What Is SEAL 911 and When Should You Contact It?

By Owen Thurm Published November 6, 2026 6 min read

Quick answer. SEAL 911 is the Security Alliance's free, around-the-clock emergency hotline for anyone facing an active or imminent crypto incident. Contact it through its official Telegram bot, @seal_911_bot, with the protocol, attack transactions and funds at risk.

Watch: What Is SEAL 911 and When Should You Contact It? 1:36

Video transcript

When an exploit starts, the first problem is often knowing who to call. SEAL 911 is a free, around-the-clock emergency hotline for exactly that.

Run by the nonprofit Security Alliance, it connects you with vetted volunteer researchers. SEAL counts over 180 million dollars in assets rescued.

Open a ticket with the official SEAL 911 Telegram bot. Send the protocol, attack transaction hashes, funds at risk and a short description.

Anyone claiming to be SEAL who asks for a seed phrase, private keys or payment is running a scam. Verify unsolicited contacts through the official bot.

Use it during active exploits, cross-protocol incidents, or when you need industry coordination. Individuals hit by a scam or hack qualify too. Unexploited bugs belong with the project's bug bounty.

SEAL lists an average response time under 30 minutes. It is free, but offers no long-running tracing, and SEAL says it cannot promise recovery in every case.

Safe Harbor, also from SEAL, is an onchain agreement protocols adopt in advance, so whitehats can rescue funds during an active exploit for a preset bounty.

SEAL 911 brings in volunteers once an incident starts. Guardian Managed Security watches your contracts on every block before then, with a 15-minute SLA on Critical alerts.

Read the full article for war room roles and a prep checklist, or talk to Guardian about Managed Security.

When an exploit starts, the first problem is often knowing who to call.

SEAL's own incident response template puts SEAL 911 first on its escalation list for an active exploit.

Cork Protocol's post-mortem shows it in use. After a monitoring alert, the team "reported the incident to the Security Alliance" and opened a war room with researchers and auditors.

What SEAL 911 Is

SEAL 911 is an initiative of the Security Alliance (SEAL), a 501(c)(3) nonprofit that describes itself as a crypto ISAC.

SEAL calls SEAL 911 "a free, around-the-clock emergency hotline" connecting anyone facing an active or imminent incident with vetted security researchers.

The responders are volunteers. Membership is invite-only, usually with a vouch from an existing member, and each commercial organization is limited to two members.

The published member list includes independent researchers and people from OtterSec, Hypernative, Elliptic, Wintermute and Binance, among others.

By SEAL's own count:

3,300+ tickets handled
200+ war rooms coordinated
$180M+ in assets rescued
31 volunteer responders

How to Contact SEAL 911

Open a ticket with the official SEAL 911 Telegram bot, @seal_911_bot. SEAL's emergency page and its GitHub repository both point to it.

SEAL 911 also has an X account, @seal_911, but tickets go through the bot.

What to send

SEAL asks for as much information as possible, so responders do not duplicate work. Its message template has four parts:

Protocol: the protocol's name.
Attack transactions: the hash or hashes.
Funds at risk: an estimate in USD or tokens.
Description: a few lines on what is happening.

SEAL 911 notes that Telegram is not encrypted by default. It offers other channels, such as Signal, for sensitive information.

Spot impersonators

SEAL 911 "will never ask for your seed phrase, private keys, or payment." Anyone claiming to be SEAL who asks for these is running a scam.

If someone claiming to be a SEAL 911 member contacts you first, verify them through the bot:

Share an unguessable keyword sentence with them.
Open a ticket in the official bot.
Ask the member to give the keyword there.

When to Contact It

Contact SEAL 911 when an incident is active or imminent.

SEAL's contacts template names three cases: active exploits, cross-protocol incidents, and a need for industry coordination.

Its smart contract exploit runbook makes contacting SEAL 911 step two, right after assessing what is at risk and before pausing.

Individuals can use it too. SEAL's emergency page is written for people who lost crypto to a scam or hack.

Not sure you were hacked? "Reach out anyway," it says.

For a bug nobody has exploited yet, SEAL's frameworks point to the project's bug bounty or security contact instead. See how to report a smart contract vulnerability.

What Happens After You Report

A real person reviews each case, SEAL says, and its emergency page lists an average response time under 30 minutes.

For individuals, SEAL lists the help on offer:

Advice on urgent next steps
Help containing an ongoing attack
Guidance on securing remaining assets
Connections to recovery resources
An explanation of what happened

For protocols, SEAL's war room guidelines set the pattern: a small war room with audio, trusted people only, and named roles.

Operations: runs the room and herds multisig signers.
Scribe: consolidates what the room learns.
Strategy lead: prioritizes actions and weighs trade-offs.
Protocol lead: pauses or upgrades contracts.
Web lead: the front end and servers.
External communicator: social media and users.

War room members are told not to publicize anything without the protocol's consent, and not to speak to the press.

Under SEAL 911's code of conduct, members ask consent before sharing what you told them outside SEAL 911.

Its data retention policy keeps ticket data for 12 months by default. You can opt out through a new ticket.

What SEAL 911 Does Not Do

Charge you. It is free and volunteer-run, and tickets are handled "based on available bandwidth".
Long-running tracing. Ticket volume rules it out. It points to members' firms instead: Tracelon, Cryptoforensic Investigators and zeroShadow.
Guarantee recovery. "We can't promise recovery in every case," SEAL says.

If your own wallet was drained, our guide to what to do when a crypto wallet is drained covers law enforcement reports and recovery scams.

SEAL 911 and Safe Harbor

Safe Harbor is a separate SEAL project: an onchain agreement that protocols adopt to pre-authorize whitehat rescues during active exploits.

SEAL says it started Safe Harbor after the Nomad hack, where whitehats "stood by, willing to help, but unable to act without legal protection."

The protocol sets the terms in advance:

The contracts in scope
An asset recovery address
A security contact
Identity rules for whitehats
The bounty

SEAL's site gives bounties of 10% of recovered assets, capped at $1M. Its framework lets each protocol set its own figures and calls 10% "standard in the industry".

SEAL's site summary says rescued funds must be returned within 72 hours. The agreement text sets the exact timing, so read it before you rely on it.

	SEAL 911	Safe Harbor
What it is	A volunteer emergency hotline	An onchain agreement for whitehat rescues
Who uses it	Anyone facing an active incident	Protocols adopt it; whitehats act under it
When	During the incident	Adopted before; applies only during an active exploit
Cost	Free	A preset bounty on recovered funds

The two meet after a rescue. SEAL's whitehat guidance strongly recommends contacting SEAL 911 immediately, for help with KYC, protocol communications and bounty collection.

Prepare Before an Incident

Save @seal_911_bot in your incident contacts, checked against securityalliance.org.
Keep SEAL's four-part message template in your runbook.
Name a holder and a backup for each war room role.
Script your pause and other defensive actions, and test them on a fork.
Decide on Safe Harbor. If you adopt, set a recovery address and a security contact someone checks at any hour.
Drill it. SEAL's Wargames simulate exploits such as oracle manipulation and leaked private keys.
Review contacts quarterly and after team changes, as SEAL's template advises.

Our DeFi incident response plan covers the rest: pause authority, severity levels and communications.

Where Guardian Fits

SEAL 911 brings in volunteers once an incident has started. Guardian Managed Security is watching before it starts.

Guardian monitors your contracts on every block: privileged calls, role and ownership changes, upgrades, multisig transactions and large fund movements.

When something fires, a Guardian engineer responds. The global 24/7 MDR team works to a 15-minute SLA on Critical alerts.

Guardian's security operations team also reviews every multisig transaction before it is signed. For how the service model works, see what Web3 MDR is.

Frequently Asked Questions

What is SEAL 911?

SEAL 911 is a free, around-the-clock emergency hotline run by the Security Alliance (SEAL), a nonprofit. Volunteer security researchers help anyone facing an active or imminent crypto security incident, from exploit triage to fund recovery.

How do I contact SEAL 911?

Open a ticket with the official Telegram bot, @seal_911_bot. Send the protocol, the attack transaction hashes, the funds at risk and a short description. SEAL 911 never asks for seed phrases, private keys or payment.

Does SEAL 911 recover stolen crypto?

It helps contain attacks and coordinate recovery, and SEAL reports $180M+ in assets rescued. It cannot provide long-running tracing and points to members' firms that do. SEAL says it cannot promise recovery in every case.

What is the difference between SEAL 911 and Safe Harbor?

SEAL 911 is a hotline for help during an incident. Safe Harbor is an onchain agreement a protocol adopts in advance, so whitehats may rescue funds during an active exploit for a preset bounty.

Sources

Have a team watching before you need SEAL 911

Guardian Managed Security monitors your contracts on every block, with an engineer on every alert and a 15-minute SLA on Critical alerts.

Talk to Guardian Explore Managed Security