A retained response partner for protocol and product teams. Prepared before the incident. Beside you during it. Calm throughout.
A fully integrated response partner. We embed with your engineering response, execute communications directly, and work alongside your in-house counsel and comms team. Where specialists are needed, from forensics to external counsel, we bring vetted options and fold them into a single coherent response.
Readiness is built in calm months, not crisis hours. We embed with your team so the plan exists before it's needed.
When something breaks, you activate a partner who already knows the business. We hold the rhythm while your team works the problem.
The incident ends. The story doesn't. We turn the response into a record that rebuilds trust rather than eroding it.
Every incident is different. The rhythm is not. This is what the first 48 hours look like when the plan already exists and the person running it already knows your business.
An exploit, an outage, a disclosure. Your team activates us on the pre-agreed channel. No introductions needed: we already know your product, your stakeholders, and who approves what.
We open the situation log: what is confirmed, what is suspected, what is unknown. Every decision gets recorded from this point on. Speculation stays out of writing.
Built from the holding language we drafted months ago, approved through the path we agreed then. Accurate, factual, and early enough to hold the narrative.
"Decisions made in the golden hour are the difference between holding the narrative and chasing one written by others."
On the "golden hour" of crisis response, after LukaszewskiInvestor note prepared and sent. Partners and exchanges briefed in the right order. Community channels get a committed next-update time, and we hold to it.
Every ad hoc request for information routes through us, not the people doing containment. Leadership works a decision rhythm instead of a hundred pings.
Audience-specific updates land when we said they would. A held cadence is what kills speculation: people stop refreshing feeds for news about you when they know when you'll speak next.
Known facts aligned, remaining unknowns named, remediation narrative drafted, debrief scheduled. The postmortem people cite will be the one you wrote.
$625 million gone, and nobody noticed. The theft was discovered by a user who couldn't withdraw, not by monitoring. Six days without facts, cadence, or a story of their own.
$1.5 billion stolen, the largest theft in crypto history. The CEO was speaking publicly within 30 minutes and withdrawals were restored in twelve hours. Industry commentary called it textbook. The exchange survived.
Ransomware across 40 countries. Hydro admitted the breach the same day and ran daily public briefings, an approach it called "extreme transparency". It is now taught as the gold standard.
Responses like that aren't improvised courage. They are decisions made calmly, in advance, by people who thought about the first 48 hours before they arrived.
To do this job well we have to be genuinely integrated: an extended set of resources for your team, not a vendor you call cold. The commercial model is designed to make that easy.
Teams where trust is inseparable from the product, and where an incident becomes public fast:
The retainer covers both sides of the work: active readiness every month, and reactive priority response through the first 48 hours, locked in without exception. Work beyond that window, sustained recovery, postmortems, trust repair, is separate by design: scoped as a fixed block and agreed with you before it begins. The terms never change mid-incident.
A defined activation channel, who can trigger it, and what the first response window covers, written down at onboarding. At the center of it: a dedicated incident hotline, answered at any hour, on any day, in any timezone. Incidents don't keep office hours, so neither does activation.
Onboarding in the first 30 days: leadership context, technical orientation, channel review, stakeholder map. We integrate into your existing tooling and communication channels, so there's no new platform to adopt and no added admin. We work with our clients where they are, and a monthly rhythm keeps us current as your product and team change.
We retain a small number of clients so that when you activate, you get full attention. A written triage protocol and a vetted specialist bench back that commitment.
Every client relationship is led by the Principal Partner: the same senior operator through readiness, response, and recovery, on the other end of the incident hotline. No account managers, no juniors learning on your incident. Behind the Principal sits a small bench of trusted associates and specialist partners, engaged under the same confidentiality, so the service never rests on a single pair of hands during a live incident. And because we serve only a limited number of retained clients at a time, there is no client who gets the second-string version of this.
The practice draws on years running high-pressure product launches and operational environments at global scale, including telecoms at Vodafone, and deep working relationships across the Cardano and wider Web3 ecosystem: protocols, wallets, infrastructure teams, and the investors behind them.
That mix matters. Incident response in this space fails when the responder understands communications but not how protocol teams, governance, and communities actually work. We speak both languages.
Credentials support the work. Experience and preparation are the product.
Start with a confidential readiness debrief and a no-obligation discovery call. Capacity is deliberately limited to a small number of retained clients.
One integrated response: embedded with engineering, communications executed directly, working as one team with your counsel and specialists.