The difference between a contained incident and a total loss is generally preparation made months earlier.
Detection infrastructure
Automated monitoring for anomalous patterns — unusual withdrawal sizes, unexpected function calls, balance changes outside normal ranges.
Which reduces detection time from hours to seconds.
Several protocols now run automated pause triggers on defined conditions.
The pause capability
A mechanism to halt contract functions.
Which is a centralisation trade-off that most protocols accept for exactly this reason.
Who can trigger it, and how quickly, determines whether it is useful during an incident.
The war room
A defined group with defined roles, contactable at any hour.
Which requires knowing in advance who does what.
Incidents at inconvenient hours are the norm rather than the exception.
Communication protocol
Who speaks publicly, through which channels and how quickly.
Which should be decided in advance rather than during the incident.
Delay in acknowledging an incident consistently damages trust more than the incident itself.
Exchange and analytics contacts
Relationships with venues and analytics firms established before they are needed.
Which allows fast notification when tracing stolen funds.
Freezing at a compliant venue is one of the few realistic recovery routes.
Legal preparation
Knowing which authorities to notify and in which jurisdictions.
Which varies by where the organisation and its users are.
Counsel engaged in advance responds faster than counsel engaged during a crisis.
Bug bounty programmes
Continuous incentive for disclosure rather than exploitation.
Which only works if payouts are meaningful relative to what exploitation would yield.
Response time to submitted reports is itself a measure of programme quality.
The post-mortem
A technical account published afterwards.
Which contributes to shared knowledge, since the same failure classes recur.
Organisations that publish thorough post-mortems generally handle the next incident better.
Tabletop exercises
Rehearsing an incident before one occurs.
Which surfaces gaps in contact lists, permissions and decision authority while it is cheap to fix them.
Access control during incidents
Emergency actions require credentials that must be available quickly and cannot be casually accessible.
Which is a genuine tension resolved through defined break-glass procedures.
Testing that these procedures work is part of preparation.
Coordinating with white hats
Security researchers frequently identify issues during incidents.
Which requires a clear channel for them to reach the team quickly.
Publicly listed security contacts are basic and are missing from many protocols.
User communication
Clear instructions about what users should do — revoke approvals, withdraw, stop interacting.
Which is the most immediately useful thing a team can publish.
Vague reassurance during an active exploit costs users money.
Recovery decisions
Whether and how to compensate affected users.
Which involves governance, treasury capacity and legal considerations.
Decisions made hastily under pressure have subsequently caused disputes.
Learning across the ecosystem
Public incident databases and shared analyses reduce repeated failures.
Which works to the extent that teams actually read them.
Severity classification
Defining levels in advance determines who is contacted and how quickly.
Which prevents both underreaction and unnecessary escalation.
Written criteria remove the need to argue about severity during an incident.
Third-party dependencies
Incidents at oracles, bridges or infrastructure providers affect protocols that did nothing wrong.
Which requires monitoring dependencies as well as your own contracts.
Dependency incident notification channels should be identified in advance.
Insurance and reserves
Protocols maintaining reserves for incident compensation have options that others lack.
Which is a treasury decision made long before it is needed.
Some protocols fund reserves from a portion of ongoing revenue.
Regulatory notification
Data breach and incident reporting obligations may apply depending on jurisdiction and entity structure.
Which has defined timescales that are short.
The preparation summary
Monitoring, a pause capability, defined roles, prepared contacts and rehearsed procedures.
What separates good responses
Preparation, speed of acknowledgement, clarity of user instructions and a thorough post-mortem.
Which are all decisions made before or within hours of an incident.
Organisations that handle it well generally prepared while nothing was wrong.
For users during an incident
Follow official protocol channels, revoke approvals if instructed, and be wary of accounts offering recovery assistance.
Which is where secondary fraud concentrates, targeting people who have already lost funds.
No legitimate party can reverse a confirmed transaction.
Building the capability
Monitoring tooling is available commercially and as open source.
Which means the barrier is deciding to do it rather than the cost.
Protocols holding substantial value without monitoring are making an active choice.
A closing observation
Every protocol that handled an incident well had made unglamorous preparations that nobody credited at the time. Every one that handled it badly was assembling contact lists and arguing about authority while funds were leaving.
A practical starting point
A published security contact, a monitoring alert on treasury movements and a written contact list.
Which costs almost nothing and puts a protocol ahead of most of its peers.
The rest is practice, which costs a day and pays for itself the first time it is needed.