The War Room

Four onchain security incidents this week. Roughly $36.5M in reported losses.

We're not going to break them down, plenty of good teams already have.

What never gets written up is what happened in the hours AFTER each one. What the triage and response is like. Who do they call?

Detection is in good shape now. Blockaid, PeckShield, CertiK and SlowMist had all four flagged within minutes. That's real progress on two years ago.

Response hasn't kept pace. Response runs on relationships, and most teams don't have them until the morning they need them.

Hour one actually looks like this:

1️⃣ Which exchange security desk answers at 3 a.m., and do they know who you are?

2️⃣ Who files with law enforcement, in which jurisdiction, and in what format will they act on the evidence?

3️⃣ Which stablecoin issuer can freeze, and what do they require before they will?

4️⃣ Who on your team declares an incident, and who speaks publicly?

If you're working out those answers during the incident, the funds are already through a mixer.

We've attached the BU War Room deck: how we run incident response, end to end. The short version: the moment an incident is confirmed, we trace and blacklist the attacker's wallets. The blacklist follows the funds through every hop, and our participating network of exchanges and protocols receives the alerts and freezes on them — in minutes, not after a package is built. Then we carry the case: evidence, law enforcement, courts.

The analytics platforms are excellent at what they do. The platforms trace.

We run the response.

We've spent four years building the lines this work runs on - exchange desks, stablecoin issuers, security firms, independent investigators, and law enforcement across jurisdictions. Tracing is rarely the bottleneck. Having someone on the other end who can move inside the window is.

If you run a protocol, bridge, or exchange: build those contacts now. Ours included, if that's useful.

The worst time to make an introduction is the morning your treasury is gone.