Helius releases Watchtower, a free open-source security monitor for Solana programs. Helius has released Watchtower, a free MIT-licensed tool that grades Solana program security and alerts on upgrades, admin calls and multisig proposals. Helius hSOL$107.230.0% has released Watchtower, a free, open-source security monitor for Solana programs. Point it at a program and it grades the program's security setup, then alerts in real time on admin calls, multisig proposals and upgrades, according to the launch thread from Helius's Ichigo, who wrote the tool. The code sits on GitHub under the helius-labs organisation with an MIT licence, so any team can run, fork or extend it. Its first commit, titled "initial release of Watchtower", landed on 5 November 2026, and the public launch followed on 6 November 2026. What helius Watchtower monitors on a Solana program. Watchtower watches the controls that let someone change a Solana program or move its money. An upgradeable program has an upgrade authority, the key that can replace its code, and some teams put that key and their treasury behind a multisig, a wallet that needs several signers to approve an action. Watchtower tracks changes to both. The README lists detectors for program deployments, upgrade proposals, multisig proposals and changes, mint authority changes, privileged instructions, treasury outflows, key and nonce authority transfers, IDL changes, config updates and build verification. Alerts go to the terminal, Discord, Slack, Telegram or a webhook. The detector that ties these together looks for a takeover in progress. Per the README, the attack-chain detector raises "one critical alert when control, risk and drain stages of a takeover line up within 24 hours". A change in who controls a program, then a risky action, then funds leaving, adds up to a single top-priority warning. Grading is a points system. Each program, multisig or key starts at 100 points, a failed check costs 25 and a warning costs 10, and the lowest-scoring subject sets the overall grade, from A (90 or more) to F (below 40), according to the README. Replaying past Solana exploits, including Drift. Watchtower can run every detector over an earlier window of transactions, which the README describes as a way "to see what an exploit would have triggered". The repo's commit history shows Ichigo adding "a nightly replay of the Drift exploit" to the project's automated runs on 5 November 2026. Drift is the kind of takeover the attack-chain detector describes. Drift Protocol DRIFT$0.013+6.1% lost roughly $268 million to $285 million on 1 April 2026 in an exploit that rekt.news attributed to an admin key compromise. The same report says Helius CEO Mert flagged the exploit publicly almost an hour before Drift confirmed it, by which time the drain had finished. Watchtower turns that kind of watching into software a team can point at its own program. How to run Watchtower with your own Helius API key. Watchtower runs locally, from a dashboard or a command line, using your own Helius API key, Ichigo wrote in the thread. The README asks for Node.js 22 or later and pnpm, and serves the dashboard at 127.0.0.1:4545. The tool works on mainnet only, recognises Squads v3 and v4 multisigs, and needs a program's published IDL (the file describing its instructions) to decode every instruction in full. Under the hood it reads two Helius products that left beta in September: Parsed Events, which returns an address's history already decoded, and Parsed Streams, which pushes the same decoded transactions live over WebSocket. Helius's documentation says Parsed Events is available on all plans, including Free, at 10 credits per request, with history scans costing 10 credits plus 1 per page. That scan endpoint is the Parsed Events Scan API Helius launched this month, and Ichigo invites developers to fork Watchtower, add detectors, or use it as a reference for building on Parsed Events. Watchtower's first commit is dated 5 November 2026, and no independent review of how well its detectors catch real attacks has been published. Because the code is open, a team can read exactly what each check looks for before relying on its grade. Keep up to date with the Solana eco Solana Compass is an independent Solana analytics and staking platform, operating a validator on Solana mainnet since September 2021. Its network statistics and...

Helius launches Parsed Events Scan API to search any Solana address's transaction history server-side. Helius's Parsed Events Scan API, launched 3 Nov 2026, searches any Solana address's history server-side by program, instruction or mint for up to 20 credits. Helius hSOL$111.61+1.0% has released the Parsed Events Scan API, which searches any Solana address's transaction history on Helius's own servers. It returns only the transactions that match, already decoded. A developer names the address and what to look for (a program, specific instructions, a token mint or native SOL), and Scan returns the parsed matches, their signatures or a count. Helius published the launch post on 3 November 2026, written by developer experience engineer 0xIchigo and software engineer Jacopo Francavilla. Keep up to date with the Solana eco Scan is the newest piece of Parsed Events, the decoding product Helius took out of beta in September. That release decoded a single transaction or an address's history on request. Scan adds the search: Helius filters the history first, so the developer receives only the activity they asked for. What the Parsed Events Scan API replaces for Solana developers. Until now, finding one kind of activity in a Solana address's history meant building the search yourself. The Helius blog sets out the loop: fetch a page of transaction signatures, request each transaction, decode it with your own parsers, apply your filters, and repeat until you have enough matches. "On a busy address, you're stuck processing thousands of transactions before finding a match," the post says. Scan moves that loop to Helius's side. The developer defines the match once, and Helius pages through the history, applies the filters and parses only the transactions that pass. Helius CEO Mert Mumtaz, replying to the announcement on X, said the problem predates the company: the use case "destroyed my mental health so many times in 2021 that we had no choice but to start helius". In a later reply he credited Helius engineers nick_pennie and Giapif, Jacopo Francavilla's handle, with building it. How Scan filters by program instruction, discriminator, token mint and native SOL. The Scan API matches transactions by program, by named instruction, by raw instruction discriminator, by token mint, by native SOL, or by a combination, according to the Scan API reference. Requests can also be bounded by slot, time or signature, and limited to successful or failed transactions. * Instruction names come from the program's IDL, the published file that describes a program's instructions and accounts. Scan checks both top-level instructions and inner instructions, the calls one program makes to another. * Programs without an IDL can be searched by discriminator, the first one to eight bytes of instruction data that identify which instruction is being called. * Up to 20 programs fit in one request, and a transaction matches if it calls any of them. Helius's example pulls one wallet's trades across Jupiter JUP$0.255+4.2%, DFlow and Pump.fun in a single scan. * Token mint matches read each transaction's token balances. Native SOL has its own pseudo-mint and matches on any change in the address's SOL balance other than the fee, which also catches Jito tips and account rent moving in or out. Two settings decide what counts. By default, a match must involve the scanned address itself, so a wallet scan for a token needs tokenAccounts set to balanceChanged to catch transfers that touch only the wallet's token account. Setting scope to transaction counts a program or mint anywhere in the transaction, which the blog recommends for relayers that only pay fees and for multisig members executing a proposal. The blog's suggested uses include tracking a program's failed calls with decoded errors and watching admin instructions for fee or parameter changes. Parsed Events Scan pricing and limits: 10 credits plus 1 per 1,000 transactions. Each Scan request costs 10 credits plus 1 credit per history page scanned, and a page holds up to 1,000 transactions, according to Helius's credits page. A request scans up to 10,000 transactions by default, which caps it at 20 credits, and returns up to 100 matches. Returning parsed transactions, signatures only or a count costs the same, and each response reports the exact charge. Helius's worked example searched the Pump.fun program for its 10 most recent creator fee claims, a rare instruction among the program's buys and sells. Scan read 3,402 transactions in 182 milliseconds and charged 14 credits. The blog says the same search through getTransactionsForAddress would cost 350 credits, 25 times more, "before any of them are parsed". Helius's announcement post described Scan as "10x faster and 30x cheaper". All of these figures come from Helius's own tests. The Pump.fun program is a fair stress case for that kind of search. On 3 November 2026, the day Scan launched, about 29.2 million transactions involved the program, according to Solana Compass program data. That averages out to roughly 340 a second, so by its arithmetic the 3,402 transactions in Helius's creator-fee test amount to about ten seconds of the program's activity. Helius says Scan saves the most when the activity being searched for is rare. Common activity fills a request quickly: searching the same program for buy and sell instructions, the blog's demo found 100 matches after scanning 261 transactions, for 11 credits. Sparse matches work the other way, and a request can reach its scan budget with nothing to show. The response then carries a pagination token, and Helius tells developers to keep paging, because an empty page can mean the budget ran out before the next match turned up. Scan, Enhanced Transactions and getTransactionsForAddress compared. getTransactionsForAddress is the Helius RPC method for pulling an address's history, which Helius presented at Breakpoint 2025. It returns unparsed transactions for the developer to decode and filter, priced at 100 credits per 1,000-transaction page in the blog's comparison. Scan does the filtering and decoding on Helius's side and bills for the history pages it reads. The Enhanced Transactions API, Helius's older parsed-data product, sorts activity into a fixed set of types such as swaps, transfers and NFT sales. The blog says it "remains available in maintenance mode", with no new parser types or feature work, and the migration guide gives no end-of-life date. The guide points developers who filtered Enhanced Transactions by type to the Scan endpoint for server-side filtering. The same guide says Parsed Events covers more than 3,600 programs and costs 10 credits per request, against 100 for Enhanced Transactions. Scan is available in Helius's TypeScript SDK as helius.parsedEvents.scan, in the Rust SDK, in the Helius CLI and MCP server, and as a scan tool in the Helius dashboard. Helius's demo searched the wallet of the trader Ansem for wrapped SOL activity in September 2026 and found 53 matches in 7,555 transactions. Who the Helius Scan API is for, and what to check. Scan is built for apps that need one slice of an address's past: a wallet's full trading history across venues, how often it used a program in a date range, or every fee change on a protocol's config account. The blog pitches it at teams who "know the onchain activity you need but do not want to build and maintain a client-side history scanner". Faster access to Solana's history has drawn other work this year, including Triton One's open-source SuperBank ledger layer and Helius's own balance-at endpoint for past wallet balances. Developers on Helius's free plan should confirm Scan access on their account. The migration guide says Parsed Events is "generally available on all plans, including Free", and the Scan reference does not list plan requirements. The cost claims are easy to test, since every Scan response reports the credits it charged. Solana Compass is an independent Solana analytics and staking platform, operating a validator on Solana mainnet since September 2021. Its network statistics and...