When a DeFi exploit is suspected, first establish what is affected and whether losses are still happening. At the same time, name an incident commander, preserve on-chain and off-chain evidence, and determine whether an authorized, tested containment action is available. Then coordinate technical, legal, operational, and public decisions; assess whether recovery is feasible; and restore service only after the fix has been reviewed and tested. A pause, rescue, or disclosure decision depends on the protocol’s controls, the incident facts, and the jurisdictions involved.
What should the team do first?
Run investigation and containment in parallel. Do not assume every suspicious transaction is a protocol exploit: it could involve an authorized operation, a single user’s compromised wallet, a front-end compromise, or a protocol-level vulnerability. The Security Alliance (SEAL) lists unexpected fund movements, monitoring alerts, unusual transaction patterns, community reports, and abnormal contract-state changes as potential warning signs in its smart-contract exploit runbook.
As an Amazon Associate I earn from qualifying purchases.
- Declare the incident and establish authority. Name an incident commander and backup. Identify who can authorize a pause or shutdown, public statements, and any recovery attempt. Open a timestamped incident log and a controlled channel for responders. The SEAL Incident Response checklist and FBI resiliency guidance both stress defined roles, decision authority, containment, and evidence preservation.
- Scope the suspected activity. Identify the affected contracts and chains, assets and users at risk, earliest known suspicious transaction, and whether funds are still moving or vulnerable state remains exposed. Compare the activity with authorized treasury or governance actions and investigate possible wallet, interface, or infrastructure compromise.
- Start a timestamped record. Log reports, observations, decisions, and actions as they happen. Preserve evidence while the technical team investigates; do not wait for a final loss estimate or root-cause analysis before recording what is known.
- Decide whether containment is available. Check the protocol’s actual controls and who is authorized to use them. If losses are ongoing, a time-critical decision may be needed; capture relevant state where practicable, but do not let documentation delay necessary containment.
The FBI’s August 29, 2022 DeFi advisory cited Chainalysis figures stating that $1.3 billion in cryptocurrency was stolen between January and March 2022, with almost 97% attributed to DeFi platforms. The same advisory gave shares of 72% for 2021 and 30% for 2020. These are historical figures, not current loss estimates.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11How do you identify what kind of exploit occurred?
Trace the suspected loss across the system rather than looking only at the user-facing application. A DeFi incident can involve smart-contract logic, bridge verification, oracle or price mechanics, privileged keys, a front end, or other off-chain systems. The FBI’s 2022 advisory described illustrative cases involving flash loans, a bridge signature-verification weakness, and oracle or price manipulation combined with other vulnerabilities.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
| Possible incident path | What to establish | Investigation focus |
|---|---|---|
| Smart-contract or protocol-level activity | Which contracts and transaction paths were involved, and whether the same path can still be called | Transactions, traces, relevant contract state, and abnormal state changes |
| Bridge, oracle, or price-mechanism issue | Which verification, price, or cross-chain assumptions were used and which assets or chains are implicated | Relevant transactions and traces, bridge or oracle inputs, and timing across involved chains |
| Privileged-key or off-chain compromise | Whether an authorized key, web interface, cloud service, or other system was compromised | Authentication, cloud, infrastructure, and system logs alongside on-chain activity |
| Individual wallet or phishing incident | Whether evidence points to one user’s wallet rather than a protocol-wide vulnerability | The reported transactions and affected addresses, while checking whether other users or protocol components are exposed |
The FBI advisory attached approximate losses of $3 million, $320 million, and $35 million to three illustrative exploit patterns, respectively: a flash-loan-triggered exploit, a bridge signature-verification weakness, and oracle or price manipulation with other vulnerabilities. Those are examples from the 2022 advisory, not typical-loss figures, averages, or forecasts.
What evidence should responders preserve?
Keep evidence that can help reconstruct what happened, when it happened, what remained at risk, and why the team made each decision. SEAL’s runbook, the OWASP incident-response playbooks, and FBI resiliency guidance all emphasize preserving relevant incident information. The precise evidence set depends on the chain, available tooling, and incident.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Exploit and related transaction hashes, block numbers, timestamps, and available transaction traces.
- Relevant contract state and available mempool observations, including pending transactions associated with suspected addresses.
- Public reports and monitoring alerts that prompted the response, with timestamps and source context.
- Off-chain authentication, cloud, infrastructure, and system logs that could clarify a key, web-interface, or other system compromise.
- The incident log: decisions, approvals, actions taken, and who took them, with timestamps.
Preserve originals where practicable and record how evidence was collected and by whom. A pause or other system change may alter what can be observed, so capture pertinent state when feasible—but do not postpone a necessary response action solely to complete collection.
Free tools Windows power users keep installed
One-click scans. No signup required.
Should you pause the contracts?
Only if the protocol has a relevant control, the authorized decision-makers approve its use, and they understand its likely effect. A pause may prevent further calls through an affected contract path; it does not automatically address a stolen key, compromised web application, or off-chain infrastructure problem. It can also interrupt legitimate user services. The SEAL runbook says to pause if possible, but its example is a template: replace placeholders with the protocol’s own reviewed procedure, not a copied command.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Confirm which contract and functions the control affects, and whether it can stop the suspected activity.
- Verify who may invoke it and what approval process applies under the protocol’s governance and operating procedures.
- Consider the risk of continued loss against service interruption and any evidence that could be changed by the action.
- Record the decision, approver, transaction or action, and time.
There is no universal instruction to pause: the right choice depends on the incident, contract design, authority, and tested controls. The SEAL checklist and its exploit runbook provide response guidance, not a protocol-specific authorization.
How should the team coordinate users, authorities, and specialists?
Communicate verified facts
Choose an authoritative place for updates. State what is confirmed, which interfaces or contracts users should avoid if known, what protective steps users can take, and when to expect another update. Separate verified facts from open questions. Avoid unsupported attribution, speculative loss totals, or improvised recovery addresses; a false instruction can create additional risk.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Bring in the right decision-makers
Coordinate technical responders with operations, governance, legal counsel, and communications. Engage specialist incident support where appropriate. The SEAL runbook names SEAL 911 as an incident-support resource. Establish who is authorized to share information or make commitments on behalf of the protocol.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Report according to circumstances and jurisdiction
The FBI’s U.S. advisory encourages suspected DeFi theft victims to report through the Internet Crime Complaint Center (IC3) or a local FBI field office. That is a reporting channel, not a substitute for evaluating other legal or regulatory duties. Consult counsel about obligations that depend on the incident, the organization, affected users, and applicable jurisdictions.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
For preparation, the FBI recommends having monitoring, rigorous testing, an incident-response plan, and an investor communications plan in place before an incident. Its advisory says the plan should include alerting investors when smart-contract exploitation, vulnerabilities, or other suspicious activity is detected.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Can whitehats rescue funds during an active exploit?
Sometimes an intervention may be considered, but recovery is uncertain and no one should treat a rescue as automatically authorized or safe. First establish whether the exploit is still in progress, whether the attack completed atomically in one transaction, and whether funds, attacker transactions, or vulnerable state remain exposed. OWASP’s DeFi recovery patterns identify atomicity and the remaining intervention window as central to feasibility.
Before anyone attempts a whitehat intervention, check whether the protocol adopted an authorization framework in advance. The SEAL Whitehat Safe Harbor is one example: its published terms set conditions for eligible active-exploit interventions and handling recovered assets. Confirm that the incident and proposed action qualify, follow those terms exactly, and retain records of rescue transactions. If no applicable authorization exists, do not assume that a technically possible transaction is permitted.
When is it safe to restore service?
Do not restore service just because the immediate suspicious activity stopped. Have qualified reviewers examine the root cause and affected dependencies, then validate the remediation against the exploit scenario in an appropriate test or staging environment. Follow the protocol’s approval process for deployment or reopening, and monitor after restoration for signs that the issue persists or has moved to another component.
Close the incident with a post-incident review: document what happened, affected users and funds as established, the evidence retained, decisions made, remediation, and changes to controls or playbooks. SEAL’s incident-detection guidance and decentralized response framework include recovery, remediation, monitoring, and review in the response lifecycle.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
