Treasury monitoring

A team that needs a notice when a known address moves a large amount can write a rule on from and to, and can read balances with one call. This suits a public treasury, a multisig or a known cold wallet. It only sees transfers of $100,000 or more in curated tokens.

#Workflow

1. List the addresses. An account holds 10 rules, and one rule can cover several addresses.
2. Check current balances with GET /wallets/{address}. It returns all six EVM chains in one call.
3. Write a rule with from and to conditions, and test it in the rule tester. A test with 0 matches is normal for a quiet address. It proves the rule parses, and it does not prove the rule will fire.
4. Sign in to the console with a Solana wallet, save the rule, and send a test delivery. Consider the lowest cooldown, 60 seconds, so a second move soon after the first still reaches you.
5. Verify the signature in your handler.
6. Run a scheduled balance check, because the rule cannot see small or uncurated moves.

#Rules

Tested with POST /rules/validate at 2026-11-04T19:21:20Z against the newest 1,948 stored rows.

(from == "0x5754284f345afc66a98fbb0a0afe71e0f007b949" or to == "0x5754284f345afc66a98fbb0a0afe71e0f007b949") and usd >= 100k

This rule uses the public Tether Treasury address as a sample. It parsed and returned 0 matches in that window. Address comparison ignores case, so a checksum address also works.

For a labeled address, the label is shorter and also returned 0 matches:

from_label == "Tether Treasury" or to_label == "Tether Treasury"

You can cover several addresses with in:

from in ["0xaaaa", "0xbbbb"] or to in ["0xaaaa", "0xbbbb"]

The third rule is a pattern. Replace the placeholders with your own addresses. Its form parsed with test values at 2026-11-04T19:33:33Z.

#Real sample

GET /wallets/0x5754284f345afc66a98fbB0a0Afe71e0F007B949 at 2026-11-04T19:24:48Z. This is the Ethereum row of the chains array. It cost 3 units.

{
  "chain": "ethereum",
  "ok": true,
  "native": { "symbol": "ETH", "amount": 0.22297739335684075, "usd": 539.92 },
  "tx_sent": 6918,
  "is_contract": false,
  "tokens": [
    { "symbol": "USDC", "address": "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48", "amount": 0.007171, "usd": 0.01 },
    { "symbol": "USDT", "address": "0xdAC17F958D2ee523a2206206994597C13D831ec7", "amount": 2998106795.265382, "usd": 2996337912.26 }
  ],
  "tracked_usd": 2996338452.19
}

tx_sent is the account nonce. A sudden increase means the account sent transactions, whatever their size, so it is a useful number for a scheduled check.

curl -s "https://farbeamlabs.com/api/v1/wallets/$ADDR" | jq '.data.chains[] | {chain, ok, tx_sent, tracked_usd}'

const { data } = await (await fetch(`https://farbeamlabs.com/api/v1/wallets/${addr}`)).json();
for (const c of data.chains) console.log(c.chain, c.ok, c.tx_sent, c.tracked_usd);

import requests

data = requests.get(f"https://farbeamlabs.com/api/v1/wallets/{addr}", timeout=30).json()["data"]
for c in data["chains"]:
    print(c["chain"], c["ok"], c.get("tx_sent"), c.get("tracked_usd"))

Compare only chains with ok: true. If data.partial is true, one chain did not answer, and a change on that chain cannot be seen in this call.

#What this will not do

• It cannot act as a security control. Delivery is not guaranteed, events can be missed or dropped in a cooldown, and it has no blocking or signing function.
• It sees no OP Mainnet or Polygon transfers, because those chains have no index. Balance reads still cover them.
• It sees no token outside the curated list, and no transfer below $100,000.
• It cannot see internal ETH movements from contracts. A multisig that sends ETH through a contract call will not appear as a native transfer.
• tracked_usd is not the value of a portfolio. It covers the native asset and curated tokens only on EVM chains.

For a treasury that holds real value, use a dedicated monitoring product and alerts from your multisig tool, and treat Farbeam as one more input.