How Kamino monitors multisigs, market activity and program upgrades with Range

Kamino is one of Solana's largest lending protocols, with approximately $1.4 billion in total value locked as of September 2026. Its lending markets handle deposits, borrowing, repayments and liquidations, while its vaults regularly move capital between markets.

Keeping those operations secure requires monitoring activity across several parts of the protocol. Kamino needs visibility into transactions approved by its multisigs, large movements through its markets and changes to the programs supporting the assets it lists as collateral.

Some of those programs belong to third-party issuers. Kamino can't control when those issuers upgrade their code, but those changes can affect assets used throughout its lending markets.

Kamino has worked with Range since June 2025 to monitor these activities in real time. Its team receives alerts for significant market movements, multisig activity and program upgrades, including changes to partner-operated programs.

The setup lets Kamino's team review unexpected activity across its lending operations without monitoring every transaction manually.

The largest theft in crypto history broke no smart contract

Smart contract audits are essential to protocol security, but they cannot account for every risk a protocol faces once it is operating.

The $1.5 billion Bybit theft in February 2025 is a good example. According to the FBI, North Korean attackers compromised the infrastructure used to approve transactions from a cold wallet. The attackers manipulated the signing interface, leading authorized signers to approve a transaction that transferred control of the wallet.

A similar incident affected Radiant Capital in October 2024, when attackers compromised developers' devices and manipulated what signers saw during transaction approval. Radiant lost approximately $50 million, according to its post-mortem.

These incidents exposed weaknesses in transaction approval processes rather than vulnerabilities in the protocols' underlying smart contracts.

For lending protocols such as Kamino, operational security also involves monitoring market activity and program upgrades. A compromised multisig could put treasury funds or upgrade authority at risk. Unexpected asset movement could require immediate investigation. An upgrade to a third-party token program could affect the collateral the protocol uses.

Continuous onchain monitoring gives teams visibility into these activities as they happen, allowing them to review unexpected events and respond accordingly.

How Kamino monitors its operations with Range

Kamino operates lending markets and vaults on Solana, including markets supporting tokenized real-world assets (RWAs). Some of these assets rely on programs controlled by external issuers, adding risks beyond Kamino's own infrastructure.

Kamino has worked with Range since June 2025, initially to monitor its Squads multisigs, which control treasury funds and program upgrades. Monitoring has since expanded to cover three areas:

• Multisigs: Transactions and approvals involving treasury funds and program authority.
• Market activity: Large individual inflows and outflows across its lending markets.
• Program upgrades: Changes to Kamino's own programs and those managed by third-party issuers.

Range monitors this activity onchain and sends real-time alerts to Kamino's team when configured conditions are met, allowing it to review significant movements and unexpected changes as they occur.

Reducing unnecessary alerts across lending markets

One of Kamino's challenges was identifying significant market movements without overwhelming its team with alerts. Its lending vaults regularly rebalance capital across markets. Deposits, repayments, liquidations and curator reallocations also generate constant activity.

Initially, Kamino monitored cumulative inflows and outflows over a defined period. However, routine rebalancing frequently pushed total volumes above the alert thresholds.

As a result, it triggered too many alerts for transactions that were part of normal protocol operations.

Kamino worked with Range to adjust its monitoring rules. Instead of triggering alerts based on cumulative transaction volume, it now focuses on large individual inflows and outflows. Kamino receives alerts through its existing team communication channels.

The thresholds are deliberately set around how Kamino's markets operate. This lets regular rebalancing continue without repeatedly triggering alerts while still bringing unusually large movements to the team's attention.

Large individual outflows from market accounts trigger real-time alerts. The change makes monitoring more useful for Kamino's day-to-day operations. The team can focus on transactions that warrant closer examination rather than reviewing expected market activity.

Monitoring program upgrades as Kamino grows

Kamino uses Range to monitor upgrades to its own programs and those supporting third-party assets, particularly RWA tokens listed as collateral.

Issuers control these external programs and can upgrade them independently of Kamino. Such changes could affect how the assets behave and potentially introduce new risks to its lending markets.

Range alerts Kamino when an upgrade proposal appears for its own programs or when an upgrade to a partner program occurs onchain, allowing the team to review the changes and assess their impact.

As Kamino launches new markets and onboards curators, it also needs to add new market accounts and multisigs to monitoring. Today, the team does this manually, which creates the risk that an account gets overlooked during a launch.

“Range gives us the flexibility to monitor our markets, multisigs and program upgrades as the protocol grows. We're now working to integrate its API into our launch process so new markets and accounts are covered from day one.” Marius George Ciubotariu, Co-Founder & CTO, Kamino

To address this, Kamino plans to integrate Range's API into its launch process. New market accounts and multisigs would automatically be added to monitoring when a market launches or a curator is onboarded, helping Kamino maintain coverage as the protocol expands.

Building monitoring around how the protocol operates

Kamino's experience shows why effective monitoring needs to reflect how a protocol operates. Routine vault rebalancing should not generate unnecessary alerts, while significant market movements, unexpected program upgrades and sensitive multisig activity require timely review.

With Range, Kamino monitors these activities in real time, using alert thresholds tailored to its markets and direct links to onchain transactions. Monitoring also extends to third-party programs supporting its listed assets, giving the team visibility into upgrades outside its control.

As Kamino expands, it plans to integrate Range's API into its launch process so new markets and multisigs are added to monitoring automatically.

Range's Treasury and Portfolio Risk module lets protocols configure monitoring around their operations, maintain visibility across critical accounts, and review significant activity as it happens.

If your protocol lists collateral on programs you do not control, or launches markets faster than a monitoring list gets updated, get in touch with us. We will walk through how Kamino covers its multisigs, markets and partner program upgrades, and map the same coverage model to your accounts, programs and workflows.