Service
When something goes wrong on-chain, the first hour decides what the next year looks like. Our team takes the call, runs the response, and stays until the dust settles.
What you get
A coordinated response that contains the incident, traces the funds, communicates clearly, and produces a written record your team and counsel can stand behind.
Scope
We get on a call within an agreed SLA, establish what is happening, and help you stop the bleeding, pause functions, revoke approvals, freeze admin keys, take down phishing infrastructure.
We trace the stolen funds across chains, mixers, and bridges. The output is the on-chain narrative your team, your investors, your community, and law enforcement need.
First post, follow-up post, post-mortem. We draft, you approve. Bad communications turn a survivable incident into an unsurvivable one, this is where most teams lose more value than the exploit itself cost.
Engagement with exchanges, custodians, and law-enforcement contacts. Coordinated wallet freezes, KYC unmasking where possible, and counsel hand-off when the case crosses jurisdictions.
Deliverables
Timeline. Active response: hours to days. Forensics and post-mortem: 1–3 weeks. Retainer relationships are billed monthly with response SLAs.
Best fit
FAQ
No. We accept emergency engagements when capacity allows. Retainer clients get guaranteed response SLAs and significantly lower hourly rates.
Sometimes. Recovery depends on where the funds went, how fast we engage, and whether off-ramps cooperate. We're honest about what's realistic, and we trace everything either way, because that documentation is what enables recovery weeks or months later.
Read more
When a contract is exploited or a wallet is drained, the first hour decides what the next year looks like. Here is what runs, in what order, and who does what.
Read article →
Announcing our partnership with Broker Defense, a firm specialised in helping crypto victims of fraud and scams. Together, we work to fight cybercrime and support those who have lost digital assets, combining on-chain analysis with international legal coordination.
Read article →
Bridges are the most exploited category of DeFi protocol. Here is why the architecture is hard, how the major incidents played out, and what good bridge security looks like.
Read article →
