DeFi TVL Anomaly Detector avatar

DeFi TVL Anomaly Detector

Pricing

Pay per usage

Go to Apify Store
DeFi TVL Anomaly Detector

DeFi TVL Anomaly Detector

Scans 7000+ DeFi protocols for extreme TVL changes. Detects hacks, rug pulls, suspicious spikes, and major capital inflows. Severity classified as critical/high/medium/info. Free DefiLlama API, no key needed. $0.005/run.

Pricing

Pay per usage

Rating

0.0

(0)

Developer

Hojun Lee

Hojun Lee

Maintained by Community

Actor stats

0

Bookmarked

2

Total users

1

Monthly active users

5 days ago

Last modified

Share

Scans 7,000+ DeFi protocols for extreme TVL changes in the last 24h. Detects hacks, rug pulls, suspicious inflows, and capital flight — before it shows up in the news.

What It Does

Pulls the full DefiLlama protocol list and flags protocols with abnormal 24h TVL movement. Anomalies are classified by type and severity so you can triage at a glance.

Anomaly Types

TypeSeverityDescription
rug_or_drainCriticalTVL collapsed to near-zero from significant prior value
severe_drainHigh−70%+ TVL change in 24h (likely hack, exploit, or mass exit)
major_drainMedium−40%+ TVL change (significant capital flight)
suspicious_spikeMedium+500%+ TVL spike (likely TVL manipulation or bootstrapped farming)
major_inflowInfo+100%+ TVL growth (new incentive program, major partnership)

Input

FieldTypeDefaultDescription
minTvlMillionnumber0.1Min protocol TVL in $M to include. Filters dust/micro-protocols.
minChangeAbsPctnumber40Min absolute 24h change % to report.
severityFilterstring""Filter to one severity: critical, high, medium, info
sortBystring"severity"Sort: severity, change_1d, or tvl
limitinteger100Max results (up to 500)

Output Schema

{
"name": "Euler Finance",
"slug": "euler",
"category": "Lending",
"chains": ["Ethereum"],
"tvl_usd": 85000,
"tvl_m": 0.085,
"change_1d_pct": -98.5,
"change_7d_pct": -97.2,
"anomaly_type": "severe_drain",
"severity": "high",
"defillama_url": "https://defillama.com/protocol/euler",
"fetched_at": "2026-07-08T14:00:00+00:00"
}

Key Value Store

A SUMMARY object is saved with:

  • total_anomalies: count of anomalies found
  • by_severity: counts per severity level
  • by_type: counts per anomaly type
  • critical_alerts: top 10 critical findings
  • high_alerts: top 10 high-severity findings

Pricing

$0.005 per run — flat rate. No API key required.

Use Cases

  • Security monitoring: schedule every hour to catch exploits early
  • Risk management: check exposure before entering large DeFi positions
  • Research signals: large inflows often precede token price movements
  • Portfolio protection: alert when protocols you use have anomalous TVL drops

Data Source

DefiLlama free API (api.llama.fi/protocols) — public, no auth required.

Notes

  • TVL data is delayed ~1 hour from real-time blockchain state
  • A "suspicious spike" is not necessarily malicious — it can be genuine growth from new farms
  • rug_or_drain detection uses 7d TVL to estimate prior value; may fire on newly listed protocols
  • For hacks specifically, cross-reference with Rekt.news or DeFiYield Shield