Operational Security & Incident Response
Operational security and incident response
You can not always prevent an incident, but you can shrink the loss. Preparation, response flow, and recovery strategy. Project operators and individual users have different perspectives, so use the toggle to switch views.
Security Alliance
SEAL Alliance
A non-profit security coalition led by samczsun and a network of whitehats. The fastest whitehat pool to reach during an incident, free for both projects and individuals.
SEAL 911
24/7 whitehat hotline. Submit a report to the Telegram bot and an anonymous whitehat pool triages it instantly and routes you to the right project or exchange contact. The fastest entry point for both individual theft and protocol incidents.
SEAL Whitehat Safe Harbor
Standard whitehat safe-harbor clause that protocols can pre-adopt. Provides a legal safety net for whitehats who recover and return funds during an active exploit. Adoption proceeds via governance or a declaration by the authorized parties.
SEAL Wargames
Incident response simulation for protocol teams. Evaluates the team's war room, multisig mobilization, and communications across a fictional exploit scenario. Major protocols participate regularly.
SEAL Frameworks
Vendor-neutral open-source library that consolidates battle-tested practices from traditional infosec and Web3 security research. Twelve-plus frameworks cover operational security, wallet management, incident response, DPRK threat mitigation, and more, designed for incremental adoption. Adopted by many major protocols and useful for both projects and individuals.
SEAL Certifications
Modular certification program designed around the actual threats crypto organizations face. Covers five domains: incident response, multisig operations, treasury security, workspace security, and DNS management. Assessed by accredited auditors and recorded as on-chain attestations via EAS, currently in beta with 15+ pilot organizations.
SEAL Intel
Threat intelligence across the crypto ecosystem. Real-time alerts on phishing campaigns, wallet drainer malware, and nation-state attacks. Operates a database of 300+ threat reports and 200,000+ malicious domains, with an integration SDK. Major wallets including MetaMask, Phantom, and WalletConnect ingest the feed directly to block threats before they reach users.
Lazarus Group Tracker
Public resource tracking how DPRK operatives infiltrate the crypto industry as IT workers. Profiles 60+ operatives with their known aliases; cumulatively linked to $6B+ in theft. Used by exchanges, protocols, and law enforcement during hiring screening. Cross-checking candidates against this database before hiring is becoming the de facto standard.
SEAL 911 Members
28 verifiedSEAL 911 is an invite-only volunteer organization. Many members work at major security firms and infrastructure teams (OtterSec, Hypernative, OpenZeppelin, Wintermute, Binance, StarkWare, etc.) and provide rapid triage during incidents.
AlexPreparation
Preparation (Project)
The first five minutes decide an incident. Those five minutes need to be automated.
Governance and authority
Make sure admin keys and upgrade authority cannot be neutralized by a single mistake.
The standard for upgrade, parameter change, and fund withdrawal authority is 4 or more diverse signers with quorum 7+. A single EOA signature is effectively a single point of failure.
48+ hour timelock on sensitive functions
If admin actions execute immediately, key compromise = immediate loss. A timelock guarantees a withdrawal window for users and is the simplest safety net during incidents.
Role-based authority separation
Separate OPERATOR, GUARDIAN, and OWNER roles at the contract level, each with a different signer pool. GUARDIAN should be limited to pause only.
Admin key rotation policy
Document a regular signer rotation and offboarding procedure. Departed members must not retain signing authority.
Contract-level defenses
Build in circuits that mechanically cap loss size even when an attack is already underway.
Pause / circuit breaker
Add a GUARDIAN-callable pause to fund-flow functions like deposit, swap, and borrow. This is the first action when an attack is detected.
Guarded launch and TVL caps
Set deposit limits, per-user limits, and asset limits right after deployment, then relax them over time. Even if an attack happens, loss has a hard ceiling.
Emergency withdraw backup path
Provide a bypass for users to recover their own assets even if the protocol is paused. It must run on simple validation that is independent of the main logic bug.
Minimize upgrade surface
Proxy upgrades are an attack surface. Keep core asset-accounting contracts immutable and isolate only peripheral modules as upgradeable.
Monitoring and alerts
The first five minutes of an incident decide everything. Automated detection has to fire before a human notices.
Real-time threat detection
Layer alerts for TVL swings, unusually large transactions, governance action attempts, abnormal mints, and unauthorized function calls.
Admin action monitoring
Multisig queueing and timelock transactions belong on a separate alert channel. Unauthorized queueing must be detected within five minutes.
On-call rotation
Run 24/7 on-call via PagerDuty or equivalent. Alerts must not stop at one person's Slack DM.
Incident playbook
Teams that build process during an incident are too late.
Pre-written playbook docs
For each scenario (contract exploit, admin key compromise, oracle manipulation, Discord hack), document the step-by-step flow and decision tree.
Roles and responsibilities matrix
Designate Incident Commander, Communications Lead, Tech Lead, and Legal/Comms support roles. During an incident, who decides what must be immediately clear.
Table-top exercises and Wargames
Run table-top scenarios quarterly and participate in events like SEAL Wargames once or twice a year to validate the playbook against real simulations.
Communication infrastructure
Time spent creating channels and chasing contacts during an incident converts directly into loss.
Pre-built war-room channels
Pre-create a private Telegram, Signal, or Discord category dedicated to security incidents. Key personnel must already be members.
Stakeholder contact sheet
Pre-collect 24/7 contacts for major CEX compliance teams, whitehat groups, partner protocols, lawyers, and foundation security teams.
Pre-written communication templates
Pre-write templates for each phase (initial notice: aware and investigating; first update: scope; final postmortem). Saves writing time mid-incident.
Register with SEAL 911 in advance
Sort out SEAL 911 bot contact and Whitehat Safe Harbor adoption ahead of time so you can use them immediately during an incident.
Whitehat incentives and coverage
The chance of recovery and compensation after an incident is mostly determined by the setup before it.
Public bug bounty
Publishing a bounty of $1M+ per Critical creates an incentive for whitehats to report findings before blackhats exploit them.
Make Safe Harbor explicit
Use legal disclosure or a governance resolution to make whitehat fund recovery indemnified. Also helps prevent exchanges from freezing funds during recovery.
Treasury emergency budget
Hold funds in a separate multisig that can be deployed immediately for user or whitehat compensation. Plan for scenarios where there is no time to wait for governance.
Insurance or coverage
Provide users with an insurable cover option, or have the protocol enroll the pool itself.
Response Flow
Response Flow (Project)
Detect → Triage → Contain → Investigate → Communicate → Recover → Post-mortem
- 1
1. Detect
T+0Verify immediately on alert. Even with a chance of false positive, spin up the war room first.
- On-call activates the war-room channel the moment the alert is received
- Share the transaction hash and impacted contracts to the war room immediately
- Reproduce the transaction with Tenderly or Phalcon
- 2
2. Triage
T+0 ~ 5 minDecide whether the attack is in progress, one-shot, and how far the impact reaches.
- Designate an Incident Commander
- Confirm whether the attack is still callable (replay potential)
- Estimate affected pools, assets, and user count
- 3
3. Contain
T+5 ~ 30 minStopping further loss is the top priority. Block first, preserve later.
- Immediately pause affected functions via GUARDIAN
- If needed, gather multisig quorum for emergency upgrade or authority revocation
- Notify external integration partners where additional funds could flow in
- 4
4. Investigate
T+15 min onwardTrack the attack vector, attacker addresses, and fund flow in parallel.
- Trace attacker transactions and upstream funders
- Determine whether the vulnerability is in contract code, an authority key, or an external dependency
- Monitor fund flow via MistTrack, Chainalysis, Arkham, etc.
- 5
5. Communicate
T+15 min onward, in parallelRun internal and external communications in parallel. Silence breeds fear.
- First notice on Twitter and Discord (aware, investigating, what funds are safe)
- Request fund freeze from major CEX compliance teams
- Contact SEAL 911 to mobilize the whitehat pool
- Notify partner protocols and integrated dApps
- 6
6. Recover
Hours to daysRecovery odds decay with time. The 24-72 hour window is the golden window.
- Send a whitehat negotiation message to the attacker (delivered via inputData of a public transaction)
- Move recoverable funds to a safe contract or multisig
- Decide the user compensation plan (treasury, token issuance, coverage)
- Deploy patched contracts and publish a migration guide
- 7
7. Post-mortem
24h short notice / 7d detailedTransparency is almost the only tool for rebuilding trust.
- Publish a short incident summary within 24-48 hours
- Within 7 days, publish a full postmortem with root cause, impact scope, compensation plan, and remediation
- Publish a minute-level timeline to rebuild trust
- Publish follow-up review results from an external audit firm