The DAO attack could have been detected by anyone that is tracking a simple ratio of ether in the dao over the total supply of dao tokens. It would be highly suspicious if the ratio went below 1:100. However, based on observations from the market movements, the effect of the attack was only apparent to many, hours after the ether was first drained.
A similar case can also be applied to the recent Bitfinex hack. On hindsight, it was apparent that the sudden drop in amount of bitcoins stored in p2sh addresses was due to the hack, but a general approach to determine whether there are potential problems in an exchange is to see if withdrawals are still working. In most scenarios, withdrawals will be stopped immediately once an exchange finds any operational irregularities. In Bitfinex case, the hack was discovered quite early internally and withdrawals were stopped, however it was only announced many hours after and then the market reacted.
The charts above display the amount of ETH withdrawn and number of withdrawals per hour from 3 of the biggest ETH exchanges - Bitfinex, Poloniex and Kraken.