limitations (2.7.5). Escalation should work outside normal business hours (2.10.3).

Our guide to ADGM's monitoring draft maps the seven areas it lists.

Wallets, custodians and exchanges

Teams that sign at scale also watch the signing path: hot wallets, treasury multisigs and what signers approve.

Build vs Buy

Option	What you get	What you still own
Self-hosted open source	Full control; no license fee	Rules, servers, RPC endpoints, uptime, on-call
Monitoring platform	Prebuilt detectors, custom rules, automated actions	Triage, response authority, on-call
Managed service	People who triage and respond around the clock	The response authority you agree in advance

Build

OpenZeppelin Monitor is open source (Rust, AGPL-3.0) for EVM networks, Stellar and Solana. It alerts to Slack, Discord, email, Telegram, webhooks or custom scripts.

OpenZeppelin points former Defender users to it; hosted Defender retired on July 1, 2026. See OpenZeppelin Defender alternatives.

Buy a platform

Hypernative, Hexagate (part of Chainalysis since December 2024) and Blockaid sell detection with automated actions such as contract pauses.

We compare them in Hypernative vs Hexagate vs Blockaid, and rank nine options in Best Smart Contract Monitoring Tools.

Buy a service

A platform produces alerts. Managed detection and response adds the people who triage and act. See What Is Web3 MDR?

Whichever you choose

Inventory every contract, role, multisig and dependency you need watched.
Write a detection for each privileged power, not just for attacks.
Decide which actions run automatically, and who holds each key.
Replay a past exploit pattern on a fork to prove detection and response work.
Page a named person around the clock, and test the pause path.
Keep rules in version control, so they survive a change of vendor.

How Guardian Monitors

Guardian's Managed Security runs onchain monitoring as a managed service, around the clock.

It starts from a live threat model. Guardian maps every path to your funds: the contracts that hold them, the roles that can move them, and the keys, signers and multisigs behind each one.

Guardian monitors your contracts on every block: privileged calls, role and ownership changes, upgrades, multisig transactions and large fund movements.

Detections are built from your estate and run alongside out-of-the-box detectors for suspicious contracts and known exploit patterns. Offchain, Sentry watches your domains, DNS, certificates, cloud and code host.

When something fires, a Guardian engineer who knows your system responds, around the clock. The security operations team also reviews every multisig transaction before it is signed.

Frequently Asked Questions

What is onchain monitoring?

It is the real-time watching of deployed contracts and the activity around them: roles, upgrades, multisigs, fund flows, oracles and governance. When something changes or matches an attack pattern, it alerts a person or triggers an action.

Why do audited protocols still need onchain monitoring?

An audit reviews code at one commit. After launch, roles are granted, contracts upgraded, signers rotated and integrations changed. Monitoring sees those changes, and attacks on keys as well as code, as they happen.

Can onchain monitoring stop an exploit?

It can if detection is wired to an action, such as pausing a contract or blocking a transaction. That action needs a privilege you grant in advance. Test it on a fork, because an untested pause path can fail.

What is the difference between onchain monitoring and Web3 MDR?

Onchain monitoring is the detection: data, rules and alerts. Web3 MDR is a managed service in which people triage those alerts and respond around the clock, under authority agreed in advance.

Sources

Watch every path to your funds, on every block

Guardian Managed Security maps your contracts, roles and signers into a live threat model, and a Guardian engineer responds when something fires.

Talk to Guardian Explore Managed Security