Incident Response

The first sign of compromise is often an unexpected outgoing transaction. By the time you see it, the attacker may already be sweeping remaining tokens. Speed of detection determines whether you can save anything.

Monitoring services like OpenZeppelin Defender Sentinels, Tenderly Alerts, or simple webhook watchers on your addresses can fire notifications within seconds of a transaction hitting the mempool. For high-value wallets, always have at least one alert channel that reaches your phone.

Common indicators: unexpected outgoing transfers, new token approvals you did not set, unfamiliar contract interactions, or a hardware wallet prompting for a transaction you did not initiate.

When compromise is confirmed, the goal is to move remaining assets to a wallet the attacker does not control — before the attacker finishes sweeping. This is a race condition.

Prepare in advance: maintain a pre-configured safe wallet (ideally a multisig on a separate set of devices) with its address saved and verified. When the incident fires, you should be able to construct the drain transaction from muscle memory. For ERC-20 tokens, you may need one transaction per token; for native ETH you need one. Prioritise by value.

Flashbots Protect or a private mempool can hide your rescue transactions from the attacker's monitoring, buying a few extra seconds.

Once the immediate threat is contained, switch from response to investigation. Preserve everything: browser history, wallet logs, transaction hashes, timestamps, screenshots. These become your evidence chain.

Determine the root cause: was it a compromised seed, a malicious approval, a phishing link, or a supply-chain attack on a dependency? The answer shapes both your remediation and your disclosure.

If user funds are affected, disclosure is not optional — it is an ethical obligation. Provide: what happened, what was lost, what you have done to prevent recurrence, and how affected users can contact you. Timeliness matters; delayed disclosure erodes trust further.