Watch the chain
before it drains your treasury
Custos Nox is an open-source real-time attack monitor for Solana multisigs and DAOs. It detects every on-chain step of the $285M Drift drain on April 1, 2026 — plus an adjacent signer-rotation vector — before the stolen funds leave the chain.
- 5
- Detectors live
- 215
- Tests passing
- $285M
- Drift loss tracked
- < 1s
- Alert latency
What it catches
Every detector maps directly to a step in the Drift April 2026 attack chain. Any single one firing would have bought hours of response time.
Timelock Removal
Squads v4 + SPL Governance
Fires when a governance timelock is removed or dropped below half. Matches the Drift step where the attacker collapsed the response window before draining funds.
if undetected · DAO loses its window to pause withdrawals or cancel the attack.
Multisig Weakening
Squads v4
Fires when a Squads multisig signer threshold is reduced. Catches the moment a treasury becomes single-signer controlled — the irreversible pivot in most exploits.
if undetected · Attacker needs only themselves to approve any treasury transaction.
Privileged Nonce
System Program
Fires on initialization or authority rotation of a watched durable-nonce account. Flags the precondition for pre-signed, replay-at-will withdrawal transactions.
if undetected · A pre-signed drain transaction is now armed and can execute at any time.
Stale Nonce Execution
System Program
Fires when a durable nonce is advanced (a pre-signed transaction executes) more than 1 hour after the nonce was first initialized. Catches the final step in the Drift attack chain — the moment the attacker's pre-signed drain transaction lands.
if undetected · This is the drain. Funds are already moving to the attacker's wallet.
Signer Set Change
Squads v4
Fires when a Squads multisig's members vector is mutated. Removal of a legitimate signer or rotation fires high; pure additions fire medium. Catches the takeover vector where an attacker swaps honest co-signers for their own keys.
if undetected · Quorum is compromised even if the threshold looks unchanged on paper.
Live mainnet — 12 Solana DAOs under continuous watch
Custos Nox is running on mainnet right now, subscribed to the governance accounts of 12 ecosystem DAOs (Mango, Marinade, Pyth, Solend, Jupiter, Raydium, Orca, Bonk, Helius, Squads, Superteam, MonkeDAO). The feed below polls the daemon every 5 seconds. When configs are calm the dots stay green; if any of the five detectors fires, the alert lands here within a second.
5 live events
- CRITICAL1m agosquads-timelock-removalTimelock removed on multisig AjULUVaCpzdGvCXgUkHLitkBR6nmn1M7AsHJ8sGgMZNy
- reason
- timelock_reduced
- previousTimelockSeconds
- 86400
- currentTimelockSeconds
- 0
- account
- AjUL…MZNy
- HIGH3m agosquads-multisig-weakeningThreshold weakened 3 → 1 on multisig AjULUVaCpzdGvCXgUkHLitkBR6nmn1M7AsHJ8sGgMZNy
- reason
- threshold_reduced
- previousThreshold
- 3
- currentThreshold
- 1
- account
- AjUL…MZNy
- HIGH4m agosquads-signer-set-changeMultisig AjULUVaCpzdGvCXgUkHLitkBR6nmn1M7AsHJ8sGgMZNy: 1 signer(s) removed, 1 added
- reason
- signer_set_changed
- account
- AjUL…MZNy
- removed
- 8wNT…KuaB
- added
- Gpoj…x5Yh
- previousCount
- 5
- currentCount
- 5
- CRITICAL5m agoprivileged-nonceNonce account 9rK8Ke7ZazGS7Knaj1i6oh9HBa2ocJCNhF9eDQegnfAS initialized with authority E9Q5UGyezdKVCZ8GDiAFRQfDarRb3REpTrYN3ytgEMzs
- reason
- nonce_initialized
- account
- 9rK8…nfAS
- authority
- E9Q5…EMzs
- HIGH8m agostale-nonce-executionStale nonce 9rK8Ke7ZazGS7Knaj1i6oh9HBa2ocJCNhF9eDQegnfAS advanced 73 min after creation (authority: E9Q5UGyezdKVCZ8GDiAFRQfDarRb3REpTrYN3ytgEMzs)
- reason
- stale_nonce_advanced
- account
- 9rK8…nfAS
- authority
- E9Q5…EMzs
- staleMs
- 4380000
- staleMins
- 73
- thresholdMs
- 3600000
- firstSeenAt
- 2026…000Z
Who should run this
If you control a Squads multisig or an SPL Governance realm, Custos Nox watches it for you. Setup takes five minutes.
Your multisig PDA is one environment variable. Add a Discord, Slack, or Telegram webhook. Any threshold change, timelock removal, or signer rotation fires an alert to your team within a second.
Grant multisigs often have fewer signers and less oversight than protocol treasuries. Custos Nox gives them the same real-time coverage as a full-time security team — for free.
Point Custos Nox at any set of Squads or SPL Governance accounts and get real-time feed of config changes. Useful for monitoring suspicious multisigs or building public watchdog dashboards.
How it works
A WebSocket daemon, five independent detectors, parallel alert fan-out — sub-second latency from on-chain change to alert in your team's channel
TypeScript · Solana web3.js · 228 tests · MIT · zero Rust
How the Drift attack unfolded
The April 2026 Drift exploit was not a zero-day — it was a 9-day on-chain preparation. Every step was observable. None were flagged.
First alert fires 9 days before the drain.
Any single one of these detectors firing would have given treasury managers days to respond — pause withdrawals, rotate signers, or escalate to the community.
Mar 23, 2026
Nonce initialized
PrivilegedNonceDetector
Attacker creates a durable nonce under a privileged key. A pre-signed drain tx is now valid and waiting.
Mar 26, 2026
Timelock removed
TimelockRemovalDetector
Governance timelock dropped from 6 days to 0, closing the community's response window.
Mar 26, 2026
Multisig migrated
MultisigWeakeningDetector
Security Council multisig migrated to a new 2-of-5 threshold with zero timelock — minimum quorum, instant execution.
Apr 1, 2026
$285M drained
StaleNonceExecutionDetector
Week-old pre-signed admin transfer executes. Funds move to attacker wallet within 12 minutes.
Self-host in 5 minutes
One binary, zero vendor lock-in. Runs on any Node.js 20+ or Docker. Free-tier Helius RPC is enough to get started.
Sign up at helius.dev — free tier, no credit card. Copy your endpoint URL into CUSTOS_RPC_URL.
Set CUSTOS_WATCH to your Squads PDA or SPL Governance realm. Comma-separate multiple accounts. Optionally add a Discord, Slack, or Telegram webhook.
Run npm run dev or the Docker one-liner below. Alerts arrive in Discord, Slack, Telegram, or stdout within a second of any config change.
git clone https://github.com/cryptoyasenka/custos-nox
cd custos-nox
npm install
cp .env.example .env # set CUSTOS_RPC_URL and CUSTOS_WATCH
npm run dev # daemon connects, seeds baseline, starts watchingdocker build -t custos .
docker run -d --name custos --restart unless-stopped --env-file .env custos
docker logs -f custos