Transaction Monitoring

Watchlists that tell you when something changed.

Add an address, define what counts as an event, and choose what a match should trigger — an alert, an investigation task, or a webhook into your own systems.

Start a case assessment View webhook docs

Configurable thresholdsWatchlistsWebhooks

Live activityExample rules

Simulated event stream. No live blockchain provider is connected to this page.

What is crypto transaction monitoring?

Crypto transaction monitoring continuously watches addresses and transactions for changes in risk exposure, raising alerts when new activity connects a monitored wallet to a sanctioned, illicit or high-risk counterparty. It reports what changed and why, so a compliance team can evidence the decision it took.

Monitoring reports changewatchlist sweepMONITORING

No changeChange detected

A monitored blockchain transaction crossing a threshold and triggering a verified response path.

Rules

When, and then.

A monitoring rule is a condition and a consequence. Both halves are yours to set.

Whena monitored address sends or receives above your threshold

Whena risk score moves by more than a configured margin

Whena new counterparty appears within two hops of a watched address

Whena watched address interacts with an attributed high-risk service

Whena screening list designation matches an address in the exposure path

Thenraise an alert, open an investigation task, notify a team, or post to your webhook

Rules are versioned

Changing a rule does not rewrite history. Alerts record the rule version that fired them, so an audit can reconstruct why a given event was raised in the first place — including rules that have since been edited or disabled.

Noise is a failure mode

A monitoring system that raises 400 alerts a day is not more thorough, it is unusable. Thresholds, hop limits and suppression windows exist so a team can tune signal against the volume it can genuinely review.

Capabilities

What monitoring covers.

Wallet monitoring

Watch individual addresses or an imported list, per network, with per-address notes.

Transaction monitoring

Evaluate transfers as they are observed against your active rule set.

Risk alerts

Alerts carry the triggering rule, the observed values and a link straight into the graph.

Configurable thresholds

Value, percentage change, hop distance, counterparty category and time window.

Investigation triggers

A match can open a case task automatically instead of waiting for someone to notice.

Event notifications

In-app, email and signed webhooks, with delivery attempts and failures recorded.

Alert lifecycle

From observation to disposition.

Observed

A transfer or score change is read from the provider and normalised.

Evaluated

Active rules are applied. The rule version and observed values are recorded.

Raised

An alert is created with severity, evidence links and the graph context.

Triaged

A reviewer confirms, escalates or dismisses it, with a reason recorded.

Actioned

Escalation opens a case task or fires a webhook to your systems.

Closed

Disposition and reviewer are retained for audit.

Integration

A webhook, not a portal you have to sit in.

POST — your endpoint

// Signed with HMAC-SHA256 over the raw body; verify before trusting.
{
  "event": "alert.raised",
  "id": "alr_8fd2c41b",
  "rule": { "id": "WL-014", "version": 7 },
  "address": "0x4f2c…9ac2",
  "network": "ethereum",
  "observed": { "value_usd": 184200, "hops": 2 },
  "risk": { "score": 78, "previous": 71 },
  "occurred_at": "2026-02-14T09:42:31Z"
}

Delivery guarantees

Webhooks are retried with exponential backoff and carry an idempotency key. Your endpoint should treat a repeated key as the same event rather than a second one.

Watch the addresses that matter.

Monitoring is available to customers with an active engagement, and to organisations under a platform agreement.

Start a case assessment Talk to a specialist