Six new alerts: see the attack being prepared, not just the drain

We went through 16 major hacks from May to October 2026. In almost every one, the first drain was a single transaction. An alert on it arrives after the funds are gone: it shortens the losses that follow, but it does not save the first hit.

Many of these hacks, though, had a preparation stage, and it was visible on-chain in advance: minutes, hours, sometimes days before. The new SmartAlert rules watch for exactly that. Below, for each rule: a real attack, and what would have changed with the rule in place.

1. Wallet handed control to a contract (EIP-7702)

With EIP-7702 a regular wallet hands control to a contract with one signature. That transaction emits no events, so event monitoring does not see it. SmartAlert reads every block in full and reports a delegation on your wallet about 6 seconds after the block, without waiting for confirmations. Business plan and above; recipe: wallet-delegation.

The real attack: Binance, October 29, 2026. At 20:20:59 UTC the attacker sent a transaction with 50 EIP-7702 authorizations, and the Binance 14 hot wallet started running the attacker's contract code. At 20:24:23, $2.5B left in one transaction. The delegation was removed only at 00:10:35, 3 hours 50 minutes later. Full story in the breakdown.

2. Suspicious token minting

After stealing a key, an attacker often mints tokens to themselves first and sells them afterwards. The rule fires when minting in an hour is above normal, when it is above a dollar threshold, or when the token's total supply grows by a set percentage. The dollar threshold and the baseline work on any plan; supply growth needs Pro or above. Recipe: token-mint.

The real attack: Humanity Protocol, June 2026. The multisig keys sat on one laptop. In the week of June 1–7, about 27M H were minted against a usual ~5M. On June 8–9 the attacker minted another 100–200M H and sold them within about 10 hours. Losses: $27–36M¹.

3. Dangerous config changes: bridges, Safe, signers

Many attacks start with a config change rather than a withdrawal: a new delegate on a LayerZero bridge, a new module on a Safe, a swapped signer. New templates report these changes:

• LayerZero: delegate, peer or config changed;
• Safe: a module enabled or disabled, the guard or fallback handler changed;
• bridges and oracles: the signer or validator set changed.

Safe templates work on any plan; LayerZero, bridges and oracles need Pro or above. Recipes: safe-modules, layerzero, bridge-signers-changed, oracle-signers-changed.

The real attack: The Sandbox, August 2026. Using approveAndCall, the attacker hijacked the LayerZero bridge delegate of the SAND token on Base and BNB Chain. They then ran 703 mints, 329 trillion SAND in total, and sold as much as liquidity allowed: about $675K².

4. Dangerous DAO proposals

A DAO takeover is almost never instant: the proposal has to sit through a vote first. SmartAlert reports a new proposal that changes the execution delay, grants roles, mints tokens or upgrades a contract, and the alert says what the proposal will do. Pro plan and above; recipe: governance-proposal-created.

The real attack: Term Finance, August 2026. The attacker bought votes and submitted a proposal. It sat in voting for 6 days. Its first action set the timelock execution delay to zero; the next drained funds. Losses: $8.5M³.

5. Fast outflow from a hot wallet

This rule adds up a wallet's withdrawals in dollars, across all tokens, over a few minutes. When the sum crosses a threshold, the alert arrives about 6 seconds after the block, without waiting for confirmations. If the block is later reverted, a "cancelled" message follows. Business plan and above; recipe: wallet-outflow.

The real attack: Binance again. After the first drain at 20:24:23, the wallet stayed open for 3 hours 46 minutes. Another 823M USDC, 204M USDT and 5,157 ETH left through it.

6. Wallet approval to a new address

To pull tokens from a wallet, a thief does not need the key: an approval to their address is enough. The rule fires when a watched wallet approves an address it has not dealt with in the last 90 days, or grants an unlimited approval. Unlimited to a new address is Critical, everything else is Warning. It covers regular ERC-20 approvals, approvals for all NFTs, and on-chain Permit2; an off-chain Permit2 signature becomes visible only when it is used. The alert arrives after network confirmations, with a link to revoke the approval on revoke.cash. Pro plan and above; the "new address only" filter needs Business. Recipe: wallet-approvals.

The real attack: jaredfromsubway.eth, June 2026. The attacker deployed 66 fake wrapper tokens with pools. The sandwich bot started trading against them and approved them to spend real WETH, USDC and USDT, but never revoked the unspent allowances. The first such approval was on June 19 at 21:49 UTC; by 23:25 the bot had approved more than 45 new contracts, each for 92 WETH, $143K USDC and $149K USDT. On June 20 at 18:49 UTC a single transaction triggered all the traps and pulled 2.87M USDC, 2.03M USDT and 1,474 WETH from the bot, about $7.5M in total⁴⁵.

Where we will not help

• A single-transaction attack with no preparation. AFX Bridge ($24M, July) and Ostium ($18–24M, July) lost everything in one transaction⁶⁷. Here the alert only records the loss.
• Networks we do not read. Today these rules cover Ethereum, BNB Chain, Base and Arbitrum.
• An alert does not stop a drain by itself. Decide in advance who gets the alert and what they do: sign the delegation removal, pause the contract, revoke permissions.

Alerts go to every channel on the rule: Telegram, email, webhook, PagerDuty.