DeFi TVL Anomaly Detector

DeFi TVL Anomaly Detector scans 7,000+ DeFi protocols for suspicious TVL movements — hacks, rug pulls, liquidity drains, and capital flight — before they appear in the news. Severity-classified into critical/high/medium/info tiers using DefiLlama's public API. Flat $0.005/run, no API key required.

On-chain hacks move faster than news coverage: the Euler Finance $197M exploit, the Harmony Horizon bridge drain, and dozens of others were visible in TVL data hours before mainstream reporting. This actor automates that surveillance across the entire DeFi ecosystem.

---

Why use DeFi TVL Anomaly Detector?

1. Exploit detection before news — A protocol losing 70%+ TVL in 24 hours is almost always a hack, exploit, or emergency governance action. Get the alert from on-chain data, not from Twitter.
2. Portfolio protection — If you have deposits in a protocol, a sudden TVL anomaly may mean your funds are at risk. Schedule hourly runs to get early warning before you're last out.
3. Risk management before entering positions — Before providing liquidity or depositing into a protocol, run a health check. Critical or high-severity anomalies on a protocol you're considering are a red flag.
4. Research signals from inflows — Large TVL spikes (+100%+) precede token price moves. New incentive programs and major partnerships drive inflows visible in TVL before price.
5. Security monitoring at scale — Manually monitoring 7,000 protocols is impossible. This actor surfaces the ones that need attention in a single run.

---

How to use

1. Open the actor on Apify Store and click Try for free.
2. Set minTvlMillion to filter out micro-protocols (default $0.1M TVL minimum).
3. Set minChangeAbsPct to control your anomaly threshold (default 40% change).
4. Use severityFilter to focus on critical/high anomalies only.
5. Click Start. Returns anomaly records sorted by severity, plus a SUMMARY object.

---

Input

Field	Type	Default	Description
minTvlMillion	number	0.1	Min protocol TVL in $M to include (filters dust/micro-protocols)
minChangeAbsPct	number	40	Minimum absolute 24h TVL change % to report
severityFilter	string	""	Filter to one severity: critical, high, medium, info (empty = all)
sortBy	string	"severity"	Sort: severity, change_1d, or tvl
limit	integer	100	Maximum results (up to 500)

---

Output

{
  "name": "Euler Finance",
  "slug": "euler",
  "category": "Lending",
  "chains": ["Ethereum"],
  "tvl_usd": 85000,
  "tvl_m": 0.085,
  "change_1d_pct": -98.5,
  "change_7d_pct": -97.2,
  "anomaly_type": "severe_drain",
  "severity": "high",
  "defillama_url": "https://defillama.com/protocol/euler",
  "fetched_at": "2026-08-29T14:00:00+00:00"
}

Anomaly types

Type	Severity	Description
rug_or_drain	Critical	TVL collapsed to near-zero from significant prior value
severe_drain	High	−70%+ TVL change in 24h (likely hack, exploit, or mass exit)
major_drain	Medium	−40%+ TVL change (significant capital flight)
suspicious_spike	Medium	+500%+ TVL spike (likely TVL manipulation or bootstrapped farming)
major_inflow	Info	+100%+ TVL growth (new incentive program or major partnership)

SUMMARY object

Saved to Key-Value Store with:

• total_anomalies — count of anomalies found
• by_severity — counts per severity level
• by_type — counts per anomaly type
• critical_alerts — top 10 critical findings
• high_alerts — top 10 high-severity findings

---

Cost estimation

Flat rate: $0.005 per run — all 7,000+ protocols scanned.

Use case	Runs	Estimated cost
Single security check	1	$0.005
Hourly monitoring (24h)	24	$0.12/day
Daily risk assessment	1/day	~$0.15/month
15-minute alert schedule	96/day	$0.48/day

---

FAQ

How quickly after a hack does the anomaly appear? DefiLlama TVL data is delayed ~1 hour from real-time blockchain state. Most major exploits show up as severe_drain or rug_or_drain within 1–2 hours of the attack completing.

Is a suspicious_spike always a red flag? No — it can be genuine growth from a new incentive program or a major ecosystem partnership. Cross-reference with the protocol's official channels. However, a sudden 500%+ spike with no announcement is worth investigating.

Does rug_or_drain always mean a rug pull? Not always — it can be triggered by a legitimate wind-down, protocol migration, or detection of a newly listed protocol with low historical TVL. Use the defillama_url to check the protocol's history for context.

Can I monitor a specific protocol? Not directly — the actor scans all protocols meeting your filters. Use severityFilter: "critical" and limit: 500 for maximum coverage, then filter by protocol name in your own code.

---

Related actors

• DeFi Protocol Fee Tracker — Fee revenue changes often precede or follow TVL anomalies
• LST Health Tracker — ETH liquid staking protocol health (peg stability, staking yield)
• DeFi Yield APY Scanner — Pool-level APY changes when protocols lose TVL

Feedback

If this actor is useful, a quick review helps other DeFi security researchers find it: Leave a review on Apify Store