# How to track a wallet and get an alert when it moves

Wallet alerts from a tracker, a labelled platform or your own poller. What each one calls a label, how fast it fires, and where the free tier stops.

*https://cryptomarkets.tools/how-to/track-a-wallet-and-get-an-alert · next to On-chain Analytics Platforms*

**Answer:** Paste the address into a tracker that pushes alerts: Cielo follows 250 EVM and 50 Solana wallets free and sends each trade to Telegram or Discord, and Nansen and Arkham alert on addresses or entities by webhook. For your own code, poll Etherscan or Solscan by address, because neither pushes anything. Treat every name on an alert as the vendor's attribution, not a fact about who owns the address.

## Approaches

*In the author’s order. Paid placement does not affect it.*

1. [Cielo](https://cryptomarkets.tools/tools/cielo.md) — Paste the addresses and get each trade in Telegram or Discord, 250 EVM and 50 Solana wallets and 120 alerts an hour free. The names are the ones you type.
2. [Nansen](https://cryptomarkets.tools/tools/nansen.md) — Smart Alerts on an address, an entity or a label, to Telegram, Discord, Slack or a signed webhook. One active alert free; the labels are Nansen's and undated.
3. [Arkham](https://cryptomarkets.tools/tools/arkham.md) — Alerts on an entity Arkham has attributed, to Telegram, Slack or a webhook, behind a free sign-in. Labels graded 98% or 80% confidence; tiers unpublished.
4. [Whale Alert](https://cryptomarkets.tools/tools/whale-alert.md) — Large labelled transfers chosen by chain, coin and value rather than by your list. An address filter exists only on the 699-dollar Enterprise API.
5. [Etherscan API](https://cryptomarkets.tools/tools/etherscan-api.md) — The do-it-yourself route on EVM chains, three calls per address and polled, since nothing is pushed. A free key covers about 23 addresses once a minute.
6. [Solscan Pro API](https://cryptomarkets.tools/tools/solscan-pro-api.md) — The same on Solana, one transfers call per owner address, polled and decoded into actions. No free plan; Lite at 49 USD is 200,000 calls a month.

## The short way

This page is about somebody else's addresses — an exchange hot wallet, a fund, a large holder, a
counterparty you settle with. If the address is your own and the question is a balance, that is a
different job: [tracking one portfolio across exchanges and a
wallet](https://cryptomarkets.tools/how-to/track-a-portfolio-across-exchanges-and-a-wallet).

For a few hundred addresses and a phone notification, use [Cielo](https://cryptomarkets.tools/tools/cielo). Paste the
addresses, connect its Telegram or Discord bot, and set a minimum USD value per wallet so that
approvals and dust stop reaching you. The free plan follows 250 EVM and 50 Solana wallets and sends
up to 120 alerts an hour, and nothing on the tracking side needs the trading wallet it offers you
on first sign-in.

If you want the alert to reach your own system rather than a chat, [Nansen](https://cryptomarkets.tools/tools/nansen) posts
Smart Alerts to an HTTPS endpoint of yours and signs each payload. And if you would rather depend on
nobody's alert engine, poll the explorer's own index by address. On an EVM chain that is three
requests to the [Etherscan API](https://cryptomarkets.tools/tools/etherscan-api), because ordinary transactions, internal
transactions and ERC-20 transfers are three different endpoints:

```text
GET https://api.etherscan.io/v2/api?chainid=1&module=account&action=txlist&address=<address>&startblock=<last_seen_block>&endblock=999999999&page=1&offset=100&sort=asc&apikey=YOUR_API_KEY
GET https://api.etherscan.io/v2/api?chainid=1&module=account&action=txlistinternal&address=<address>&startblock=<last_seen_block>&endblock=999999999&page=1&offset=100&sort=asc&apikey=YOUR_API_KEY
GET https://api.etherscan.io/v2/api?chainid=1&module=account&action=tokentx&address=<address>&startblock=<last_seen_block>&endblock=999999999&page=1&offset=100&sort=asc&apikey=YOUR_API_KEY
```

Keep the highest block number you have seen, pass it as `startblock` next time, and alert on
anything new. Change `chainid` for another EVM chain; the key is the same.

## What the options are

**A tracker for a list you chose.** Cielo is bought by someone who already knows which addresses
to watch. Each transaction lands in a feed and in the bot, tagged with the protocol, the size, the
direction and the wallet's PnL. Per wallet you can set a minimum USD value, the transaction types
(swaps, transfers, NFT trades, perps, approvals) and the chains. The docs' overview listed 22
chains on 27 October 2026 while the homepage says 30-plus, and coverage is uneven: token-swap alerts
run on Ethereum, Base and Solana only. The vendor gives no latency figure beyond "real-time". The
names are the ones you type into its address book, plus a Popular Wallets tag on any address more
than 30 free users follow, so Cielo does not tell you who owns anything. Pro, at 59 USD a month,
raises the list to 1,000 EVM and 200 Solana wallets and adds Hyperliquid alerts.

**A labelled platform that alerts.** Nansen's Smart Alerts come in three types: token transfers
(buy, sell, swap, send, receive), net flows for a target over a window, and calls to a named
contract. A target can be an address, an entity, one of Nansen's labels, a label of your own or a
watchlist. Delivery is Telegram, Slack, Discord or a webhook, with an `X-Nansen-Signature` header
when you set a secret, and no email. A `realtime` window fires on each matching event. Nansen puts
its data at "seconds to a couple of minutes" behind the chain, with some current-day responses
cached for up to five minutes. The free plan allows one active alert, and Pro, at 69 USD a month
or 49 billed annually, makes them unlimited. The names come from Nansen's own label set, and the
labels endpoint accepts 20 chains.

[Arkham](https://cryptomarkets.tools/tools/arkham) is the other one. Its card records alerts on an entity's movements,
delivered to Telegram, Slack and webhooks. Alerts need a free sign-in, and the application carries
an alert tier and an upgrade request that Arkham prices nowhere in public. The names come from its
attribution engine and are graded: verified at 98% confidence or better, predicted at 80% or
better. This catalogue has not read Arkham's alert screens, so which conditions an alert takes,
how many a free account gets and how fast one fires are not stated here.
[Nansen vs Arkham](https://cryptomarkets.tools/compare/nansen-vs-arkham) sets the two platforms side by side.

**A feed of large transfers, not your list.** [Whale Alert](https://cryptomarkets.tools/tools/whale-alert) answers a different
question: what large transfer just happened on a chain I follow. Its dashboard filters take a chain,
a coin, a transaction type and a minimum value, never an address, from 14.95 USD a month. Its
Custom Alerts WebSocket, 29.95 USD a month and personal use only, has the same filters with a
100,000-dollar floor and a cap of 100 alerts an hour. An address filter exists only on the
Enterprise API's transactions endpoint, at 699 USD a month. Each alert names the owner of each end
where Whale Alert has one, and says "unknown wallet" where it does not.

**Your own poller on Solana.** The [Solscan Pro API](https://cryptomarkets.tools/tools/solscan-pro-api) returns an owner
address's transfers in one call, with swaps and other program activity decoded into typed actions
by its other endpoints:

```bash
curl -s "https://pro-api.solscan.io/v2.0/account/transfer?address=<owner_address>&page_size=100&sort_order=desc" \
  -H "token: YOUR_API_KEY"
```

There is no free plan. Lite, at 49 USD a month, is 200,000 calls and is licensed for personal and
research use; commercial use starts at Level 2, 199 USD.

**Before you choose what to watch.** [Bubblemaps](https://cryptomarkets.tools/tools/bubblemaps) is not an alert tool: it has
no alerts and no webhooks, and its maps are recomputed within six hours. What it does well is show
which of a token's top holders have sent funds to each other. That is a way to find the other
addresses worth adding to a list before you put the list into one of the tools above. A line on its
map is a transfer and nothing more, as the [wallet-tracking shelf](https://cryptomarkets.tools/collections/wallet-tracking)
explains along with every other card that follows addresses.

Whatever arrives, the alert is a record that a transfer happened. What anyone should do about it is
outside this page and outside this catalogue.

## Where this breaks

**The name on the alert is an attribution, not a fact.** The chain records two addresses and an
amount. "Binance", "a fund" or a person's name is something a vendor added, from clustering,
behaviour and off-chain evidence, and each vendor here says so in its own way. Arkham grades its
labels and shows the grade as a badge, which is lost the moment someone screenshots the alert.
Nansen's labels have a name, a category and a kind, with no date and no history, and its coverage
page lists "attribution or label-history updates" among the reasons a past result can change.
Whale Alert's changelog announces live updates of owners after the fact, and it publishes no
method. An "exchange" label is a heuristic that was right often enough to ship. [Where an on-chain
number comes from](https://cryptomarkets.tools/guides/where-an-onchain-number-comes-from) covers this attribution layer at
length, in its third stage.

**Most large exchange transfers are the exchange talking to itself.** A customer deposit goes to a
per-customer deposit address, and the exchange later sweeps it into a hot wallet. Hot and cold
wallets rebalance in transfers that dwarf any single customer's. Both kinds are real transfers
between two addresses one company controls. Whale Alert says its attribution is what lets it drop
transfers an owner makes to itself, so the filter is only as good as the names. Where the deposit
address is unlabelled, a
sweep reads as an unknown wallet paying an exchange, which looks like a deposit and is not one. A
watcher on a labelled exchange wallet hears about every rebalance.

**Exchange deposit addresses rotate.** An address you watch because a counterparty deposits through
it is one of many the exchange can issue. Kraken's deposit-address endpoint is documented as
"Retrieve (or generate a new) deposit addresses", takes a `new` flag that makes a fresh one, and
returns an `expiretm` field for addresses that expire. A customer can stop using an address
whenever they like, and your alert keeps watching an address nobody uses any more. Watch the
destination the exchange sweeps into, or the counterparty's own wallet, rather than a deposit
address.

**Solana and EVM chains are not the same shape.** On Solana a wallet does not hold its tokens
itself. Each token sits in a token account whose `owner` field points back at the wallet, the
default one has an address derived from the wallet and the mint (a program-derived address), and
by the Solana docs a wallet "can own multiple token accounts for the same token". Watch a token
account and you miss the others; watch the owner and use an API that resolves its token accounts
for you. Solscan's transfers endpoint takes the owner and reports `from_token_account` and
`to_token_account` separately from `from_address` and `to_address`. On EVM chains the trap runs the
other way: `txlist` returns only transactions the address sent or received directly, so ETH paid
out by a contract is in `txlistinternal`, and a token transfer is in `tokentx`. Poll one of the
three and you see a third of the activity. Some ETH reaches an address with no transaction at all,
which [what an Ethereum RPC cannot answer](https://cryptomarkets.tools/guides/what-an-ethereum-rpc-cannot-answer) explains.

**The free tier is an address cap or a call budget.** Cielo stops at 250 EVM and 50 Solana wallets.
Its 120 alerts an hour then halt until the next hour starts, and the FAQ says a Solana wallet making
more than 3,000 transactions a day is filtered out entirely. Nansen's free plan is one active
alert. A free Etherscan key is 3 calls a second and 100,000 a day across all your keys. At three
calls per address once a minute that is 4,320 calls a day per address, or about 23 addresses. The
free key leaves out Base, BNB Smart Chain, OP Mainnet, Avalanche and Gnosis, and is licensed for
personal and research use only. Solscan Lite's 200,000 calls a month cover about four addresses
polled once a minute. From 3 November 2026 Etherscan blocks requests at the daily limit unless a
paid plan has overage switched on, and the poller stops seeing anything until midnight.

**Polling has a silence that looks like nothing happening.** Etherscan answers `status` "0" both
for an error and for a valid request with no records; a request with no key comes back as
`{"status":"0","message":"NOTOK","result":"Missing/Invalid API Key"}`. A poller that reads "0" as
"no new transfers" goes quiet on a revoked key and never says so. Read `message` and `result`
before you conclude the address is idle. Your latency is the polling interval plus the explorer's
indexing lag, and neither explorer publishes the second figure. Pushed alerts fail in their own
ways. Cielo says Telegram's own rate limits delay a burst from busy wallets, and that shared bots
can saturate until alerts "drop out altogether". Its paid plans sell private bots for that reason.
Whale Alert's WebSocket replays what you missed only if you resubscribe within five minutes under
the same `id`. Nansen signs webhooks only when you set a secret. Without one, anyone who learns the
URL can post a fake alert to it.

**Do not poll the platforms' own pages.** Arkham's terms prohibit scraping and automated extraction
of its content, and anything you want out of it in code goes through its priced API. The same goes
for any labelled platform: the alert or the API is the product, and the web page is not.

## If you outgrow this

If the problem is **many addresses on several chains**, a poller that asks an explorer about each
address in turn stops scaling well before the call budget does. Hundreds of addresses on six chains
is thousands of requests a minute to learn that almost nothing happened. A stream inverts that.
[Bitquery](https://cryptomarkets.tools/tools/bitquery) streams GraphQL subscriptions over WebSocket from its 99-dollar Pro
plan. Streams are billed by the connected minute, and the card's arithmetic puts Pro at about two
always-on streams, so the number of streams is what to budget, not the number of addresses.
Arkham's API also offers a websocket alongside REST, on an Intel API quoted per customer from 100
USD a month.

If the problem is **a daily summary rather than a push**, [Dune](https://cryptomarkets.tools/tools/dune) runs a scheduled SQL
query over decoded chain data and fires an email or a webhook when it finishes. That is a report,
not an alert. Since September 2026 it also needs a paid plan, because free access after the trial
is view-only.

If the addresses are **Hyperliquid wallets**, the chain explorers above are the wrong shape.
[0xArchive](https://cryptomarkets.tools/tools/0xarchive) sends webhook alerts on fills by a wallet you name from its Build plan,
and [HyperTracker](https://cryptomarkets.tools/tools/hypertracker) covers Hyperliquid wallets only.

And if the problem is that **you need to trust the feed itself**, which every vendor here asks you
to do, the end of the road is your own node or indexer. You subscribe to new blocks at an [RPC
endpoint](https://cryptomarkets.tools/glossary/rpc-endpoint), decode the transfers to and from your list, and attach whatever
names you can defend. That is a node to run or rent, and an indexer to maintain for every chain you
add. It is also the only version where the latency, the coverage and the labels are all decisions
you made. The other tools that read chain data are under [on-chain
analytics](https://cryptomarkets.tools/categories/onchain-analytics).

## FAQ

### Can I get a free alert when a crypto wallet moves?

Yes, within limits. Cielo's free plan follows 250 EVM and 50 Solana wallets and sends up to 120 Telegram or Discord alerts an hour, after which alerts stop until the next hour. Nansen's free plan allows one active smart alert at a time. Polling the Etherscan API on a free key works too, at 3 calls a second and 100,000 a day, for personal and research use only.

### Does an "exchange" label on an alert mean the address belongs to that exchange?

It means a vendor decided it does. No address carries an owner on the chain, so a name is an attribution made from clustering, behaviour and off-chain evidence. Arkham grades its labels at 98% or 80% confidence, Nansen's labels carry no date, and Whale Alert publishes no method and updates owners after an alert has gone out. The transfer itself can be checked on an explorer; the name on either end cannot.

### Can I get wallet alerts by webhook?

From Nansen and Arkham, yes. Nansen's Smart Alerts post to an HTTPS endpoint you give it and sign each delivery with HMAC-SHA256 when you set a secret; Arkham's card records webhook delivery for its alerts. Cielo delivers to Telegram, Discord and its own web app. Etherscan and Solscan publish no webhooks at all, so watching an address there means polling it on a schedule you set.

### Why did I get an alert for a huge exchange transfer that nobody deposited?

Usually because the exchange moved its own coins. Exchanges sweep customer deposit addresses into hot wallets and move funds between hot and cold storage, and each move is a real on-chain transfer between two addresses the same company controls. Whale Alert says its attribution is what lets it drop transfers an owner makes to itself; where it has no name for the deposit address, the same move arrives as an unknown wallet sending to an exchange.

## Sources

1. [Smart Alerts — alert types, targets, channels and webhook signatures](https://docs.nansen.ai/api/smart-alerts) — Nansen, read 2026-10-27
2. [Data coverage — freshness, caching and revisions](https://docs.nansen.ai/api/data-coverage) — Nansen, read 2026-10-27
3. [Pro plan explained](https://academy.nansen.ai/articles/9412804-pro-plan-explained) — Nansen, read 2026-10-27
4. [Alert settings](https://docs.cielo.finance/wallet-tracking/my-wallets/alert-settings) — Cielo, read 2026-10-27
5. [Wallet tracking FAQ](https://docs.cielo.finance/wallet-tracking/faq) — Cielo, read 2026-10-27
6. [API documentation — Custom Alerts WebSocket and Enterprise REST API](https://developer.whale-alert.io/documentation/) — Whale Alert, read 2026-10-27
7. [Get a list of normal transactions by address (API V2)](https://docs.etherscan.io/api-reference/endpoint/txlist) — Etherscan, read 2026-10-27
8. [Rate limits](https://docs.etherscan.io/resources/rate-limits) — Etherscan, read 2026-10-27
9. [Account transfers, Pro API v2.0](https://pro-api.solscan.io/pro-api-docs/v2.0/reference/v2-account-transfer) — Solscan, read 2026-10-27
10. [Tokens on Solana — token accounts and associated token accounts](https://solana.com/docs/tokens) — Solana Foundation, read 2026-10-27
11. [Get Deposit Addresses](https://docs.kraken.com/api-reference/funding/get-deposit-addresses) — Kraken, read 2026-10-27

*Last updated 2026-10-27. Corrected in place — an endpoint that moves is a bug here, not a new post.*