Crypto Exchange Incident Response Plan: The First Hour

Video transcript

When a hot wallet drains, the attacker races your freezes. Here is how to run the first hour.

On October 29, about 6.36 billion dollars left Binance wallets, most of it in about 20 minutes.

Declare against written criteria: outflows no withdrawal explains, a ledger that stops reconciling, a signer approval nobody queued, or API keys on new IP addresses.

Then stop the outflow. Halt affected withdrawals, list every wallet sharing the key, sweep what remains, revoke exposed credentials, and hold cold to hot transfers.

Binance halted withdrawals. Bybit stayed open after losing 1.4 billion dollars. Stay open only if the compromise is bounded and you can still pay out.

After the Binance drain, about 2.7 billion dollars was frozen. Send freeze requests to stablecoin issuers first, then exchanges and bridges, SEAL 911, your analytics provider and law enforcement.

Post confirmed facts on one channel and warn users about impersonation. Regulators run clocks too, like 72 hours under NYDFS. Confirm yours with counsel.

Preserve signing, cloud and withdrawal logs with integrity intact, and bring in outside forensics early. Close on criteria, not mood.

Guardian's Managed Security streams your monitoring to a global MDR team around the clock, with a 15-minute SLA on Critical alerts.

Read the full article for the runbook template, then talk to Guardian and rehearse your first hour.

On October 29, 2026, about $6.36 billion left Binance wallets on ten blockchains, according to TRM Labs. Most of it went in about 20 minutes.

Tether froze 971.1 million USDT in the main receiving wallet 37 minutes after the main sweep. The attacker raced the freezes, selling USDT for ETH at a discount of more than 10%.

This runbook is built on NIST SP 800-61 Rev. 3 and on what Bybit, Coinbase and Binance disclosed about their own incidents.

Running a protocol instead? Use our DeFi incident response plan.

Detection and Declaration

NIST SP 800-61 Rev. 3, final since April 2025, frames incident response as three CSF 2.0 functions: Detect, Respond and Recover.

Its test for declaring is plain: "Incidents are declared when adverse events meet the defined incident criteria." So write the criteria down now.

For an exchange, any one of these should open an incident:

• Hot wallet outflows that no customer withdrawal explains
• Internal ledger and onchain balances that stop reconciling
• A signer or signing service approving something nobody queued
• A spike in password, 2FA or withdrawal address changes
• API keys withdrawing or trading from new IP addresses

NIST suggests an incident lead for each incident. Give that person the authority to halt withdrawals without calling a meeting.

Add a scribe who logs every action in UTC. NIST asks that those records keep their integrity.

Containment Steps

Next, stop the outflow. In order:

1. Halt: suspend withdrawals on the affected networks or wallets.
2. Bound: list every wallet that shares the compromised key, signer or service.
3. Sweep: move remaining hot balances to wallets on a separate key path.
4. Revoke: rotate signing service credentials, admin sessions and exposed API keys.
5. Hold: stop cold to hot transfers until the path is clean.

Halt, or keep withdrawals open?

Binance halted. In May 2019, after 7,000 BTC left its BTC hot wallet, it suspended deposits and withdrawals for a review it expected to take a week.

In October 2026 it suspended withdrawals on several networks.

Bybit stayed open after losing $1.4 billion in February 2025. CEO Ben Zhou told customers no other Bybit wallet was compromised.

"We don't have plans to suspend or cancel withdrawals," he said. Bybit also had the liquidity: a same-day bridge loan for almost 80% of the stolen ETH, The Block reported.

The rule: stay open only if you can show the compromise is bounded and you can still pay out in kind.

Freezes and Partner Notifications

Freezes beat recovery. After the Binance drain, issuers and one chain's security council froze about $2.7 billion in all, per TRM Labs.

Send requests in this order, with addresses, transaction hashes and amounts in one message:

1. Stablecoin issuers, for every asset taken
2. Exchanges, OTC desks and bridges the funds can reach
3. SEAL 911, through its Telegram bot, t.me/seal_911_bot
4. Your blockchain analytics provider, to label and trace the addresses
5. Law enforcement, such as the FBI through ic3.gov

Law enforcement can widen the net. After Bybit, the FBI published the attackers' Ethereum addresses and asked exchanges, bridges, RPC node operators and others to block transactions with them.

Communications

The first notice can be one line. Binance said it was investigating a potential security issue, then that it had suspended withdrawals on several networks, per TRM.

Bybit's CEO went live on an X Space the same day and said all client withdrawals would be processed, The Block reported.

After the insider breach it disclosed in May 2025, Coinbase refused to pay the extortion demand. It said it would reimburse customers tricked into sending funds to the attacker.

From those cases:

• Post only confirmed facts, on one channel, on a fixed schedule.
• Say plainly whether user funds are affected and whether withdrawals are open.
• Warn users about impersonation: at Coinbase, stolen data was used to trick customers.

Regulators

NYDFS Part 500 requires covered entities to notify the superintendent within 72 hours of determining a cybersecurity incident has occurred. That includes incidents at affiliates and third-party service providers.

Under the same rule, an extortion payment needs notice within 24 hours.

SEC registrants file Form 8-K Item 1.05, generally within four business days of determining an incident is material. Coinbase filed one in May 2025.

This is not legal advice; confirm which notices apply to you with counsel.

Forensics and Recovery

Preserve first. NIST asks you to collect incident data with its integrity and provenance intact, with prosecution in mind.

• Signing service logs, approval records and policy engine decisions
• Cloud audit logs and CI/CD history for every system near a key
• Withdrawal requests, sessions and API calls around the first outflow

Then size it. NIST says to look for signs of compromise on the targeted assets and on other potential targets.

Bring in outside forensics early. Sygnia and Verichains traced Bybit's loss to malicious JavaScript served from Safe{Wallet}'s infrastructure. Sygnia found no evidence that Bybit's own was compromised.

Reserves and reopening

By February 24, 2025, Bybit says, bridge loans, whale deposits and OTC purchases had covered its ETH deficit. Hacken then published an updated proof of reserves.

Binance says SAFU and company funds cover its October 2026 losses. It will publish updated proof of reserves once remediation is complete.

On November 5, it announced withdrawals reopening for more assets.

Close on criteria, not mood: NIST ends recovery with an after-action report on the incident, the response and what to change.

The Runbook Template

Copy this table into your plan, and give every row an owner and a backup.

For each row, also record:

• Who can declare, and who can halt withdrawals
• Pre-built sweep transactions, tested against current balances
• Verified contacts at issuers, partner exchanges and SEAL 911

Then rehearse it: NIST notes that procedures can be exercised to verify their accuracy.

For the insider row, use our insider threat program template. To find gaps first, see what a crypto exchange pentest covers.

How Guardian Helps

Guardian's Managed Security streams your existing monitoring into a global 24/7 MDR team, with a 15-minute SLA on Critical alerts.

It watches contracts on every block for privileged calls, upgrades and large fund movements. Offchain, Sentry watches your domains, DNS, cloud and code host.

Its security operations team reviews every multisig transaction before it is signed. For keys and signers, an OpSec audit maps every path to your funds and checks whether your runbooks hold up.

Frequently Asked Questions

What should a crypto exchange do in the first hour after a hack?

Declare the incident and stop outflows: pause affected withdrawals, sweep remaining hot funds and revoke compromised keys. Within minutes, request freezes from issuers and exchanges, contact SEAL 911 and law enforcement, post a factual notice and preserve evidence.

Should an exchange halt withdrawals after a hack?

Halt them unless you can show the compromise is bounded and can still pay out in kind. Binance suspended withdrawals in 2019 and 2026. Bybit stayed open in 2025, saying no other wallet was compromised.

Can stolen crypto be frozen?

Stablecoins often can, if the issuer acts before they are swapped. After the October 2026 Binance drain, four issuers froze about $2.67 billion, per TRM Labs. BTC and other assets without an issuer depend on exchanges refusing them.

Sources

• NIST: SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management (April 2025)
• TRM Labs: North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History (October 29, 2026)
• Binance: Binance Security Breach Update (May 7, 2019, with an October 30, 2026 update)
• BleepingComputer: Lazarus hacked Bybit via breached Safe{Wallet} developer machine (February 26, 2025)
• Cointelegraph: Bybit confirms withdrawals are active, warns of delays (February 21, 2025)
• The Block: Bybit CEO says firm secured almost 80% of lost ETH as bridge loan from partners (February 21, 2025)
• Bybit: Security incident timeline (2025)
• FBI IC3: North Korea Responsible for $1.5 Billion Bybit Hack (February 26, 2025)
• SEC: Coinbase Global, Inc. Form 8-K, Item 1.05 (May 14, 2025)
• CNBC: Coinbase says hackers bribed staff to steal customer data and are demanding $20 million ransom (May 15, 2025)
• Security Alliance: SEAL 911
• Security Alliance: seal-911 (GitHub)
• Cornell LII: 23 NYCRR 500.17, Notices to Superintendent (amended November 1, 2023)
• SEC: SEC Adopts Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies (July 26, 2023)
• Guardian: Managed Security
• Guardian: Guardian Announces Managed Security
• Guardian: OpSec Audit