Contents

Security incidents

Security view, newest first: detector events (Hyperliquid manipulation patterns, possible ADL, oracle / mark deviations, HLP vault drawdowns, market-wide liquidation surges, stablecoin depegs from Chainlink feeds read on-chain, outflows from bridge and lending contracts listed in the protocols’ own docs) and curated incidents (our own factual summary, amount with its primary source, status, post-mortem and transaction links).

GET/api/v1/security/incidentsEvery keyPaginated

Description

Pattern detectors are matches, not confirmed attacks. Paginated over the newest 500 items.

Who can call it

Available with every key and keyless (X-Blockmetric-Access: public). Keys of Free accounts get free-tier data (real-time feeds, 30 days of history, heatmap over time for every coin over the last 24 hours, liquidation levels now for every coin, the same as the free web plan); Pro and Desk keys the data of their plan; API Dev / API Pro raise the limits.

No key: 24 h
Free: 30 days
Pro: 365 days
Desk: 1095 days
API Dev: 365 days
API Pro: 1095 days

History window per plan. Limits: Authentication & limits.

Parameters

Parameters of /security/incidents
Parameter	Description
`origin`string	all (default) \| detector \| curated.one of all, detector, curated · default all
`type`string	Incident type (exploit, hack, rug_pull, oracle_manipulation, market_manipulation, bridge, key_compromise, governance_attack, phishing, depeg, other) or detector type (tvl_drop, outflow, adl, oracle_deviation, vault_drawdown, liquidation_surge) (optional).one of adl, bridge, depeg, exploit, governance_attack, hack, key_compromise, liquidation_surge, market_manipulation, oracle_deviation, oracle_manipulation, other, outflow, phishing, rug_pull, tvl_drop, vault_drawdown
`chain`string	ethereum \| arbitrum \| base \| optimism \| polygon \| bnb \| avalanche \| solana \| bitcoin \| tron \| hyperliquid \| sui \| aptos \| ronin \| harmony \| fantom \| starknet \| blast \| linea \| zksync \| mantle \| sonic \| ton \| xrp \| other (optional).one of ethereum, arbitrum, base, optimism, polygon, bnb, avalanche, solana, bitcoin, tron, hyperliquid, sui, aptos, ronin, harmony, fantom, starknet, blast, linea, zksync, mantle, sonic, ton, xrp, other
`minSeverity`integer	1 info, 2 notable, 3 major, 4 critical; default 1.1–4 · default 1
`limit`integer	Number of items, default 50, clamped to 1–500.1–500 · default 50
`cursor`string	Next page: the value of meta.nextCursor from the previous response (keep the other parameters unchanged). Cursors are signed: an edited cursor answers 400; paging stops at the plan history.
`fields`string	Comma-separated fields of every item to return, e.g. id,date,title,amountUsd (case-insensitive). All other fields are left out, so large lists get much smaller; an unknown name answers 400 with the list of fields. Default: every field.
`format`string	json (default: the { data, meta } envelope) \| csv (the rows with a header line; nested values as JSON text) \| ndjson (one JSON object per row and line). csv and ndjson carry the meta block in headers: Link rel="next" and X-Blockmetric-Next-Cursor (next page), X-Blockmetric-Next-After (forward polling), X-Blockmetric-Updated-At, X-Blockmetric-Warnings, X-Blockmetric-License. Errors stay JSON.one of json, csv, ndjson · default json

Response fields

Every success is { data, meta }; these are the fields of data. meta is the same on every endpoint.

Response fields of /security/incidents
Field	Description
`[].id`string	"evt_<radar event id>" (detector) or "inc_<incident id>" (curated).
`[].origin`"detector" \| "curated"	detector = found by our detectors in market data; curated = an incident written up by us with primary sources.
`[].ts`string (ISO 8601)	Event time (detector) or publication time (curated).
`[].date`string	UTC day of the incident (YYYY-MM-DD).
`[].kind`string	Radar event kind ("incident" for curated items).
`[].type`string	Incident type (exploit, oracle_manipulation, …) or detector type (depeg, outflow, adl, …).
`[].severity`"1" \| "2" \| "3" \| "4"	1 info, 2 notable, 3 major, 4 critical.
`[].title`string	One-line factual title in our own words.
`[].summary`string · nullable	Our own factual text.
`[].chains[]`array of string	Chains involved.
`[].coin`string · nullable	Coin name as on Hyperliquid (BTC, kPEPE, HIP-3 names like xyz:TSLA).
`[].amountUsd`number · nullable	Reported loss / flow (USD).
`[].status`string · nullable	Curated: unknown \| ongoing \| funds_frozen \| partially_recovered \| recovered \| not_recovered \| resolved.
`[].url`string	Evidence page on the website.
`[].links[]`array of objects	Curated: primary-source links (post-mortem, announcement, tx, address, governance) and coverage links.
`[].links[].kind`string	Kind of the item (enum of this field).
`[].links[].url`string	Link (absolute URL).
`[].links[].label`string	Display label: a public label with a cited source, else the self-chosen leaderboard name (unverified).
`[].data`any	Detector: the evidence numbers of the event (JSON). Curated: recoveredUsd, amountSource, txs.

Errors

400invalid_param Invalid parameter
401unauthorized Missing or invalid API key
403plan_required Plan does not include this
403scope_required Key not scoped for this API
403ip_not_allowed Address not on the IP allowlist of the key
403origin_not_allowed Key used from a browser origin it does not allow
403source_restricted Exchange data not redistributed
403https_required https required
429rate_limited Per-minute limit reachedretry
429daily_limit_exceeded Daily limit reachedretry
429stream_limit Too many open streamsretry
500internal_error Internal errorretry

Request

curl -s -H "X-Blockmetric-Access: public" \
  "https://api.blockmetric.io/v1/security/incidents?limit=20"

Example response

HTTP 200Real data from 2026-10-27 06:37 UTC

{
  "data": [
    {
      "id": "evt_5146",
      "origin": "detector",
      "ts": "2026-10-27T06:37:54.627Z",
      "date": "2026-10-27",
      "kind": "oracle_deviation",
      "type": "oracle_deviation",
      "severity": 1,
      "title": "xyz:UNITREE mark price −2.5% from its oracle on Hyperliquid",
      "summary": "Mark $94.732 vs oracle $97.203 on 2 consecutive checks · open interest $28M. A wide mark/oracle gap moves liquidation prices and funding.",
      "chains": [
        "hyperliquid"
      ],
      "coin": "xyz:UNITREE",
      "amountUsd": null,
      "status": null,
      "url": "https://blockmetric.io/radar/5146",
      "links": [],
      "data": {
        "venue": "hyperliquid",
        "check": "mark_vs_oracle",
        "mark": 94.732,
        "oracle": 97.203,
        "deviation": -0.0254210261,
        "change": -0.0254210261,
        "openInterestUsd": 27977203.45
      }
    },
    {
      "id": "evt_5127",
      "origin": "detector",
      "ts": "2026-10-27T05:48:11.489Z",
      "date": "2026-10-27",
      "kind": "protocol_outflow",
      "type": "outflow",
      "severity": 1,
      "title": "Net outflow of $24.1M (−14%) from Aave v3 (Ethereum) aEthUSDC in 80 min",
      "summary": "USDC −$24.1M at 0x98c23e9d8f34fefb1b7bd6a91b7ff122f4e16f5c (ethereum), $177M before. Large withdrawals, rebalancing or a migration look the same as an exploit; not verified. The aToken holds the available (not borrowed) liquidity; borrows lower it as much as withdrawals do.",
      "chains": [
        "ethereum"
      ],
      "coin": null,
      "amountUsd": 24095140.25,
      "status": null,
      "url": "https://blockmetric.io/radar/5127",
      "links": [],
      "data": {
        "name": "Aave v3 (Ethereum) aEthUSDC",
        "protocol": "Aave v3 (Ethereum)",
        "contractId": "aave-v3-ausdc",
        "contract": "0x98c23e9d8f34fefb1b7bd6a91b7ff122f4e16f5c",
        "chain": "ethereum",
        "usd": 24095140.25,
        "change": -0.1361881816,
        "prevUsd": 176925339.41,
        "byAsset": {
          "USDC": {
            "before": 176990826.019,
            "after": 152886767.271,
            "usd": -24095140.25
          }
        },
        "windowMinutes": 80,
        "sinceTs": "2026-10-27T04:28:05.859Z",
        "fromBlock": 26281648,
        "toBlock": 26282048,
        "sourceUrl": "https://github.com/bgd-labs/aave-address-book/blob/main/src/AaveV3Ethereum.sol",
        "transfers": [
          {
            "hash": "0xea72f1cdf7eef0ef8a74201a46fd24f0bb9414e766dce1f46f0f65afc3f47268",
            "to": "0xaf9ff2179b3fb87e5d7d07302727dc3bbd5e3bd5",
            "asset": "USDC",
            "amount": 24745927.9355,
            "usd": 24736771.94,
            "block": 26281883
          },
          {
            "hash": "0x4d321dd1ded9ea22001ce1467efc674db7413019a2be1d2eaf1cd3ac5bdceec6",
            "to": "0xd2011d314acaa68e5401e7f5aec3be6d2c574dcf",
            "asset": "USDC",
            "amount": 881504.745416,
            "usd": 881178.59,
            "block": 26281934
          }
        ]
      }
    }
  ],
  "meta": {
    "updatedAt": "2026-10-27T06:37:54.627Z",
    "source": "hyperliquid,binance,bybit,publicnode,chainlink_onchain,protocol_registry",
    "sources": [
      "hyperliquid",
      "binance"
    ],
    "plan": "api_dev",
    "delayMinutes": 0,
    "commercial": false,
    "license": {
      "id": "internal",
      "display": false,
      "attributionRequired": false,
      "attribution": null,
      "redistribution": false,
      "mauCap": null,
      "terms": "https://blockmetric.io/terms#api-license"
    },
    "attribution": {
      "text": "Data by Blockmetric · Source: Blockmetric Research · Binance · Bybit",
      "url": "https://blockmetric.io/"
    },
    "access": {
      "historyDays": 365,
      "historyFrom": "2025-10-27T13:14:00.000Z"
    },
    "nextCursor": "<cursor>",
    "nextUrl": "https://api.blockmetric.io/v1/security/incidents?cursor=<cursor>",
    "restricted": [
      "binance",
      "bybit"
    ]
  }
}

Lists shortened to their first items (4 more in the real response).

More options: open in the explorer · SDK method securityIncidents() / security_incidents()

Code snippets in these docs are licensed under MIT-0: copy them into your own code without attribution. The SDKs, CLI and MCP server will be, once published, Apache-2.0; the name Blockmetric is not licensed (forks must be renamed). Data from the API is governed by the API terms; third-party exchange data by the exchange’s terms.