# Exploit track (SEV-1)

An exploit is the one incident where saying more, sooner, can make things worse, and
saying nothing makes things worse too. This file states that tension and routes it. It
does not resolve it, because the resolution is a legal and strategic call for the team and
its counsel.

## The tension, stated honestly

- **Users need to stop interacting now.** Every minute without a warning, more users sign
  into a drained pool or a malicious frontend. This part never waits.
- **Detail can cost recovery.** Publishing which accounts you are watching, which exchange
  or issuer you have contacted, or what the attacker's funds can still be frozen by, can
  tell the attacker where to move next. Recovery paths that depend on freezes, negotiation
  or a bounty offer are fragile in the first hours.
- **Copycats are watching.** Naming the drained vault, pool or bug before it is paused or
  empty tells others which one to hit next.
- **Silence is visible.** The chain is public. Researchers and bots will post the
  attacker's address and the drained amount, often before you do. A team that says
  nothing while the explorer says everything loses the story.

So the default split is: **the warning goes out at once; the mechanism, the recovery
effort and any statement about losses or compensation wait for counsel.**

## What comms can say without waiting

- Do not interact with {{PRODUCT}} or sign on {{DOMAIN}}.
- We are aware of {{ONE CONFIRMED FACT}} and are investigating.
- We will never DM you first. Anyone offering recovery help in DMs is a scammer.
  (Recovery scams follow every public exploit.)
- What we have already done onchain, with transaction links (a pause, an upgrade freeze).
- When the next update comes.

## What waits for counsel

Route each of these through
[solanabr/crypto-legal-skill](https://github.com/solanabr/crypto-legal-skill), which is
information-only and escalates to counsel, then to counsel itself. This skill does not draft
them and does not guess.

- How much was lost, and whose funds. Numbers are quoted forever.
- Any compensation, reimbursement, snapshot or token action.
- Any message to the attacker, including a bounty or "whitehat" offer.
- Any contact with regulators, law enforcement, exchanges or issuers, and anything said
  publicly about it. If a regulator has already made contact, crypto-legal-skill's
  [`/triage`](https://github.com/solanabr/crypto-legal-skill/blob/0f0de7ccbf39213c20bc34fa76791628ad43b838/commands/triage.md)
  treats that as a hard stop that goes straight to counsel.
- Whether personal data was exposed (a frontend or backend compromise can leak it). That
  carries its own notification clocks, covered in crypto-legal-skill's privacy domain.
- The cause, if it implicates a third party.

crypto-legal-skill covers breach notification for personal data; it has no
exploit-disclosure playbook. Treat that gap as a reason to call counsel, not as permission
to improvise.

## Who to reach, in parallel with comms

| Who | Why | Route |
|---|---|---|
| Your auditor and the auditor-skill IR checklist | Technical triage, evidence preservation | [auditor-skill checklist 17](https://github.com/solanabr/auditor-skill/blob/c6a4a17297f8994dfb1bb9f2e9e0d19acaab421a/checklists/17-logging-monitoring-incident-response.md) (LM-041 to LM-052), [checklist 07](https://github.com/solanabr/auditor-skill/blob/c6a4a17297f8994dfb1bb9f2e9e0d19acaab421a/checklists/07-program-opsec-governance.md) (war room, security contact) |
| SEAL 911 | Volunteer emergency group of security responders | [Telegram bot](https://t.me/seal_911_bot), per [security-alliance/seal-911](https://github.com/security-alliance/seal-911) (checked 2026-10-05). Verify any member who contacts you through the bot, as its README describes. |
| Integrators routing into you | Aggregators and wallets can stop sending users to a drained pool | Your partner channel with each; this is why the plan lists them before you need them |
| Counsel | Everything in "What waits for counsel" | via crypto-legal-skill's routing |

## After

The technical report is the auditor's
([auditor-skill report template](https://github.com/solanabr/auditor-skill/blob/c6a4a17297f8994dfb1bb9f2e9e0d19acaab421a/templates/audit-report.md)).
The user-facing account is [postmortem.html](postmortem.html), published only after counsel
has seen it.