Incident Response

Blockchain Security Incident Response

When an exploit occurs, every second counts. The difference between losing one million and ten million dollars can come down to the speed of reaction. Incident response in the blockchain space is a unique discipline that combines on-chain forensics, coordination with exchanges, legal measures, and community communication.

Phases of Incident Response

Phase 1: Detection (0-5 minutes)

Detection can come from multiple sources:

  • Automatic alerts from monitoring systems (Forta, Tenderly, OpenZeppelin Defender)
  • A user noticing that funds are disappearing
  • A white hat researcher identifying the attack
  • On-chain analytics tools detecting anomalies

Key point: in this phase, you should quickly verify whether it is truly an ongoing attack or a false alarm, and assess the scale of exposure.

Phase 2: Containment (5-30 minutes)

The goal is to stop or minimize further damage:

  • If the protocol has a pause functionality, activate it immediately
  • Contact major exchanges (Binance, Coinbase, Kraken) to freeze deposits from known attacker addresses
  • Contact bridge operators to halt cross-chain transactions
  • Trigger an emergency governance proposal if the protocol supports it

Example of good practice: when Euler Finance was exploited in March 2023, the team contacted Binance within an hour, which froze the attacker’s address. The attacker eventually returned all funds, partly due to pressure and partly because they could not convert the stolen assets into fiat.

Phase 3: Analysis and Forensics (1-24 hours)

Detailed post-mortem analysis includes:

  • Reconstructing the attack transaction by transaction on a block explorer
  • Identifying the exact code that was exploited
  • Tracing the attacker’s funds, which exchanges, which mixers, which addresses
  • Communicating with Chainalysis or TRM Labs for professional tracking
  • Assessing the total loss

Phase 4: Community Communication

Transparent communication is critical for maintaining trust:

  • A quick initial tweet confirming that an attack is underway and being investigated
  • Regular updates every 30-60 minutes while the situation lasts
  • A detailed post-mortem is usually published within 72 hours
  • Clearly explain what happened, who is affected, and what actions are being taken

Example of poor communication: Ronin Bridge waited more than six days before publicly announcing the attack, during which users did not know their funds were gone.

On-Chain Forensics

Tracing stolen funds is a specialized skill. Attackers typically try to “launder” stolen assets through:

  • Tornado Cash or other mixers (now sanctioned in the US)
  • Cross-chain bridges, moving between chains makes tracking harder
  • Centralized exchanges in permissive jurisdictions
  • DEX swaps to convert into privacy tokens (Monero)

Even with mixing, professional blockchain forensic firms (Chainalysis, Elliptic, TRM Labs) manage to trace the vast majority of flows. In the case of the Bybit hack ($1.5B, February 2025), researchers tracked nearly every step of the Lazarus Group before the funds were converted.

Bug Bounty as Prevention

The most effective incident response is the one that never happens. Bug bounty programs (ImmuneFi) pay white hat researchers to find vulnerabilities before attackers do. The largest bounty paid to date: $10 million for a critical vulnerability in the Wormhole bridge (2022).

Protocols with active bug bounty programs statistically experience fewer successful exploits, as the white hat community effectively provides continuous free auditing.

Recovery Strategies

After an exploit, protocols have several options:

  • Negotiating with the attacker: Many attackers have accepted “bug bounty” offers and returned part of the funds (Euler Finance, Poly Network)
  • Insurance: Nexus Mutual and InsurAce offer crypto insurance; payouts are rare but possible
  • Treasury coverage: Protocols with a healthy treasury can compensate users directly
  • Token dilution: New tokens are minted for compensation, affecting all token holders
  • Hard fork: Ethereum did this in 2016 to recover DAO funds, a controversial decision

None of these strategies is perfect. Prevention, through quality audits, bug bounties, and secure design, remains far more effective than recovery.

← Back to BlockchainSecurity.rs
Scroll to Top