Post-block alerting is a receipt, not a defence
It tells you precisely how much you lost and exactly when you lost it. Both facts arrive too late to be worth anything.
There is a moment in every on-chain incident where the outcome is still undecided. One block, sometimes two. It is the only moment a defensive system can change the number at the bottom of the report. Everything after it is accounting.
Most security tooling operates entirely after that moment. It watches confirmed state, notices the drain, and sends a very good alert about a transaction that is already irreversible. That is not a criticism of the alert; it is what an alert can do after finality, which is nothing.
Where the window actually is
Live Detection works in three places, all of them upstream of finality. In the pending-transaction pool, where a drainer transaction is visible before inclusion. On a forked simulation of mainnet state, where the transaction's real outcome can be computed rather than guessed. And at signature time, before a wallet user has approved anything at all, which is the earliest and cheapest place any of this can be stopped.
The pre-signature lane inverts the usual economics. Blocking a malicious approval before the user signs costs a round trip to an API. Recovering the funds afterwards costs a negotiation, a bounty, a law firm and usually most of the money.
The Circuit Breaker is staged, never assumed
Detecting in the window is one thing; acting in it is another, and acting is where vendors overreach. Every breaker executes through a guardian module the customer deploys and owns, and it ships disarmed. It first runs report-only against your real traffic, writing to a durable shadow ledger, until duration, volume and distinct subjects clear a bar you set.
Zero false reverts on a quiet afternoon is not evidence. Weeks of real traffic across real subjects, decisions recorded and reviewable, is. You arm it, and revoke it at any block.
More from the walls.
Your audit certified the code. The attacker is signing in as you.
Four incidents, four different mechanisms, and not one of them was a Solidity bug the auditors were asked to look for.
7 min read
Why the model is never the first line of defence
Software that guesses does not get to declare an emergency. The layer order is a commitment, not a preference.
5 min read
Read and attest: capping the blast radius of your own vendor
The question nobody asks their monitoring vendor: what happens on the day the vendor is the one that gets breached?
6 min read
The next breach is already being dug.
Every engagement is scoped to your protocol by the team, and pricing follows that scope.