Response engagement · From $5,000 · Emergency rate applies
Incident Response & Post-Exploit Forensics
When funds are moving, the first hour decides how much of this is recoverable and how much of your credibility survives. We triage live, find the root cause, trace the funds, and write the post-mortem your users and investors will actually be able to trust.
Most teams have never run an incident before, and the failure mode is predictable: everyone looks at the same block explorer tab, nobody has authority to pause, and the first public statement is written in a panic and has to be retracted.
Our job in the first hour is narrow. What is the mechanism, is it still active, what stops it, and what does stopping it cost? A pause that freezes user funds for three days has a price, and that is a decision your team makes — but it should be made with the mechanism understood, not while it is still a rumour in a Discord channel.
After containment, the work changes shape: reconstruct the exploit transaction by transaction, quantify the loss precisely, trace where the funds went, and coordinate with exchanges, analytics firms and — where there is a realistic path — the attacker. Then write it all down honestly, because a post-mortem that hedges is read as a confession.
Scope of review
What we look at, and what we're looking for.
Live triage
Mechanism identification from on-chain evidence, whether the exploit is still active, and the containment options actually available to you with the privileges you hold.
Containment advice
Pause, parameter change, upgrade, or drain-to-safety — with the trade-offs of each spelled out, including what it does to users who are not under attack.
Root-cause analysis
The exploit reconstructed transaction by transaction, with a runnable reproduction against a fork at the pre-exploit block.
Loss quantification
Precise accounting of what left, from where, and who is affected — because approximate loss figures in a public statement are a credibility problem you cannot undo.
Fund tracing
Following funds through mixers, bridges and exchanges, with the reporting that exchanges and analytics firms need in the format they need it.
Recovery & disclosure
White-hat negotiation support, safe-harbour framing, coordination with law enforcement where appropriate, and drafting the public post-mortem.
In practice
Reconstruction is how root cause gets proven
Code on this page is written to illustrate a technique or a finding class. It is not taken from any client engagement.
// ILLUSTRATIVE — the first artefact of a real incident response:
// the exploit, reproduced at the pre-exploit block.
contract IncidentRepro is Test {
function setUp() public {
// Fork at the block *before* the attack transaction.
vm.createSelectFork(RPC_URL, EXPLOIT_BLOCK - 1);
}
function test_reproduce() public {
uint256 before = target.totalAssets();
vm.prank(ATTACKER);
attacker.execute(); // the reconstructed sequence
uint256 lost = before - target.totalAssets();
emit log_named_decimal_uint("drained", lost, 18);
assertGt(lost, 0); // mechanism confirmed
}
}
// Once this test passes, the root cause is no longer a theory —
// and the same test proves whether the fix actually closes it.Email audits@sentryx.example with URGENT in the subject and include the contract addresses and the transaction hashes you have seen. Do not wait for a reply to act: if you hold a pause and the mechanism is still active, pausing while you wait for analysis is almost always the right call. Do not publish a mechanism description before it is contained.
Same day for emergencies, subject to researcher availability. The emergency rate reflects reassigning researchers from scheduled work at no notice — it is not opportunistic pricing, and we will tell you honestly if we cannot get to you fast enough to help.
From $5,000, with the final figure depending on duration and scope. Live triage and root-cause analysis is the base; fund tracing, exchange coordination, negotiation support and the public post-mortem are scoped as the incident develops. We bill for what we do rather than taking a percentage of recovered funds.
Sometimes. Recovery depends on where the funds went and how fast: exchange deposits can be frozen if reported quickly, and some attackers negotiate for a bounty under safe-harbour terms. We support that process technically and help you coordinate with exchanges, analytics firms and counsel — but nobody honest promises recovery, and you should be suspicious of anyone who does.
We draft it and you own it. A good post-mortem states the mechanism, the timeline, the exact loss, what was done, and what changes — without minimising language. Users forgive protocols that are straight with them far more readily than protocols that hedge, and hedged post-mortems get taken apart publicly within hours.
That is the majority of incident work and it makes no difference to how we engage. We come in cold, read the code and the chain, and tell you what happened. We will not use your incident as marketing material, and nothing is published without your approval.
Related
Often scoped alongside this.
From $5,000
Send the repo. Scoping is free.
Under two working days to a written scope, a fixed quote and a review plan.