Incidents follow a recognisable pattern, and how a team handles each stage is informative about the quality of the operation.
Detection
Frequently by external monitors rather than by the team.
Which is why several protocols now run automated anomaly detection with alerting.
Time between exploitation and detection is a meaningful measure, and it has ranged from seconds to weeks.
Containment
Pausing contracts, disabling functions or withdrawing remaining funds to safety.
Which requires that a pause capability exists, itself a centralisation trade-off.
Protocols with no ability to intervene lose everything reachable by the exploit.
Communication
Acknowledgement, then detail, then a post-mortem.
Which is where teams differ most visibly.
Silence during an active incident does more damage than an incomplete early statement.
Tracing
Funds are followed on chain, and analytics firms and exchanges are notified.
Which sometimes freezes funds if they reach a compliant venue.
Attackers generally move through mixers or bridges quickly for this reason.
Negotiation
Public offers of a bounty in exchange for returning funds.
Which has succeeded in several notable cases and failed in many others.
The legal position of such arrangements is not straightforward in most jurisdictions.
The post-mortem
A technical account of what happened and why.
Which is a genuine public good, since the same classes of bug recur across protocols.
Teams that publish detailed post-mortems contribute more than those that publish vague ones.
Compensation
May come from treasury, insurance, or a new token issued against future revenue.
Which spreads the loss in different ways with very different implications for existing holders.
Full reimbursement is uncommon and has occurred where treasuries were large enough.
What it indicates
Response quality is a signal about the team that is only observable after something goes wrong.
Reading historical incident responses for a protocol is worthwhile before depending on it.
The recurring root causes are documented and remarkably consistent, which is itself informative.
Common root causes
Price oracle manipulation, access control errors, reentrancy, arithmetic issues and flawed upgrade logic.
Which account for the large majority of documented incidents.
The distribution has shifted over time as tooling addressed the earlier categories.
Access control
Functions that should be restricted but are not.
Which is conceptually simple and has caused very large losses.
Initialisation functions left callable after deployment are a recurring specific case.
Insurance
Cover for smart contract failure exists with limited capacity.
Which pays on defined trigger conditions that may not match what actually happened.
Reading the exclusions is more informative than the headline cover amount.
Legal aftermath
Prosecutions have followed several incidents, including cases where the actor argued the code permitted their actions.
Which courts in several jurisdictions have not accepted as a defence.
The legal position is clearer now than it was a few years ago.
For users
Diversifying across protocols, limiting approvals and preferring longer-established code all reduce exposure.
White hat interventions
Security researchers exploiting a vulnerability first to protect funds, then returning them.
Which has saved substantial sums and carries real legal ambiguity.
Safe harbour frameworks have been proposed to clarify the position for good-faith intervention.
Bug bounty economics
A bounty must compete with the value of exploitation to be effective.
Which means small bounties on protocols holding large sums do not create the intended incentive.
Several protocols now offer bounties scaled to funds at risk.
Monitoring and automated response
Systems detecting anomalous patterns and pausing automatically.
Which reduces response time from hours to seconds.
False positives pausing a live protocol are the corresponding cost and must be tuned for.
Community response
How a protocol's users and governance handle losses shapes whether it survives.
Which includes decisions about socialising losses that are genuinely contested.
Several protocols have continued operating after substantial exploits, and several have not.
Reading history
Incident databases and post-mortem collections are public and are the best available education on how these systems fail.
Personal exposure
Funds deposited in a protocol are exposed to its code and its dependencies.
Which is a different risk from holding an asset directly.
Sizing positions accordingly is the practical response available to individuals.
Closing
The failure modes are documented and recurring, which makes them learnable.
Timeline expectations
Containment happens in minutes, communication in hours, post-mortems in days and compensation decisions in weeks or longer.
Which is the general pattern across documented incidents.
Teams deviating substantially from it, in either direction, are worth paying attention to.
Watching for it
Protocol status channels and security researcher accounts carry news faster than any other source during an active incident.
Reading two or three detailed post-mortems is worth more than any amount of general advice about protocol risk, because the specific mechanisms recur and become recognisable.
One last point
Protocols that have been through an incident and handled it well are frequently safer afterwards than comparable ones that have never been tested, because the response revealed what the organisation is capable of.