How to track a wallet and get an alert when it moves

The short way

This page is about somebody else's addresses — an exchange hot wallet, a fund, a large holder, a counterparty you settle with. If the address is your own and the question is a balance, that is a different job: tracking one portfolio across exchanges and a wallet.

For a few hundred addresses and a phone notification, use Cielo. Paste the addresses, connect its Telegram or Discord bot, and set a minimum USD value per wallet so that approvals and dust stop reaching you. The free plan follows 250 EVM and 50 Solana wallets and sends up to 120 alerts an hour, and nothing on the tracking side needs the trading wallet it offers you on first sign-in.

If you want the alert to reach your own system rather than a chat, Nansen posts Smart Alerts to an HTTPS endpoint of yours and signs each payload. And if you would rather depend on nobody's alert engine, poll the explorer's own index by address. On an EVM chain that is three requests to the Etherscan API, because ordinary transactions, internal transactions and ERC-20 transfers are three different endpoints:

GET https://api.etherscan.io/v2/api?chainid=1&module=account&action=txlist&address=<address>&startblock=<last_seen_block>&endblock=999999999&page=1&offset=100&sort=asc&apikey=YOUR_API_KEY
GET https://api.etherscan.io/v2/api?chainid=1&module=account&action=txlistinternal&address=<address>&startblock=<last_seen_block>&endblock=999999999&page=1&offset=100&sort=asc&apikey=YOUR_API_KEY
GET https://api.etherscan.io/v2/api?chainid=1&module=account&action=tokentx&address=<address>&startblock=<last_seen_block>&endblock=999999999&page=1&offset=100&sort=asc&apikey=YOUR_API_KEY

Keep the highest block number you have seen, pass it as startblock next time, and alert on anything new. Change chainid for another EVM chain; the key is the same.

What the options are

A tracker for a list you chose. Cielo is bought by someone who already knows which addresses to watch. Each transaction lands in a feed and in the bot, tagged with the protocol, the size, the direction and the wallet's PnL. Per wallet you can set a minimum USD value, the transaction types (swaps, transfers, NFT trades, perps, approvals) and the chains. The docs' overview listed 22 chains on 27 October 2026 while the homepage says 30-plus, and coverage is uneven: token-swap alerts run on Ethereum, Base and Solana only. The vendor gives no latency figure beyond "real-time". The names are the ones you type into its address book, plus a Popular Wallets tag on any address more than 30 free users follow, so Cielo does not tell you who owns anything. Pro, at 59 USD a month, raises the list to 1,000 EVM and 200 Solana wallets and adds Hyperliquid alerts.

A labelled platform that alerts. Nansen's Smart Alerts come in three types: token transfers (buy, sell, swap, send, receive), net flows for a target over a window, and calls to a named contract. A target can be an address, an entity, one of Nansen's labels, a label of your own or a watchlist. Delivery is Telegram, Slack, Discord or a webhook, with an X-Nansen-Signature header when you set a secret, and no email. A realtime window fires on each matching event. Nansen puts its data at "seconds to a couple of minutes" behind the chain, with some current-day responses cached for up to five minutes. The free plan allows one active alert, and Pro, at 69 USD a month or 49 billed annually, makes them unlimited. The names come from Nansen's own label set, and the labels endpoint accepts 20 chains.

Arkham is the other one. Its card records alerts on an entity's movements, delivered to Telegram, Slack and webhooks. Alerts need a free sign-in, and the application carries an alert tier and an upgrade request that Arkham prices nowhere in public. The names come from its attribution engine and are graded: verified at 98% confidence or better, predicted at 80% or better. This catalogue has not read Arkham's alert screens, so which conditions an alert takes, how many a free account gets and how fast one fires are not stated here. Nansen vs Arkham sets the two platforms side by side.

A feed of large transfers, not your list. Whale Alert answers a different question: what large transfer just happened on a chain I follow. Its dashboard filters take a chain, a coin, a transaction type and a minimum value, never an address, from 14.95 USD a month. Its Custom Alerts WebSocket, 29.95 USD a month and personal use only, has the same filters with a 100,000-dollar floor and a cap of 100 alerts an hour. An address filter exists only on the Enterprise API's transactions endpoint, at 699 USD a month. Each alert names the owner of each end where Whale Alert has one, and says "unknown wallet" where it does not.

Your own poller on Solana. The Solscan Pro API returns an owner address's transfers in one call, with swaps and other program activity decoded into typed actions by its other endpoints:

curl -s "https://pro-api.solscan.io/v2.0/account/transfer?address=<owner_address>&page_size=100&sort_order=desc" \
  -H "token: YOUR_API_KEY"

There is no free plan. Lite, at 49 USD a month, is 200,000 calls and is licensed for personal and research use; commercial use starts at Level 2, 199 USD.

Before you choose what to watch. Bubblemaps is not an alert tool: it has no alerts and no webhooks, and its maps are recomputed within six hours. What it does well is show which of a token's top holders have sent funds to each other. That is a way to find the other addresses worth adding to a list before you put the list into one of the tools above. A line on its map is a transfer and nothing more, as the wallet-tracking shelf explains along with every other card that follows addresses.

Whatever arrives, the alert is a record that a transfer happened. What anyone should do about it is outside this page and outside this catalogue.

Where this breaks

The name on the alert is an attribution, not a fact. The chain records two addresses and an amount. "Binance", "a fund" or a person's name is something a vendor added, from clustering, behaviour and off-chain evidence, and each vendor here says so in its own way. Arkham grades its labels and shows the grade as a badge, which is lost the moment someone screenshots the alert. Nansen's labels have a name, a category and a kind, with no date and no history, and its coverage page lists "attribution or label-history updates" among the reasons a past result can change. Whale Alert's changelog announces live updates of owners after the fact, and it publishes no method. An "exchange" label is a heuristic that was right often enough to ship. Where an on-chain number comes from covers this attribution layer at length, in its third stage.

Most large exchange transfers are the exchange talking to itself. A customer deposit goes to a per-customer deposit address, and the exchange later sweeps it into a hot wallet. Hot and cold wallets rebalance in transfers that dwarf any single customer's. Both kinds are real transfers between two addresses one company controls. Whale Alert says its attribution is what lets it drop transfers an owner makes to itself, so the filter is only as good as the names. Where the deposit address is unlabelled, a sweep reads as an unknown wallet paying an exchange, which looks like a deposit and is not one. A watcher on a labelled exchange wallet hears about every rebalance.

Exchange deposit addresses rotate. An address you watch because a counterparty deposits through it is one of many the exchange can issue. Kraken's deposit-address endpoint is documented as "Retrieve (or generate a new) deposit addresses", takes a new flag that makes a fresh one, and returns an expiretm field for addresses that expire. A customer can stop using an address whenever they like, and your alert keeps watching an address nobody uses any more. Watch the destination the exchange sweeps into, or the counterparty's own wallet, rather than a deposit address.

Solana and EVM chains are not the same shape. On Solana a wallet does not hold its tokens itself. Each token sits in a token account whose owner field points back at the wallet, the default one has an address derived from the wallet and the mint (a program-derived address), and by the Solana docs a wallet "can own multiple token accounts for the same token". Watch a token account and you miss the others; watch the owner and use an API that resolves its token accounts for you. Solscan's transfers endpoint takes the owner and reports from_token_account and to_token_account separately from from_address and to_address. On EVM chains the trap runs the other way: txlist returns only transactions the address sent or received directly, so ETH paid out by a contract is in txlistinternal, and a token transfer is in tokentx. Poll one of the three and you see a third of the activity. Some ETH reaches an address with no transaction at all, which what an Ethereum RPC cannot answer explains.

The free tier is an address cap or a call budget. Cielo stops at 250 EVM and 50 Solana wallets. Its 120 alerts an hour then halt until the next hour starts, and the FAQ says a Solana wallet making more than 3,000 transactions a day is filtered out entirely. Nansen's free plan is one active alert. A free Etherscan key is 3 calls a second and 100,000 a day across all your keys. At three calls per address once a minute that is 4,320 calls a day per address, or about 23 addresses. The free key leaves out Base, BNB Smart Chain, OP Mainnet, Avalanche and Gnosis, and is licensed for personal and research use only. Solscan Lite's 200,000 calls a month cover about four addresses polled once a minute. From 3 November 2026 Etherscan blocks requests at the daily limit unless a paid plan has overage switched on, and the poller stops seeing anything until midnight.

Polling has a silence that looks like nothing happening. Etherscan answers status "0" both for an error and for a valid request with no records; a request with no key comes back as {"status":"0","message":"NOTOK","result":"Missing/Invalid API Key"}. A poller that reads "0" as "no new transfers" goes quiet on a revoked key and never says so. Read message and result before you conclude the address is idle. Your latency is the polling interval plus the explorer's indexing lag, and neither explorer publishes the second figure. Pushed alerts fail in their own ways. Cielo says Telegram's own rate limits delay a burst from busy wallets, and that shared bots can saturate until alerts "drop out altogether". Its paid plans sell private bots for that reason. Whale Alert's WebSocket replays what you missed only if you resubscribe within five minutes under the same id. Nansen signs webhooks only when you set a secret. Without one, anyone who learns the URL can post a fake alert to it.

Do not poll the platforms' own pages. Arkham's terms prohibit scraping and automated extraction of its content, and anything you want out of it in code goes through its priced API. The same goes for any labelled platform: the alert or the API is the product, and the web page is not.

If you outgrow this

If the problem is many addresses on several chains, a poller that asks an explorer about each address in turn stops scaling well before the call budget does. Hundreds of addresses on six chains is thousands of requests a minute to learn that almost nothing happened. A stream inverts that. Bitquery streams GraphQL subscriptions over WebSocket from its 99-dollar Pro plan. Streams are billed by the connected minute, and the card's arithmetic puts Pro at about two always-on streams, so the number of streams is what to budget, not the number of addresses. Arkham's API also offers a websocket alongside REST, on an Intel API quoted per customer from 100 USD a month.

If the problem is a daily summary rather than a push, Dune runs a scheduled SQL query over decoded chain data and fires an email or a webhook when it finishes. That is a report, not an alert. Since September 2026 it also needs a paid plan, because free access after the trial is view-only.

If the addresses are Hyperliquid wallets, the chain explorers above are the wrong shape. 0xArchive sends webhook alerts on fills by a wallet you name from its Build plan, and HyperTracker covers Hyperliquid wallets only.

And if the problem is that you need to trust the feed itself, which every vendor here asks you to do, the end of the road is your own node or indexer. You subscribe to new blocks at an RPC endpoint, decode the transfers to and from your list, and attach whatever names you can defend. That is a node to run or rent, and an indexer to maintain for every chain you add. It is also the only version where the latency, the coverage and the labels are all decisions you made. The other tools that read chain data are under on-chain analytics.