general cleanup - removed old comments, enforced naming conventions etc

2026-03-04 23:29:58 -05:00
parent 44dad43f1d
commit 2c86bba235
55 changed files with 68 additions and 101 deletions
--- a/backend/internal/config/config.go
+++ b/backend/internal/config/config.go
@@ -0,0 +1,111 @@
+//loads environment-based configuration.
+package config
+
+import (
+	"fmt"
+	"os"
+	"strconv"
+	"strings"
+)
+
+const (
+	defaultPort = 3001
+	defaultDBPort = 5432
+	defaultPollIntervalMS = 60000
+	minPollIntervalMS = 1000
+	defaultDigestIntervalHours = 24
+)
+
+type Config struct {
+	Port              int
+	APIBasePath       string
+	DatabaseURL       string
+	DBHost            string
+	DBPort            int
+	DBUser            string
+	DBPassword        string
+	DBName            string
+	FirebaseProjectID string
+	EthRPCURL         string
+	PollIntervalMS    int
+	NodeEnv           string
+	ResendAPIKey         string
+	EmailFrom            string
+	DigestIntervalHours  int
+	StripeSecretKey      string
+	StripeWebhookSecret  string
+	StripePriceID        string
+	StripePublishableKey string
+	FrontendURL          string
+}
+
+// Load reads configuration from environment variables and returns a Config.
+func Load() (*Config, error) {
+	cfg := &Config{
+		Port:              getEnvInt("PORT", defaultPort),
+		APIBasePath:       getEnv("API_BASE_PATH", "/v1"),
+		DatabaseURL:       os.Getenv("DATABASE_URL"),
+		DBHost:            getEnv("DB_HOST", "localhost"),
+		DBPort:            getEnvInt("DB_PORT", defaultDBPort),
+		DBUser:            os.Getenv("DB_USER"),
+		DBPassword:        os.Getenv("DB_PASSWORD"),
+		DBName:            os.Getenv("DB_NAME"),
+		FirebaseProjectID: os.Getenv("FIREBASE_PROJECT_ID"),
+		EthRPCURL:         os.Getenv("ETH_RPC_URL"),
+		PollIntervalMS:    getEnvInt("POLL_INTERVAL_MS", defaultPollIntervalMS),
+		NodeEnv:           getEnv("NODE_ENV", "development"),
+		ResendAPIKey:        os.Getenv("RESEND_API_KEY"),
+		EmailFrom:           getEnv("EMAIL_FROM", "Koin Ping <alerts@koinping.com>"),
+		DigestIntervalHours:  getEnvInt("DIGEST_INTERVAL_HOURS", defaultDigestIntervalHours),
+		StripeSecretKey:      os.Getenv("STRIPE_SECRET_KEY"),
+		StripeWebhookSecret:  os.Getenv("STRIPE_WEBHOOK_SECRET"),
+		StripePriceID:        os.Getenv("STRIPE_PRICE_ID"),
+		StripePublishableKey: os.Getenv("STRIPE_PUBLISHABLE_KEY"),
+		FrontendURL:          getEnv("FRONTEND_URL", "http://localhost:3000"),
+	}
+
+	if cfg.PollIntervalMS < minPollIntervalMS {
+		return nil, fmt.Errorf("POLL_INTERVAL_MS must be >= 1000, got %d", cfg.PollIntervalMS) //nolint:err113
+	}
+
+	return cfg, nil
+}
+
+func (c *Config) DSN() string {
+	if c.DatabaseURL != "" {
+		// Append sslmode=disable if not already specified.
+		if !strings.Contains(c.DatabaseURL, "sslmode=") {
+			sep := "?"
+			if strings.Contains(c.DatabaseURL, "?") {
+				sep = "&"
+			}
+
+			return c.DatabaseURL + sep + "sslmode=disable"
+		}
+
+		return c.DatabaseURL
+	}
+
+	return fmt.Sprintf(
+		"host=%s port=%d user=%s password=%s dbname=%s sslmode=disable",
+		c.DBHost, c.DBPort, c.DBUser, c.DBPassword, c.DBName,
+	)
+}
+
+func getEnv(key, fallback string) string {
+	if v := os.Getenv(key); v != "" {
+		return v
+	}
+
+	return fallback
+}
+
+func getEnvInt(key string, fallback int) int {
+	if v := os.Getenv(key); v != "" {
+		if n, err := strconv.Atoi(v); err == nil {
+			return n
+		}
+	}
+
+	return fallback
+}
--- a/backend/internal/database/postgres.go
+++ b/backend/internal/database/postgres.go
@@ -0,0 +1,68 @@
+package database
+
+import (
+	"context"
+	"fmt"
+	"log"
+	"time"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+const (
+
+	maxConnIdleSeconds = 30
+
+	maxConnLifetimeMinutes = 5
+
+	connectTimeoutSeconds = 10
+
+	maxConns = 20
+
+	minConns = 2
+)
+
+var pool *pgxpool.Pool //nolint:gochecknoglobals
+
+// establishPostgreSQL connection pool using the given DSN.
+func Connect(dsn string) (*pgxpool.Pool, error) {
+	cfg, err := pgxpool.ParseConfig(dsn)
+	if err != nil {
+		return nil, fmt.Errorf("parse database config: %w", err)
+	}
+
+	cfg.MaxConns = maxConns
+	cfg.MinConns = minConns
+	cfg.MaxConnIdleTime = maxConnIdleSeconds * time.Second
+	cfg.MaxConnLifetime = maxConnLifetimeMinutes * time.Minute
+
+	ctx, cancel := context.WithTimeout(context.Background(), connectTimeoutSeconds*time.Second)
+	defer cancel()
+
+	p, err := pgxpool.NewWithConfig(ctx, cfg)
+	if err != nil {
+		return nil, fmt.Errorf("create connection pool: %w", err)
+	}
+
+	if err := p.Ping(ctx); err != nil {
+		p.Close()
+
+		return nil, fmt.Errorf("ping database: %w", err)
+	}
+
+	log.Println("Connected to PostgreSQL database")
+	pool = p
+
+	return p, nil
+}
+
+func Pool() *pgxpool.Pool {
+	return pool
+}
+
+func Close() {
+	if pool != nil {
+		pool.Close()
+		log.Println("Database connection pool closed")
+	}
+}
--- a/backend/internal/domain/types.go
+++ b/backend/internal/domain/types.go
@@ -0,0 +1,149 @@
+package domain
+
+import "time"
+
+type User struct {
+	ID                    string     `json:"id"`
+	FirebaseUID           string     `json:"-"`
+	Email                 string     `json:"email"`
+	DisplayName           *string    `json:"display_name"`           //nolint:tagliatelle
+	StripeCustomerID      *string    `json:"-"`
+	StripeSubscriptionID  *string    `json:"-"`
+	SubscriptionStatus    string     `json:"subscription_status"`    //nolint:tagliatelle
+	SubscriptionCreatedAt *time.Time `json:"subscription_created_at,omitempty"` //nolint:tagliatelle
+	CreatedAt             time.Time  `json:"created_at"`             //nolint:tagliatelle
+	UpdatedAt             time.Time  `json:"updated_at"`             //nolint:tagliatelle
+}
+
+type Address struct {
+	ID        int       `json:"id"`
+	UserID    string    `json:"user_id"`    //nolint:tagliatelle
+	Address   string    `json:"address"`
+	Label     *string   `json:"label"`
+	CreatedAt time.Time `json:"created_at"` //nolint:tagliatelle
+}
+
+type AlertType string
+
+func (a AlertType) String() string { return string(a) }
+
+const (
+	AlertIncomingTx    AlertType = "incoming_tx"
+	AlertOutgoingTx    AlertType = "outgoing_tx"
+	AlertLargeTransfer AlertType = "large_transfer"
+	AlertBalanceBelow  AlertType = "balance_below"
+)
+
+var ValidAlertTypes = []AlertType{ //nolint:gochecknoglobals
+	AlertIncomingTx,
+	AlertOutgoingTx,
+	AlertLargeTransfer,
+	AlertBalanceBelow,
+}
+
+// ThresholdRequiredTypes lists alert types that require a threshold value.
+var ThresholdRequiredTypes = []AlertType{ //nolint:gochecknoglobals
+	AlertLargeTransfer,
+	AlertBalanceBelow,
+}
+
+// returns true if the given string matches a known AlertType.
+func IsValidAlertType(t string) bool {
+	for _, v := range ValidAlertTypes {
+		if string(v) == t {
+			return true
+		}
+	}
+
+	return false
+}
+
+func IsThresholdRequired(t AlertType) bool {
+	for _, v := range ThresholdRequiredTypes {
+		if v == t {
+			return true
+		}
+	}
+
+	return false
+}
+
+type AlertRule struct {
+	ID        int       `json:"id"`
+	AddressID int       `json:"address_id"` //nolint:tagliatelle
+	Type      AlertType `json:"type"`
+	Threshold *float64  `json:"threshold"`
+	Enabled   bool      `json:"enabled"`
+	CreatedAt time.Time `json:"created_at"` //nolint:tagliatelle
+}
+
+type AlertEvent struct {
+	ID           int       `json:"id"`
+	AlertRuleID  int       `json:"alert_rule_id"`   //nolint:tagliatelle
+	Message      string    `json:"message"`
+	AddressLabel *string   `json:"address_label"`   //nolint:tagliatelle
+	TxHash       *string   `json:"tx_hash"`         //nolint:tagliatelle
+	Timestamp    time.Time `json:"timestamp"`
+}
+
+type AddressCheckpoint struct {
+	AddressID        int       `json:"address_id"`         //nolint:tagliatelle
+	LastCheckedBlock int       `json:"last_checked_block"` //nolint:tagliatelle
+	LastCheckedAt    time.Time `json:"last_checked_at"`    //nolint:tagliatelle
+}
+
+type CheckpointDetail struct {
+	AddressID        int       `json:"address_id"`         //nolint:tagliatelle
+	Address          string    `json:"address"`
+	Label            *string   `json:"label"`
+	LastCheckedBlock int       `json:"last_checked_block"` //nolint:tagliatelle
+	LastCheckedAt    time.Time `json:"last_checked_at"`    //nolint:tagliatelle
+}
+
+//  holds a user's notification preferences.
+type NotificationConfig struct {
+	UserID              string     `json:"user_id"`              //nolint:tagliatelle
+	DiscordWebhookURL   *string    `json:"discord_webhook_url"`  //nolint:tagliatelle
+	TelegramChatID      *string    `json:"telegram_chat_id"`     //nolint:tagliatelle
+	TelegramBotToken    *string    `json:"telegram_bot_token"`   //nolint:tagliatelle
+	Email               *string    `json:"email"`
+	SlackWebhookURL     *string    `json:"slack_webhook_url"`    //nolint:tagliatelle
+	NotificationEnabled bool       `json:"notification_enabled"` //nolint:tagliatelle
+	CreatedAt           *time.Time `json:"created_at,omitempty"` //nolint:tagliatelle
+	UpdatedAt           *time.Time `json:"updated_at,omitempty"` //nolint:tagliatelle
+}
+
+// NormalizedTx is a blockchain transaction normalized for internal use.
+type NormalizedTx struct {
+	Hash           string  `json:"hash"`
+	From           string  `json:"from"`
+	To             *string `json:"to"`
+	Value          string  `json:"value"` // Wei as string for precision
+	BlockNumber    int     `json:"block_number"`    //nolint:tagliatelle
+	BlockTimestamp int64   `json:"block_timestamp"` //nolint:tagliatelle
+
+	// ERC-20 token transfer fields (nil for native ETH transfers)
+	TokenContract *string `json:"token_contract,omitempty"` //nolint:tagliatelle
+	TokenSymbol   *string `json:"token_symbol,omitempty"`   //nolint:tagliatelle
+	TokenDecimals *int    `json:"token_decimals,omitempty"` //nolint:tagliatelle
+	TokenValue    *string `json:"token_value,omitempty"`    //nolint:tagliatelle
+}
+
+func (tx NormalizedTx) IsTokenTransfer() bool {
+	return tx.TokenContract != nil
+}
+
+type Direction string
+
+func (d Direction) String() string { return string(d) }
+
+const (
+	DirectionIncoming Direction = "incoming"
+	DirectionOutgoing Direction = "outgoing"
+)
+
+type ObservedTx struct {
+	NormalizedTx
+	AddressID int       `json:"address_id"` //nolint:tagliatelle
+	Direction Direction `json:"direction"`
+}
--- a/backend/internal/firebase/admin.go
+++ b/backend/internal/firebase/admin.go
@@ -0,0 +1,51 @@
+package firebase
+
+import (
+	"context"
+	"fmt"
+	"sync"
+
+	fb "firebase.google.com/go/v4"
+	"firebase.google.com/go/v4/auth"
+	"google.golang.org/api/option"
+)
+
+var ( //nolint:gochecknoglobals
+	authClient *auth.Client //nolint:gochecknoglobals
+	once       sync.Once    //nolint:gochecknoglobals
+	errInit    error        //nolint:gochecknoglobals
+)
+
+func Init(projectID string) error {
+	once.Do(func() {
+		ctx := context.Background()
+
+		var app *fb.App
+		var err error
+
+		if projectID != "" {
+			cfg := &fb.Config{ProjectID: projectID}
+			app, err = fb.NewApp(ctx, cfg, option.WithoutAuthentication())
+		} else {
+			app, err = fb.NewApp(ctx, nil)
+		}
+		if err != nil {
+			errInit = fmt.Errorf("initialize firebase app: %w", err)
+
+			return
+		}
+
+		authClient, err = app.Auth(ctx)
+		if err != nil {
+			errInit = fmt.Errorf("initialize firebase auth: %w", err)
+
+			return
+		}
+	})
+
+	return errInit
+}
+
+func Auth() *auth.Client {
+	return authClient
+}
--- a/backend/internal/handlers/address.go
+++ b/backend/internal/handlers/address.go
@@ -0,0 +1,159 @@
+// Package handlers implements HTTP request handlers for the API.
+package handlers
+
+import (
+	"encoding/json"
+	"log"
+	"net/http"
+	"regexp"
+	"strings"
+
+	"github.com/kjannette/koin-ping/backend/internal/domain"
+	"github.com/kjannette/koin-ping/backend/internal/middleware"
+	"github.com/kjannette/koin-ping/backend/internal/models"
+)
+
+var ethAddressRe = regexp.MustCompile(`^0x[a-fA-F0-9]{40}$`)
+
+type AddressHandler struct {
+	addresses *models.AddressModel
+}
+
+func NewAddressHandler(addresses *models.AddressModel) *AddressHandler {
+	return &AddressHandler{addresses: addresses}
+}
+
+func (h *AddressHandler) Create(w http.ResponseWriter, r *http.Request) {
+	userID := middleware.GetUserID(r.Context())
+
+	var body struct {
+		Address string  `json:"address"`
+		Label   *string `json:"label"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
+		log.Printf("Failed to decode address request body: %v", err)
+		writeError(w, http.StatusBadRequest, "VALIDATION_ERROR", "Invalid request body")
+
+		return
+	}
+
+	if body.Address == "" {
+		writeError(w, http.StatusBadRequest, "VALIDATION_ERROR", "Address is required")
+
+		return
+	}
+
+	if !ethAddressRe.MatchString(body.Address) {
+		writeError(w, http.StatusBadRequest, "VALIDATION_ERROR", "Invalid Ethereum address format")
+
+		return
+	}
+
+	log.Printf("User %s creating address: %s", userID, body.Address)
+
+	addr, err := h.addresses.Create(r.Context(), userID, body.Address, body.Label)
+	if err != nil {
+		if strings.Contains(err.Error(), "23505") || strings.Contains(err.Error(), "unique") {
+			writeError(w, http.StatusBadRequest, "VALIDATION_ERROR", "You are already tracking this address")
+
+			return
+		}
+		log.Printf("Error creating address: %v", err)
+		writeError(w, http.StatusInternalServerError, "INTERNAL_ERROR", "Failed to create address")
+
+		return
+	}
+
+	log.Printf("Address created with ID: %d", addr.ID)
+	writeJSON(w, http.StatusCreated, addr)
+}
+
+// List handles GET requests to list all tracked addresses for the current user.
+func (h *AddressHandler) List(w http.ResponseWriter, r *http.Request) {
+	userID := middleware.GetUserID(r.Context())
+	log.Printf("User %s listing addresses", userID)
+
+	addresses, err := h.addresses.ListByUser(r.Context(), userID)
+	if err != nil {
+		log.Printf("Error listing addresses: %v", err)
+		writeError(w, http.StatusInternalServerError, "INTERNAL_ERROR", "Failed to list addresses")
+
+		return
+	}
+
+	if addresses == nil {
+		addresses = []domain.Address{}
+	}
+
+	log.Printf("Found %d addresses for user", len(addresses))
+	writeJSON(w, http.StatusOK, addresses)
+}
+
+//  handles PATCH requests to update an address label.
+func (h *AddressHandler) UpdateLabel(w http.ResponseWriter, r *http.Request) {
+	userID := middleware.GetUserID(r.Context())
+	addressID, ok := parseIntParam(r.PathValue("addressId"))
+	if !ok {
+		writeError(w, http.StatusBadRequest, "VALIDATION_ERROR", "Invalid address ID")
+
+		return
+	}
+
+	var body struct {
+		Label *string `json:"label"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
+		writeError(w, http.StatusBadRequest, "VALIDATION_ERROR", "Invalid request body")
+
+		return
+	}
+
+	log.Printf("User %s updating label for address ID: %d", userID, addressID)
+
+	addr, err := h.addresses.UpdateLabel(r.Context(), addressID, userID, body.Label)
+	if err != nil {
+		log.Printf("Error updating address label: %v", err)
+		writeError(w, http.StatusInternalServerError, "INTERNAL_ERROR", "Failed to update address")
+
+		return
+	}
+
+	if addr == nil {
+		writeError(w, http.StatusNotFound, "NOT_FOUND", "Address not found")
+
+		return
+	}
+
+	writeJSON(w, http.StatusOK, addr)
+}
+
+// Remove handles DELETE requests to remove a tracked address.
+func (h *AddressHandler) Remove(w http.ResponseWriter, r *http.Request) {
+	userID := middleware.GetUserID(r.Context())
+	addressID, ok := parseIntParam(r.PathValue("addressId"))
+	if !ok {
+		writeError(w, http.StatusBadRequest, "VALIDATION_ERROR", "Invalid address ID")
+
+		return
+	}
+
+	log.Printf("User %s deleting address ID: %d", userID, addressID)
+
+	deleted, err := h.addresses.Remove(r.Context(), addressID, userID)
+	if err != nil {
+		log.Printf("Error deleting address: %v", err)
+		writeError(w, http.StatusInternalServerError, "INTERNAL_ERROR", "Failed to delete address")
+
+		return
+	}
+
+	if !deleted {
+		log.Printf("Address %d not found or not owned by user", addressID)
+		writeError(w, http.StatusNotFound, "NOT_FOUND", "Address not found")
+
+		return
+	}
+
+	log.Printf("Address %d deleted", addressID)
+	w.WriteHeader(http.StatusNoContent)
+}
--- a/backend/internal/handlers/alert_event.go
+++ b/backend/internal/handlers/alert_event.go
@@ -0,0 +1,58 @@
+package handlers
+
+import (
+	"log"
+	"net/http"
+	"strconv"
+
+	"github.com/kjannette/koin-ping/backend/internal/domain"
+	"github.com/kjannette/koin-ping/backend/internal/middleware"
+	"github.com/kjannette/koin-ping/backend/internal/models"
+)
+
+// AlertEventHandler handles HTTP requests for alert event history.
+type AlertEventHandler struct {
+	alertEvents *models.AlertEventModel
+}
+
+// NewAlertEventHandler creates a new AlertEventHandler.
+func NewAlertEventHandler(alertEvents *models.AlertEventModel) *AlertEventHandler {
+	return &AlertEventHandler{alertEvents: alertEvents}
+}
+
+// List handles GET requests to list recent alert events for the current user.
+func (h *AlertEventHandler) List(w http.ResponseWriter, r *http.Request) {
+	userID := middleware.GetUserID(r.Context())
+
+	limitStr := r.URL.Query().Get("limit")
+	limit := 20
+	if limitStr != "" {
+		if n, err := strconv.Atoi(limitStr); err == nil {
+			limit = n
+		}
+	}
+
+	log.Printf("User %s listing alert events (limit: %d)", userID, limit)
+
+	if limit < 1 || limit > 100 {
+		writeError(w, http.StatusBadRequest, "VALIDATION_ERROR", "Limit must be between 1 and 100")
+
+		return
+	}
+
+	events, err := h.alertEvents.ListRecentByUser(r.Context(), userID, limit)
+	if err != nil {
+		log.Printf("Error listing alert events: %v", err)
+		writeError(w, http.StatusInternalServerError, "INTERNAL_ERROR", "Failed to list alert events")
+
+		return
+	}
+
+	log.Printf("Found %d alert events for user", len(events))
+
+	if events == nil {
+		events = []domain.AlertEvent{}
+	}
+
+	writeJSON(w, http.StatusOK, events)
+}
--- a/backend/internal/handlers/alert_rule.go
+++ b/backend/internal/handlers/alert_rule.go
@@ -0,0 +1,274 @@
+package handlers
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"log"
+	"net/http"
+	"strconv"
+	"strings"
+
+	"github.com/kjannette/koin-ping/backend/internal/domain"
+	"github.com/kjannette/koin-ping/backend/internal/middleware"
+	"github.com/kjannette/koin-ping/backend/internal/models"
+)
+
+var errThresholdFormat = errors.New("unsupported threshold format")
+
+type AlertRuleHandler struct {
+	alertRules *models.AlertRuleModel
+	addresses  *models.AddressModel
+}
+
+func NewAlertRuleHandler(alertRules *models.AlertRuleModel, addresses *models.AddressModel) *AlertRuleHandler {
+	return &AlertRuleHandler{alertRules: alertRules, addresses: addresses}
+}
+
+func (h *AlertRuleHandler) Create(w http.ResponseWriter, r *http.Request) {
+	userID := middleware.GetUserID(r.Context())
+	addressID, ok := parseIntParam(r.PathValue("addressId"))
+	if !ok {
+		writeError(w, http.StatusBadRequest, "VALIDATION_ERROR", "Invalid address ID")
+
+		return
+	}
+
+	var body struct {
+		Type      string          `json:"type"`
+		Threshold json.RawMessage `json:"threshold"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
+		log.Printf("Failed to decode alert request body: %v", err)
+		writeError(w, http.StatusBadRequest, "VALIDATION_ERROR", "Invalid request body")
+
+		return
+	}
+
+	threshold, err := parseThreshold(body.Threshold)
+	if err != nil {
+		log.Printf("Failed to parse threshold: %v", err)
+		writeError(w, http.StatusBadRequest, "VALIDATION_ERROR", "threshold must be a valid number")
+
+		return
+	}
+
+	log.Printf("User %s creating alert: type=%s, addressID=%d", userID, body.Type, addressID)
+
+	if body.Type == "" {
+		writeError(w, http.StatusBadRequest, "VALIDATION_ERROR", "Alert type is required")
+
+		return
+	}
+
+	if !domain.IsValidAlertType(body.Type) {
+		types := make([]string, len(domain.ValidAlertTypes))
+		for i, t := range domain.ValidAlertTypes {
+			types[i] = t.String()
+		}
+		writeError(w, http.StatusBadRequest, "VALIDATION_ERROR",
+			"Invalid alert type. Must be one of: "+strings.Join(types, ", "))
+
+		return
+	}
+
+	alertType := domain.AlertType(body.Type)
+	if domain.IsThresholdRequired(alertType) {
+		if threshold == nil || *threshold <= 0 {
+			writeError(w, http.StatusBadRequest, "VALIDATION_ERROR",
+				fmt.Sprintf("Alert type '%s' requires a positive threshold value", body.Type))
+
+			return
+		}
+	}
+
+	addr, err := h.addresses.FindByID(r.Context(), addressID, &userID)
+	if err != nil {
+		log.Printf("Error finding address: %v", err)
+		writeError(w, http.StatusInternalServerError, "INTERNAL_ERROR", "Failed to create alert rule")
+
+		return
+	}
+	if addr == nil {
+		log.Printf("Address %d not found or not owned by user", addressID)
+		writeError(w, http.StatusNotFound, "NOT_FOUND", "Address not found")
+
+		return
+	}
+
+	newAlert, err := h.alertRules.Create(r.Context(), addressID, alertType, threshold)
+	if err != nil {
+		log.Printf("Error creating alert rule: %v", err)
+		writeError(w, http.StatusInternalServerError, "INTERNAL_ERROR", "Failed to create alert rule")
+
+		return
+	}
+
+	log.Printf("Alert rule created with ID: %d", newAlert.ID)
+	writeJSON(w, http.StatusCreated, newAlert)
+}
+
+func parseThreshold(raw json.RawMessage) (*float64, error) {
+	if len(raw) == 0 {
+		return nil, nil //nolint:nilnil
+	}
+
+	// Check null before number -- json.Unmarshal treats null as valid for float64 (sets to 0).
+	if string(raw) == "null" {
+		return nil, nil //nolint:nilnil
+	}
+
+	var asNumber float64
+	if err := json.Unmarshal(raw, &asNumber); err == nil {
+		return &asNumber, nil
+	}
+
+	var asString string
+	if err := json.Unmarshal(raw, &asString); err == nil {
+		asString = strings.TrimSpace(asString)
+		if asString == "" {
+			return nil, nil //nolint:nilnil
+		}
+		parsed, parseErr := strconv.ParseFloat(asString, 64)
+		if parseErr != nil {
+			return nil, parseErr
+		}
+
+		return &parsed, nil
+	}
+
+	return nil, errThresholdFormat
+}
+
+// ListByAddress handles GET requests to list alert rules for an address.
+func (h *AlertRuleHandler) ListByAddress(w http.ResponseWriter, r *http.Request) {
+	userID := middleware.GetUserID(r.Context())
+	addressID, ok := parseIntParam(r.PathValue("addressId"))
+	if !ok {
+		writeError(w, http.StatusBadRequest, "VALIDATION_ERROR", "Invalid address ID")
+
+		return
+	}
+
+	log.Printf("User %s listing alerts for address ID: %d", userID, addressID)
+
+	addr, err := h.addresses.FindByID(r.Context(), addressID, &userID)
+	if err != nil {
+		log.Printf("Error finding address: %v", err)
+		writeError(w, http.StatusInternalServerError, "INTERNAL_ERROR", "Failed to list alerts")
+
+		return
+	}
+	if addr == nil {
+		log.Printf("Address %d not found or not owned by user", addressID)
+		writeError(w, http.StatusNotFound, "NOT_FOUND", "Address not found")
+
+		return
+	}
+
+	alerts, err := h.alertRules.ListByAddress(r.Context(), addressID)
+	if err != nil {
+		log.Printf("Error listing alerts: %v", err)
+		writeError(w, http.StatusInternalServerError, "INTERNAL_ERROR", "Failed to list alerts")
+
+		return
+	}
+
+	if alerts == nil {
+		alerts = []domain.AlertRule{}
+	}
+
+	log.Printf("Found %d alert rules", len(alerts))
+	writeJSON(w, http.StatusOK, alerts)
+}
+
+// UpdateStatus handles PATCH requests to enable or disable an alert rule.
+func (h *AlertRuleHandler) UpdateStatus(w http.ResponseWriter, r *http.Request) {
+	userID := middleware.GetUserID(r.Context())
+	alertID, ok := parseIntParam(r.PathValue("alertId"))
+	if !ok {
+		writeError(w, http.StatusBadRequest, "VALIDATION_ERROR", "Invalid alert ID")
+
+		return
+	}
+
+	var body struct {
+		Enabled *bool `json:"enabled"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
+		log.Printf("Failed to decode update request body: %v", err)
+		writeError(w, http.StatusBadRequest, "VALIDATION_ERROR", "Invalid request body")
+
+		return
+	}
+
+	log.Printf("User %s updating alert ID: %d", userID, alertID)
+
+	if body.Enabled == nil {
+		writeError(w, http.StatusBadRequest, "VALIDATION_ERROR", "enabled must be a boolean value")
+
+		return
+	}
+
+	alert, err := h.alertRules.FindByID(r.Context(), alertID, &userID)
+	if err != nil {
+		log.Printf("Error finding alert: %v", err)
+		writeError(w, http.StatusInternalServerError, "INTERNAL_ERROR", "Failed to update alert")
+
+		return
+	}
+	if alert == nil {
+		log.Printf("Alert %d not found or not owned by user", alertID)
+		writeError(w, http.StatusNotFound, "NOT_FOUND", "Alert rule not found")
+
+		return
+	}
+
+	updated, err := h.alertRules.UpdateEnabled(r.Context(), alertID, *body.Enabled)
+	if err != nil {
+		log.Printf("Error updating alert: %v", err)
+		writeError(w, http.StatusInternalServerError, "INTERNAL_ERROR", "Failed to update alert")
+
+		return
+	}
+
+	log.Printf("Alert %d updated: enabled=%v", alertID, *body.Enabled)
+	writeJSON(w, http.StatusOK, updated)
+}
+
+// Remove handles DELETE requests to remove an alert rule.
+func (h *AlertRuleHandler) Remove(w http.ResponseWriter, r *http.Request) {
+	userID := middleware.GetUserID(r.Context())
+	alertID, ok := parseIntParam(r.PathValue("alertId"))
+	if !ok {
+		writeError(w, http.StatusBadRequest, "VALIDATION_ERROR", "Invalid alert ID")
+
+		return
+	}
+
+	log.Printf("User %s deleting alert ID: %d", userID, alertID)
+
+	alert, err := h.alertRules.FindByID(r.Context(), alertID, &userID)
+	if err != nil {
+		log.Printf("Error finding alert: %v", err)
+		writeError(w, http.StatusInternalServerError, "INTERNAL_ERROR", "Failed to delete alert")
+
+		return
+	}
+	if alert == nil {
+		log.Printf("Alert %d not found or not owned by user", alertID)
+		writeError(w, http.StatusNotFound, "NOT_FOUND", "Alert rule not found")
+
+		return
+	}
+
+	if _, err := h.alertRules.Remove(r.Context(), alertID); err != nil {
+		log.Printf("Error deleting alert: %v", err)
+		writeError(w, http.StatusInternalServerError, "INTERNAL_ERROR", "Failed to delete alert")
+
+		return
+	}
+
+	log.Printf("Alert %d deleted", alertID)
+	w.WriteHeader(http.StatusNoContent)
+}
--- a/backend/internal/handlers/alert_rule_test.go
+++ b/backend/internal/handlers/alert_rule_test.go
@@ -0,0 +1,252 @@
+//nolint:testpackage // parseThreshold is unexported; internal test package required
+package handlers
+
+import (
+	"encoding/json"
+	"math"
+	"testing"
+)
+
+//nolint:gocognit
+func TestParseThreshold(t *testing.T) {
+	t.Parallel()
+
+	t.Run("nil/empty raw message returns nil", func(t *testing.T) {
+		t.Parallel()
+
+		val, err := parseThreshold(nil)
+		if err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+		if val != nil {
+			t.Fatalf("expected nil, got %v", *val)
+		}
+	})
+
+	t.Run("empty slice returns nil", func(t *testing.T) {
+		t.Parallel()
+
+		val, err := parseThreshold(json.RawMessage{})
+		if err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+		if val != nil {
+			t.Fatalf("expected nil, got %v", *val)
+		}
+	})
+
+	t.Run("JSON null returns nil", func(t *testing.T) {
+		t.Parallel()
+
+		val, err := parseThreshold(json.RawMessage("null"))
+		if err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+		if val != nil {
+			t.Fatalf("expected nil, got %v", *val)
+		}
+	})
+
+	t.Run("number 10 returns 10.0", func(t *testing.T) {
+		t.Parallel()
+
+		val, err := parseThreshold(json.RawMessage("10"))
+		if err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+		if val == nil {
+			t.Fatal("expected non-nil value")
+		}
+		if *val != 10.0 {
+			t.Fatalf("expected 10.0, got %v", *val)
+		}
+	})
+
+	t.Run("number 0.5 returns 0.5", func(t *testing.T) {
+		t.Parallel()
+
+		val, err := parseThreshold(json.RawMessage("0.5"))
+		if err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+		if val == nil || *val != 0.5 {
+			t.Fatalf("expected 0.5, got %v", val)
+		}
+	})
+
+	t.Run("string '10' returns 10.0", func(t *testing.T) {
+		t.Parallel()
+
+		val, err := parseThreshold(json.RawMessage(`"10"`))
+		if err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+		if val == nil || *val != 10.0 {
+			t.Fatalf("expected 10.0, got %v", val)
+		}
+	})
+
+	t.Run("string '0.001' returns 0.001", func(t *testing.T) {
+		t.Parallel()
+
+		val, err := parseThreshold(json.RawMessage(`"0.001"`))
+		if err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+		if val == nil || math.Abs(*val-0.001) > 1e-9 {
+			t.Fatalf("expected 0.001, got %v", val)
+		}
+	})
+
+	t.Run("string with spaces '  10  ' returns 10.0", func(t *testing.T) {
+		t.Parallel()
+
+		val, err := parseThreshold(json.RawMessage(`"  10  "`))
+		if err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+		if val == nil || *val != 10.0 {
+			t.Fatalf("expected 10.0, got %v", val)
+		}
+	})
+
+	t.Run("empty string returns nil", func(t *testing.T) {
+		t.Parallel()
+
+		val, err := parseThreshold(json.RawMessage(`""`))
+		if err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+		if val != nil {
+			t.Fatalf("expected nil, got %v", *val)
+		}
+	})
+
+	t.Run("whitespace-only string returns nil", func(t *testing.T) {
+		t.Parallel()
+
+		val, err := parseThreshold(json.RawMessage(`"   "`))
+		if err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+		if val != nil {
+			t.Fatalf("expected nil, got %v", *val)
+		}
+	})
+
+	t.Run("invalid string returns error", func(t *testing.T) {
+		t.Parallel()
+
+		_, err := parseThreshold(json.RawMessage(`"abc"`))
+		if err == nil {
+			t.Fatal("expected error for non-numeric string")
+		}
+	})
+
+	t.Run("boolean returns error", func(t *testing.T) {
+		t.Parallel()
+
+		_, err := parseThreshold(json.RawMessage("true"))
+		if err == nil {
+			t.Fatal("expected error for boolean")
+		}
+	})
+
+	t.Run("array returns error", func(t *testing.T) {
+		t.Parallel()
+
+		_, err := parseThreshold(json.RawMessage("[1,2]"))
+		if err == nil {
+			t.Fatal("expected error for array")
+		}
+	})
+}
+
+//nolint:funlen
+func TestDecodeAlertBody(t *testing.T) {
+	t.Parallel()
+
+	// Verifies that the struct used in Create handler can decode all
+	// payload shapes the frontend might send.
+
+	type alertBody struct {
+		Type      string          `json:"type"`
+		Threshold json.RawMessage `json:"threshold"`
+	}
+
+	tests := []struct {
+		name    string
+		payload string
+		wantErr bool
+	}{
+		{
+			name:    "incoming_tx without threshold",
+			payload: `{"type":"incoming_tx"}`,
+		},
+		{
+			name:    "outgoing_tx without threshold",
+			payload: `{"type":"outgoing_tx"}`,
+		},
+		{
+			name:    "large_transfer with number threshold",
+			payload: `{"type":"large_transfer","threshold":10}`,
+		},
+		{
+			name:    "large_transfer with string threshold",
+			payload: `{"type":"large_transfer","threshold":"10"}`,
+		},
+		{
+			name:    "balance_below with number threshold",
+			payload: `{"type":"balance_below","threshold":0.5}`,
+		},
+		{
+			name:    "threshold null",
+			payload: `{"type":"incoming_tx","threshold":null}`,
+		},
+		{
+			name:    "empty object",
+			payload: `{}`,
+		},
+		{
+			name:    "empty body",
+			payload: ``,
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			var body alertBody
+			err := json.Unmarshal([]byte(tt.payload), &body)
+			if tt.wantErr {
+				if err == nil {
+					t.Fatal("expected decode error")
+				}
+
+				return
+			}
+			if err != nil {
+				t.Fatalf("unexpected decode error: %v", err)
+			}
+		})
+	}
+}
+
+func TestOldStructFailsWithStringThreshold(t *testing.T) {
+	t.Parallel()
+
+	// Documents the original bug: *float64 cannot decode a string threshold.
+	type oldAlertBody struct {
+		Type      string   `json:"type"`
+		Threshold *float64 `json:"threshold"`
+	}
+
+	payload := `{"type":"large_transfer","threshold":"10"}`
+	var body oldAlertBody
+	err := json.Unmarshal([]byte(payload), &body)
+	if err == nil {
+		t.Fatal("expected error: old struct with *float64 should reject string threshold")
+	}
+}
--- a/backend/internal/handlers/email_digest.go
+++ b/backend/internal/handlers/email_digest.go
@@ -0,0 +1,101 @@
+package handlers
+
+import (
+	"log"
+	"net/http"
+
+	"github.com/kjannette/koin-ping/backend/internal/middleware"
+	"github.com/kjannette/koin-ping/backend/internal/models"
+	"github.com/kjannette/koin-ping/backend/internal/services"
+)
+
+type EmailDigestHandler struct {
+	digestSvc *services.EmailDigestService
+	configs   *models.NotificationConfigModel
+}
+
+func NewEmailDigestHandler(
+	digestSvc *services.EmailDigestService,
+	configs *models.NotificationConfigModel,
+) *EmailDigestHandler {
+	return &EmailDigestHandler{digestSvc: digestSvc, configs: configs}
+}
+
+// SetupEmail reads the user's email from their notification config and sends
+// a confirmation message via Resend to verify the integration works.
+func (h *EmailDigestHandler) SetupEmail(w http.ResponseWriter, r *http.Request) {
+	userID := middleware.GetUserID(r.Context())
+
+	if !h.digestSvc.Configured() {
+		writeError(w, http.StatusServiceUnavailable, "EMAIL_NOT_CONFIGURED",
+			"Email service is not configured on the server")
+		return
+	}
+
+	cfg, err := h.configs.GetConfig(r.Context(), userID)
+	if err != nil {
+		log.Printf("Error getting notification config for email setup: %v", err)
+		writeError(w, http.StatusInternalServerError, "INTERNAL_ERROR",
+			"Failed to load notification config")
+		return
+	}
+
+	if cfg == nil || cfg.Email == nil || *cfg.Email == "" {
+		writeError(w, http.StatusBadRequest, "VALIDATION_ERROR",
+			"Save an email address in notification settings first")
+		return
+	}
+
+	if err := h.digestSvc.SetupEmail(*cfg.Email); err != nil {
+		log.Printf("Email setup failed for user %s: %v", userID, err)
+		writeError(w, http.StatusBadGateway, "EMAIL_SEND_FAILED",
+			"Failed to send confirmation email — check server email config")
+		return
+	}
+
+	log.Printf("Email setup confirmation sent to user %s (%s)", userID, *cfg.Email)
+	writeJSON(w, http.StatusOK, map[string]any{
+		"success": true,
+		"email":   *cfg.Email,
+		"message": "Confirmation email sent",
+	})
+}
+
+// SendDigest compiles and sends a digest of recent alerts to the user's email.
+func (h *EmailDigestHandler) SendDigest(w http.ResponseWriter, r *http.Request) {
+	userID := middleware.GetUserID(r.Context())
+
+	if !h.digestSvc.Configured() {
+		writeError(w, http.StatusServiceUnavailable, "EMAIL_NOT_CONFIGURED",
+			"Email service is not configured on the server")
+		return
+	}
+
+	cfg, err := h.configs.GetConfig(r.Context(), userID)
+	if err != nil {
+		log.Printf("Error getting notification config for digest: %v", err)
+		writeError(w, http.StatusInternalServerError, "INTERNAL_ERROR",
+			"Failed to load notification config")
+		return
+	}
+
+	if cfg == nil || cfg.Email == nil || *cfg.Email == "" {
+		writeError(w, http.StatusBadRequest, "VALIDATION_ERROR",
+			"No email address configured")
+		return
+	}
+
+	if err := h.digestSvc.SendDigest(r.Context(), userID, *cfg.Email); err != nil {
+		log.Printf("Digest send failed for user %s: %v", userID, err)
+		writeError(w, http.StatusBadGateway, "DIGEST_SEND_FAILED",
+			"Failed to send digest email")
+		return
+	}
+
+	log.Printf("Digest sent to user %s (%s)", userID, *cfg.Email)
+	writeJSON(w, http.StatusOK, map[string]any{
+		"success": true,
+		"email":   *cfg.Email,
+		"message": "Digest email sent",
+	})
+}
--- a/backend/internal/handlers/helpers.go
+++ b/backend/internal/handlers/helpers.go
@@ -0,0 +1,30 @@
+package handlers
+
+import (
+	"encoding/json"
+	"net/http"
+	"strconv"
+)
+
+type errorBody struct {
+	Error   string `json:"error"`
+	Message string `json:"message"`
+}
+
+func writeJSON(w http.ResponseWriter, status int, v interface{}) {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(status)
+	json.NewEncoder(w).Encode(v)
+}
+
+func writeError(w http.ResponseWriter, status int, code, message string) {
+	writeJSON(w, status, errorBody{Error: code, Message: message})
+}
+
+func parseIntParam(s string) (int, bool) {
+	n, err := strconv.Atoi(s)
+	if err != nil {
+		return 0, false
+	}
+	return n, true
+}
--- a/backend/internal/handlers/notification_config.go
+++ b/backend/internal/handlers/notification_config.go
@@ -0,0 +1,216 @@
+package handlers
+
+import (
+	"encoding/json"
+	"log"
+	"net/http"
+	"regexp"
+	"strings"
+
+	"github.com/kjannette/koin-ping/backend/internal/config"
+	"github.com/kjannette/koin-ping/backend/internal/domain"
+	"github.com/kjannette/koin-ping/backend/internal/middleware"
+	"github.com/kjannette/koin-ping/backend/internal/models"
+	"github.com/kjannette/koin-ping/backend/internal/notifications"
+)
+
+var emailRe = regexp.MustCompile(`^[^\s@]+@[^\s@]+\.[^\s@]+$`)
+
+type NotificationConfigHandler struct {
+	configs *models.NotificationConfigModel
+	cfg     *config.Config
+}
+
+func NewNotificationConfigHandler(configs *models.NotificationConfigModel, cfg *config.Config) *NotificationConfigHandler {
+	return &NotificationConfigHandler{configs: configs, cfg: cfg}
+}
+
+func (h *NotificationConfigHandler) GetConfig(w http.ResponseWriter, r *http.Request) {
+	userID := middleware.GetUserID(r.Context())
+	log.Printf("User %s getting notification config", userID)
+
+	cfg, err := h.configs.GetConfig(r.Context(), userID)
+	if err != nil {
+		log.Printf("Error getting notification config: %v", err)
+		writeError(w, http.StatusInternalServerError, "INTERNAL_ERROR", "Failed to get notification config")
+		return
+	}
+
+	if cfg == nil {
+		writeJSON(w, http.StatusOK, domain.NotificationConfig{
+			UserID:              userID,
+			NotificationEnabled: true,
+		})
+		return
+	}
+
+	log.Println("Config found")
+	writeJSON(w, http.StatusOK, cfg)
+}
+
+func (h *NotificationConfigHandler) UpdateConfig(w http.ResponseWriter, r *http.Request) {
+	userID := middleware.GetUserID(r.Context())
+
+	var body struct {
+		DiscordWebhookURL   *string `json:"discord_webhook_url"`
+		TelegramChatID      *string `json:"telegram_chat_id"`
+		TelegramBotToken    *string `json:"telegram_bot_token"`
+		Email               *string `json:"email"`
+		SlackWebhookURL     *string `json:"slack_webhook_url"`
+		NotificationEnabled *bool   `json:"notification_enabled"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
+		log.Printf("Failed to decode notification config request body: %v", err)
+		writeError(w, http.StatusBadRequest, "VALIDATION_ERROR", "Invalid request body")
+		return
+	}
+
+	log.Printf("User %s updating notification config", userID)
+
+	if body.DiscordWebhookURL == nil && body.TelegramChatID == nil &&
+		body.TelegramBotToken == nil && body.Email == nil &&
+		body.SlackWebhookURL == nil && body.NotificationEnabled == nil {
+		writeError(w, http.StatusBadRequest, "VALIDATION_ERROR",
+			"At least one configuration field must be provided")
+		return
+	}
+
+	if body.DiscordWebhookURL != nil && *body.DiscordWebhookURL != "" &&
+		!strings.HasPrefix(*body.DiscordWebhookURL, "https://discord.com/api/webhooks/") {
+		writeError(w, http.StatusBadRequest, "VALIDATION_ERROR",
+			"Invalid Discord webhook URL format")
+		return
+	}
+
+	if body.SlackWebhookURL != nil && *body.SlackWebhookURL != "" &&
+		!strings.HasPrefix(*body.SlackWebhookURL, "https://hooks.slack.com/") {
+		writeError(w, http.StatusBadRequest, "VALIDATION_ERROR",
+			"Invalid Slack webhook URL format")
+		return
+	}
+
+	if body.Email != nil && *body.Email != "" && !emailRe.MatchString(*body.Email) {
+		writeError(w, http.StatusBadRequest, "VALIDATION_ERROR",
+			"Invalid email address format")
+		return
+	}
+
+	enabled := true
+	if body.NotificationEnabled != nil {
+		enabled = *body.NotificationEnabled
+	}
+
+	cfg := domain.NotificationConfig{
+		DiscordWebhookURL:   body.DiscordWebhookURL,
+		TelegramChatID:      body.TelegramChatID,
+		TelegramBotToken:    body.TelegramBotToken,
+		Email:               body.Email,
+		SlackWebhookURL:     body.SlackWebhookURL,
+		NotificationEnabled: enabled,
+	}
+
+	updated, err := h.configs.UpsertConfig(r.Context(), userID, cfg)
+	if err != nil {
+		log.Printf("Error updating notification config: %v", err)
+		writeError(w, http.StatusInternalServerError, "INTERNAL_ERROR",
+			"Failed to update notification configuration")
+		return
+	}
+
+	log.Println("Notification config updated")
+	writeJSON(w, http.StatusOK, updated)
+}
+
+func (h *NotificationConfigHandler) DeleteConfig(w http.ResponseWriter, r *http.Request) {
+	userID := middleware.GetUserID(r.Context())
+	log.Printf("User %s deleting notification config", userID)
+
+	deleted, err := h.configs.Remove(r.Context(), userID)
+	if err != nil {
+		log.Printf("Error deleting notification config: %v", err)
+		writeError(w, http.StatusInternalServerError, "INTERNAL_ERROR",
+			"Failed to delete notification configuration")
+		return
+	}
+
+	if !deleted {
+		writeError(w, http.StatusNotFound, "NOT_FOUND", "No notification configuration found")
+		return
+	}
+
+	log.Println("Notification config deleted")
+	w.WriteHeader(http.StatusNoContent)
+}
+
+// TestChannels sends a test message to all configured notification channels.
+func (h *NotificationConfigHandler) TestChannels(w http.ResponseWriter, r *http.Request) {
+	userID := middleware.GetUserID(r.Context())
+	log.Printf("User %s testing notification channels", userID)
+
+	cfg, err := h.configs.GetConfig(r.Context(), userID)
+	if err != nil {
+		log.Printf("Error getting notification config for test: %v", err)
+		writeError(w, http.StatusInternalServerError, "INTERNAL_ERROR", "Failed to get notification config")
+		return
+	}
+
+	if cfg == nil {
+		writeError(w, http.StatusNotFound, "NOT_FOUND", "No notification configuration found")
+		return
+	}
+
+	type channelResult struct {
+		Channel string `json:"channel"`
+		Success bool   `json:"success"`
+		Error   string `json:"error,omitempty"`
+	}
+
+	var results []channelResult
+
+	if cfg.DiscordWebhookURL != nil && *cfg.DiscordWebhookURL != "" {
+		ok, testErr := notifications.TestDiscordWebhook(*cfg.DiscordWebhookURL)
+		res := channelResult{Channel: "discord", Success: ok}
+		if testErr != nil {
+			res.Error = testErr.Error()
+		}
+		results = append(results, res)
+	}
+
+	if cfg.TelegramBotToken != nil && *cfg.TelegramBotToken != "" &&
+		cfg.TelegramChatID != nil && *cfg.TelegramChatID != "" {
+		ok, testErr := notifications.TestTelegramWebhook(*cfg.TelegramBotToken, *cfg.TelegramChatID)
+		res := channelResult{Channel: "telegram", Success: ok}
+		if testErr != nil {
+			res.Error = testErr.Error()
+		}
+		results = append(results, res)
+	}
+
+	if cfg.SlackWebhookURL != nil && *cfg.SlackWebhookURL != "" {
+		ok, testErr := notifications.TestSlackWebhook(*cfg.SlackWebhookURL)
+		res := channelResult{Channel: "slack", Success: ok}
+		if testErr != nil {
+			res.Error = testErr.Error()
+		}
+		results = append(results, res)
+	}
+
+	if cfg.Email != nil && *cfg.Email != "" {
+		ok, testErr := notifications.TestEmailNotification(
+			h.cfg.ResendAPIKey, h.cfg.EmailFrom, *cfg.Email,
+		)
+		res := channelResult{Channel: "email", Success: ok}
+		if testErr != nil {
+			res.Error = testErr.Error()
+		}
+		results = append(results, res)
+	}
+
+	if len(results) == 0 {
+		writeError(w, http.StatusBadRequest, "NO_CHANNELS",
+			"No notification channels are configured")
+		return
+	}
+
+	writeJSON(w, http.StatusOK, map[string]any{"results": results})
+}
--- a/backend/internal/handlers/status.go
+++ b/backend/internal/handlers/status.go
@@ -0,0 +1,71 @@
+package handlers
+
+import (
+	"log"
+	"net/http"
+	"time"
+
+	"github.com/kjannette/koin-ping/backend/internal/models"
+)
+
+// StatusHandler handles the system status endpoint.
+type StatusHandler struct {
+	checkpoints *models.CheckpointModel
+}
+
+// NewStatusHandler creates a new StatusHandler.
+func NewStatusHandler(checkpoints *models.CheckpointModel) *StatusHandler {
+	return &StatusHandler{checkpoints: checkpoints}
+}
+
+// GetStatus returns real-time system status derived from checkpoint data.
+func (h *StatusHandler) GetStatus(w http.ResponseWriter, r *http.Request) {
+	block, checkedAt, err := h.checkpoints.GetLatestBlock(r.Context())
+	if err != nil {
+		log.Printf("Error querying latest block: %v", err)
+		writeError(w, http.StatusInternalServerError, "INTERNAL_ERROR", "Failed to get system status")
+
+		return
+	}
+
+	latestBlock := 0
+	lag := 0
+	status := "starting"
+
+	if checkedAt != nil {
+		lag = int(time.Since(*checkedAt).Seconds())
+		if lag > 600 { //nolint:mnd
+			status = "idle"
+		} else {
+			status = "active"
+		}
+	}
+
+	if block != nil {
+		latestBlock = *block
+	}
+
+	writeJSON(w, http.StatusOK, map[string]interface{}{
+		"status":        status,
+		"latestBlock":   latestBlock,
+		"lag":           lag,
+		"lastCheckedAt": checkedAtStr(checkedAt),
+		"timestamp":     time.Now().UTC().Format(time.RFC3339),
+	})
+}
+
+func checkedAtStr(t *time.Time) string {
+	if t == nil {
+		return ""
+	}
+
+	return t.UTC().Format(time.RFC3339)
+}
+
+func HealthCheck(w http.ResponseWriter, r *http.Request) {
+	writeJSON(w, http.StatusOK, map[string]interface{}{
+		"status":    "ok",
+		"timestamp": time.Now().UTC().Format(time.RFC3339),
+		"service":   "koin-ping-backend",
+	})
+}
--- a/backend/internal/handlers/stripe.go
+++ b/backend/internal/handlers/stripe.go
@@ -0,0 +1,254 @@
+package handlers
+
+import (
+	"encoding/json"
+	"io"
+	"log"
+	"net/http"
+
+	"github.com/stripe/stripe-go/v82"
+	checkoutsession "github.com/stripe/stripe-go/v82/checkout/session"
+	"github.com/stripe/stripe-go/v82/webhook"
+
+	"github.com/kjannette/koin-ping/backend/internal/config"
+	"github.com/kjannette/koin-ping/backend/internal/middleware"
+	"github.com/kjannette/koin-ping/backend/internal/models"
+)
+
+const webhookMaxBodyBytes = 65536
+
+type StripeHandler struct {
+	users *models.UserModel
+	cfg   *config.Config
+}
+
+func NewStripeHandler(users *models.UserModel, cfg *config.Config) *StripeHandler {
+	stripe.Key = cfg.StripeSecretKey
+	return &StripeHandler{users: users, cfg: cfg}
+}
+
+// CreateCheckoutSession creates a Stripe Checkout session for the monthly subscription.
+func (h *StripeHandler) CreateCheckoutSession(w http.ResponseWriter, r *http.Request) {
+	userID := middleware.GetUserID(r.Context())
+
+	user, err := h.users.GetByID(r.Context(), userID)
+	if err != nil || user == nil {
+		log.Printf("Failed to get user %s: %v", userID, err)
+		writeError(w, http.StatusInternalServerError, "INTERNAL_ERROR", "Failed to load user")
+		return
+	}
+
+	params := &stripe.CheckoutSessionParams{
+		Mode: stripe.String(string(stripe.CheckoutSessionModeSubscription)),
+		LineItems: []*stripe.CheckoutSessionLineItemParams{
+			{
+				Price:    stripe.String(h.cfg.StripePriceID),
+				Quantity: stripe.Int64(1),
+			},
+		},
+		SuccessURL:        stripe.String(h.cfg.FrontendURL + "/subscribe?payment=success&session_id={CHECKOUT_SESSION_ID}"),
+		CancelURL:         stripe.String(h.cfg.FrontendURL + "/subscribe?payment=cancelled"),
+		ClientReferenceID: stripe.String(userID),
+		CustomerEmail:     stripe.String(user.Email),
+	}
+
+	if user.StripeCustomerID != nil && *user.StripeCustomerID != "" {
+		params.Customer = user.StripeCustomerID
+		params.CustomerEmail = nil
+	}
+
+	s, err := checkoutsession.New(params)
+	if err != nil {
+		log.Printf("Failed to create Stripe checkout session: %v", err)
+		writeError(w, http.StatusInternalServerError, "STRIPE_ERROR", "Failed to create checkout session")
+		return
+	}
+
+	writeJSON(w, http.StatusOK, map[string]string{"url": s.URL})
+}
+
+// GetSubscriptionStatus returns the current user's subscription state.
+func (h *StripeHandler) GetSubscriptionStatus(w http.ResponseWriter, r *http.Request) {
+	userID := middleware.GetUserID(r.Context())
+
+	user, err := h.users.GetByID(r.Context(), userID)
+	if err != nil || user == nil {
+		log.Printf("Failed to get user %s: %v", userID, err)
+		writeError(w, http.StatusInternalServerError, "INTERNAL_ERROR", "Failed to load user")
+		return
+	}
+
+	writeJSON(w, http.StatusOK, map[string]any{
+		"subscription_status":     user.SubscriptionStatus,
+		"subscription_created_at": user.SubscriptionCreatedAt,
+	})
+}
+
+// VerifyCheckoutSession retrieves a completed checkout session from Stripe,
+// confirms payment, and activates the user's subscription in the database.
+// This is the primary activation path; webhooks serve as a backup.
+func (h *StripeHandler) VerifyCheckoutSession(w http.ResponseWriter, r *http.Request) {
+	userID := middleware.GetUserID(r.Context())
+
+	var body struct {
+		SessionID string `json:"session_id"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&body); err != nil || body.SessionID == "" {
+		writeError(w, http.StatusBadRequest, "BAD_REQUEST", "Missing session_id")
+		return
+	}
+
+	s, err := checkoutsession.Get(body.SessionID, nil)
+	if err != nil {
+		log.Printf("Failed to retrieve checkout session %s: %v", body.SessionID, err)
+		writeError(w, http.StatusBadRequest, "STRIPE_ERROR", "Invalid checkout session")
+		return
+	}
+
+	if s.ClientReferenceID != userID {
+		writeError(w, http.StatusForbidden, "FORBIDDEN", "Session does not belong to this user")
+		return
+	}
+
+	if s.PaymentStatus != stripe.CheckoutSessionPaymentStatusPaid {
+		writeError(w, http.StatusBadRequest, "PAYMENT_INCOMPLETE", "Payment has not been completed")
+		return
+	}
+
+	customerID := ""
+	if s.Customer != nil {
+		customerID = s.Customer.ID
+	}
+	subscriptionID := ""
+	if s.Subscription != nil {
+		subscriptionID = s.Subscription.ID
+	}
+
+	if customerID != "" {
+		if err := h.users.UpdateStripeCustomer(r.Context(), userID, customerID); err != nil {
+			log.Printf("VerifyCheckout: failed to save customer ID: %v", err)
+		}
+	}
+	if subscriptionID != "" && customerID != "" {
+		if err := h.users.ActivateSubscription(r.Context(), customerID, subscriptionID, "active"); err != nil {
+			log.Printf("VerifyCheckout: failed to activate subscription: %v", err)
+		}
+	}
+
+	log.Printf("Checkout verified for user %s, customer %s, subscription %s", userID, customerID, subscriptionID)
+	writeJSON(w, http.StatusOK, map[string]string{"subscription_status": "active"})
+}
+
+// HandleWebhook processes incoming Stripe webhook events.
+// This endpoint must NOT require authentication (Stripe calls it directly).
+func (h *StripeHandler) HandleWebhook(w http.ResponseWriter, r *http.Request) {
+	payload, err := io.ReadAll(io.LimitReader(r.Body, webhookMaxBodyBytes))
+	if err != nil {
+		log.Printf("Error reading webhook body: %v", err)
+		w.WriteHeader(http.StatusServiceUnavailable)
+		return
+	}
+
+	sig := r.Header.Get("Stripe-Signature")
+	event, err := webhook.ConstructEvent(payload, sig, h.cfg.StripeWebhookSecret)
+	if err != nil {
+		log.Printf("Webhook signature verification failed: %v", err)
+		w.WriteHeader(http.StatusBadRequest)
+		return
+	}
+
+	switch event.Type {
+	case "checkout.session.completed":
+		h.handleCheckoutCompleted(r, event)
+	case "customer.subscription.updated":
+		h.handleSubscriptionUpdated(r, event)
+	case "customer.subscription.deleted":
+		h.handleSubscriptionDeleted(r, event)
+	default:
+		log.Printf("Unhandled Stripe event type: %s", event.Type)
+	}
+
+	w.WriteHeader(http.StatusOK)
+}
+
+func (h *StripeHandler) handleCheckoutCompleted(r *http.Request, event stripe.Event) {
+	var session stripe.CheckoutSession
+	if err := json.Unmarshal(event.Data.Raw, &session); err != nil {
+		log.Printf("Error parsing checkout session: %v", err)
+		return
+	}
+
+	userID := session.ClientReferenceID
+	if userID == "" {
+		log.Println("Checkout session missing client_reference_id")
+		return
+	}
+
+	customerID := ""
+	if session.Customer != nil {
+		customerID = session.Customer.ID
+	}
+	subscriptionID := ""
+	if session.Subscription != nil {
+		subscriptionID = session.Subscription.ID
+	}
+
+	if customerID != "" {
+		if err := h.users.UpdateStripeCustomer(r.Context(), userID, customerID); err != nil {
+			log.Printf("Failed to save Stripe customer ID: %v", err)
+		}
+	}
+
+	if subscriptionID != "" && customerID != "" {
+		if err := h.users.ActivateSubscription(r.Context(), customerID, subscriptionID, "active"); err != nil {
+			log.Printf("Failed to activate subscription: %v", err)
+		}
+	}
+
+	log.Printf("Checkout completed for user %s, customer %s, subscription %s", userID, customerID, subscriptionID)
+}
+
+func (h *StripeHandler) handleSubscriptionUpdated(r *http.Request, event stripe.Event) {
+	var sub stripe.Subscription
+	if err := json.Unmarshal(event.Data.Raw, &sub); err != nil {
+		log.Printf("Error parsing subscription update: %v", err)
+		return
+	}
+
+	customerID := ""
+	if sub.Customer != nil {
+		customerID = sub.Customer.ID
+	}
+	if customerID == "" {
+		return
+	}
+
+	status := string(sub.Status)
+	if err := h.users.ActivateSubscription(r.Context(), customerID, sub.ID, status); err != nil {
+		log.Printf("Failed to update subscription status: %v", err)
+	}
+
+	log.Printf("Subscription %s updated to %s for customer %s", sub.ID, status, customerID)
+}
+
+func (h *StripeHandler) handleSubscriptionDeleted(r *http.Request, event stripe.Event) {
+	var sub stripe.Subscription
+	if err := json.Unmarshal(event.Data.Raw, &sub); err != nil {
+		log.Printf("Error parsing subscription deletion: %v", err)
+		return
+	}
+
+	customerID := ""
+	if sub.Customer != nil {
+		customerID = sub.Customer.ID
+	}
+	if customerID == "" {
+		return
+	}
+
+	if err := h.users.UpdateSubscriptionStatus(r.Context(), customerID, "canceled"); err != nil {
+		log.Printf("Failed to mark subscription canceled: %v", err)
+	}
+
+	log.Printf("Subscription canceled for customer %s", customerID)
+}
--- a/backend/internal/middleware/auth.go
+++ b/backend/internal/middleware/auth.go
@@ -0,0 +1,152 @@
+// Package middleware provides HTTP middleware for authentication and context injection.
+package middleware
+
+import (
+	"context"
+	"encoding/json"
+	"log"
+	"net/http"
+	"strings"
+
+	fbauth "github.com/kjannette/koin-ping/backend/internal/firebase"
+	"github.com/kjannette/koin-ping/backend/internal/models"
+)
+
+type contextKey string
+
+const (
+	UserIDKey    contextKey = "user_id"
+	UserEmailKey contextKey = "user_email"
+)
+
+type errorResponse struct {
+	Error   string `json:"error"`
+	Message string `json:"message"`
+}
+
+func writeJSON(w http.ResponseWriter, status int, v interface{}) {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(status)
+	json.NewEncoder(w).Encode(v) //nolint:errcheck
+}
+
+// Authenticate verifies the Firebase ID token and auto-provisions a local user
+// record. The local user UUID (not the Firebase UID) is placed into context so
+// all downstream handlers use it as the canonical user identifier.
+func Authenticate(userModel *models.UserModel) func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			authHeader := r.Header.Get("Authorization")
+			if authHeader == "" || !strings.HasPrefix(authHeader, "Bearer ") {
+				log.Println("No Authorization header or invalid format")
+				writeJSON(w, http.StatusUnauthorized, errorResponse{
+					Error:   "UNAUTHORIZED",
+					Message: "No authentication token provided",
+				})
+				return
+			}
+
+			token := strings.TrimPrefix(authHeader, "Bearer ")
+			if token == "" {
+				log.Println("Empty token")
+				writeJSON(w, http.StatusUnauthorized, errorResponse{
+					Error:   "UNAUTHORIZED",
+					Message: "Invalid token format",
+				})
+				return
+			}
+
+			log.Println("Verifying Firebase token...")
+			decoded, err := fbauth.Auth().VerifyIDToken(r.Context(), token)
+			if err != nil {
+				log.Printf("Token verification failed: %v", err)
+
+				errMsg := err.Error()
+				if strings.Contains(errMsg, "expired") {
+					writeJSON(w, http.StatusUnauthorized, errorResponse{
+						Error:   "TOKEN_EXPIRED",
+						Message: "Authentication token has expired",
+					})
+					return
+				}
+
+				writeJSON(w, http.StatusUnauthorized, errorResponse{
+					Error:   "UNAUTHORIZED",
+					Message: "Failed to verify authentication token",
+				})
+				return
+			}
+
+			firebaseUID := decoded.UID
+			email, _ := decoded.Claims["email"].(string)
+
+			user, err := userModel.FindOrCreateByFirebaseUID(r.Context(), firebaseUID, email)
+			if err != nil {
+				log.Printf("Failed to provision local user for Firebase UID %s: %v", firebaseUID, err)
+				writeJSON(w, http.StatusInternalServerError, errorResponse{
+					Error:   "INTERNAL_ERROR",
+					Message: "Failed to initialize user account",
+				})
+				return
+			}
+
+			log.Printf("Token verified! User UUID: %s, Email: %s", user.ID, email)
+
+			ctx := context.WithValue(r.Context(), UserIDKey, user.ID)
+			ctx = context.WithValue(ctx, UserEmailKey, email)
+
+			next.ServeHTTP(w, r.WithContext(ctx))
+		})
+	}
+}
+
+// RequireSubscription blocks requests from users without an active subscription.
+// Must be applied after Authenticate.
+func RequireSubscription(userModel *models.UserModel) func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			userID := GetUserID(r.Context())
+			if userID == "" {
+				writeJSON(w, http.StatusUnauthorized, errorResponse{
+					Error:   "UNAUTHORIZED",
+					Message: "Authentication required",
+				})
+				return
+			}
+
+			user, err := userModel.GetByID(r.Context(), userID)
+			if err != nil || user == nil {
+				log.Printf("RequireSubscription: failed to load user %s: %v", userID, err)
+				writeJSON(w, http.StatusInternalServerError, errorResponse{
+					Error:   "INTERNAL_ERROR",
+					Message: "Failed to verify subscription",
+				})
+				return
+			}
+
+			if user.SubscriptionStatus != "active" && user.SubscriptionStatus != "trialing" {
+				writeJSON(w, http.StatusForbidden, errorResponse{
+					Error:   "SUBSCRIPTION_REQUIRED",
+					Message: "An active subscription is required to use this feature",
+				})
+				return
+			}
+
+			next.ServeHTTP(w, r)
+		})
+	}
+}
+
+func GetUserID(ctx context.Context) string {
+	if v, ok := ctx.Value(UserIDKey).(string); ok {
+		return v
+	}
+	return ""
+}
+
+func GetUserEmail(ctx context.Context) string {
+	if v, ok := ctx.Value(UserEmailKey).(string); ok {
+		return v
+	}
+	return ""
+}
--- a/backend/internal/models/address.go
+++ b/backend/internal/models/address.go
@@ -0,0 +1,137 @@
+package models
+
+import (
+	"context"
+	"errors"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgxpool"
+	"github.com/kjannette/koin-ping/backend/internal/domain"
+)
+
+type AddressModel struct {
+	pool *pgxpool.Pool
+}
+
+func NewAddressModel(pool *pgxpool.Pool) *AddressModel {
+	return &AddressModel{pool: pool}
+}
+
+func (m *AddressModel) Create(ctx context.Context, userID, address string, label *string) (*domain.Address, error) {
+	var a domain.Address
+	err := m.pool.QueryRow(ctx,
+		`INSERT INTO addresses (user_id, address, label)
+		 VALUES ($1, $2, $3)
+		 RETURNING id, user_id, address, label, created_at`,
+		userID, address, label,
+	).Scan(&a.ID, &a.UserID, &a.Address, &a.Label, &a.CreatedAt)
+	if err != nil {
+		return nil, err
+	}
+	return &a, nil
+}
+
+func (m *AddressModel) ListByUser(ctx context.Context, userID string) ([]domain.Address, error) {
+	rows, err := m.pool.Query(ctx,
+		`SELECT id, user_id, address, label, created_at
+		 FROM addresses
+		 WHERE user_id = $1
+		 ORDER BY created_at DESC`,
+		userID,
+	)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var addresses []domain.Address
+	for rows.Next() {
+		var a domain.Address
+		if err := rows.Scan(&a.ID, &a.UserID, &a.Address, &a.Label, &a.CreatedAt); err != nil {
+			return nil, err
+		}
+		addresses = append(addresses, a)
+	}
+	return addresses, rows.Err()
+}
+
+// ListAll returns all addresses system-wide (used by the poller).
+func (m *AddressModel) ListAll(ctx context.Context) ([]domain.Address, error) {
+	rows, err := m.pool.Query(ctx,
+		`SELECT id, user_id, address, label, created_at
+		 FROM addresses
+		 ORDER BY created_at DESC`,
+	)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var addresses []domain.Address
+	for rows.Next() {
+		var a domain.Address
+		if err := rows.Scan(&a.ID, &a.UserID, &a.Address, &a.Label, &a.CreatedAt); err != nil {
+			return nil, err
+		}
+		addresses = append(addresses, a)
+	}
+	return addresses, rows.Err()
+}
+
+func (m *AddressModel) FindByID(ctx context.Context, id int, userID *string) (*domain.Address, error) {
+	var a domain.Address
+	var err error
+
+	if userID != nil {
+		err = m.pool.QueryRow(ctx,
+			`SELECT id, user_id, address, label, created_at
+			 FROM addresses
+			 WHERE id = $1 AND user_id = $2`,
+			id, *userID,
+		).Scan(&a.ID, &a.UserID, &a.Address, &a.Label, &a.CreatedAt)
+	} else {
+		err = m.pool.QueryRow(ctx,
+			`SELECT id, user_id, address, label, created_at
+			 FROM addresses
+			 WHERE id = $1`,
+			id,
+		).Scan(&a.ID, &a.UserID, &a.Address, &a.Label, &a.CreatedAt)
+	}
+
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return nil, nil
+		}
+		return nil, err
+	}
+	return &a, nil
+}
+
+// UpdateLabel updates the label for an address owned by userID.
+// Returns nil, nil if no row matched (address not found or not owned by user).
+func (m *AddressModel) UpdateLabel(ctx context.Context, id int, userID string, label *string) (*domain.Address, error) {
+	var a domain.Address
+	err := m.pool.QueryRow(ctx,
+		`UPDATE addresses SET label = $3 WHERE id = $1 AND user_id = $2
+		 RETURNING id, user_id, address, label, created_at`,
+		id, userID, label,
+	).Scan(&a.ID, &a.UserID, &a.Address, &a.Label, &a.CreatedAt)
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return nil, nil
+		}
+		return nil, err
+	}
+	return &a, nil
+}
+
+func (m *AddressModel) Remove(ctx context.Context, id int, userID string) (bool, error) {
+	tag, err := m.pool.Exec(ctx,
+		`DELETE FROM addresses WHERE id = $1 AND user_id = $2`,
+		id, userID,
+	)
+	if err != nil {
+		return false, err
+	}
+	return tag.RowsAffected() > 0, nil
+}
--- a/backend/internal/models/alert_event.go
+++ b/backend/internal/models/alert_event.go
@@ -0,0 +1,88 @@
+package models
+
+import (
+	"context"
+	"errors"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgxpool"
+	"github.com/kjannette/koin-ping/backend/internal/domain"
+)
+
+type AlertEventModel struct {
+	pool *pgxpool.Pool
+}
+
+func NewAlertEventModel(pool *pgxpool.Pool) *AlertEventModel {
+	return &AlertEventModel{pool: pool}
+}
+
+func (m *AlertEventModel) ListRecentByUser(ctx context.Context, userID string, limit int) ([]domain.AlertEvent, error) {
+	rows, err := m.pool.Query(ctx,
+		`SELECT ae.id, ae.alert_rule_id, ae.message, ae.address_label, ae.tx_hash, ae.timestamp
+		 FROM alert_events ae
+		 JOIN alert_rules ar ON ar.id = ae.alert_rule_id
+		 JOIN addresses a ON a.id = ar.address_id
+		 WHERE a.user_id = $1
+		 ORDER BY ae.timestamp DESC
+		 LIMIT $2`,
+		userID, limit,
+	)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var events []domain.AlertEvent
+	for rows.Next() {
+		var e domain.AlertEvent
+		if err := rows.Scan(&e.ID, &e.AlertRuleID, &e.Message, &e.AddressLabel, &e.TxHash, &e.Timestamp); err != nil {
+			return nil, err
+		}
+		events = append(events, e)
+	}
+	return events, rows.Err()
+}
+
+func (m *AlertEventModel) ListRecent(ctx context.Context, limit int) ([]domain.AlertEvent, error) {
+	rows, err := m.pool.Query(ctx,
+		`SELECT id, alert_rule_id, message, address_label, tx_hash, timestamp
+		 FROM alert_events
+		 ORDER BY timestamp DESC
+		 LIMIT $1`,
+		limit,
+	)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var events []domain.AlertEvent
+	for rows.Next() {
+		var e domain.AlertEvent
+		if err := rows.Scan(&e.ID, &e.AlertRuleID, &e.Message, &e.AddressLabel, &e.TxHash, &e.Timestamp); err != nil {
+			return nil, err
+		}
+		events = append(events, e)
+	}
+	return events, rows.Err()
+}
+
+func (m *AlertEventModel) Create(ctx context.Context, alertRuleID int, message string, addressLabel *string, txHash *string) (*domain.AlertEvent, error) {
+	var e domain.AlertEvent
+	err := m.pool.QueryRow(ctx,
+		`INSERT INTO alert_events (alert_rule_id, message, address_label, tx_hash)
+		 VALUES ($1, $2, $3, $4)
+		 ON CONFLICT DO NOTHING
+		 RETURNING id, alert_rule_id, message, address_label, tx_hash, timestamp`,
+		alertRuleID, message, addressLabel, txHash,
+	).Scan(&e.ID, &e.AlertRuleID, &e.Message, &e.AddressLabel, &e.TxHash, &e.Timestamp)
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			// Duplicate silently skipped by ON CONFLICT DO NOTHING
+			return nil, nil
+		}
+		return nil, err
+	}
+	return &e, nil
+}
--- a/backend/internal/models/alert_rule.go
+++ b/backend/internal/models/alert_rule.go
@@ -0,0 +1,115 @@
+package models
+
+import (
+	"context"
+	"errors"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgxpool"
+	"github.com/kjannette/koin-ping/backend/internal/domain"
+)
+
+type AlertRuleModel struct {
+	pool *pgxpool.Pool
+}
+
+func NewAlertRuleModel(pool *pgxpool.Pool) *AlertRuleModel {
+	return &AlertRuleModel{pool: pool}
+}
+
+func (m *AlertRuleModel) Create(ctx context.Context, addressID int, alertType domain.AlertType, threshold *float64) (*domain.AlertRule, error) {
+	var r domain.AlertRule
+	err := m.pool.QueryRow(ctx,
+		`INSERT INTO alert_rules (address_id, type, threshold, enabled)
+		 VALUES ($1, $2, $3, TRUE)
+		 RETURNING id, address_id, type, threshold, enabled, created_at`,
+		addressID, alertType.String(), threshold,
+	).Scan(&r.ID, &r.AddressID, &r.Type, &r.Threshold, &r.Enabled, &r.CreatedAt)
+	if err != nil {
+		return nil, err
+	}
+	return &r, nil
+}
+
+func (m *AlertRuleModel) ListByAddress(ctx context.Context, addressID int) ([]domain.AlertRule, error) {
+	rows, err := m.pool.Query(ctx,
+		`SELECT id, address_id, type, threshold, enabled, created_at
+		 FROM alert_rules
+		 WHERE address_id = $1
+		 ORDER BY created_at DESC`,
+		addressID,
+	)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var rules []domain.AlertRule
+	for rows.Next() {
+		var r domain.AlertRule
+		if err := rows.Scan(&r.ID, &r.AddressID, &r.Type, &r.Threshold, &r.Enabled, &r.CreatedAt); err != nil {
+			return nil, err
+		}
+		rules = append(rules, r)
+	}
+	return rules, rows.Err()
+}
+
+func (m *AlertRuleModel) FindByID(ctx context.Context, id int, userID *string) (*domain.AlertRule, error) {
+	var r domain.AlertRule
+	var err error
+
+	if userID != nil {
+		err = m.pool.QueryRow(ctx,
+			`SELECT ar.id, ar.address_id, ar.type, ar.threshold, ar.enabled, ar.created_at
+			 FROM alert_rules ar
+			 JOIN addresses a ON a.id = ar.address_id
+			 WHERE ar.id = $1 AND a.user_id = $2`,
+			id, *userID,
+		).Scan(&r.ID, &r.AddressID, &r.Type, &r.Threshold, &r.Enabled, &r.CreatedAt)
+	} else {
+		err = m.pool.QueryRow(ctx,
+			`SELECT id, address_id, type, threshold, enabled, created_at
+			 FROM alert_rules
+			 WHERE id = $1`,
+			id,
+		).Scan(&r.ID, &r.AddressID, &r.Type, &r.Threshold, &r.Enabled, &r.CreatedAt)
+	}
+
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return nil, nil
+		}
+		return nil, err
+	}
+	return &r, nil
+}
+
+func (m *AlertRuleModel) UpdateEnabled(ctx context.Context, id int, enabled bool) (*domain.AlertRule, error) {
+	var r domain.AlertRule
+	err := m.pool.QueryRow(ctx,
+		`UPDATE alert_rules
+		 SET enabled = $2
+		 WHERE id = $1
+		 RETURNING id, address_id, type, threshold, enabled, created_at`,
+		id, enabled,
+	).Scan(&r.ID, &r.AddressID, &r.Type, &r.Threshold, &r.Enabled, &r.CreatedAt)
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return nil, nil
+		}
+		return nil, err
+	}
+	return &r, nil
+}
+
+func (m *AlertRuleModel) Remove(ctx context.Context, id int) (bool, error) {
+	tag, err := m.pool.Exec(ctx,
+		`DELETE FROM alert_rules WHERE id = $1`,
+		id,
+	)
+	if err != nil {
+		return false, err
+	}
+	return tag.RowsAffected() > 0, nil
+}
--- a/backend/internal/models/checkpoint.go
+++ b/backend/internal/models/checkpoint.go
@@ -0,0 +1,101 @@
+package models
+
+import (
+	"context"
+	"errors"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgxpool"
+	"github.com/kjannette/koin-ping/backend/internal/domain"
+)
+
+type CheckpointModel struct {
+	pool *pgxpool.Pool
+}
+
+func NewCheckpointModel(pool *pgxpool.Pool) *CheckpointModel {
+	return &CheckpointModel{pool: pool}
+}
+
+// GetLatestBlock returns the highest last_checked_block and its timestamp across all addresses.
+// Returns nil, nil, nil when no checkpoints exist yet.
+func (m *CheckpointModel) GetLatestBlock(ctx context.Context) (*int, *time.Time, error) {
+	var block *int
+	var checkedAt *time.Time
+	err := m.pool.QueryRow(ctx,
+		`SELECT MAX(last_checked_block), MAX(last_checked_at) FROM address_checkpoints`,
+	).Scan(&block, &checkedAt)
+	if err != nil {
+		return nil, nil, err
+	}
+	return block, checkedAt, nil
+}
+
+// GetLastCheckedBlock returns the last checked block for an address, or -1 if never checked.
+func (m *CheckpointModel) GetLastCheckedBlock(ctx context.Context, addressID int) (int, bool, error) {
+	var block int
+	err := m.pool.QueryRow(ctx,
+		`SELECT last_checked_block FROM address_checkpoints WHERE address_id = $1`,
+		addressID,
+	).Scan(&block)
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return 0, false, nil
+		}
+		return 0, false, err
+	}
+	return block, true, nil
+}
+
+func (m *CheckpointModel) UpdateLastCheckedBlock(ctx context.Context, addressID, blockNumber int) (*domain.AddressCheckpoint, error) {
+	var cp domain.AddressCheckpoint
+	err := m.pool.QueryRow(ctx,
+		`INSERT INTO address_checkpoints (address_id, last_checked_block, last_checked_at)
+		 VALUES ($1, $2, NOW())
+		 ON CONFLICT (address_id)
+		 DO UPDATE SET
+		   last_checked_block = $2,
+		   last_checked_at = NOW()
+		 RETURNING address_id, last_checked_block, last_checked_at`,
+		addressID, blockNumber,
+	).Scan(&cp.AddressID, &cp.LastCheckedBlock, &cp.LastCheckedAt)
+	if err != nil {
+		return nil, err
+	}
+	return &cp, nil
+}
+
+func (m *CheckpointModel) ListAll(ctx context.Context) ([]domain.CheckpointDetail, error) {
+	rows, err := m.pool.Query(ctx,
+		`SELECT ac.address_id, a.address, a.label, ac.last_checked_block, ac.last_checked_at
+		 FROM address_checkpoints ac
+		 JOIN addresses a ON a.id = ac.address_id
+		 ORDER BY ac.last_checked_at DESC`,
+	)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var details []domain.CheckpointDetail
+	for rows.Next() {
+		var d domain.CheckpointDetail
+		if err := rows.Scan(&d.AddressID, &d.Address, &d.Label, &d.LastCheckedBlock, &d.LastCheckedAt); err != nil {
+			return nil, err
+		}
+		details = append(details, d)
+	}
+	return details, rows.Err()
+}
+
+func (m *CheckpointModel) Remove(ctx context.Context, addressID int) (bool, error) {
+	tag, err := m.pool.Exec(ctx,
+		`DELETE FROM address_checkpoints WHERE address_id = $1`,
+		addressID,
+	)
+	if err != nil {
+		return false, err
+	}
+	return tag.RowsAffected() > 0, nil
+}
--- a/backend/internal/models/notification_config.go
+++ b/backend/internal/models/notification_config.go
@@ -0,0 +1,101 @@
+package models
+
+import (
+	"context"
+	"errors"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgxpool"
+	"github.com/kjannette/koin-ping/backend/internal/domain"
+)
+
+type NotificationConfigModel struct {
+	pool *pgxpool.Pool
+}
+
+func NewNotificationConfigModel(pool *pgxpool.Pool) *NotificationConfigModel {
+	return &NotificationConfigModel{pool: pool}
+}
+
+func (m *NotificationConfigModel) GetConfig(ctx context.Context, userID string) (*domain.NotificationConfig, error) {
+	var c domain.NotificationConfig
+	err := m.pool.QueryRow(ctx,
+		`SELECT user_id, discord_webhook_url, telegram_chat_id, telegram_bot_token,
+		        email, slack_webhook_url, notification_enabled, created_at, updated_at
+		 FROM user_notification_configs
+		 WHERE user_id = $1`,
+		userID,
+	).Scan(&c.UserID, &c.DiscordWebhookURL, &c.TelegramChatID, &c.TelegramBotToken,
+		&c.Email, &c.SlackWebhookURL, &c.NotificationEnabled, &c.CreatedAt, &c.UpdatedAt)
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return nil, nil
+		}
+		return nil, err
+	}
+	return &c, nil
+}
+
+func (m *NotificationConfigModel) UpsertConfig(ctx context.Context, userID string, cfg domain.NotificationConfig) (*domain.NotificationConfig, error) {
+	var c domain.NotificationConfig
+	err := m.pool.QueryRow(ctx,
+		`INSERT INTO user_notification_configs
+		   (user_id, discord_webhook_url, telegram_chat_id, telegram_bot_token,
+		    email, slack_webhook_url, notification_enabled, updated_at)
+		 VALUES ($1, $2, $3, $4, $5, $6, $7, NOW())
+		 ON CONFLICT (user_id)
+		 DO UPDATE SET
+		   discord_webhook_url = $2,
+		   telegram_chat_id = $3,
+		   telegram_bot_token = $4,
+		   email = $5,
+		   slack_webhook_url = $6,
+		   notification_enabled = $7,
+		   updated_at = NOW()
+		 RETURNING user_id, discord_webhook_url, telegram_chat_id, telegram_bot_token,
+		           email, slack_webhook_url, notification_enabled, created_at, updated_at`,
+		userID, cfg.DiscordWebhookURL, cfg.TelegramChatID, cfg.TelegramBotToken,
+		cfg.Email, cfg.SlackWebhookURL, cfg.NotificationEnabled,
+	).Scan(&c.UserID, &c.DiscordWebhookURL, &c.TelegramChatID, &c.TelegramBotToken,
+		&c.Email, &c.SlackWebhookURL, &c.NotificationEnabled, &c.CreatedAt, &c.UpdatedAt)
+	if err != nil {
+		return nil, err
+	}
+	return &c, nil
+}
+
+func (m *NotificationConfigModel) Remove(ctx context.Context, userID string) (bool, error) {
+	tag, err := m.pool.Exec(ctx,
+		`DELETE FROM user_notification_configs WHERE user_id = $1`,
+		userID,
+	)
+	if err != nil {
+		return false, err
+	}
+	return tag.RowsAffected() > 0, nil
+}
+
+func (m *NotificationConfigModel) ListEnabled(ctx context.Context) ([]domain.NotificationConfig, error) {
+	rows, err := m.pool.Query(ctx,
+		`SELECT user_id, discord_webhook_url, telegram_chat_id, telegram_bot_token,
+		        email, slack_webhook_url
+		 FROM user_notification_configs
+		 WHERE notification_enabled = TRUE`,
+	)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var configs []domain.NotificationConfig
+	for rows.Next() {
+		var c domain.NotificationConfig
+		if err := rows.Scan(&c.UserID, &c.DiscordWebhookURL, &c.TelegramChatID,
+			&c.TelegramBotToken, &c.Email, &c.SlackWebhookURL); err != nil {
+			return nil, err
+		}
+		c.NotificationEnabled = true
+		configs = append(configs, c)
+	}
+	return configs, rows.Err()
+}
--- a/backend/internal/models/user.go
+++ b/backend/internal/models/user.go
@@ -0,0 +1,89 @@
+package models
+
+import (
+	"context"
+	"errors"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgxpool"
+	"github.com/kjannette/koin-ping/backend/internal/domain"
+)
+
+type UserModel struct {
+	pool *pgxpool.Pool
+}
+
+func NewUserModel(pool *pgxpool.Pool) *UserModel {
+	return &UserModel{pool: pool}
+}
+
+const userColumns = `id, firebase_uid, email, display_name,
+	stripe_customer_id, stripe_subscription_id, subscription_status,
+	subscription_created_at, created_at, updated_at`
+
+func scanUser(row pgx.Row) (*domain.User, error) {
+	var u domain.User
+	err := row.Scan(
+		&u.ID, &u.FirebaseUID, &u.Email, &u.DisplayName,
+		&u.StripeCustomerID, &u.StripeSubscriptionID, &u.SubscriptionStatus,
+		&u.SubscriptionCreatedAt, &u.CreatedAt, &u.UpdatedAt,
+	)
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return nil, nil //nolint:nilnil
+		}
+		return nil, err
+	}
+	return &u, nil
+}
+
+// FindOrCreateByFirebaseUID returns the local user for a Firebase UID,
+// creating one if it doesn't exist yet. On conflict (returning user) the
+// updated_at timestamp is refreshed.
+func (m *UserModel) FindOrCreateByFirebaseUID(ctx context.Context, firebaseUID, email string) (*domain.User, error) {
+	row := m.pool.QueryRow(ctx,
+		`INSERT INTO users (firebase_uid, email)
+		 VALUES ($1, $2)
+		 ON CONFLICT (firebase_uid) DO UPDATE SET updated_at = NOW()
+		 RETURNING `+userColumns,
+		firebaseUID, email,
+	)
+	return scanUser(row)
+}
+
+func (m *UserModel) GetByID(ctx context.Context, id string) (*domain.User, error) {
+	row := m.pool.QueryRow(ctx,
+		`SELECT `+userColumns+` FROM users WHERE id = $1`, id,
+	)
+	return scanUser(row)
+}
+
+func (m *UserModel) UpdateStripeCustomer(ctx context.Context, userID, stripeCustomerID string) error {
+	_, err := m.pool.Exec(ctx,
+		`UPDATE users SET stripe_customer_id = $2, updated_at = NOW() WHERE id = $1`,
+		userID, stripeCustomerID,
+	)
+	return err
+}
+
+func (m *UserModel) ActivateSubscription(ctx context.Context, stripeCustomerID, subscriptionID, status string) error {
+	_, err := m.pool.Exec(ctx,
+		`UPDATE users
+		 SET stripe_subscription_id = $2,
+		     subscription_status = $3,
+		     subscription_created_at = COALESCE(subscription_created_at, NOW()),
+		     updated_at = NOW()
+		 WHERE stripe_customer_id = $1`,
+		stripeCustomerID, subscriptionID, status,
+	)
+	return err
+}
+
+func (m *UserModel) UpdateSubscriptionStatus(ctx context.Context, stripeCustomerID, status string) error {
+	_, err := m.pool.Exec(ctx,
+		`UPDATE users SET subscription_status = $2, updated_at = NOW()
+		 WHERE stripe_customer_id = $1`,
+		stripeCustomerID, status,
+	)
+	return err
+}
--- a/backend/internal/notifications/discord.go
+++ b/backend/internal/notifications/discord.go
@@ -0,0 +1,146 @@
+package notifications
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"log"
+	"net/http"
+	"time"
+)
+
+const (
+	// discordHTTPTimeoutSeconds is the timeout for Discord webhook requests.
+	discordHTTPTimeoutSeconds = 10
+
+	// Alert color codes for Discord embeds.
+	colorGreen  = 0x00ff00
+	colorOrange = 0xff9900
+	colorRed    = 0xff0000
+	colorBlue   = 0x0099ff
+)
+
+var discordHTTPClient = &http.Client{ //nolint:gochecknoglobals
+	Timeout: discordHTTPTimeoutSeconds * time.Second,
+}
+
+//  sends alert notifications via a Discord webhook.
+type DiscordNotifier struct {
+	WebhookURL string
+}
+func (d *DiscordNotifier) Send(_ context.Context, message string, meta AlertMetadata) error {
+	_, err := SendDiscordNotification(d.WebhookURL, message, meta)
+	return err
+}
+
+type discordEmbed struct {
+	Title       string         `json:"title"`
+	Description string         `json:"description"`
+	Color       int            `json:"color"`
+	Fields      []discordField `json:"fields"`
+	Timestamp   string         `json:"timestamp"`
+	Footer      discordFooter  `json:"footer"`
+}
+
+type discordField struct {
+	Name   string `json:"name"`
+	Value  string `json:"value"`
+	Inline bool   `json:"inline"`
+}
+
+type discordFooter struct {
+	Text string `json:"text"`
+}
+
+type discordPayload struct {
+	Content *string        `json:"content"`
+	Embeds  []discordEmbed `json:"embeds,omitempty"`
+}
+
+func SendDiscordNotification(webhookURL, message string, meta AlertMetadata) (bool, error) {
+	fields := []discordField{
+		{Name: "Address", Value: meta.AddressLabel, Inline: true},
+		{Name: "Blockchain Address", Value: fmt.Sprintf("`%s`", meta.Address), Inline: false},
+	}
+
+	if meta.TxHash != "" {
+		fields = append(fields, discordField{
+			Name:   "Transaction",
+			Value:  fmt.Sprintf("[View on Etherscan](https://etherscan.io/tx/%s)", meta.TxHash),
+			Inline: false,
+		})
+	}
+
+	payload := discordPayload{
+		Content: nil,
+		Embeds: []discordEmbed{
+			{
+				Title:       "Koin Ping Alert",
+				Description: message,
+				Color:       colorForAlertType(meta.AlertType),
+				Fields:      fields,
+				Timestamp:   time.Now().UTC().Format(time.RFC3339),
+				Footer:      discordFooter{Text: "Koin Ping"},
+			},
+		},
+	}
+
+	body, err := json.Marshal(payload)
+	if err != nil {
+		return false, fmt.Errorf("marshal discord payload: %w", err)
+	}
+
+	resp, err := discordHTTPClient.Post(
+		webhookURL, "application/json", bytes.NewReader(body),
+	)
+	if err != nil {
+		log.Printf("Failed to send Discord notification: %v", err)
+		return false, err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		log.Printf("Discord webhook failed: HTTP %d", resp.StatusCode)
+		return false, fmt.Errorf("discord webhook failed: HTTP %d", resp.StatusCode)
+	}
+
+	return true, nil
+}
+
+func TestDiscordWebhook(webhookURL string) (bool, error) {
+	payload := map[string]string{
+		"content": "Koin Ping test notification - Your Discord webhook is configured correctly!",
+	}
+
+	body, err := json.Marshal(payload)
+	if err != nil {
+		return false, err
+	}
+
+	resp, err := discordHTTPClient.Post(
+		webhookURL, "application/json", bytes.NewReader(body),
+	)
+	if err != nil {
+		log.Printf("Discord webhook test failed: %v", err)
+		return false, err
+	}
+	defer resp.Body.Close()
+
+	return resp.StatusCode >= 200 && resp.StatusCode < 300, nil
+}
+
+func colorForAlertType(alertType string) int {
+	switch alertType {
+	case "incoming_tx":
+		return colorGreen
+	case "outgoing_tx":
+		return colorOrange
+	case "large_transfer":
+		return colorRed
+	case "balance_below":
+		return colorRed
+	default:
+		return colorBlue
+	}
+}
--- a/backend/internal/notifications/email.go
+++ b/backend/internal/notifications/email.go
@@ -0,0 +1,154 @@
+package notifications
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"log"
+	"net/http"
+	"time"
+)
+
+type EmailNotifier struct {
+	APIKey string
+	From   string
+	To     string
+}
+
+func (e *EmailNotifier) Send(_ context.Context, message string, meta AlertMetadata) error {
+	_, err := SendEmailNotification(e.APIKey, e.From, e.To, message, meta)
+	return err
+}
+
+const emailHTTPTimeoutSeconds = 10
+
+var emailHTTPClient = &http.Client{ //nolint:gochecknoglobals
+	Timeout: emailHTTPTimeoutSeconds * time.Second,
+}
+
+type resendPayload struct {
+	From    string `json:"from"`
+	To      string `json:"to"`
+	Subject string `json:"subject"`
+	HTML    string `json:"html"`
+}
+
+func SendEmailNotification(apiKey, fromAddress, toAddress, message string, meta AlertMetadata) (bool, error) {
+	if apiKey == "" {
+		log.Printf("Skipping email notification: RESEND_API_KEY not configured")
+		return false, nil
+	}
+
+	subject := fmt.Sprintf("Koin Ping Alert: %s", alertTypeLabel(meta.AlertType))
+
+	txLink := ""
+	if meta.TxHash != "" {
+		txLink = fmt.Sprintf(
+			`<p><a href="https://etherscan.io/tx/%s">View on Etherscan</a></p>`,
+			meta.TxHash,
+		)
+	}
+
+	html := fmt.Sprintf(`
+<div style="font-family: sans-serif; max-width: 600px; margin: 0 auto;">
+  <h2 style="color: #333;">Koin Ping Alert</h2>
+  <p style="font-size: 16px;">%s</p>
+  <table style="margin: 16px 0; border-collapse: collapse;">
+    <tr>
+      <td style="padding: 4px 12px 4px 0; color: #666;">Address</td>
+      <td style="padding: 4px 0;">%s</td>
+    </tr>
+    <tr>
+      <td style="padding: 4px 12px 4px 0; color: #666;">Blockchain</td>
+      <td style="padding: 4px 0; font-family: monospace; font-size: 13px;">%s</td>
+    </tr>
+  </table>
+  %s
+  <hr style="border: none; border-top: 1px solid #eee; margin: 24px 0;" />
+  <p style="font-size: 12px; color: #999;">Sent by Koin Ping</p>
+</div>`,
+		message, meta.AddressLabel, meta.Address, txLink)
+
+	payload := resendPayload{
+		From:    fromAddress,
+		To:      toAddress,
+		Subject: subject,
+		HTML:    html,
+	}
+
+	body, err := json.Marshal(payload)
+	if err != nil {
+		return false, fmt.Errorf("marshal email payload: %w", err)
+	}
+
+	req, err := http.NewRequest(http.MethodPost, "https://api.resend.com/emails", bytes.NewReader(body))
+	if err != nil {
+		return false, fmt.Errorf("create email request: %w", err)
+	}
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("Authorization", "Bearer "+apiKey)
+
+	resp, err := emailHTTPClient.Do(req)
+	if err != nil {
+		log.Printf("Failed to send email notification: %v", err)
+		return false, err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		log.Printf("Resend API failed: HTTP %d", resp.StatusCode)
+		return false, fmt.Errorf("resend API failed: HTTP %d", resp.StatusCode)
+	}
+
+	return true, nil
+}
+
+func TestEmailNotification(apiKey, fromAddress, toAddress string) (bool, error) {
+	if apiKey == "" {
+		return false, fmt.Errorf("email not configured: RESEND_API_KEY not set") //nolint:err113
+	}
+
+	payload := resendPayload{
+		From:    fromAddress,
+		To:      toAddress,
+		Subject: "Koin Ping — Test Notification",
+		HTML:    `<p>Your email alerts are configured correctly!</p><p style="font-size:12px;color:#999;">Sent by Koin Ping</p>`,
+	}
+
+	body, err := json.Marshal(payload)
+	if err != nil {
+		return false, err
+	}
+
+	req, err := http.NewRequest(http.MethodPost, "https://api.resend.com/emails", bytes.NewReader(body))
+	if err != nil {
+		return false, err
+	}
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("Authorization", "Bearer "+apiKey)
+
+	resp, err := emailHTTPClient.Do(req)
+	if err != nil {
+		log.Printf("Email test failed: %v", err)
+		return false, err
+	}
+	defer resp.Body.Close()
+
+	return resp.StatusCode >= 200 && resp.StatusCode < 300, nil
+}
+
+func alertTypeLabel(alertType string) string {
+	switch alertType {
+	case "incoming_tx":
+		return "Incoming Transaction"
+	case "outgoing_tx":
+		return "Outgoing Transaction"
+	case "large_transfer":
+		return "Large Transfer"
+	case "balance_below":
+		return "Balance Below Threshold"
+	default:
+		return "Alert"
+	}
+}
--- a/backend/internal/notifications/notifier.go
+++ b/backend/internal/notifications/notifier.go
@@ -0,0 +1,15 @@
+package notifications
+
+import "context"
+
+// AlertMetadata holds context about the alert being sent.
+type AlertMetadata struct {
+	TxHash       string
+	AddressLabel string
+	AlertType    string
+	Address      string
+}
+
+type Notifier interface {
+	Send(ctx context.Context, message string, meta AlertMetadata) error
+}
--- a/backend/internal/notifications/slack.go
+++ b/backend/internal/notifications/slack.go
@@ -0,0 +1,128 @@
+package notifications
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"log"
+	"net/http"
+	"time"
+)
+
+// SlackNotifier sends alert notifications via a Slack webhook.
+type SlackNotifier struct {
+	WebhookURL string
+}
+
+// Send implements Notifier for Slack.
+func (s *SlackNotifier) Send(_ context.Context, message string, meta AlertMetadata) error {
+	_, err := SendSlackNotification(s.WebhookURL, message, meta)
+	return err
+}
+
+const slackHTTPTimeoutSeconds = 10
+
+var slackHTTPClient = &http.Client{ //nolint:gochecknoglobals
+	Timeout: slackHTTPTimeoutSeconds * time.Second,
+}
+
+type slackAttachment struct {
+	Color  string        `json:"color"`
+	Title  string        `json:"title"`
+	Text   string        `json:"text"`
+	Fields []slackField  `json:"fields"`
+	Footer string        `json:"footer"`
+	Ts     int64         `json:"ts"`
+}
+
+type slackField struct {
+	Title string `json:"title"`
+	Value string `json:"value"`
+	Short bool   `json:"short"`
+}
+
+type slackPayload struct {
+	Text        string            `json:"text,omitempty"`
+	Attachments []slackAttachment `json:"attachments,omitempty"`
+}
+
+func SendSlackNotification(webhookURL, message string, meta AlertMetadata) (bool, error) {
+	fields := []slackField{
+		{Title: "Address", Value: meta.AddressLabel, Short: true},
+		{Title: "Blockchain Address", Value: fmt.Sprintf("`%s`", meta.Address), Short: false},
+	}
+
+	if meta.TxHash != "" {
+		fields = append(fields, slackField{
+			Title: "Transaction",
+			Value: fmt.Sprintf("<https://etherscan.io/tx/%s|View on Etherscan>", meta.TxHash),
+			Short: false,
+		})
+	}
+
+	payload := slackPayload{
+		Attachments: []slackAttachment{
+			{
+				Color:  slackColorForAlertType(meta.AlertType),
+				Title:  "Koin Ping Alert",
+				Text:   message,
+				Fields: fields,
+				Footer: "Koin Ping",
+				Ts:     time.Now().Unix(),
+			},
+		},
+	}
+
+	body, err := json.Marshal(payload)
+	if err != nil {
+		return false, fmt.Errorf("marshal slack payload: %w", err)
+	}
+
+	resp, err := slackHTTPClient.Post(webhookURL, "application/json", bytes.NewReader(body))
+	if err != nil {
+		log.Printf("Failed to send Slack notification: %v", err)
+		return false, err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		log.Printf("Slack webhook failed: HTTP %d", resp.StatusCode)
+		return false, fmt.Errorf("slack webhook failed: HTTP %d", resp.StatusCode)
+	}
+
+	return true, nil
+}
+
+func TestSlackWebhook(webhookURL string) (bool, error) {
+	payload := slackPayload{
+		Text: "Koin Ping test notification — Your Slack alerts are configured correctly!",
+	}
+
+	body, err := json.Marshal(payload)
+	if err != nil {
+		return false, err
+	}
+
+	resp, err := slackHTTPClient.Post(webhookURL, "application/json", bytes.NewReader(body))
+	if err != nil {
+		log.Printf("Slack webhook test failed: %v", err)
+		return false, err
+	}
+	defer resp.Body.Close()
+
+	return resp.StatusCode >= 200 && resp.StatusCode < 300, nil
+}
+
+func slackColorForAlertType(alertType string) string {
+	switch alertType {
+	case "incoming_tx":
+		return "#00ff00"
+	case "outgoing_tx":
+		return "#ff9900"
+	case "large_transfer", "balance_below":
+		return "#ff0000"
+	default:
+		return "#0099ff"
+	}
+}
--- a/backend/internal/notifications/telegram.go
+++ b/backend/internal/notifications/telegram.go
@@ -0,0 +1,122 @@
+package notifications
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"log"
+	"net/http"
+	"time"
+)
+
+// TelegramNotifier sends alert notifications via Telegram.
+type TelegramNotifier struct {
+	BotToken string
+	ChatID   string
+}
+
+// Send implements Notifier for Telegram.
+func (t *TelegramNotifier) Send(_ context.Context, message string, meta AlertMetadata) error {
+	_, err := SendTelegramNotification(t.BotToken, t.ChatID, message, meta)
+	return err
+}
+
+const telegramHTTPTimeoutSeconds = 10
+
+var telegramHTTPClient = &http.Client{ //nolint:gochecknoglobals
+	Timeout: telegramHTTPTimeoutSeconds * time.Second,
+}
+
+type telegramPayload struct {
+	ChatID    string `json:"chat_id"`
+	Text      string `json:"text"`
+	ParseMode string `json:"parse_mode"`
+}
+
+func SendTelegramNotification(botToken, chatID, message string, meta AlertMetadata) (bool, error) {
+	text := fmt.Sprintf("*Koin Ping Alert*\n\n%s\n\n*Address:* %s\n`%s`",
+		escapeMarkdown(message), escapeMarkdown(meta.AddressLabel), meta.Address)
+
+	if meta.TxHash != "" {
+		text += fmt.Sprintf("\n\n[View on Etherscan](https://etherscan.io/tx/%s)", meta.TxHash)
+	}
+
+	payload := telegramPayload{
+		ChatID:    chatID,
+		Text:      text,
+		ParseMode: "Markdown",
+	}
+
+	body, err := json.Marshal(payload)
+	if err != nil {
+		return false, fmt.Errorf("marshal telegram payload: %w", err)
+	}
+
+	url := fmt.Sprintf("https://api.telegram.org/bot%s/sendMessage", botToken)
+
+	resp, err := telegramHTTPClient.Post(url, "application/json", bytes.NewReader(body))
+	if err != nil {
+		log.Printf("Failed to send Telegram notification: %v", err)
+		return false, err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		log.Printf("Telegram API failed: HTTP %d", resp.StatusCode)
+		return false, fmt.Errorf("telegram API failed: HTTP %d", resp.StatusCode)
+	}
+
+	return true, nil
+}
+
+func TestTelegramWebhook(botToken, chatID string) (bool, error) {
+	payload := telegramPayload{
+		ChatID:    chatID,
+		Text:      "Koin Ping test notification — Your Telegram alerts are configured correctly!",
+		ParseMode: "Markdown",
+	}
+
+	body, err := json.Marshal(payload)
+	if err != nil {
+		return false, err
+	}
+
+	url := fmt.Sprintf("https://api.telegram.org/bot%s/sendMessage", botToken)
+
+	resp, err := telegramHTTPClient.Post(url, "application/json", bytes.NewReader(body))
+	if err != nil {
+		log.Printf("Telegram test failed: %v", err)
+		return false, err
+	}
+	defer resp.Body.Close()
+
+	return resp.StatusCode >= 200 && resp.StatusCode < 300, nil
+}
+
+func escapeMarkdown(s string) string {
+	replacer := []struct{ old, new string }{
+		{"_", "\\_"}, {"*", "\\*"}, {"[", "\\["}, {"]", "\\]"},
+		{"(", "\\("}, {")", "\\)"}, {"~", "\\~"}, {"`", "\\`"},
+		{">", "\\>"}, {"#", "\\#"}, {"+", "\\+"}, {"-", "\\-"},
+		{"=", "\\="}, {"|", "\\|"}, {"{", "\\{"}, {"}", "\\}"},
+		{".", "\\."}, {"!", "\\!"},
+	}
+	result := s
+	for _, r := range replacer {
+		result = replaceAll(result, r.old, r.new)
+	}
+	return result
+}
+
+func replaceAll(s, old, new string) string {
+	out := ""
+	for i := 0; i < len(s); i++ {
+		if string(s[i]) == old {
+			out += new
+		} else {
+			out += string(s[i])
+		}
+	}
+	return out
+}
--- a/backend/internal/protocols/ethereum/jsonrpc.go
+++ b/backend/internal/protocols/ethereum/jsonrpc.go
@@ -0,0 +1,399 @@
+package ethereum
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"log"
+	"math/big"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/kjannette/koin-ping/backend/internal/domain"
+)
+
+const (
+	rpcTimeoutMS    = 30000
+	rpcMaxRetries   = 3
+	rpcRetryBaseMS  = 2000
+)
+
+type JsonRpcEthereum struct {
+	rpcURL string
+	client *http.Client
+}
+
+func NewJsonRpcEthereum(rpcURL string) (*JsonRpcEthereum, error) {
+	if rpcURL == "" {
+		return nil, fmt.Errorf("JsonRpcEthereum requires a valid RPC URL")
+	}
+	return &JsonRpcEthereum{
+		rpcURL: rpcURL,
+		client: &http.Client{
+			Timeout: time.Duration(rpcTimeoutMS) * time.Millisecond,
+		},
+	}, nil
+}
+
+type rpcRequest struct {
+	JSONRPC string        `json:"jsonrpc"`
+	ID      int64         `json:"id"`
+	Method  string        `json:"method"`
+	Params  []interface{} `json:"params"`
+}
+
+type rpcResponse struct {
+	JSONRPC string          `json:"jsonrpc"`
+	ID      int64           `json:"id"`
+	Result  json.RawMessage `json:"result"`
+	Error   *rpcError       `json:"error"`
+}
+
+type rpcError struct {
+	Code    int    `json:"code"`
+	Message string `json:"message"`
+}
+
+func (j *JsonRpcEthereum) callRPC(ctx context.Context, method string, params ...interface{}) (json.RawMessage, error) {
+	if params == nil {
+		params = []interface{}{}
+	}
+
+	body, err := json.Marshal(rpcRequest{
+		JSONRPC: "2.0",
+		ID:      time.Now().UnixMilli(),
+		Method:  method,
+		Params:  params,
+	})
+	if err != nil {
+		return nil, fmt.Errorf("marshal RPC request: %w", err)
+	}
+
+	return j.callWithRetry(ctx, method, body)
+}
+
+// callWithRetry executes a JSON-RPC POST with exponential backoff on transient errors.
+// It retries on network errors, HTTP 429, and HTTP 5xx. It does NOT retry on RPC-level
+// errors or other 4xx responses (those are permanent failures).
+func (j *JsonRpcEthereum) callWithRetry(ctx context.Context, method string, body []byte) (json.RawMessage, error) {
+	var lastErr error
+	for attempt := range rpcMaxRetries {
+		if attempt > 0 {
+			wait := time.Duration(rpcRetryBaseMS*(1<<(attempt-1))) * time.Millisecond
+			select {
+			case <-ctx.Done():
+				return nil, ctx.Err()
+			case <-time.After(wait):
+			}
+			log.Printf("Retrying RPC call [%s] (attempt %d/%d)", method, attempt+1, rpcMaxRetries)
+		}
+
+		result, err := j.doRPCCall(ctx, method, body)
+		if err == nil {
+			return result, nil
+		}
+
+		lastErr = err
+
+		// Permanent errors: do not retry
+		if isPermanentRPCError(err) {
+			return nil, err
+		}
+
+		log.Printf("Transient RPC error [%s] (attempt %d/%d): %v", method, attempt+1, rpcMaxRetries, err)
+	}
+
+	return nil, lastErr
+}
+
+func (j *JsonRpcEthereum) doRPCCall(ctx context.Context, method string, body []byte) (json.RawMessage, error) {
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, j.rpcURL, bytes.NewReader(body))
+	if err != nil {
+		return nil, fmt.Errorf("create RPC request: %w", err)
+	}
+	req.Header.Set("Content-Type", "application/json")
+
+	resp, err := j.client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("RPC call failed [%s]: %w", method, err)
+	}
+	defer resp.Body.Close()
+
+	// 429 and 5xx are transient; other non-200 are permanent.
+	if resp.StatusCode != http.StatusOK {
+		err := fmt.Errorf("HTTP %d: %s for %s", resp.StatusCode, resp.Status, method)
+		if resp.StatusCode == http.StatusTooManyRequests || resp.StatusCode >= 500 { //nolint:mnd
+			return nil, err // transient — will be retried
+		}
+		return nil, &permanentRPCError{err}
+	}
+
+	var rpcResp rpcResponse
+	if err := json.NewDecoder(resp.Body).Decode(&rpcResp); err != nil {
+		return nil, fmt.Errorf("decode RPC response: %w", err)
+	}
+
+	if rpcResp.Error != nil {
+		// RPC-level errors are permanent (bad params, unsupported method, etc.)
+		return nil, &permanentRPCError{
+			fmt.Errorf("RPC Error [%s]: %s (code: %d)", method, rpcResp.Error.Message, rpcResp.Error.Code),
+		}
+	}
+
+	return rpcResp.Result, nil
+}
+
+type permanentRPCError struct{ cause error }
+
+func (e *permanentRPCError) Error() string { return e.cause.Error() }
+func (e *permanentRPCError) Unwrap() error { return e.cause }
+
+func isPermanentRPCError(err error) bool {
+	var p *permanentRPCError
+	return errors.As(err, &p)
+}
+
+func (j *JsonRpcEthereum) GetLatestBlockNumber(ctx context.Context) (int, error) {
+	result, err := j.callRPC(ctx, "eth_blockNumber")
+	if err != nil {
+		return 0, err
+	}
+
+	var hexBlock string
+	if err := json.Unmarshal(result, &hexBlock); err != nil {
+		return 0, fmt.Errorf("unmarshal block number: %w", err)
+	}
+
+	return hexToInt(hexBlock)
+}
+
+type rpcBlock struct {
+	Timestamp    string  `json:"timestamp"`
+	Transactions []rpcTx `json:"transactions"`
+}
+
+type rpcTx struct {
+	Hash        string  `json:"hash"`
+	From        string  `json:"from"`
+	To          *string `json:"to"`
+	Value       string  `json:"value"`
+	BlockNumber string  `json:"blockNumber"`
+}
+
+func (j *JsonRpcEthereum) GetBlockTransactions(ctx context.Context, blockNumber int) ([]domain.NormalizedTx, error) {
+	hexBlock := fmt.Sprintf("0x%x", blockNumber)
+
+	result, err := j.callRPC(ctx, "eth_getBlockByNumber", hexBlock, true)
+	if err != nil {
+		return nil, err
+	}
+
+	if string(result) == "null" {
+		return nil, nil
+	}
+
+	var block rpcBlock
+	if err := json.Unmarshal(result, &block); err != nil {
+		return nil, fmt.Errorf("unmarshal block: %w", err)
+	}
+
+	blockTimestamp, err := hexToInt64(block.Timestamp)
+	if err != nil {
+		return nil, fmt.Errorf("parse block timestamp: %w", err)
+	}
+
+	txs := make([]domain.NormalizedTx, 0, len(block.Transactions))
+	for _, tx := range block.Transactions {
+		bn, _ := hexToInt(tx.BlockNumber)
+
+		var toLower *string
+		if tx.To != nil {
+			s := strings.ToLower(*tx.To)
+			toLower = &s
+		}
+
+		txs = append(txs, domain.NormalizedTx{
+			Hash:           tx.Hash,
+			From:           strings.ToLower(tx.From),
+			To:             toLower,
+			Value:          hexToDecimalString(tx.Value),
+			BlockNumber:    bn,
+			BlockTimestamp: blockTimestamp,
+		})
+	}
+
+	return txs, nil
+}
+
+func (j *JsonRpcEthereum) GetBalance(ctx context.Context, address string) (string, error) {
+	result, err := j.callRPC(ctx, "eth_getBalance", address, "latest")
+	if err != nil {
+		return "", err
+	}
+
+	var hexBalance string
+	if err := json.Unmarshal(result, &hexBalance); err != nil {
+		return "", fmt.Errorf("unmarshal balance: %w", err)
+	}
+
+	return hexToDecimalString(hexBalance), nil
+}
+
+const erc20TransferTopic = "0xddf252ad1be2c89b69c2b068fc378daa952ba7f163c4a11628f55a4df523b3ef"
+
+const minTransferTopics = 3
+
+type rpcLog struct {
+	Address     string   `json:"address"`
+	Topics      []string `json:"topics"`
+	Data        string   `json:"data"`
+	BlockNumber string   `json:"blockNumber"`
+	TxHash      string   `json:"transactionHash"`
+}
+
+// GetTokenTransfers fetches ERC-20 Transfer events for a given address
+// across a block range, covering both incoming and outgoing transfers.
+func (j *JsonRpcEthereum) GetTokenTransfers(ctx context.Context, fromBlock, toBlock int, address string) ([]domain.NormalizedTx, error) {
+	paddedAddr := padAddress(address)
+	hexFrom := fmt.Sprintf("0x%x", fromBlock)
+	hexTo := fmt.Sprintf("0x%x", toBlock)
+
+	incomingLogs, err := j.getTransferLogs(ctx, hexFrom, hexTo, "", paddedAddr)
+	if err != nil {
+		return nil, fmt.Errorf("fetch incoming token transfers: %w", err)
+	}
+
+	outgoingLogs, err := j.getTransferLogs(ctx, hexFrom, hexTo, paddedAddr, "")
+	if err != nil {
+		return nil, fmt.Errorf("fetch outgoing token transfers: %w", err)
+	}
+
+	seen := make(map[string]bool)
+	var txs []domain.NormalizedTx
+
+	for _, entry := range append(incomingLogs, outgoingLogs...) {
+		key := entry.TxHash + "|" + entry.Address + "|" + entry.Data
+		if seen[key] {
+			continue
+		}
+		seen[key] = true
+
+		tx, parseErr := parseTransferLog(entry)
+		if parseErr != nil {
+			log.Printf("Skipping unparseable transfer log in tx %s: %v", entry.TxHash, parseErr)
+			continue
+		}
+		txs = append(txs, tx)
+	}
+
+	return txs, nil
+}
+
+func (j *JsonRpcEthereum) getTransferLogs(ctx context.Context, fromBlock, toBlock, fromAddr, toAddr string) ([]rpcLog, error) {
+	topics := make([]interface{}, minTransferTopics)
+	topics[0] = erc20TransferTopic
+
+	if fromAddr != "" {
+		topics[1] = fromAddr
+	}
+	if toAddr != "" {
+		topics[2] = toAddr
+	}
+
+	filter := map[string]interface{}{
+		"fromBlock": fromBlock,
+		"toBlock":   toBlock,
+		"topics":    topics,
+	}
+
+	result, err := j.callRPC(ctx, "eth_getLogs", filter)
+	if err != nil {
+		return nil, err
+	}
+
+	var logs []rpcLog
+	if err := json.Unmarshal(result, &logs); err != nil {
+		return nil, fmt.Errorf("unmarshal logs: %w", err)
+	}
+
+	return logs, nil
+}
+
+func parseTransferLog(entry rpcLog) (domain.NormalizedTx, error) {
+	if len(entry.Topics) < minTransferTopics {
+		return domain.NormalizedTx{}, fmt.Errorf("transfer log has %d topics, expected >= 3", len(entry.Topics))
+	}
+
+	from := topicToAddress(entry.Topics[1])
+	to := topicToAddress(entry.Topics[2])
+	tokenValue := hexToDecimalString(entry.Data)
+	blockNumber, _ := hexToInt(entry.BlockNumber)
+
+	contractAddr := strings.ToLower(entry.Address)
+	tokenInfo, known := LookupToken(contractAddr)
+
+	tx := domain.NormalizedTx{
+		Hash:          entry.TxHash,
+		From:          from,
+		To:            &to,
+		Value:         "0",
+		BlockNumber:   blockNumber,
+		TokenContract: &contractAddr,
+		TokenValue:    &tokenValue,
+	}
+
+	if known {
+		tx.TokenSymbol = &tokenInfo.Symbol
+		tx.TokenDecimals = &tokenInfo.Decimals
+	}
+
+	return tx, nil
+}
+
+func padAddress(addr string) string {
+	clean := strings.TrimPrefix(strings.ToLower(addr), "0x")
+	const addressHexLen = 64
+	return "0x" + strings.Repeat("0", addressHexLen-len(clean)) + clean
+}
+
+func topicToAddress(topic string) string {
+	clean := strings.TrimPrefix(topic, "0x")
+	const ethAddrLen = 40
+	if len(clean) > ethAddrLen {
+		clean = clean[len(clean)-ethAddrLen:]
+	}
+	return "0x" + strings.ToLower(clean)
+}
+
+func hexToInt(hex string) (int, error) {
+	hex = strings.TrimPrefix(hex, "0x")
+	n, ok := new(big.Int).SetString(hex, 16)
+	if !ok {
+		return 0, fmt.Errorf("invalid hex: %s", hex)
+	}
+	return int(n.Int64()), nil
+}
+
+func hexToInt64(hex string) (int64, error) {
+	hex = strings.TrimPrefix(hex, "0x")
+	n, ok := new(big.Int).SetString(hex, 16)
+	if !ok {
+		return 0, fmt.Errorf("invalid hex: %s", hex)
+	}
+	return n.Int64(), nil
+}
+
+func hexToDecimalString(hex string) string {
+	if hex == "" || hex == "0x" || hex == "0x0" {
+		return "0"
+	}
+	clean := strings.TrimPrefix(hex, "0x")
+	n, ok := new(big.Int).SetString(clean, 16)
+	if !ok {
+		return "0"
+	}
+	return n.String()
+}
--- a/backend/internal/protocols/ethereum/observer.go
+++ b/backend/internal/protocols/ethereum/observer.go
@@ -0,0 +1,16 @@
+package ethereum
+
+import (
+	"context"
+
+	"github.com/kjannette/koin-ping/backend/internal/domain"
+)
+
+// EthereumObserver defines the interface for blockchain interaction.
+// Any concrete implementation (JSON-RPC, WebSocket, mock) must satisfy this.
+type EthereumObserver interface {
+	GetLatestBlockNumber(ctx context.Context) (int, error)
+	GetBlockTransactions(ctx context.Context, blockNumber int) ([]domain.NormalizedTx, error)
+	GetBalance(ctx context.Context, address string) (string, error)
+	GetTokenTransfers(ctx context.Context, fromBlock, toBlock int, address string) ([]domain.NormalizedTx, error)
+}
--- a/backend/internal/protocols/ethereum/tokens.go
+++ b/backend/internal/protocols/ethereum/tokens.go
@@ -0,0 +1,34 @@
+package ethereum
+
+import "strings"
+
+// TokenInfo holds metadata for a known ERC-20 token contract.
+type TokenInfo struct {
+	Symbol   string
+	Decimals int
+}
+
+//nolint:gochecknoglobals
+var wellKnownTokens = map[string]TokenInfo{
+	"0xdac17f958d2ee523a2206206994597c13d831ec7": {Symbol: "USDT", Decimals: 6},
+	"0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48": {Symbol: "USDC", Decimals: 6},
+	"0x6b175474e89094c44da98b954eedeac495271d0f": {Symbol: "DAI", Decimals: 18},
+	"0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2": {Symbol: "WETH", Decimals: 18},
+	"0x2260fac5e5542a773aa44fbcfedf7c193bc2c599": {Symbol: "WBTC", Decimals: 8},
+	"0x514910771af9ca656af840dff83e8264ecf986ca": {Symbol: "LINK", Decimals: 18},
+	"0x1f9840a85d5af5bf1d1762f925bdaddc4201f984": {Symbol: "UNI", Decimals: 18},
+	"0x7fc66500c84a76ad7e9c93437bfc5ac33e2ddae9": {Symbol: "AAVE", Decimals: 18},
+	"0x95ad61b0a150d79219dcf64e1e6cc01f0b64c4ce": {Symbol: "SHIB", Decimals: 18},
+	"0x6982508145454ce325ddbe47a25d4ec3d2311933": {Symbol: "PEPE", Decimals: 18},
+	"0xb8c77482e45f1f44de1745f52c74426c631bdd52": {Symbol: "BNB", Decimals: 18},
+	"0x4fabb145d64652a948d72533023f6e7a623c7c53": {Symbol: "BUSD", Decimals: 18},
+	"0x75231f58b43240c9718dd58b4967c5114342a86c": {Symbol: "OKB", Decimals: 18},
+	"0x582d872a1b094fc48f5de31d3b73f2d9be47def1": {Symbol: "TON", Decimals: 9},
+	"0x4d224452801aced8b2f0aebe155379bb5d594381": {Symbol: "APE", Decimals: 18},
+}
+
+// LookupToken returns metadata for a known token contract, if found.
+func LookupToken(contractAddress string) (TokenInfo, bool) {
+	info, ok := wellKnownTokens[strings.ToLower(contractAddress)]
+	return info, ok
+}
--- a/backend/internal/services/email_digest.go
+++ b/backend/internal/services/email_digest.go
@@ -0,0 +1,196 @@
+package services
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"log"
+	"net/http"
+	"time"
+
+	"github.com/kjannette/koin-ping/backend/internal/models"
+)
+
+const (
+	resendAPIURL          = "https://api.resend.com/emails"
+	emailHTTPTimeout      = 10 * time.Second
+	defaultDigestMaxItems = 50
+)
+
+var digestHTTPClient = &http.Client{Timeout: emailHTTPTimeout} //nolint:gochecknoglobals
+
+// handles email setup and digest sending via Resend.
+type EmailDigestService struct {
+	apiKey      string
+	fromAddress string
+	alertEvents *models.AlertEventModel
+	notifCfgs   *models.NotificationConfigModel
+}
+
+func NewEmailDigestService(
+	apiKey, fromAddress string,
+	alertEvents *models.AlertEventModel,
+	notifCfgs *models.NotificationConfigModel,
+) *EmailDigestService {
+	return &EmailDigestService{
+		apiKey:      apiKey,
+		fromAddress: fromAddress,
+		alertEvents: alertEvents,
+		notifCfgs:   notifCfgs,
+	}
+}
+
+// Configured returns true when the Resend API key is present.
+func (s *EmailDigestService) Configured() bool {
+	return s.apiKey != ""
+}
+
+// SetupEmail validates the email works by sending a welcome/confirmation
+// message via Resend. Called when a user saves their email in notification settings.
+func (s *EmailDigestService) SetupEmail(toAddress string) error {
+	if !s.Configured() {
+		return fmt.Errorf("email service not configured: RESEND_API_KEY not set") //nolint:err113
+	}
+
+	html := `
+<div style="font-family: sans-serif; max-width: 600px; margin: 0 auto;">
+  <h2 style="color: #333;">Welcome to Koin Ping Email Alerts</h2>
+  <p>Your email has been successfully configured for alert notifications.</p>
+  <p>You will receive alert digests at this address when events are triggered
+     on your watched addresses.</p>
+  <hr style="border: none; border-top: 1px solid #eee; margin: 24px 0;" />
+  <p style="font-size: 12px; color: #999;">Sent by Koin Ping</p>
+</div>`
+
+	return s.send(toAddress, "Koin Ping — Email Alerts Configured", html)
+}
+
+func (s *EmailDigestService) SendDigest(ctx context.Context, userID, toAddress string) error {
+	if !s.Configured() {
+		return fmt.Errorf("email service not configured: RESEND_API_KEY not set") //nolint:err113
+	}
+
+	events, err := s.alertEvents.ListRecentByUser(ctx, userID, defaultDigestMaxItems)
+	if err != nil {
+		return fmt.Errorf("fetch alert events: %w", err)
+	}
+
+	if len(events) == 0 {
+		log.Printf("No recent alerts for user %s — skipping digest", userID)
+		return nil
+	}
+
+	var rows string
+	for _, e := range events {
+		label := "—"
+		if e.AddressLabel != nil {
+			label = *e.AddressLabel
+		}
+		txLink := "—"
+		if e.TxHash != nil {
+			txLink = fmt.Sprintf(
+				`<a href="https://etherscan.io/tx/%s" style="color:#0066cc;">%s…</a>`,
+				*e.TxHash, (*e.TxHash)[:10],
+			)
+		}
+		rows += fmt.Sprintf(`
+      <tr>
+        <td style="padding:6px 8px; border-bottom:1px solid #eee;">%s</td>
+        <td style="padding:6px 8px; border-bottom:1px solid #eee;">%s</td>
+        <td style="padding:6px 8px; border-bottom:1px solid #eee;">%s</td>
+        <td style="padding:6px 8px; border-bottom:1px solid #eee; font-size:12px; color:#666;">%s</td>
+      </tr>`,
+			label, e.Message, txLink,
+			e.Timestamp.Format("Jan 2 15:04 UTC"),
+		)
+	}
+
+	html := fmt.Sprintf(`
+<div style="font-family: sans-serif; max-width: 700px; margin: 0 auto;">
+  <h2 style="color: #333;">Koin Ping — Alert Digest</h2>
+  <p>Here are your recent alerts (%d total):</p>
+  <table style="width:100%%; border-collapse:collapse; font-size:14px;">
+    <thead>
+      <tr style="background:#f5f5f5;">
+        <th style="padding:8px; text-align:left;">Address</th>
+        <th style="padding:8px; text-align:left;">Alert</th>
+        <th style="padding:8px; text-align:left;">Tx</th>
+        <th style="padding:8px; text-align:left;">Time</th>
+      </tr>
+    </thead>
+    <tbody>%s</tbody>
+  </table>
+  <hr style="border:none; border-top:1px solid #eee; margin:24px 0;" />
+  <p style="font-size:12px; color:#999;">Sent by Koin Ping</p>
+</div>`, len(events), rows)
+
+	subject := fmt.Sprintf("Koin Ping Digest — %d alerts", len(events))
+
+	return s.send(toAddress, subject, html)
+}
+
+func (s *EmailDigestService) SendDigestsForAllUsers(ctx context.Context) (int, error) {
+	if !s.Configured() {
+		return 0, nil
+	}
+
+	configs, err := s.notifCfgs.ListEnabled(ctx)
+	if err != nil {
+		return 0, fmt.Errorf("list enabled configs: %w", err)
+	}
+
+	sent := 0
+	for _, cfg := range configs {
+		if cfg.Email == nil || *cfg.Email == "" {
+			continue
+		}
+		if err := s.SendDigest(ctx, cfg.UserID, *cfg.Email); err != nil {
+			log.Printf("Failed to send digest to user %s: %v", cfg.UserID, err)
+			continue
+		}
+		sent++
+	}
+
+	return sent, nil
+}
+
+type resendEmailPayload struct {
+	From    string `json:"from"`
+	To      string `json:"to"`
+	Subject string `json:"subject"`
+	HTML    string `json:"html"`
+}
+
+func (s *EmailDigestService) send(to, subject, html string) error {
+	payload := resendEmailPayload{
+		From:    s.fromAddress,
+		To:      to,
+		Subject: subject,
+		HTML:    html,
+	}
+
+	body, err := json.Marshal(payload)
+	if err != nil {
+		return fmt.Errorf("marshal email payload: %w", err)
+	}
+
+	req, err := http.NewRequest(http.MethodPost, resendAPIURL, bytes.NewReader(body))
+	if err != nil {
+		return fmt.Errorf("create request: %w", err)
+	}
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("Authorization", "Bearer "+s.apiKey)
+
+	resp, err := digestHTTPClient.Do(req)
+	if err != nil {
+		return fmt.Errorf("send email via Resend: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		return fmt.Errorf("Resend API returned HTTP %d", resp.StatusCode) //nolint:err113
+	}
+
+	return nil
+}
--- a/backend/internal/services/evaluator.go
+++ b/backend/internal/services/evaluator.go
@@ -0,0 +1,363 @@
+package services
+
+import (
+	"context"
+	"fmt"
+	"log"
+	"sync"
+	"time"
+
+	"golang.org/x/sync/semaphore"
+
+	"github.com/kjannette/koin-ping/backend/internal/domain"
+	"github.com/kjannette/koin-ping/backend/internal/models"
+	"github.com/kjannette/koin-ping/backend/internal/notifications"
+	"github.com/kjannette/koin-ping/backend/internal/protocols/ethereum"
+	"github.com/kjannette/koin-ping/backend/internal/wei"
+)
+
+const (
+	notificationTimeout    = 30 * time.Second
+	notificationMaxRetries = 3
+	notificationRetryBase  = time.Second
+	maxConcurrentNotifications = 5
+)
+
+type EvaluatorService struct {
+	eth          ethereum.EthereumObserver
+	alertRules   *models.AlertRuleModel
+	alertEvents  *models.AlertEventModel
+	addresses    *models.AddressModel
+	notifConfigs *models.NotificationConfigModel
+	resendAPIKey string
+	emailFrom    string
+	notifSem     *semaphore.Weighted
+	notifWg      sync.WaitGroup
+}
+
+func NewEvaluatorService(
+	eth ethereum.EthereumObserver,
+	alertRules *models.AlertRuleModel,
+	alertEvents *models.AlertEventModel,
+	addresses *models.AddressModel,
+	notifConfigs *models.NotificationConfigModel,
+	resendAPIKey string,
+	emailFrom string,
+) *EvaluatorService {
+	return &EvaluatorService{
+		eth:          eth,
+		alertRules:   alertRules,
+		alertEvents:  alertEvents,
+		addresses:    addresses,
+		notifConfigs: notifConfigs,
+		resendAPIKey: resendAPIKey,
+		emailFrom:    emailFrom,
+		notifSem:     semaphore.NewWeighted(maxConcurrentNotifications),
+	}
+}
+
+func (s *EvaluatorService) Evaluate(ctx context.Context, observations []domain.ObservedTx) (int, error) {
+	alertsFired := 0
+
+	for _, obs := range observations {
+		fired, err := s.evaluateObservation(ctx, obs)
+		if err != nil {
+			log.Printf("Error evaluating observation for address ID %d: %v", obs.AddressID, err)
+			continue
+		}
+		alertsFired += fired
+	}
+
+	return alertsFired, nil
+}
+
+func (s *EvaluatorService) evaluateObservation(ctx context.Context, obs domain.ObservedTx) (int, error) {
+	rules, err := s.alertRules.ListByAddress(ctx, obs.AddressID)
+	if err != nil {
+		return 0, err
+	}
+
+	alertsFired := 0
+	for _, rule := range rules {
+		if !rule.Enabled {
+			continue
+		}
+
+		matches, err := s.ruleMatches(ctx, rule, obs)
+		if err != nil {
+			log.Printf("Error matching rule %d: %v", rule.ID, err)
+			continue
+		}
+
+		if matches {
+			if err := s.fireAlert(ctx, rule, obs); err != nil {
+				log.Printf("Error firing alert for rule %d: %v", rule.ID, err)
+				continue
+			}
+			alertsFired++
+		}
+	}
+
+	return alertsFired, nil
+}
+
+func (s *EvaluatorService) ruleMatches(ctx context.Context, rule domain.AlertRule, obs domain.ObservedTx) (bool, error) {
+	switch rule.Type {
+	case domain.AlertIncomingTx:
+		return obs.Direction == domain.DirectionIncoming, nil
+	case domain.AlertOutgoingTx:
+		return obs.Direction == domain.DirectionOutgoing, nil
+	case domain.AlertLargeTransfer:
+		return s.matchesLargeTransfer(rule, obs)
+	case domain.AlertBalanceBelow:
+		return s.matchesBalanceBelow(ctx, rule, obs)
+	default:
+		log.Printf("Unknown rule type: %s", rule.Type)
+		return false, nil
+	}
+}
+
+func (s *EvaluatorService) matchesLargeTransfer(rule domain.AlertRule, obs domain.ObservedTx) (bool, error) {
+	if rule.Threshold == nil {
+		return false, nil
+	}
+
+	thresholdWei, err := wei.FromEth(*rule.Threshold)
+	if err != nil {
+		return false, err
+	}
+
+	return wei.GreaterThanOrEqual(obs.Value, thresholdWei)
+}
+
+// matchesBalanceBelow only triggers after outgoing transactions, since incoming
+// transactions increase balance and can't cause it to drop below threshold.
+func (s *EvaluatorService) matchesBalanceBelow(ctx context.Context, rule domain.AlertRule, obs domain.ObservedTx) (bool, error) {
+	if rule.Threshold == nil {
+		return false, nil
+	}
+
+	if obs.Direction != domain.DirectionOutgoing {
+		return false, nil
+	}
+
+	addr, err := s.addresses.FindByID(ctx, obs.AddressID, nil)
+	if err != nil {
+		return false, err
+	}
+	if addr == nil {
+		log.Printf("Address ID %d not found", obs.AddressID)
+		return false, nil
+	}
+
+	balanceWei, err := s.eth.GetBalance(ctx, addr.Address)
+	if err != nil {
+		return false, err
+	}
+
+	thresholdWei, err := wei.FromEth(*rule.Threshold)
+	if err != nil {
+		return false, err
+	}
+
+	return wei.LessThan(balanceWei, thresholdWei)
+}
+
+func (s *EvaluatorService) fireAlert(ctx context.Context, rule domain.AlertRule, obs domain.ObservedTx) error {
+	addr, err := s.addresses.FindByID(ctx, obs.AddressID, nil)
+	if err != nil {
+		return err
+	}
+
+	addressLabel := "Unknown"
+	if addr != nil {
+		if addr.Label != nil {
+			addressLabel = *addr.Label
+		} else {
+			addressLabel = addr.Address
+		}
+	}
+
+	message := s.buildMessage(rule, obs)
+	txHash := &obs.Hash
+
+	event, err := s.alertEvents.Create(ctx, rule.ID, message, &addressLabel, txHash)
+	if err != nil {
+		return err
+	}
+
+	if event == nil {
+		log.Printf("[ALERT DEDUP] Rule %d (%s) - duplicate event skipped for TX: %s", rule.ID, rule.Type, obs.Hash)
+		return nil
+	}
+
+	log.Printf("[ALERT FIRED] Rule %d (%s) - %s - TX: %s", rule.ID, rule.Type, message, obs.Hash)
+
+	if addr != nil {
+		userID := addr.UserID
+		address := addr.Address
+		if err := s.notifSem.Acquire(ctx, 1); err != nil {
+			log.Printf("Failed to acquire notification semaphore for rule %d: %v", rule.ID, err)
+			return nil
+		}
+		s.notifWg.Add(1)
+		go func() {
+			defer s.notifSem.Release(1)
+			defer s.notifWg.Done()
+			notifCtx, cancel := context.WithTimeout(context.Background(), notificationTimeout)
+			defer cancel()
+			s.sendNotification(notifCtx, userID, message, obs, addressLabel, rule, address)
+		}()
+	}
+
+	return nil
+}
+
+// WaitForNotifications blocks until all in-flight notification goroutines finish.
+func (s *EvaluatorService) WaitForNotifications() {
+	s.notifWg.Wait()
+}
+
+func (s *EvaluatorService) buildNotifiers(cfg *domain.NotificationConfig) []notifications.Notifier {
+	var notifiers []notifications.Notifier
+
+	if cfg.DiscordWebhookURL != nil && *cfg.DiscordWebhookURL != "" {
+		notifiers = append(notifiers, &notifications.DiscordNotifier{WebhookURL: *cfg.DiscordWebhookURL})
+	}
+
+	if cfg.TelegramBotToken != nil && *cfg.TelegramBotToken != "" &&
+		cfg.TelegramChatID != nil && *cfg.TelegramChatID != "" {
+		notifiers = append(notifiers, &notifications.TelegramNotifier{
+			BotToken: *cfg.TelegramBotToken,
+			ChatID:   *cfg.TelegramChatID,
+		})
+	}
+
+	if cfg.SlackWebhookURL != nil && *cfg.SlackWebhookURL != "" {
+		notifiers = append(notifiers, &notifications.SlackNotifier{WebhookURL: *cfg.SlackWebhookURL})
+	}
+
+	if cfg.Email != nil && *cfg.Email != "" {
+		notifiers = append(notifiers, &notifications.EmailNotifier{
+			APIKey: s.resendAPIKey,
+			From:   s.emailFrom,
+			To:     *cfg.Email,
+		})
+	}
+
+	return notifiers
+}
+
+func sendWithRetry(ctx context.Context, n notifications.Notifier, message string, meta notifications.AlertMetadata) error {
+	var lastErr error
+	for attempt := range notificationMaxRetries {
+		if attempt > 0 {
+			wait := notificationRetryBase * time.Duration(1<<(attempt-1))
+			select {
+			case <-ctx.Done():
+				return ctx.Err()
+			case <-time.After(wait):
+			}
+		}
+
+		if err := n.Send(ctx, message, meta); err != nil {
+			log.Printf("Notification attempt %d/%d failed: %v", attempt+1, notificationMaxRetries, err)
+			lastErr = err
+			continue
+		}
+
+		return nil
+	}
+
+	return lastErr
+}
+
+func (s *EvaluatorService) sendNotification(ctx context.Context, userID, message string, obs domain.ObservedTx, addressLabel string, rule domain.AlertRule, address string) {
+	notifConfig, err := s.notifConfigs.GetConfig(ctx, userID)
+	if err != nil {
+		log.Printf("Failed to get notification config: %v", err)
+		return
+	}
+
+	if notifConfig == nil || !notifConfig.NotificationEnabled {
+		return
+	}
+
+	meta := notifications.AlertMetadata{
+		TxHash:       obs.Hash,
+		AddressLabel: addressLabel,
+		AlertType:    string(rule.Type),
+		Address:      address,
+	}
+
+	for _, n := range s.buildNotifiers(notifConfig) {
+		if err := sendWithRetry(ctx, n, message, meta); err != nil {
+			log.Printf("Notification channel failed for user %s after retries: %v", userID, err)
+		} else {
+			log.Printf("Notification sent to user %s via %T", userID, n)
+		}
+	}
+}
+
+func (s *EvaluatorService) buildMessage(rule domain.AlertRule, obs domain.ObservedTx) string {
+	if obs.IsTokenTransfer() {
+		return s.buildTokenMessage(rule, obs)
+	}
+
+	switch rule.Type {
+	case domain.AlertIncomingTx:
+		ethStr, _ := wei.FormatAsEth(obs.Value, 4)
+		return fmt.Sprintf("Incoming transaction: %s received", ethStr)
+	case domain.AlertOutgoingTx:
+		ethStr, _ := wei.FormatAsEth(obs.Value, 4)
+		return fmt.Sprintf("Outgoing transaction: %s sent", ethStr)
+	case domain.AlertLargeTransfer:
+		ethStr, _ := wei.FormatAsEth(obs.Value, 4)
+		threshold := float64(0)
+		if rule.Threshold != nil {
+			threshold = *rule.Threshold
+		}
+		return fmt.Sprintf("Large transfer detected: %s (threshold: %g ETH)", ethStr, threshold)
+	case domain.AlertBalanceBelow:
+		threshold := float64(0)
+		if rule.Threshold != nil {
+			threshold = *rule.Threshold
+		}
+		return fmt.Sprintf("Balance dropped below threshold of %g ETH", threshold)
+	default:
+		return "Alert triggered"
+	}
+}
+
+const defaultTokenDecimals = 18
+
+func (s *EvaluatorService) buildTokenMessage(rule domain.AlertRule, obs domain.ObservedTx) string {
+	symbol := "tokens"
+	if obs.TokenSymbol != nil {
+		symbol = *obs.TokenSymbol
+	}
+
+	amount := "unknown"
+	if obs.TokenValue != nil {
+		decimals := defaultTokenDecimals
+		if obs.TokenDecimals != nil {
+			decimals = *obs.TokenDecimals
+		}
+		amount = wei.FormatTokenAmount(*obs.TokenValue, decimals)
+	}
+
+	switch rule.Type {
+	case domain.AlertIncomingTx:
+		return fmt.Sprintf("Incoming transfer: %s %s received", amount, symbol)
+	case domain.AlertOutgoingTx:
+		return fmt.Sprintf("Outgoing transfer: %s %s sent", amount, symbol)
+	case domain.AlertLargeTransfer:
+		threshold := float64(0)
+		if rule.Threshold != nil {
+			threshold = *rule.Threshold
+		}
+		return fmt.Sprintf("Large token transfer: %s %s (threshold: %g)", amount, symbol, threshold)
+	default:
+		return fmt.Sprintf("Token transfer: %s %s", amount, symbol)
+	}
+}
--- a/backend/internal/services/observer.go
+++ b/backend/internal/services/observer.go
@@ -0,0 +1,141 @@
+package services
+
+import (
+	"context"
+	"log"
+	"strings"
+
+	"github.com/kjannette/koin-ping/backend/internal/domain"
+	"github.com/kjannette/koin-ping/backend/internal/models"
+	"github.com/kjannette/koin-ping/backend/internal/protocols/ethereum"
+)
+
+const maxBlocksPerRun = 100
+
+type ObserverService struct {
+	eth        ethereum.EthereumObserver
+	addresses  *models.AddressModel
+	checkpoint *models.CheckpointModel
+}
+
+func NewObserverService(eth ethereum.EthereumObserver, addresses *models.AddressModel, checkpoint *models.CheckpointModel) *ObserverService {
+	return &ObserverService{
+		eth:        eth,
+		addresses:  addresses,
+		checkpoint: checkpoint,
+	}
+}
+
+func (s *ObserverService) RunOnce(ctx context.Context) ([]domain.ObservedTx, error) {
+	addresses, err := s.addresses.ListAll(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	if len(addresses) == 0 {
+		return nil, nil
+	}
+
+	latestBlock, err := s.eth.GetLatestBlockNumber(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	var observations []domain.ObservedTx
+	for _, addr := range addresses {
+		obs, err := s.observeAddress(ctx, addr, latestBlock)
+		if err != nil {
+			log.Printf("Error observing address %s: %v", addr.Address, err)
+			continue
+		}
+		observations = append(observations, obs...)
+	}
+
+	return observations, nil
+}
+
+func (s *ObserverService) observeAddress(ctx context.Context, addr domain.Address, latestBlock int) ([]domain.ObservedTx, error) {
+	lastChecked, found, err := s.checkpoint.GetLastCheckedBlock(ctx, addr.ID)
+	if err != nil {
+		return nil, err
+	}
+
+	startBlock := s.getStartBlock(lastChecked, found, latestBlock)
+	endBlock := s.getEndBlock(startBlock, latestBlock)
+
+	if startBlock > endBlock {
+		return nil, nil
+	}
+
+	var observations []domain.ObservedTx
+	for blockNumber := startBlock; blockNumber <= endBlock; blockNumber++ {
+		blockTxs, err := s.eth.GetBlockTransactions(ctx, blockNumber)
+		if err != nil {
+			return nil, err
+		}
+
+		relevant := filterRelevantTransactions(blockTxs, addr.Address)
+		for _, tx := range relevant {
+			observations = append(observations, createObservedTx(tx, addr))
+		}
+	}
+
+	tokenTxs, err := s.eth.GetTokenTransfers(ctx, startBlock, endBlock, addr.Address)
+	if err != nil {
+		log.Printf("Error fetching token transfers for %s: %v", addr.Address, err)
+	} else {
+		for _, tx := range tokenTxs {
+			observations = append(observations, createObservedTx(tx, addr))
+		}
+	}
+
+	if _, err := s.checkpoint.UpdateLastCheckedBlock(ctx, addr.ID, endBlock); err != nil {
+		return nil, err
+	}
+
+	return observations, nil
+}
+
+func (s *ObserverService) getStartBlock(lastChecked int, found bool, latestBlock int) int {
+	if !found {
+		return latestBlock
+	}
+	return lastChecked + 1
+}
+
+func (s *ObserverService) getEndBlock(startBlock, latestBlock int) int {
+	end := startBlock + maxBlocksPerRun - 1
+	if end > latestBlock {
+		return latestBlock
+	}
+	return end
+}
+
+func filterRelevantTransactions(txs []domain.NormalizedTx, trackedAddress string) []domain.NormalizedTx {
+	addrLower := strings.ToLower(trackedAddress)
+	var relevant []domain.NormalizedTx
+
+	for _, tx := range txs {
+		fromMatch := strings.ToLower(tx.From) == addrLower
+		toMatch := tx.To != nil && strings.ToLower(*tx.To) == addrLower
+		if fromMatch || toMatch {
+			relevant = append(relevant, tx)
+		}
+	}
+
+	return relevant
+}
+
+func createObservedTx(tx domain.NormalizedTx, addr domain.Address) domain.ObservedTx {
+	addrLower := strings.ToLower(addr.Address)
+	direction := domain.DirectionOutgoing
+	if tx.To != nil && strings.ToLower(*tx.To) == addrLower {
+		direction = domain.DirectionIncoming
+	}
+
+	return domain.ObservedTx{
+		NormalizedTx: tx,
+		AddressID:    addr.ID,
+		Direction:    direction,
+	}
+}
--- a/backend/internal/wei/converter.go
+++ b/backend/internal/wei/converter.go
@@ -0,0 +1,151 @@
+package wei
+
+import (
+	"fmt"
+	"math/big"
+	"strings"
+)
+
+var weiPerEth = new(big.Int).Exp(big.NewInt(10), big.NewInt(18), nil)
+
+// ToEth converts a Wei string to a float64 ETH value.
+// Use for display only — not for precision-sensitive comparisons.
+func ToEth(weiString string) (float64, error) {
+	if weiString == "" || weiString == "0" {
+		return 0, nil
+	}
+
+	w, ok := new(big.Int).SetString(weiString, 10)
+	if !ok {
+		return 0, fmt.Errorf("invalid Wei value: %s", weiString)
+	}
+
+	wf := new(big.Float).SetInt(w)
+	ef := new(big.Float).SetInt(weiPerEth)
+	result, _ := new(big.Float).Quo(wf, ef).Float64()
+	return result, nil
+}
+
+// FromEth converts an ETH float64 to a Wei string.
+// Handles decimal precision by splitting on the decimal point.
+func FromEth(eth float64) (string, error) {
+	if eth == 0 {
+		return "0", nil
+	}
+
+	s := fmt.Sprintf("%.18f", eth)
+	parts := strings.SplitN(s, ".", 2)
+	whole := parts[0]
+	decimal := ""
+	if len(parts) == 2 {
+		decimal = parts[1]
+	}
+
+	// Pad or trim decimal to exactly 18 digits
+	if len(decimal) < 18 {
+		decimal = decimal + strings.Repeat("0", 18-len(decimal))
+	} else {
+		decimal = decimal[:18]
+	}
+
+	wholeBig, ok := new(big.Int).SetString(whole, 10)
+	if !ok {
+		return "", fmt.Errorf("invalid ETH value: %f", eth)
+	}
+	decimalBig, ok := new(big.Int).SetString(decimal, 10)
+	if !ok {
+		return "", fmt.Errorf("invalid ETH decimal: %s", decimal)
+	}
+
+	result := new(big.Int).Mul(wholeBig, weiPerEth)
+	result.Add(result, decimalBig)
+	return result.String(), nil
+}
+
+func Compare(weiA, weiB string) (int, error) {
+	a, ok := new(big.Int).SetString(weiA, 10)
+	if !ok {
+		return 0, fmt.Errorf("invalid Wei value: %s", weiA)
+	}
+	b, ok := new(big.Int).SetString(weiB, 10)
+	if !ok {
+		return 0, fmt.Errorf("invalid Wei value: %s", weiB)
+	}
+	return a.Cmp(b), nil
+}
+
+func GreaterThanOrEqual(weiA, weiB string) (bool, error) {
+	cmp, err := Compare(weiA, weiB)
+	if err != nil {
+		return false, err
+	}
+	return cmp >= 0, nil
+}
+
+func LessThan(weiA, weiB string) (bool, error) {
+	cmp, err := Compare(weiA, weiB)
+	if err != nil {
+		return false, err
+	}
+	return cmp < 0, nil
+}
+
+// FormatAsEth formats a Wei string as "X.XXXX ETH".
+func FormatAsEth(weiString string, decimals int) (string, error) {
+	eth, err := ToEth(weiString)
+	if err != nil {
+		return "", err
+	}
+	return fmt.Sprintf("%.*f ETH", decimals, eth), nil
+}
+
+// FormatTokenAmount formats a raw token amount using the token's decimal places.
+// For example, 1000000 USDT (6 decimals) becomes "1".
+func FormatTokenAmount(rawValue string, tokenDecimals int) string {
+	if rawValue == "" || rawValue == "0" {
+		return "0"
+	}
+
+	n, ok := new(big.Int).SetString(rawValue, 10)
+	if !ok {
+		return "0"
+	}
+
+	divisor := new(big.Int).Exp(big.NewInt(10), big.NewInt(int64(tokenDecimals)), nil) //nolint:mnd
+	whole := new(big.Int).Div(n, divisor)
+	remainder := new(big.Int).Mod(n, divisor)
+
+	if remainder.Sign() == 0 {
+		return addThousandsSeparators(whole.String())
+	}
+
+	fracStr := fmt.Sprintf("%0*s", tokenDecimals, remainder.String())
+	fracStr = strings.TrimRight(fracStr, "0")
+	const maxDisplayDecimals = 4
+	if len(fracStr) > maxDisplayDecimals {
+		fracStr = fracStr[:maxDisplayDecimals]
+	}
+
+	return addThousandsSeparators(whole.String()) + "." + fracStr
+}
+
+func addThousandsSeparators(s string) string {
+	if len(s) <= 3 { //nolint:mnd
+		return s
+	}
+
+	var result strings.Builder
+	offset := len(s) % 3 //nolint:mnd
+	if offset > 0 {
+		result.WriteString(s[:offset])
+	}
+
+	for i := offset; i < len(s); i += 3 { //nolint:mnd
+		if result.Len() > 0 {
+			result.WriteByte(',')
+		}
+		result.WriteString(s[i : i+3]) //nolint:mnd
+	}
+
+	return result.String()
+}