How to Write a Web3 Incident Response Plan for DeFi

By the Guardian team Updated November 2026 6 min read

Quick answer. A DeFi response plan names who can pause each contract, how signers are reached at any hour, and the containment step for each threat. It adds severity levels, SEAL 911 and issuer contacts, comms templates and regular drills.

Watch: How to Write a Web3 Incident Response Plan for DeFi 1:44

Video transcript

A Web3 incident response plan covers the hour after prevention fails. Onchain, that hour is short.

In Guardian's timing of 30 exploits, the median pause came 88 minutes after the first exploit transaction.

Give SEAL's six roles a holder and backup, inventory every admin key and multisig, verify contacts like SEAL nine one one and stablecoin issuers, and decide on Safe Harbor early.

Per Rekt, gathering signatures to pause Resolv took about three hours. Give pausing to a small on-call multisig, simulate pause transactions in advance, and never pre-sign admin transactions.

SEAL grades incidents from P one to P five. When in doubt, escalate. Treating a P one as a P two can cost millions.

Detection is often not the slow part. Post-mortems in Guardian's study put first awareness at a median of 4 minutes. Route every Critical alert to someone awake.

Containment follows SEAL's exploit runbook. Assess the scope, contact SEAL nine one one, then pause and confirm it took effect. Finally, preserve evidence.

Drill the plan. Run a quarterly tabletop, simulate every pause on a mainnet fork, and page signers at an off hour to time quorum.

Guardian's Managed Security monitors contracts on every block and can trigger automated pauses. A Guardian engineer responds to Critical alerts under a 15-minute SLA.

Read the full article, then talk to Guardian about rehearsing your first hour.

A Web3 incident response plan covers the hour after prevention fails. Onchain, that hour is short.

In Guardian's timing of 30 exploits, the first public alert came a median of 35 minutes after the first exploit transaction. The median pause came 88 minutes in.

NIST SP 800-61 Rev. 3, final since April 2025, places incident response inside overall cyber risk management. A protocol's plan adds the onchain parts: pause authority, signers, SEAL and stablecoin issuers.

Before: Preparation

Roles

The Security Alliance (SEAL) publishes an incident response template for Web3 protocols. Its policy defines six roles:

Role	Job
Detector	Spots the incident, alerts responders, hands off
Incident Leader	Coordinates, assigns tasks, makes decisions
Scribe	Keeps the log in UTC, with decisions and reasons
Communication Manager	Drafts updates and runs community channels
Subject matter experts	Specialists pulled in by incident type
Decision Makers	Senior leaders for high-stakes calls

Name a holder and a backup for each role, across the time zones you cover.

An access inventory

SEAL's template also asks for a list of "privileged roles, multisigs, admin keys, and what each controls".

For each one, record the holder, the threshold, the timelock and what it can pause, upgrade or move. Drift's 2-of-5 council with a zero timelock is the case for doing it. See the Drift exploit.

Signer availability

A pause is only as fast as its signers. Rekt reports that gathering the signatures to pause Resolv took about three hours.

Give pausing to a narrow role or small emergency multisig, with signers on call.
Record each signer's time zone, device and a verified backup channel.
Build and simulate pause transactions in advance, so nobody writes calldata mid-incident.
Never pre-sign admin transactions. Pre-signed durable nonce approvals cost Drift its admin control.

Contacts

SEAL's contact sheet covers your team, security partners, vendors, legal and communications, and key partners. For DeFi, make sure it includes:

SEAL 911, through its Telegram bot, t.me/seal_911_bot.
Stablecoin issuers for assets your contracts hold. USDC's contract lets a blacklister role block an address.
Exchanges and bridges an attacker might route funds through.
Auditors, your response retainer and your bug bounty platform.
Vendors: hosting, DNS, CDN, RPC and monitoring, with escalation paths.
Integrators that hold your token or depend on your prices.

SEAL's template says to verify the list quarterly and after team changes. Stale contacts "waste critical time".

Safe Harbor

Decide in advance whether whitehats may step in. SEAL's Safe Harbor is an onchain agreement that pre-authorizes whitehat interventions during active exploits.

You set the scope, the bounty, identity rules and an asset recovery address. SEAL calls a 10% bounty "standard in the industry", and rescued funds must reach your recovery address within 72 hours.

Detection and Triage

SEAL's policy grades incidents P1 to P5:

Level	Example	Response
P1 Critical	Loss of funds or an active exploit	Immediate, Decision Makers involved
P2 High	A major unexploited vulnerability	Immediate
P3 Moderate	Minor vulnerability, no likely fund loss	Within hours
P4 Low	Minor bugs or display issues	Scheduled
P5 Info	Expiring certificates, maintenance notices	No immediate action

Its rule for doubt: escalate. "Treating a P1 as P2 can cost millions."

SEAL's exploit runbook starts with three questions: how much is at risk, which contracts are affected, and is the exploit still running?

It also separates look-alikes. Funds moving to your own multisig are likely authorized. One affected user may be phishing. Wrong numbers in the UI with correct chain state point to the frontend.

Detection is often not the slow part. In the six post-mortems in Guardian's study that say when the team or its monitoring first knew, the median was 4 minutes.

So route every Critical alert to a person who is awake, around the clock. That is the job of Web3 MDR.

Containment Onchain

SEAL's exploit runbook runs in this order:

Assess scope: funds at risk, contracts affected, whether it is ongoing.
Contact SEAL 911.
Pause if you can, and verify the pause took effect.
Preserve evidence: transactions, block numbers, mempool data, attacker addresses.

Without a pause, it lists an emergency upgrade through governance or the multisig, or a rescue that moves funds first.

If a key or signer is compromised

Remove the signer, add a replacement and check the threshold still fits.
Transfer ownership to a new address, or revoke the key's permissions.
Move remaining hot wallet funds to a secure address.
On Solana, a pre-signed durable nonce approval stays valid until its nonce advances. At Drift, changing the multisig voided the attacker's first approvals, per BlockSec.

Pre-authorized freezes

Freezes work when they are ready before the incident. At Kelp DAO, a second release of 40,000 rsETH reverted because Kelp had already frozen the recipient address, per Aave's incident report.

Test the pause itself, too. In Guardian's study, Seneca's pause functions were internal and Arcadia's pause was in a cooldown.

Recovery and Communications

Communications

SEAL's communications guidance is short: "Ship only confirmed facts".

Name a primary and a backup spokesperson.
Pre-approve templates for notices, updates and press releases.
Post on a fixed schedule, even when there is nothing new.
Tell integrators directly. At least 20 protocols reported disruption from Drift, per Chainalysis.

A first notice can be two lines. Drift's first post read: "We are observing unusual activity on the protocol. We are currently investigating."

Recovery

SEAL's policy puts a temporary fix first, such as a pause or rollback. The permanent fix gets an owner and a timeline.

Monitor the fix for at least a week after deployment.
Involve legal if the loss is significant, and law enforcement where appropriate.
Hold a blameless post-mortem within a week, published by default with sensitive details redacted.
Gate any relaunch on fresh review. Drift tied its relaunch to two independent audits.

Testing the Plan

SEAL puts it plainly: "Plans written under stress lose to plans practiced in calm."

Run a tabletop every quarter, as SEAL's template suggests, with the people who hold the roles.
Simulate every pause and freeze transaction on a fork of current mainnet state.
Page the emergency signers at an off hour, and time how long quorum takes.
Review contacts quarterly and after every team change.
Re-test after every upgrade, signer change or new deployment.
Record each exercise with its date and lessons, and fix what failed.

How Guardian Helps

Guardian's Managed Security monitors contracts on every block: privileged calls, role changes, upgrades, multisig transactions and large fund movements.

Monitors run with custom rules and actions, including automated pauses. When something fires, a Guardian engineer responds, with a 15-minute SLA on Critical alerts.

For onchain teams, operational security includes incident runbooks rehearsed before they are needed.

Guardian's regulatory compliance work exercises key compromise and an unreachable signer quorum as tabletops and technical tests.

Frequently Asked Questions

What should a DeFi incident response plan include?

It needs named roles with backups and an inventory of privileged roles and their holders. Add pause and key rotation runbooks, severity levels, verified contacts including SEAL 911 and stablecoin issuers, comms templates and a drill schedule.

What is SEAL 911?

SEAL 911 is a free, around-the-clock emergency hotline from the Security Alliance. It connects teams facing an active incident with vetted security researchers through a Telegram bot. It is volunteer-run and does not provide paid services.

What is SEAL Safe Harbor?

An onchain agreement a protocol adopts to pre-authorize whitehats to rescue funds during an active exploit. The protocol sets the scope, bounty, identity rules and recovery address. Whitehats must return funds within 72 hours.

How often should a protocol test its incident response plan?

SEAL's template suggests a tabletop exercise every quarter, even a 30-minute one, and reviewing contacts quarterly and after team changes. Re-run pause paths on a fork after every upgrade or signer change, since either can break them.

Sources

Rehearse your first hour with Guardian

Guardian Managed Security watches your contracts around the clock, with a 15-minute SLA on Critical alerts and incident runbooks rehearsed before they are needed.

Talk to Guardian Explore onchain team security