Emergency Procedures

Engineer/DeveloperSecurity SpecialistMultisig Security

Authored by:

Isaac Patka

SEAL | Shield3

Geoffrey Arone

Shield3

Louis Marquenet

Opsek

Pablo Sabbatella

SEAL | Opsek

Dickson Wu

SEAL

Reviewed by:

Piña

Coinspect

engn33r

When security incidents occur, quick and decisive action is critical. This page covers procedures for key compromise, lost access, and communication breaches.

Key Compromise

Immediate Actions (Within 30 Minutes)

Stop operations - Halt all non-emergency transactions
Notify team - Alert via all communication channels using emergency notification template
Assess scope - Determine which keys may be compromised
Escalate - Contact Security team immediately
Document - Record timeline and details

Recovery Process

Isolate - Quarantine potentially compromised devices
New hardware setup - Set up fresh wallet with new seed following Hardware Wallet Setup
Coordinate replacement - Plan signer replacement transaction with team
Execute replacement - Replace compromised signer on multisig, following steps for signer rotation in Secure Multisig Best Practices
Verify security - Confirm new setup before resuming operations

Lost Key Access

Immediate Steps

Try backup device first if available
Contact team immediately via backup communication channels
Do not panic - Lost access doesn't mean compromised keys
Document the situation - Record what happened and when

Identity Verification Process

Since you can't sign with your key, verify identity through alternative methods:

Video call with other signers
Authentication via verified social media account
Other pre-arranged verification methods

Replacement Coordination

Generate new hardware wallet following standard setup procedures in Hardware Wallet Setup
Verify new address through identity verification process above
Coordinate timing with other signers for replacement transaction
Execute replacement once team confirms identity
Update documentation with new signer information

Communication Account Compromise

If Telegram/Signal/Discord Gets Taken Over

Immediate Actions

Assume all recent messages are suspect - Don't trust recent communication
Use backup channels to alert team about compromise
Change passwords and enable additional security on compromised account

Team Verification Process

For the compromised person:

Use alternative contact methods (email, phone, other platforms)
Verify identity through video call or pre-arranged methods
Provide proof of the compromise (screenshots, platform confirmation)

For other team members:

Verify all recent requests from compromised account
Cancel any pending transactions initiated via compromised communication
Require additional verification for any future requests until resolved

Recovery Steps

Regain account control through platform recovery processes
Enable maximum security (2FA, security keys, session management)
Review recent message history for unauthorized communications
Alert team when account is secured and verified clean
Resume normal operations only after team confirms account security

Emergency Notification Template

Use this template for security incidents or key compromises:

Subject: [URGENT] Multisig Security Incident - [Multisig Name]
 
Immediate details:
- Multisig address: [ADDRESS]
- Classification: [Impact Level / Operational Type]
- Incident type: [Key Compromise / Communication Failure / System Issue]
- Time of discovery: [TIMESTAMP]
- Reporting signer: [NAME/HANDLE]
 
Situation summary: [Brief description of what happened and current status]
 
Immediate actions taken:
□ Stopped non-emergency operations
□ Isolated affected systems
□ Notified team members
□ [Other actions]
 
Next steps required:
□ Security team assessment
□ Key rotation process
□ Emergency transaction execution
□ [Other actions]
 
Current multisig status:
- Available signers: [X/Y]
- Communication status: [Operational/Compromised]
- Operational capability: [Full/Limited/Suspended]

Emergency Communication Protocols

Multi-Channel Notification

Primary channel: Alert via main communication channel
Backup channels: Simultaneously notify via backup platforms
Emergency contacts: Use emergency contact procedures if established

Identity Verification

Code words: Use pre-established verification phrases
Multiple confirmations: Verify through multiple channels
Video verification: Use video calls for critical confirmations

Information Sharing

Need-to-know basis: Share only essential information
Secure channels only: Use most secure available communication
Documentation: Record all emergency communications

Operational Emergency Procedures

For Emergency Response Multisigs

Rapid Response Protocol

Immediate assessment - Determine scope and urgency
Signer activation - Contact threshold number of signers
Streamlined verification - Use minimal verification appropriate for risk level
Execute response - Implement emergency measures
Post-action review - Document and assess response effectiveness

24/7 Availability

Geographic distribution - Ensure coverage across time zones
Backup signers - Have additional signers available for activation
Communication redundancy - Multiple ways to reach each signer

Emergency Pause Runbook

This is an example runbook. Review and customize it for your protocol before use. Add your specific contract addresses, pause functions, emergency contacts, and communication channels.

Quick Reference

Field	Value
Severity	EMERGENCY
Response Time	<2 hours
Required Threshold	Per multisig config (often lower for emergencies)
Owner	Security Team
Last Updated	[Date]

When to Use

Active exploit detected
Suspicious activity on protocol contracts
Key compromise affecting protocol
Vulnerability disclosure requiring immediate action

Immediate Actions (First 30 Minutes)

1. Alert Team

Send alert to emergency Signal group
Page signers via configured paging system
Notify the security contact

Alert template:

URGENT: [Brief description]
Multisig: [Name]
Action needed: [Pause/Freeze/etc.]
Respond ASAP - <2hr SLA

2. Assess Situation

Confirm threat is real (not false alarm)
Identify affected contracts or assets
Determine which pause function(s) to call
Estimate urgency

3. Prepare Transaction

Proposer (can be any signer or delegated proposer):

Go to Safe or Squads UI
Use Transaction Builder for contract interaction
Select target contract
Select pause() or appropriate emergency function
Create transaction

Signing Process (Streamlined)

Emergency signing follows abbreviated verification.

Minimum Verification

[ ] Correct multisig address
[ ] Correct network
[ ] Target contract is correct (verify address)
[ ] Function is pause() or expected emergency function
[ ] No unexpected additional calls
[ ] Hash matches hardware wallet

Sign and Communicate

Sign immediately after verification
Message: "Signed - [X/Y] - [your name]"
Stay available until executed

Execute

Execute as soon as threshold is reached
Verify pause took effect (check contract state)
Communicate: "EXECUTED - pause confirmed"

If Primary UI is Down

Use backup infrastructure:

EVM:

Eternal Safe
Configure with backup RPC
Load Safe address
Create custom transaction with pause calldata

Solana:

Squads Backup
Configure RPC
Load multisig

See Backup Signing & Infrastructure for detailed instructions.

After Pause

Immediate (Within 1 hour)

Confirm pause is effective
Document incident using Incident Reporting
Notify stakeholders

Short-term (Within 24 hours)

Root cause analysis
Plan for resolution
Draft public communication if needed

Resolution

Fix underlying issue
Test fix thoroughly
Plan unpause procedure
Execute unpause with full verification (not emergency process)

Emergency Drill Procedures

Regular Testing Schedule

Quarterly: Communication system tests
Bi-annually: Emergency paging system tests
Annually: Full emergency simulation with all signers

Drill Components

Notification test - Verify all signers receive alerts
Response time measurement - Track time to threshold signatures
Process verification - Ensure procedures work under pressure
Documentation review - Update procedures based on drill results

Recovery and Post-Incident

Immediate Recovery

Restore operations - Resume normal operations once threat is mitigated
Monitor for issues - Watch for any residual security concerns
Update security measures - Implement additional controls if needed

Post-Incident Analysis

Root cause analysis - Determine how incident occurred
Process improvement - Update procedures to prevent recurrence
Team debriefing - Gather lessons learned from all participants
Documentation updates - Revise emergency procedures based on experience

Communication

Team notification - Inform team when incident is resolved
Stakeholder updates - Notify relevant parties as appropriate
Documentation - Complete incident report for future reference

Emergency Contact Information

Security Team Contact

Email: [Security team email]
Emergency escalation: [24/7 emergency contact if available]
Communication: Use subject line format from emergency notification template

Internal Escalation

Protocol leadership: [Contact information]
Technical team: [Emergency technical contact]
Legal/compliance: [If regulatory notification required]