Crypto Security & Black Swan Regime: Detect Hacks and Depegs via API

The Risk That Arrives in Minutes, Not Days

Most regime signals are slow by design. Trend, sentiment, macro — they breathe over days and weeks. But the worst drawdowns in crypto don't announce themselves on that clock. A bridge gets drained, a stablecoin slips its peg, an exchange goes quiet on withdrawals — and the unwind happens in the next fifteen minutes.

By the time a hack shows up in a trend indicator, your bot has already eaten the gap. The signal you actually needed fired hours earlier, in a forensic pattern: a confirmed exploit, a self-custody withdrawal stampede, a depeg cascade rippling across the stable basket.

That acute, short-horizon signature is its own regime. It's Regime #11 of 14 — Security / Black Swan — in our regime taxonomy, and it now ships as a handful of endpoints built for one job: telling an automated agent to go risk-off before the candle prints.

What the Security Stress Score Actually Measures

The core number is security_stress_score — a 0-100 composite with a baseline of 0. Unlike a trend score that idles at 50, security stress is absence-by-default: a calm market reads 0, and the number only climbs when something is actively breaking.

It blends three independent sub-scores, each 0-100, then re-normalizes over whichever feeds are live so a dead feed never masquerades as 'all clear':

Sub-score	Weight	What it catches	Source
`hack_subscore`	0.45	Confirmed exploits in the last 10d, scored by USD lost × recency decay	DefiLlama hacks registry
`flow_subscore`	0.30	Worst net-CEX flow z-score (self-custody flight / dump deposits)	Exchange net flows
`depeg_subscore`	0.25	Stablecoin depeg cascade severity, cap-weighted, dead-zoned	CoinGecko stable prices

The composite formula is literally 0.45·hack + 0.30·flow + 0.25·depeg. When a feed is down, partial flips true and inputs_available lists exactly which feeds backed the number.

The hack weight dominates for a reason: a confirmed, USD-quantified exploit is the cleanest black-swan signal there is. Flow stress is the second tell — a withdrawal stampede off an exchange, or a wall of deposits queued to dump, both read as stress regardless of direction. Depeg rounds it out, because a major stable breaking peg is how local trouble turns systemic.

Reading the Band: From Dormant to Critical

The raw score maps to a band so an agent can branch on a label instead of a magic threshold. The cut-points are baseline-0 and shared with the Event/Catalyst regime (#5):

Band	Score	What it means for a bot
`dormant`	< 10	No meaningful security stress. Trade your base regime normally.
`quiet`	10–29	Background noise — a small hack or minor flow blip. Watch, don't act.
`elevated`	30–54	Something real is dislocating. Tighten stops, trim leverage.
`heavy`	55–79	Acute stress — large hack or hard depeg in progress. Cut size, bias short.
`critical`	≥ 80	Black-swan signature. Flatten risk, gate new entries.

Because the baseline is 0, you can treat any reading above elevated as a hard override on an otherwise-bullish base regime. A green trend during a heavy security band is exactly the kind of trap this overlay exists to catch.

How Do I Pull the Current Security Regime in One Call?

Two endpoints cover most needs. /security/regime/score returns the composite, all three sub-scores, and the explainability fields. /security/regime returns the same headline score plus the recent events list (up to 10 days back).

curl -H "X-API-Key: cdk_live_yourkey" \
  "https://cryptodataapi.com/api/v1/security/regime/score"

A representative response during a mid-sized exploit:

{
  "as_of": "2026-06-11T14:30:00+00:00",
  "security_stress_score": 41.8,
  "band": "elevated",
  "hack_subscore": 62.3,
  "flow_subscore": 28.0,
  "depeg_subscore": 0.0,
  "hacks_in_window": 2,
  "largest_hack_usd": 84000000.0,
  "worst_flow_symbol": "USDC",
  "worst_flow_zscore": 3.41,
  "events_count": 2,
  "counts": {"hack": 2, "depeg": 0},
  "partial": false,
  "inputs_available": ["depeg", "flow", "hack"],
  "security_headlines": { "advisory_pressure": 0.71, "...": "..." }
}

Note largest_hack_usd and worst_flow_symbol: the regime doesn't just hand you a number, it tells you which event is driving it. An agent can log 'risk-off: $84M hack + USDC outflow z=3.4' without a second call.

Drilling Into the Events Behind the Score

The score is the trigger; the events list is the evidence. /security/events returns each underlying event and accepts three filters so an agent can ask precise questions:

type — hack or depeg. Isolate exploit risk from stablecoin risk.
symbol — only events implicating a given ticker (e.g. ?symbol=USDC). Strips the trailing USDT for you.
min_severity — a 0.0–1.0 floor. Set ?min_severity=0.5 to ignore everything but the serious stuff.

Each event carries event_type, title, date, days_ago, the affected symbols list, a short/neutral bias, and a 0–1 severity. Hack events add amount_usd, technique, target_type, and chains; depeg events add deviation_bps.

curl -H "X-API-Key: cdk_live_yourkey" \
  "https://cryptodataapi.com/api/v1/security/events?type=hack&min_severity=0.5"

One item from the response:

{
  "event_type": "hack",
  "title": "SomeBridge protocol exploit \u2014 $84M lost",
  "date": "2026-06-10",
  "days_ago": 1,
  "symbols": [],
  "bias": "short",
  "severity": 0.84,
  "amount_usd": 84000000.0,
  "technique": "oracle_manipulation",
  "target_type": "protocol",
  "chains": ["ethereum", "arbitrum"],
  "source": "defillama_hacks"
}

Wiring Black-Swan Detection Into an Agent

The pattern is a single guard call before any new-position logic. Pull the score, branch on the band, and let the explainability fields feed your log line.

import httpx

HDR = {"X-API-Key": "cdk_live_yourkey"}
BASE = "https://cryptodataapi.com/api/v1/security"

def security_gate() -> bool:
    """Return True if it is safe to open new risk."""
    s = httpx.get(f"{BASE}/regime/score", headers=HDR).json()
    band = s["band"]
    if band in ("heavy", "critical"):
        print(
            f"RISK-OFF [{band}] score={s['security_stress_score']} "
            f"hack=${(s['largest_hack_usd'] or 0)/1e6:.0f}M "
            f"flow={s['worst_flow_symbol']} z={s['worst_flow_zscore']}"
        )
        return False
    return band != "elevated"  # be conservative above 'quiet'

if security_gate():
    pass  # ... your entry logic ...

The composite, recent events, and filterable list are open to any valid key. Two endpoints are Pro+: the per-symbol overlay GET /security/regime/{symbol} (returns the implicating events, an acute_bias, and max_severity for one ticker, plus its hl_symbol), and the force-recompute POST /security/regime/refresh.

Backtestable Score, Live-Only Headlines

The composite is partly backfillable. All three sub-scores replay from dated history — the DefiLlama hacks registry (dated + USD-quantified), archived net flows, and historical stablecoin prices — through the same assembly the live service uses. A backfilled day equals what the regime would have produced live, so you can replay risk-off gating in a backtest.

The one piece that does not backfill is security_headlines: a live-only sidecar of classified breaking advisories from free RSS feeds (rekt.news post-mortems and SlowMist). It carries advisory_pressure, a headline_count, and the top classified top_headlines. It often fires hours before a hack lands in any curated dataset — but RSS only gives you the recent window, so it lands null on backfilled days and stays out of the replayable composite.

This split matters for how you deploy the regime. The backfillable composite is what you trust in a backtest and in production gating. The headlines sidecar is an early-warning tap — useful for a human-in-the-loop alert, but never wire an automated kill-switch to it alone, because it isn't reproducible historically.

Related reading: this regime pairs naturally with our token-level rug-pull and contract risk scoring for pre-trade vetting, and the stablecoin flows indicator that feeds the same depeg machinery used here.

When to Reach for the Security / Black Swan Regime

This isn't an alpha signal you trade into — it's a circuit breaker. It earns its place in three spots:

As a pre-entry gate. Call /security/regime/score before any new position. Above elevated, override a bullish base regime and stand down. This is the single highest-value use.
As a position-sizing dial. Map the security_stress_score to a leverage multiplier — full size at dormant, scaling to zero by critical — so risk shrinks smoothly as stress builds.
As a contagion alert. Poll /security/events with min_severity=0.5 and route worst_flow_symbol / affected symbols straight into a watchlist for the names most likely to gap.

It is regime #11 of the fourteen baskets in our 14-regime framework. Run it as an overlay on whatever directional regime you're already in — because the cheapest black-swan trade is the one you never put on.