← All posts

Cold-wallet anti-theft: know the instant funds leave your wallet

June 18, 2026 · The SCMon team · 1 min read

A cold wallet should rarely move. So when it does move unexpectedly, you want to know immediately — not hours later when you next check an explorer. An outgoing-transfer alert is one of the cheapest, highest-value security tripwires you can set.

The tripwire

Put a watch on the wallet with a single rule: direction out. From then on, any outbound transfer of the watched token triggers an instant alert.

{
  "chain": "tron",
  "token": "USDT-TRC20-contract",
  "address": "TYourColdWallet…",
  "rule": { "direction": "out" },
  "channel_type": "telegram",
  "channel_target": "123456789"
}

Because SCMon is watch-only, setting this up gives an attacker nothing: there are no keys on our servers, and a watch can’t move funds — it can only observe.

Make it loud, and make it smart

• Escalate. Route the alert to a channel people actually watch — a Telegram group, or a webhook that pages on-call.
• Whitelist known destinations. If your wallet only ever sends to a few addresses (a custodian, an exchange, a hot wallet), use counterpartyNotIn to stay quiet on those and only scream on an unknown destination. The opposite, counterpartyIn, alerts only when funds go somewhere specific.
• Layer thresholds. Add a minAmount if tiny outflows are expected and you only care about material ones.

Why seconds matter

Alerts fire on confirmed transfers within seconds of inclusion. That window is often enough to trigger an incident response — freeze related systems, rotate access, contact a custodian — before more funds move.

This is the same approach behind our treasury anti-theft use case. Pair it with the practices on our security page, and start with the Quickstart.