Onchain Monitoring for Trading Firms: Real-Time Risk Visibility for Capital Deployed Onchain

Executive Summary

A trading firm that holds a position in a lending market, a stablecoin, or a vault inherits every risk that protocol carries, and none of the levers to stop it. Pausing the protocol is never an option on the desk, which makes getting out first the only response the firm actually controls. When an event hits a protocol, every exposed participant is handed the same information at the same moment, and financial outcomes diverge from there, often by orders of magnitude, decided by who was watching, what they were watching, and how fast they could act. Two desks holding identical positions can post very different results on the same bad day, and the difference is often just monitoring.

That gap reshapes what monitoring has to do, because knowing that an exploit happened is only the start. A desk needs to know early enough, and specifically enough, to act on its own positions before the outcome is set. And the events that move a book fastest are often financial rather than adversarial, a depeg, a health factor sliding toward liquidation, an unexpected outflow. Blockaid's Onchain Monitoring is built to watch both sides. It discovers the full set of assets a firm is actually exposed to, several hops out along the dependency graph, tracks financial and security signals directly from onchain state, and, when a rule trips, alerts the desk or triggers an automated response through systems the firm controls.

This post covers why reaction speed separates trading outcomes when incidents hit, how firms map their real exposure with auto-asset discovery, and how Blockaid's Onchain Monitoring puts monitors to work across financial and security risk, from a sliding health factor to an exploit contract aimed at a protocol three hops out.

A Few Minutes is the Difference Between Preventable and Irreversible

A DeFi position ties the firm holding it to a bundle of dependencies. The desk that supplies collateral to a lending market, holds a stablecoin as margin, or routes size through a vault is exposed to that protocol's contracts, its admin keys, its oracles, and the collateral behind it, while holding none of the controls. When something goes wrong, the protocol team can pause contracts or freeze markets. A trading firm can only decide how fast to exit, and whether it even knows it needs to.

Recent incidents show how much room that leaves for outcomes to diverge. In March 2026, an exploit of the Resolv protocol depegged its USR stablecoin, and the losses reached well beyond direct holders of USR to teams exposed through collateral reuse. In April 2026, Drift, Solana's largest perpetuals platform, was exploited for $285 million in an event that spread across the Solana DeFi ecosystem, and later that month KelpDAO was drained of $292 million, with losses rippling through DeFi's largest lending protocol and across multiple chains. Rather than resolving in a single transaction, each attack played out over minutes or hours and left a window in which exposed participants could exit positions or cut off the flow of funds. Every firm exposed to those protocols received the same event at the same moment. What differed was who saw it in time to use the window.

That window is what monitoring exists to win, and it is wider than security alone. A monitoring system that only speaks the language of exploits misses half the picture, because a depeg or a liquidation can take a position apart as quickly as an attacker can. Blockaid's Onchain Monitoring covers both halves of that picture in a single product. The walkthrough below follows the order the questions come up on a desk, from what to track, to how to watch it, to how fast the firm can respond.

Auto-Asset Discovery Maps What a Firm Is Actually Exposed To

A firm's real risk surface is almost never just the assets it holds. It is everything those assets depend on, the contracts they call, the pools they route through, the oracles that price them, and the tokens that back them. A position in one vault can carry silent exposure to a lending market, a stablecoin, and a price feed three steps removed, none of which the desk deliberately chose to hold, all of which can sink the position.

Blockaid handles this mapping with auto-asset discovery, a built-in capability of Onchain Monitoring. A firm adds a seed asset, a wallet, a token, or a protocol it is exposed to, and Blockaid automatically discovers the other risk- and performance-relevant assets connected to it, several hops out along its dependency graph. The map takes in the contracts the seed asset interacts with, then the assets those contracts depend on, and keeps expanding outward until it reflects the firm's actual exposure rather than just its holdings.

It’s Important to Watch a Position as the Chain Sees It 

Consider a lending position, where one of the firm's wallets has supplied collateral into a lending market and borrowed against it. The number that matters for that position is the health factor, and letting it drift toward the liquidation threshold puts the collateral at risk. That can happen for reasons that have nothing to do with the firm's own behavior, since a volatile collateral asset can simply reprice.

A Blockaid monitor can track that health factor directly from onchain state. It reads the value the way the protocol itself computes it, calling the lending pool's account-data function for the specific wallet, pulling the health factor out of the result, and re-evaluating on every block. With no separate data feed to trust and no polling lag to reason about, the monitor sees what the chain sees, as the chain sees it.

What the desk does when the number crosses a line is a separate decision, and the firm configures it. A monitor can simply alert, or it can trigger an action through an API call to a system the firm controls. One example is a rebalancing service that shifts a portion of collateral from a volatile asset into a stable one as the health factor deteriorates, partially repays the loan if it keeps sliding, and moves back toward the original allocation once conditions recover. The monitor watches, the firm's systems act, and the two stay wired together but distinct, so the response logic remains under the firm's control.

Every desk builds that rebalancing recipe differently, but the primitive underneath carries across. Watching an onchain value and firing an action when it crosses a threshold covers a large share of what a trading firm worries about day to day.

The Most Useful Monitors May Have Nothing to Do With Attacks

A good deal of what trading firms want to monitor is not dangerous at all, just information the desk needs to see.

A monitor can watch for a specific event emitted by a contract, a supply into a pool from one of the firm's wallets for instance, and treat it purely as a notification. Contracts emit events the way an application writes log entries, so a monitor can subscribe to a named event, filter it to the wallets or parameters that matter, and route the hit wherever the firm's operations already live, whether that is an alerting tool like PagerDuty or an internal audit trail. A desk that wants to know every time a particular address supplies more than some threshold sets that up as a monitor and moves on.

It is worth stating plainly, because it is easy to miss, that a strong monitoring system is a general instrument. Once a firm can reliably observe onchain state and events, and reach external services to enrich or act on what it sees, it can point that capability at security, at financial risk, or at pure bookkeeping. The mechanism stays the same across all three, and only the question asked of it changes.

Some Security Events Could Mean "Get Out"

Security events call for a different posture, because a firm invested in a protocol cannot fix it. A handful of onchain events should therefore change the desk's behavior immediately, since the only lever available is the exit.

The sharpest of these is an exploit contract deployed against a protocol the firm is exposed to. Blockaid ships an out-of-the-box monitor that watches the contracts in a firm's inventory and flags when a newly deployed contract appears to target one of them. For a protocol team that alert means pause, while for a trading firm it means withdraw, unwind, and get out of the position before the exploit executes.

This is a different threat from a wallet drainer, and the distinction matters. A drainer tricks an individual into connecting a wallet and approving away their assets. An exploit-contract deployment is an attacker who has found a vulnerability in the protocol itself and is positioning to use it. The word malicious covers both, while the mechanics and the right response differ completely.

Deployment of a hostile contract is one signal, and changes to a protocol's own control surface are another. Monitors can watch for a proxy upgrade on a contract the firm is exposed to, for privileged roles being added or removed, or for an admin address changing. Any of these can be the first visible sign that the terms of a protocol the firm is invested in have shifted underneath it, and thanks to auto-asset discovery, that exposure includes the protocols a firm reaches only through its dependencies. The inventory-level exploit monitor is on by default for every contract a firm adds. The control-surface monitors are configured by the firm, and they are worth configuring for anything the desk holds a meaningful position in.

A Stablecoin’s Stability is a Trading Firm's Risk Exposure

For a firm holding a stablecoin, the asset's stability is the exposure. The workhorse here is a formula-based monitor tracking price, which reads the relevant price feed onchain, normalizes the raw value, and compares it against a band. A tight band, a fraction of a percent in either direction, gives an early informational signal. A wider band, several percent, marks the point where something is genuinely wrong and the desk needs to act. A depeg rarely arrives in one step, and running two thresholds separates noise from a real break.

Price is only one of several signals worth watching on a stablecoin. Depending on the asset, a firm might monitor for unusually large mints, for a sharp move in total supply, or for supply drifting out of line with the reserves that are supposed to back it. Each is a different question asked of onchain state, and each can carry its own threshold and its own response.

A Single Standalone Condition Isn’t Always Enough

Single-threshold monitors are the foundation, but real trading decisions are often conditional. Composite monitors combine several rules so a response fires only when multiple conditions hold at once.

A desk might reasonably want to stay in through a small, isolated depeg and exit the moment a modest depeg coincides with unusual outflows from other wallets, treating the combination as a signal worth acting on well before either condition alone would justify it. Security events tend to want the opposite logic, since a confirmed malicious upgrade or a hostile role change is usually a single-condition, act-immediately affair, with no second condition worth waiting for. Composite rules let a firm encode both styles of judgment rather than forcing every decision into a single "if this, then that."

How Blockaid's Onchain Monitoring Keeps Trading Firms Ahead of Risk

None of these monitors is exotic. Each is a variation on one loop. The loop discovers what the firm is actually exposed to, observes something onchain, a value, an event, a contract's control surface, and evaluates it against a rule. When the rule trips, it either notifies the desk or triggers an action in a system the firm controls, and it can reach off-chain at either step, both to enrich what it sees and to act on it.

That loop is what Blockaid's Onchain Monitoring delivers, giving trading firms, asset managers, protocols, and financial institutions real-time visibility into the assets they hold and move, with the ability to detect anomalies and respond as activity happens:

• Full asset coverage - Firms monitor the smart contracts, wallets, tokens, vaults, and third-party dependencies that make up their onchain footprint from a single inventory.
• Real-time detection - Out-of-the-box and custom monitors flag anomalies, risks, and vulnerabilities as they emerge, before they become losses.
• Ecosystem-wide exploit detection - Blockaid's detection engines identify exploit preparation and execution across chains, surfacing threats whether or not a firm's own assets are the target.
• Automated response - When a monitor fires, response workflows can alert the desk, call out to the firm's own systems, and propose transactions automatically, cutting the time between detection and action.

Together these capabilities reduce time to detect, time to respond, and the value at risk in between.

Learn more about Blockaid's Onchain Monitoring →

Conclusion

When a bad event hits a protocol, it hits everyone exposed to it at once, and the financial outcomes fan out from there, decided by who was watching, what they were watching, and how fast they could act. The risks that reach a trading firm first, a health factor sliding toward liquidation, a stablecoin losing its peg, an exploit contract taking aim at a protocol three hops out, do not respect the line between financial and security. A firm's monitoring should not respect it either. With exposure mapped automatically, monitors reading state as the chain computes it, and responses wired into the firm's own systems, the desk that is watching is never the one finding out last.

Request a demo →

About Blockaid

Blockaid is the onchain security platform trusted by the largest companies operating in Web3. Built by veterans of elite intelligence and cybersecurity units, Blockaid provides end-to-end protection for financial institutions, protocols, and end users, combining direct wallet and dApp integrations with real-time monitoring, detection, and response across smart contracts, infrastructure, and externally owned accounts. Since 2025, Blockaid scanned over 6.3 billion transactions and blocked 585 million attacks. Blockaid is the security infrastructure behind Coinbase, MetaMask, Uniswap, Safe, and dozens of the most widely used platforms in the industry.

Learn more at Blockaid.io, and follow us on Twitter and LinkedIn.