Crypto Tabletop Exercise Scenarios: 12 Incident Drills

By the Guardian team Updated November 2026 6 min read

Quick answer. Good scenarios test the decisions your team will face. Drill a compromised signer, a contract exploit, a DNS hijack, an oracle or bridge failure, a hot wallet drain, an insider, extortion and a regulator's clock.

Watch: Crypto Tabletop Exercise Scenarios: 12 Incident Drills 1:42

Video transcript

A response plan is a hypothesis until people use it. A tabletop tests it with the people who will run it.

Set objectives, the decisions to test. Script injects, the updates a facilitator hands out. Pick players with authority and keep planners out. Then hold a hot wash and write an after-action report.

CISA notes that equipment and resources do not deploy. Pair each drill with a technical test, like a pause simulated on a fork.

The twelve drills span keys and signers, contracts, oracles and bridges, frontends, cloud and hot wallets, and people, money and regulators.

Most follow a real incident. At Drift, council signers pre-signed transactions. A migration voided them, but the attacker got new ones and took about 285 million dollars.

Each drill defines what good looks like. After a signer compromise, the signer is removed within the hour. In an exploit, a pre-simulated pause is confirmed onchain. In a hot wallet drain, withdrawals halt without a meeting.

Regulators run clocks too. NYDFS gives covered entities 72 hours from determining an incident occurred, including at a vendor. List every clock with counsel.

Guardian's operational resilience assessment exercises key compromise, an unreachable signer quorum, an oracle failure, a chain halt and a depeg, as tabletops and technical tests.

Read the full article for all twelve drills, then talk to Guardian about rehearsing your worst day.

A response plan is a hypothesis until people use it. A tabletop tests it with the people who will run it.

These 12 drills cover protocols, exchanges and custodians. Most follow a real incident.

Run them against your DeFi incident response plan or exchange incident response plan.

How to Run a Tabletop

CISA's Tabletop Exercise Packages define a tabletop as "a facilitated discussion of a scripted scenario in an informal, stress-free environment."

Set objectives: the two or three decisions the drill must test.
Script injects: CISA calls them situation updates, handed out by a facilitator.
Pick players with authority to speak for their function.
Keep planners out: whoever wrote the scenario should not play.
Record decisions: evaluators note how discussion matches the plan.
Hot wash: were objectives met, and what gaps need fixing?
Close out with an after-action report: owners and deadlines for each fix.

CISA's templates run about four hours in three modules, but the length is at your discretion.

A tabletop is talk: CISA notes that "equipment and resources do not deploy." Pair each drill with a technical test, such as a pause simulated on a fork.

Keys and Signers

1. Signer key compromise

Inject: A signer's laptop shows malware. A Safe transaction nobody proposed needs one more signature.
Decide: Who removes the signer? Does the threshold still hold? Who checks pending transactions?
In the room: Incident lead, every signer, security lead, wallet vendor contact.
Good looks like: Signer removed within the hour; nothing signed without decoded calldata.

At Bybit in February 2025, a compromised Safe{Wallet} developer machine led signers to approve a disguised transaction, BleepingComputer reported.

2. Pre-signed approvals

Inject: Two council members admit they pre-signed governance transactions last week.
Decide: How do we void those signatures before they land? Is there a timelock?
In the room: Council members, protocol engineers, counsel.
Good looks like: Pending approvals voided, durable nonces disabled and a nonzero timelock set.

At Drift in April 2026, two of five council signers pre-signed durable nonce transactions, per BlockSec. A migration voided them; the attacker got new ones and took about $285 million.

See our Drift exploit breakdown.

Contracts, Oracles and Bridges

3. Contract exploit and pause

Inject: A vault loses 30% of its balance in two blocks, and the attack is still running.
Decide: Pause now or investigate first? Who signs? Do we call SEAL 911?
In the room: Incident lead, pause signers, engineers, communications.
Good looks like: A pre-simulated pause, confirmed onchain; evidence preserved.

Harder variant: it is 3 AM, and two pause signers are on flights.

4. Oracle failure

Inject: The price feed for your largest collateral stops updating while the market moves 15%.
Decide: Freeze borrowing? Switch feeds? Who can change the oracle, and how fast?
In the room: Risk lead, protocol engineers, signers, oracle provider contact.
Good looks like: A documented fallback, and a rehearsed path to change parameters.

Variant: the feed keeps quoting a pre-exploit price, a risk LlamaRisk flagged for rsETH after Kelp DAO.

5. Bridge message forgery

Inject: Your bridge releases most of its locked tokens for a burn that never happened.
Decide: Pause the adapter? Freeze the recipient? Warn lenders that accept your token?
In the room: Bridge engineers, emergency signers, the bridge provider, communications.
Good looks like: Pause in minutes, recipient frozen, every route's verifier setup on file.

This is Kelp DAO's April 2026 loss, where a single verifier was fooled. LayerZero says Kelp chose that setup; Kelp says it followed LayerZero's documented defaults.

Kelp paused 46 minutes after the release, and a frozen recipient blocked a second one. See our Kelp DAO breakdown.

Frontends, Cloud and Hot Wallets

6. Frontend or DNS hijack

Inject: Users report odd approval prompts, and your domain resolves to an IP you do not own.
Decide: How do we warn users when our domain is the attack? Who calls the registrar?
In the room: Infrastructure lead, registrar account owner, communications, support.
Good looks like: Warnings out in minutes; a registrar escalation path verified in advance.

In April 2026, attackers held CoW Swap's domain for about 4.5 hours after a social engineering attack on its registrar. CoW's core team estimates users lost about 1.2 million USDC.

7. Cloud credential leak

Inject: A cloud key with access near your signing service sat in a public repository.
Decide: What could the key reach or sign, and what do the logs show?
In the room: Infrastructure, security, signing service owner, CTO.
Good looks like: Key revoked in minutes; its path to signing keys mapped beforehand.

At Bybit, Sygnia suspected leaked or compromised Safe AWS credentials, BleepingComputer reported.

8. Exchange hot wallet drain

Inject: Hot wallet outflows on several chains that no customer withdrawal explains.
Decide: Halt withdrawals? Which wallets share the key path? Who gets freeze requests first?
In the room: Incident lead, wallet operations, compliance, communications, an executive who can halt.
Good looks like: Withdrawals halted without a meeting; issuer freeze requests out within minutes.

In October 2026, about $6.36 billion left Binance wallets, per TRM Labs. Tether's first freeze came 37 minutes after the main sweep.

Add Binance's twist: "suspending withdrawals alone could not stop all unauthorized asset movements." See our Binance hack explainer.

People, Money and Regulators

9. Insider data theft

Inject: A support agent ran thousands of customer lookups. Customers report calls from fake support.
Decide: Cut access now? What data left? Warn customers? Which notices apply?
In the room: Security, HR, counsel, support lead, communications.
Good looks like: Access cut and logs kept the same day; customers warned about impersonation.

In May 2025, Coinbase disclosed that a threat actor paid support contractors or employees outside the US for customer data. Our insider threat program covers the controls.

10. Ransom or extortion email

Inject: An email claims to hold your customer data, attaches a sample and demands crypto.
Decide: Is the sample real? Pay or refuse? When do law enforcement and customers hear?
In the room: CEO, counsel, security lead, communications, a board contact.
Good looks like: A pay-or-refuse framework agreed in advance; law enforcement engaged early.

Coinbase got its extortion email on May 11, 2025, and said it had not paid. NYDFS requires covered entities to report any extortion payment within 24 hours.

11. Regulator notification deadline

Inject: Friday, 6 PM: forensics confirm data left through a vendor's API. Monday is a holiday.
Decide: When did the clock start? Which regulators? Who approves and files the notice?
In the room: Compliance, counsel, security lead, vendor manager.
Good looks like: Every reporting clock listed in advance, and the notice filed on time.

NYDFS gives covered entities 72 hours from determining that a cybersecurity incident occurred, including at a vendor. List every clock with counsel.

12. Stablecoin depeg

Inject: A stablecoin holding much of your treasury trades at $0.92. The issuer is silent.
Decide: Redeem, swap or hold? Cut its collateral caps? What do we tell users?
In the room: Treasury, risk lead, protocol engineers, communications.
Good looks like: Concentration limits set in advance; a redemption path already tested.

How Guardian Helps

Guardian's operational resilience assessment exercises key compromise, an unreachable signer quorum, a custodian or cloud outage, an oracle failure, a chain halt and a depeg.

Each runs as a tabletop and a technical test, with a rehearsed path to file reports on time.

For live incidents, Managed Security streams your monitoring into a 24/7 MDR team, with a 15-minute SLA on Critical alerts.

Frequently Asked Questions

What is a tabletop exercise in cybersecurity?

A facilitated discussion of a scripted incident, in what CISA calls an informal, stress-free environment. Players talk through decisions as situation updates arrive; nothing is deployed. It tests the plan, the roles and the coordination.

How often should a crypto company run a tabletop exercise?

SEAL's incident response template suggests every quarter, adding that even 30 minutes helps. Re-run a drill after a signer change or upgrade.

Who should attend a crypto tabletop exercise?

The people who would make the real calls: incident lead, signers, engineers, communications, counsel and an executive who can halt. CISA wants players who can speak for their function, and keeps planners out.

Sources

Rehearse your worst day with Guardian

Guardian exercises key compromise, an unreachable signer quorum, an oracle failure and a depeg as tabletops and as technical tests.

Talk to Guardian Explore Managed Security