btc-watchtower

Mempool monitoring for Bitcoin UTXOs with a pre-signed break-glass defense. Its own bitcoind treats any unrecognised spend of a watched coin as hostile, calls, texts and emails in parallel, and escalates if nobody acknowledges in five minutes. If a defense is armed it fights back with a ladder you signed on your own hardware at enrollment: transactions spending that one UTXO to your own cold address, identical but for their fee, broadcast at climbing rates until they out-bid the thief.

The defense

Bids are priced against the attacker's descendant fee rate, not the parent's, so a CPFP pin cannot make the package expensive to replace while the parent looks cheap; every bid is checked with testmempoolaccept before broadcast, so a mispriced attempt costs a retry rather than the window. It can also submit straight to miners through MARA Slipstream, since an attacker with their own channel never touches the public mempool. ZMQ gets a spend seen in milliseconds, but a gettxspendingprevout sweep runs every 15 seconds regardless — a promise that rests on a lossy notification channel is not a promise.

Why storing signed transactions is safe

No service ever holds a private key, and every rung is validated at enrollment to spend exactly one input and pay exactly one output, to an address on an allowlist that only a fresh hardware-key touch can extend. An attacker who exfiltrates the entire encrypted database can broadcast every rung and still only force your coins into your own cold storage: the exposure is griefing and privacy, never theft.

At the top of the ladder the fee can exceed the amount being fought over. That is the option you are really buying — given the choice between funding a thief and burning the coins, most people choose to burn them. You set the ceiling.