HACKING PROJECT · crypto · Advanced
On-Chain Threat Intelligence & Monitoring Dashboard
Detect, attribute, and alert on malicious on-chain activity in near real time through continuous transaction monitoring and threat-intel enrichment.
Blockchain attacks — rug pulls, flash-loan exploits, wallet drainers, and laundering through mixers — unfold on-chain in real time, but most teams learn about them only after funds are gone. Raw chain data is public yet overwhelming, and there is a gap between the flood of transactions and actionable, attributed threat intelligence. Security teams, exchanges, and protocols need continuous monitoring that detects malicious activity and links addresses to known threat actors as events happen.
**What you'll build**
Build a real-time on-chain monitoring and threat-intelligence dashboard that ingests mempool and confirmed transactions, applies detection rules and anomaly models for known attack patterns (flash-loan exploits, approval-drainer signatures, mixer interactions), and enriches addresses with labels from threat-intel feeds and sanctions lists. Provide alerting, address-clustering/attribution, and an analyst dashboard with graph visualization of fund flows. Structure detections as a rule engine plus ML anomaly layer, supporting proactive incident response.
**Objective** — Detect, attribute, and alert on malicious on-chain activity in near real time through continuous transaction monitoring and threat-intel enrichment.
**Expected outcome** — A live dashboard that ingests chain data, raises alerts on malicious patterns, clusters/labels addresses, and visualizes fund-flow graphs for analysts.
**Difficulty** — Advanced — requires blockchain data engineering, real-time detection pipelines, anomaly modeling, and threat-intel enrichment.
**Primary category** — Threat Intelligence / Threat Hunting; Secondary = SOC Monitoring, DFIR, Blockchain Analytics
**Security domains** — Primary = Threat Intelligence; Secondary = Blue Team, Incident Response, Digital Forensics, SOC
**Technical focus** — On-chain data ingestion, mempool monitoring, transaction-graph analysis, address clustering/attribution, anomaly detection, detection engineering, sanctions/AML screening, real-time alerting, SIEM-style dashboards
**Core technologies** — Languages: Python, TypeScript, SQL; Frameworks/Libraries: web3.py/ethers.js, Etherscan/Alchemy/QuickNode APIs, Kafka, NetworkX; Security Tools: threat-intel feeds, Chainalysis/TRM-style label sets (or open OFAC/Etherscan labels), YARA-like rule concepts; Cloud/Infra: Kafka/Redis, Docker, Kubernetes, Grafana/Elastic; AI/Data: scikit-learn/PyTorch anomaly detection, graph ML; Databases: PostgreSQL, ClickHouse/TimescaleDB, Neo4j
**Where it's valued** — Crypto exchanges, DeFi protocols, blockchain analytics firms, financial crime/AML, regulators, incident-response providers
**Careers it builds toward** — Blockchain Threat Intelligence Analyst, SOC Analyst, Threat Hunter, Blockchain Forensics Investigator, Detection Engineer
**Framework alignment**
• MITRE ATT&CK: Detects post-compromise monetization analogs; enterprise mappings include Financial Theft (T1657) and Exfiltration behaviors. Primary taxonomy is on-chain attack patterns + FinCEN/AML typologies.
• NIST CSF 2.0: Detect (continuous monitoring, anomaly detection), Respond (alerting), Identify (threat landscape)
• OWASP: OWASP Smart Contract Top 10 (attack awareness); API Top 10 for data-source security
• CIS Controls v8: 8 Audit Log Management, 13 Network Monitoring & Defense, 17 Incident Response Management
**Innovation** — Startup Potential — real-time on-chain threat intel is a fast-growing market (Chainalysis, TRM, Forta); a working detection+attribution dashboard is highly compelling. Scores: Innovation 8/10, Startup 9/10, Enterprise-Readiness 7/10, Patent = Possible.