DeFi TVL Anomaly Detector
Pricing
Pay per usage
DeFi TVL Anomaly Detector
Scans 7000+ DeFi protocols for extreme TVL changes. Detects hacks, rug pulls, suspicious spikes, and major capital inflows. Severity classified as critical/high/medium/info. Free DefiLlama API, no key needed. $0.005/run.
Pricing
Pay per usage
Rating
0.0
(0)
Developer
Hojun Lee
Maintained by CommunityActor stats
0
Bookmarked
2
Total users
1
Monthly active users
5 days ago
Last modified
Categories
Share
Scans 7,000+ DeFi protocols for extreme TVL changes in the last 24h. Detects hacks, rug pulls, suspicious inflows, and capital flight — before it shows up in the news.
What It Does
Pulls the full DefiLlama protocol list and flags protocols with abnormal 24h TVL movement. Anomalies are classified by type and severity so you can triage at a glance.
Anomaly Types
| Type | Severity | Description |
|---|---|---|
rug_or_drain | Critical | TVL collapsed to near-zero from significant prior value |
severe_drain | High | −70%+ TVL change in 24h (likely hack, exploit, or mass exit) |
major_drain | Medium | −40%+ TVL change (significant capital flight) |
suspicious_spike | Medium | +500%+ TVL spike (likely TVL manipulation or bootstrapped farming) |
major_inflow | Info | +100%+ TVL growth (new incentive program, major partnership) |
Input
| Field | Type | Default | Description |
|---|---|---|---|
minTvlMillion | number | 0.1 | Min protocol TVL in $M to include. Filters dust/micro-protocols. |
minChangeAbsPct | number | 40 | Min absolute 24h change % to report. |
severityFilter | string | "" | Filter to one severity: critical, high, medium, info |
sortBy | string | "severity" | Sort: severity, change_1d, or tvl |
limit | integer | 100 | Max results (up to 500) |
Output Schema
{"name": "Euler Finance","slug": "euler","category": "Lending","chains": ["Ethereum"],"tvl_usd": 85000,"tvl_m": 0.085,"change_1d_pct": -98.5,"change_7d_pct": -97.2,"anomaly_type": "severe_drain","severity": "high","defillama_url": "https://defillama.com/protocol/euler","fetched_at": "2026-07-08T14:00:00+00:00"}
Key Value Store
A SUMMARY object is saved with:
total_anomalies: count of anomalies foundby_severity: counts per severity levelby_type: counts per anomaly typecritical_alerts: top 10 critical findingshigh_alerts: top 10 high-severity findings
Pricing
$0.005 per run — flat rate. No API key required.
Use Cases
- Security monitoring: schedule every hour to catch exploits early
- Risk management: check exposure before entering large DeFi positions
- Research signals: large inflows often precede token price movements
- Portfolio protection: alert when protocols you use have anomalous TVL drops
Data Source
DefiLlama free API (api.llama.fi/protocols) — public, no auth required.
Notes
- TVL data is delayed ~1 hour from real-time blockchain state
- A "suspicious spike" is not necessarily malicious — it can be genuine growth from new farms
rug_or_draindetection uses 7d TVL to estimate prior value; may fire on newly listed protocols- For hacks specifically, cross-reference with Rekt.news or DeFiYield Shield