How Fast Are Crypto Hacks Detected? Data From 30 Exploits
Quick answer. In Guardian's timing of 30 notable exploits from 2024 to 2026, the first public alert came a median of 35 minutes after the first exploit transaction. By the median pause, 88 minutes in, the money was usually gone.
Video transcript
Crypto hacks are often spotted within minutes. The slow part is everything after the alert.
Guardian timed 30 exploits from 2024 to 2026 using onchain timestamps. The first public alert came a median of 35 minutes after the first exploit transaction.
Code exploits were flagged in a median of 30 minutes. Key and signer compromises took 60, because their transactions look legitimate until the money moves.
Privately, teams knew much sooner. In the six post-mortems that say when monitoring first fired, the median was just 4 minutes.
From the exploit, the public alert lands around 35 minutes in, the team statement about two hours in, and the median pause at 88 minutes, often an upper bound.
By then the money was usually gone. In 7 of the 11 incidents where the last exploit transaction is known, the drain ended before any public alert.
Fast teams wire detection to an action, keep the pause reachable, test that it works, pre-authorize targeted freezes, and have the war room ready.
Guardian Managed Security carries a 15-minute SLA on Critical alerts. Here, only 1 of 19 incidents was contained that fast. All 30 predate its launch, so this data does not show Guardian stopping any of them.
Read the full dataset below, or talk to Guardian about closing the gap between the alert and the pause.
How fast are crypto hacks detected? Annual hack reports count dollars and incidents, not minutes.
So we built a dataset from the record itself: block timestamps, the creation times of the first public alerts, and the times teams state in their post-mortems.
The sample covers 30 exploits from January 2024 to September 2026 with public write-ups. Eighteen were onchain code exploits and twelve were offchain compromises of keys, signers or infrastructure.
The short version: where post-mortems say when the team or its monitoring first knew, it was within minutes. The long part is everything after the alert.
Method and Limitations
For each incident we recorded four times, all in UTC:
- First exploit transaction, from the post-mortem, or the block time of the earliest cited exploit transaction.
- First public alert, the earliest cited post flagging the exploit, timed from its X post ID.
- Team's first public statement, from the affected team or its founder.
- Pause or containment. Where only an announcement exists, its time is an upper bound.
Every time, median and count here is Guardian's own compilation from those public records. Losses are DefiLlama's figures, for consistency.
Medians use the incidents that have each time: 30 for the first public alert, 29 for the team statement, 6 for private detection and 19 for a pause.
Limitations. These are notable incidents with public write-ups, not a random sample.
Attacks stopped before any loss are missing, which likely makes the sample look slower than the best teams are.
The first alert is the first post we found among those that post-mortems and Rekt cite. Earlier posts, Telegram messages and private alerts may exist.
Eleven of the 19 pause times come from announcement posts, so they are upper bounds.
We filed Drift and Kelp DAO as offchain by root cause, although DefiLlama labels them access control and bridge incidents.
Exploit to First Public Alert
The median is 35 minutes, and the middle half of incidents fall between 21 and 71 minutes.
Five of the 30 had a public alert within 15 minutes, and 21 within an hour.
The fastest was Sonne Finance in May 2024, where Nerv Alert posted 4 minutes after the exploit transaction. The slowest was Velocore, at 2.5 hours.
Onchain exploits were flagged faster: a median of 30 minutes (18 incidents) against 60 minutes for offchain ones (12 incidents).
One likely reason: code exploits trip detectors. A compromised key or signer produces transactions that look legitimate until the money moves.
Private detection was much faster
Six post-mortems state when the team or its monitoring vendor first knew. The median was 4 minutes after the first exploit transaction.
- Radiant Capital: a Hypernative alert, under 2 minutes in.
- Cork Protocol: a Hypernative notification, 4 minutes in.
- Arcadia Finance: a Hexagate alert when the malicious contract was deployed, before the drain.
- Balancer V2: a Hypernative flag, about 6 minutes in.
- Sonne Finance: the team became aware 25 minutes in.
- Bitget: its reconciliation system flagged a discrepancy 34 minutes in.
Alert to Pause or Freeze
Nineteen incidents have a pause or containment time, with a median of 88 minutes after the first exploit transaction.
The eight exact times have a median of 50 minutes. The eleven based on announcement posts, which are upper bounds, have a median of 149 minutes.
Only one team contained an incident within 15 minutes: Socket patched its vulnerable route 14 minutes after the attack began.
Radiant's automated pauses fired within 22 seconds, but the attacker took over the BSC contracts anyway. So we count Radiant's containment from its Base pause at 17:43.
Two teams, Balancer and Kelp DAO, contained before any public alert. In both cases the main theft had already happened.
In three incidents there was no pause to use. Seneca's pause functions were internal, Arcadia's pause was in a cooldown, and Bybit kept processing withdrawals as normal.
Multisig coordination was the other recurring delay. Rekt reports that gathering the signatures to pause Resolv took about three hours.
When speed still helps
A fast response only helps if the attack is still running. In 7 of the 11 incidents where the last exploit transaction is known, the drain had ended before any public alert.
Kelp DAO lost 116,500 rsETH in one transaction, and Rekt reports Drift's vaults were emptied within 128 seconds of the admin takeover.
Only prevention or an automated response could have changed those outcomes.
In four incidents the attacker was still active after a public alert: Prisma Finance, Resolv USR, KiloEx and Bitget.
At Resolv, a second mint of 30 million USR landed 80 minutes after the first, an hour after the first public alert.
These are the incidents where someone who can pause within minutes saves money.
What Fast Teams Do
- Wire detection to an action. Balancer's monitoring triggered emergency controls that paused vulnerable pools within minutes.
- Keep the pause reachable. Give a guardian role or small emergency multisig the power to pause, with signers on call.
- Test that the pause works. Internal functions, cooldowns and expired pause windows (Balancer V5) left nothing to press.
- Pre-authorize targeted freezes. Kelp DAO's recipient freeze stopped a second 40,000 rsETH release.
- Give signing its own kill switch. Bitget blocked withdrawal requests 34 minutes in, yet the drain ran over two more hours.
- Have the war room ready. Cork and Arcadia contacted SEAL 911. Decide in advance who calls whom.
- Speak early. The median team statement came about 2 hours in, while integrators such as Pendle and Aave were already pausing.
Our comparison of smart contract monitoring tools covers detection, and what Web3 MDR is covers response.
How Guardian Managed Security Compares
Guardian's Managed Security comes with a 15-minute SLA on Critical alerts. In this sample, only 1 of 19 incidents was contained within 15 minutes.
In the six post-mortems that say when the team or its monitoring first knew, that took a median of 4 minutes.
Most of the delay was in the response: deciding, reaching signers and pausing.
This data does not show Guardian detecting or stopping any of these incidents. All 30 predate the November 2026 launch of Guardian Managed Security.
Managed Security monitors contracts on every block, with custom rules and actions, including automated pauses. When something fires, a Guardian engineer responds around the clock.
Offchain incidents need eyes beyond the chain: twelve of the 30 started with a key, signer or infrastructure compromise.
Our report on onchain vs offchain attacks shows those account for most of the dollars lost.
The Dataset
Times are minutes after the first exploit transaction, and ≤ marks an upper bound. Each figure links to its source.
Frequently Asked Questions
How long does it take to detect a crypto hack?
In our sample of 30 exploits from 2024 to 2026, the first public alert came a median of 35 minutes after the first exploit transaction. Where post-mortems say when teams first knew, the median was 4 minutes.
How quickly do teams pause a protocol after a hack?
In the 19 incidents with a pause or containment time, the median was 88 minutes, or 50 where the exact time is known. Only Socket contained an incident within 15 minutes.
Are offchain hacks detected more slowly than smart contract exploits?
Yes, in this sample: onchain exploits drew a first public alert a median of 30 minutes in, against 60 for key, signer and infrastructure compromises. Their transactions often look legitimate until the funds move.
Does faster detection reduce losses?
Only if the attack is still running and someone can act. Most known drains ended before any public alert, but at Prisma, Resolv, KiloEx and Bitget, attackers kept going.
Sources
- DefiLlama: Hacks dataset API (pulled November 4, 2026)
- Bybit: Security incident timeline (2025)
- Bitget: Security incident timeline, impact and response (2026)
- Aave governance forum: rsETH Incident Report (April 20, 2026)
- Balancer: Nov 3 exploit post-mortem (November 18, 2025)
- Cork Protocol: Post-mortem (June 4, 2025)
- Resupply: crvUSD-wstUSR market post-mortem (June 28, 2025)
- Arcadia Finance: Post Mortem 15-07-2025 (July 2025)
- Bunni: Exploit post-mortem (September 2025)
- Radiant Capital: Radiant post-mortem (2024)
- Sonne Finance: Post-mortem, Sonne Finance exploit (May 15, 2024)
- Velocore: Incident post-mortem (June 2, 2024)
- WazirX: Cyber attack day-wise report (2024)
- Rekt: PrismaFi, Rekt (March 2024)
- Etherscan: Kelp DAO Safe transaction pausing rsETH contracts (April 18, 2026)
- Rekt: Resolv Labs, Rekt (March 2026)
- Rekt: Drift Protocol, Rekt (April 2026)
- Rekt: KelpDAO, Rekt (April 2026)
- Rekt: Ostium, Rekt (July 2026)
- Rekt: AFX Trade, Rekt (July 2026)
- Rekt: Bitget, Rekt (September 2026)
- Rekt: Term Labs, Rekt (August 2026)
- Rekt: Seneca Protocol, Rekt (February 2024)
- Rekt: Socket, Rekt (January 2024)
- Guardian: Guardian Announces Managed Security (November 2026)
Close the gap between the alert and the pause
Guardian Managed Security watches your contracts and offchain estate around the clock, with a 15-minute SLA on Critical alerts and an engineer who responds.