Curriculum·G205 Monitoring, Alerting, and Response·about 31 min
Detection is the longest clock
By the end of this lesson you can
- →Separate an incident into three clocks: the attacker's preparation, your detection, and your response
- →Explain how a phishing email against one bZx developer's personal machine led to a 55 million dollar loss
- →Compute why detection time usually dominates the loss window and is the clock a defender most controls
- →Decide where to invest to shorten detection rather than assuming an attack begins when funds move
Graduate · enrolled learners
This lesson opens with bZx, 5 November 2021.
- What happened
- bZx is a decentralized lending protocol. Before 5 November 2021 a developer was sent a phishing email carrying a Word document with a malicious macro; opening it ran a script that compromised the developer's personal computer and the mnemonic seed phrase of his personal wallet. That wallet's key, a single externally owned account, controlled the bZx protocol deployments on the Binance Smart Chain and Polygon directly. On 5 November the attacker took control of both deployments within eighteen seconds of each other, drained them, and upgraded the contracts to pull tokens from every wallet that had given them unlimited approvals, up to about 55 million dollars in all by SlowMist's running tally. bZx learned of it from a user report of a negative balance, about two hours after funds began leaving. The Ethereum deployment was not exploited because it was governed by a DAO, not by the stolen key. The attacker's work, the phishing, the malware, the key theft, had been underway before a single token moved, and the defenders' clock did not start until funds were already leaving.
- The decision point
- The bZx loss did not begin when the funds moved; it began with a phishing email, and the interval between that email and anyone noticing was the window in which everything on two chains was lost. Every incident runs on three clocks. The attacker's preparation clock, the recon and the phishing and the waiting, is long and is not yours to control. Your detection clock runs from the first hostile event to the moment you notice, and your response clock from noticing to acting. Detection is usually the longest of the three and the one a defender most controls, because an attack does not announce itself and a defender who assumes it begins when funds move has already conceded the whole preparation. Shortening detection, watching the exposures that precede a drain rather than only the drain, is the highest-leverage move a user or a small team can make.
- Recorded loss
- $55,000,000
What you will be able to answer
- →How did the bZx compromise begin?
- →What are the three clocks in an incident?
- →Which clock dominates, and which do you control?
- →Why did bZx's Ethereum deployment survive?
Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.
It is free. We do not sell the list and there is nothing to buy at the end of it.
Sources and review
- https://web.archive.org/web/20220531230042/https://bzx.network/blog/prelminary-post-mortem
- https://rekt.news/bzx-rekt
- https://ediscoverytoday.com/2023/08/08/ibm-cost-of-a-data-breach-report-2023-cybersecurity-trends/
- https://therecord.media/cost-of-data-breach-reaches-all-time-high-ibm-report
Confidence high·Volatility medium·Reviewed 2026-09-14·Owner unassigned
Contested
bZx's own post-mortem lists the stolen tokens but gives no dollar total; the figure of up to about 55 million dollars across the Binance Smart Chain and Polygon deployments is SlowMist's running tally as reported by Rekt, and exact figures vary with asset prices. The post-mortem describes the phishing email and the compromised developer mnemonic as the root cause, and says the Ethereum deployment was unaffected because it is governed by a DAO; Rekt notes the attacker still sent stolen BZRX to Ethereum and used it there as collateral to borrow other assets, so the Ethereum deployment was not exploited but was used. The timing is the post-mortem's: control taken at 11:07 UTC on 5 November, funds leaving from 11:14 UTC, and bZx alerted by a user report at around 8:30 a.m. Eastern.
The general claim that detection time usually exceeds response time is drawn from IBM's Cost of a Data Breach study, which for 2023 put the mean time to identify a breach at 204 days and the mean time to contain it at 73. Those are organizational data breaches in general, not crypto drains; specific durations vary widely by incident and are not asserted for bZx precisely.