Helius hSOL$107.95+0.2% has released Watchtower, a free, open-source security monitor for Solana programs. Point it at a program and it grades the program's security setup, then alerts in real time on admin calls, multisig proposals and upgrades, according to the launch thread from Helius's Ichigo, who wrote the tool.
The code sits on GitHub under the helius-labs organisation with an MIT licence, so any team can run, fork or extend it. Its first commit, titled "initial release of Watchtower", landed on 5 November 2026, and the public launch followed on 6 November 2026.
What Helius Watchtower monitors on a Solana program
Watchtower watches the controls that let someone change a Solana program or move its money. An upgradeable program has an upgrade authority, the key that can replace its code, and some teams put that key and their treasury behind a multisig, a wallet that needs several signers to approve an action. Watchtower tracks changes to both.
The README lists detectors for program deployments, upgrade proposals, multisig proposals and changes, mint authority changes, privileged instructions, treasury outflows, key and nonce authority transfers, IDL changes, config updates and build verification. Alerts go to the terminal, Discord, Slack, Telegram or a webhook.
The detector that ties these together looks for a takeover in progress. Per the README, the attack-chain detector raises "one critical alert when control, risk and drain stages of a takeover line up within 24 hours". A change in who controls a program, then a risky action, then funds leaving, adds up to a single top-priority warning.
Grading is a points system. Each program, multisig or key starts at 100 points, a failed check costs 25 and a warning costs 10, and the lowest-scoring subject sets the overall grade, from A (90 or more) to F (below 40), according to the README.
Replaying past Solana exploits, including Drift
Watchtower can run every detector over an earlier window of transactions, which the README describes as a way "to see what an exploit would have triggered". The repo's commit history shows Ichigo adding "a nightly replay of the Drift exploit" to the project's automated runs on 5 November 2026.
Drift is the kind of takeover the attack-chain detector describes. Drift Protocol DRIFT$0.013+5.1% lost roughly $268 million to $285 million on 1 April 2026 in an exploit that rekt.news attributed to an admin key compromise. The same report says Helius CEO Mert flagged the exploit publicly almost an hour before Drift confirmed it, by which time the drain had finished. Watchtower turns that kind of watching into software a team can point at its own program.
How to run Watchtower with your own Helius API key
Watchtower runs locally, from a dashboard or a command line, using your own Helius API key, Ichigo wrote in the thread. The README asks for Node.js 22 or later and pnpm, and serves the dashboard at 127.0.0.1:4545. The tool works on mainnet only, recognises Squads v3 and v4 multisigs, and needs a program's published IDL (the file describing its instructions) to decode every instruction in full.
Under the hood it reads two Helius products that left beta in September: Parsed Events, which returns an address's history already decoded, and Parsed Streams, which pushes the same decoded transactions live over WebSocket. Helius's documentation says Parsed Events is available on all plans, including Free, at 10 credits per request, with history scans costing 10 credits plus 1 per page. That scan endpoint is the Parsed Events Scan API Helius launched this month, and Ichigo invites developers to fork Watchtower, add detectors, or use it as a reference for building on Parsed Events.
Watchtower's first commit is dated 5 November 2026, and no independent review of how well its detectors catch real attacks has been published. Because the code is open, a team can read exactly what each check looks for before relying on its grade.
