Stablecoin Whale Monitor
RepositoryOpen monitor
USDCUSDTon Ethereum mainnet

See every USDC and USDT transfer of 100,000 tokens or more on Ethereum.

Stablecoin Whale Monitor records large stablecoin transfers after 6 block confirmations, keeps them for 7 days, and links each one to its on-chain record so you can verify it yourself.

Open monitorRead documentation
TokensUSDC, USDT
NetworkEthereum mainnet
Qualifies at100,000 tokens
Confirmation6 blocks
Retention7 days
Transfer monitor
Example data
TokenAllMin100,0005 example transfers
Example transfers, not live data
TimeTokenAmountFromTo
14:03 UTCUSDT1,250,0000xa4c1…216f0xdaee…9e9c
14:02 UTCUSDC348,912.4172030x3b02…7a760x7c76…2cec
13:56 UTCUSDCMint5,000,0000x0000…00000xe0ca…3e0a
13:52 UTCUSDT2,750,000.50x8183…9fc30x5526…287c
13:42 UTCUSDCBurn12,000,0000x611a…142a0x0000…0000
Illustration of the monitor using example data. Addresses and amounts are not real transfers.
How it works

Observe, filter, inspect, verify.

  1. 01

    Observe

    The indexer reads Transfer logs from the USDC and USDT contracts 6 blocks behind the chain tip and records every transfer of 100,000 tokens or more.

  2. 02

    Filter

    Narrow the feed by token, a higher minimum amount, or one address on either side of the transfer. Each view has its own link you can share.

  3. 03

    Inspect

    Open a transfer for the exact amount, raw base units, block, log index and the time it was recorded. Look up a transaction to see all of its qualifying transfers.

  4. 04

    Verify

    Every transaction, address and block links to Etherscan, so you can check each record against the chain yourself.

Who it is for

One record of large transfers, three ways to use it.

Analysts

Research large movements, mints and burns without wading through every small transfer. Start from the feed, open a transfer, and take the transaction hash to Etherscan or your own tools.

Reading transfer details

Treasury and operations

Follow an address you care about. The address filter matches the sender or the receiver, and the link keeps the filter, so a teammate opens exactly the same view.

Filtering by address

Developers

Read the same records from a small read-only JSON API with exact decimal amounts, raw base units, cursor pagination and a health endpoint that reports freshness.

API reference
Data and freshness

Where the data comes from and how current it is.

A transfer appears in the monitor after the confirmation buffer plus the indexer and API refresh intervals. That is usually under three minutes after its block, not instantly.

Source
Transfer logs on Ethereum mainnet (chain ID 1), read over JSON-RPC
USDC contract
0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48
USDT contract
0xdac17f958d2ee523a2206206994597c13d831ec7
Confirmation buffer
6 blocks, about 72 seconds
Refresh cadence
Indexer polls every 30 s. API reloads every 30 s
Retention
7 days, then removed from the API and from storage

Limitations

  • Only USDC and USDT on Ethereum mainnet. No other tokens, chains or event types.
  • Transfers below 100,000 tokens are never stored, so a lower display filter cannot reveal them.
  • Amounts are token units. There is no USD pricing and no total volume.
  • Addresses carry no labels. An address does not tell you who owns it.
  • History covers the last 7 days only.
  • 6 confirmations reduce exposure to chain reorganizations but do not guarantee finality. Published records are not rewritten after a deep reorganization.
Check current service status
For developers

A small, read-only API.

The monitor runs on the same public endpoints you can call. Responses are JSON from the same origin as the site. No key is required.

  • GET /api/transfers newest first, filter by token, minimum amount or address, 1 to 50 per page
  • GET /api/transfers/{txHash} every retained qualifying transfer in one transaction
  • GET /api/health index freshness and chain progress
  • 60 requests per minute per IP address. Exceeding it returns 429 and blocks for 60 seconds.
API referenceWhy HTTP 200 is not always healthy
Request
curl "https://swm.josephdara.com/api/transfers?token=USDT&minimumAmount=250000&limit=1"
Response · 200Example data
{
  "items": [{
    "chain": "ethereum", "chainId": 1,
    "token": "USDT",
    "tokenContract": "0xdac17f958d2ee523a2206206994597c13d831ec7",
    "from": "0x818319478da6bd0c621de49f145fda9988c79fc3",
    "to": "0x5526f7eaed46725a2a7b860dcd6c8a1f8b46287c",
    "amount": "2750000.5",
    "rawAmount": "2750000500000",
    "threshold": "100000",
    "blockNumber": 26248680,
    "blockTimestamp": "2026-10-22T13:52:59.000Z",
    "logIndex": 257,
    "transactionHash": "0xced9041d…6fd287db7",
    "transactionStatus": "success",
    "transferType": "normal",
    "detectedAt": "2026-10-22T13:54:41.512Z"
  }],
  "nextCursor": "eyJrZXkiOiIxOjB4Y2VkOTA0…",
  "total": 312,
  "counts": { "USDC": 0, "USDT": 312 },
  "refreshedAt": "2026-10-22T14:02:31.204Z"
}

Hash and cursor shortened for display. Real responses return full values.

Infrastructure and security

Built on Google Cloud, locked down by default.

Architecture and security docs

Two small services

An indexer on a single Cloud Run worker pool instance and a read-only API on Cloud Run, behind one HTTPS load balancer with the static site.

Private, idempotent storage

Events land as deterministic NDJSON objects in a private Cloud Storage bucket. The checkpoint advances only after its range is written.

Guarded edge

Cloud Armor rate limits the API per IP, the API accepts traffic only from the load balancer, and TLS 1.2 is the minimum.

Least privilege, gated releases

One service account per workload, the RPC URL in Secret Manager, Terraform for infrastructure, and approval-gated deploys of immutable image digests.