Monitoring

This page covers Theft Shield monitoring status and controls.

Monitoring Status

Status Indicators

Status	Meaning	Icon
Active	Full protection enabled	🛡️ Green shield
Paused	Temporarily disabled	⏸️ Yellow pause
Needs Attention	PSBTs need regeneration	⚠️ Orange warning
Inactive	Not configured	⚪ Gray empty

Viewing Status

Navigate to Wallets → [Wallet] → Theft Shield to see:

• Current monitoring status
• Last activity timestamp
• PSBT validity status
• Protected UTXO count

Active Monitoring

When Theft Shield is active:

1. Mempool Scanning - Every transaction is checked
2. UTXO Matching - Transactions spending your UTXOs are flagged
3. Whitelist Check - Legitimate transactions are allowed
4. Ready to Respond - PSBTs are ready for instant broadcast

What We Monitor

Data Point	Frequency
Bitcoin mempool	Continuous
Your monitored UTXOs	Real-time
Transaction propagation	Per-transaction

Pausing Protection

You can temporarily pause Theft Shield:

When to Pause

• Making transactions to non-whitelisted addresses - If you need to send funds to a new address
• Testing your setup
• Maintenance periods
• UTXO consolidation

Moving Funds Safely

If you need to move funds from your protected wallet:

Option 1: Whitelist the destination (recommended)

1. Add the destination address to your whitelist
2. Make the transaction
3. Protection remains active
4. Remove from whitelist after confirmation (optional)

Option 2: Temporarily disable protection

1. Pause Theft Shield
2. Make the transaction
3. Wait for confirmation
4. Re-enable Theft Shield
5. Regenerate and re-sign PSBTs (required - your withdrawal invalidated them)

How to Pause

1. Go to Theft Shield → Monitoring
2. Click Pause Protection
3. Select duration (1 hour, 4 hours, 24 hours, indefinite)
4. Confirm

Auto-Resume

If you select a duration, protection automatically resumes after that time.

Manual Resume

1. Go to Theft Shield → Monitoring
2. Click Resume Protection

Vulnerability Window

While paused, your wallet is NOT protected. Keep pause duration minimal.

"Needs Attention" Status

This status indicates your PSBTs need regeneration.

Common Causes

Cause	Solution
Transaction sent	PSBTs invalidated, must regenerate
UTXO consolidated	PSBTs invalidated, must regenerate
New deposit received	Coverage reduced, regenerate recommended
PSBT expired	Regenerate PSBTs

Understanding Reduced Coverage

When coverage drops below 100% due to new deposits, RBF protection still works for any theft attempt that includes covered UTXOs. However, if an attacker targets ONLY the new uncovered UTXOs (rare, since attackers typically want all funds), RBF cannot intercept it. Regenerating PSBTs ensures complete protection.

Resolving

1. Click Regenerate PSBTs
2. Download new unsigned PSBTs
3. Sign with your hardware wallet
4. Upload signed PSBTs
5. Status returns to Active

Notifications

Monitoring Alerts

Vigil sends notifications for:

Event	Description
psbt.invalidated	PSBTs need regeneration
theft_shield.monitoring_toggled	Monitoring was toggled
theft_shield.incident_detected	Potential theft detected
theft_shield.sweep_broadcast	Defense transaction broadcast

Configuring Alerts

1. Go to Settings → Notifications → Preferences
2. Find "Theft Shield" section
3. Enable desired event notifications
4. Select channels (Email, Nostr, Webhook)

Dashboard Metrics

The Theft Shield dashboard shows:

Protection Overview

┌─────────────────────────────────┐
│ Theft Shield - Active 🛡️        │
├─────────────────────────────────┤
│ Protected Value:  0.5 BTC       │
│ Protected UTXOs:  3             │
│ Valid PSBTs:      4 rounds      │
│ Fee Budget:       0.01 BTC      │
│ Last Scan:        2 sec ago     │
└─────────────────────────────────┘

Activity Log

Recent monitoring activity:

[12:34:56] Mempool scan completed
[12:34:52] Mempool scan completed
[12:30:00] PSBT validity confirmed
[12:00:00] Daily status check: OK

Health Checks

Vigil performs regular health checks:

Automated Checks

Check	Frequency	Purpose
PSBT validity	Hourly	Ensure PSBTs match current UTXOs
UTXO sync	Per-block	Track UTXO changes
Safe address	Daily	Verify address is valid

Manual Check

1. Go to Theft Shield → Monitoring
2. Click Run Health Check
3. Review results

---

Next: Incidents →