Curriculum·G205 Monitoring, Alerting, and Response·about 31 min
Detection is the longest clock
By the end of this lesson you can
- →Separate an incident into three clocks: the attacker's preparation, your detection, and your response
- →Explain how a phishing email against one bZx developer's personal machine led to a 55 million dollar loss
- →Compute why detection time usually dominates the loss window and is the clock a defender most controls
- →Decide where to invest to shorten detection rather than assuming an attack begins when funds move
Graduate · enrolled learners
This lesson opens with bZx, 5 November 2021.
- What happened
- bZx is a decentralized lending protocol. In November 2021 a developer received a phishing email carrying a malicious document; opening it ran code that compromised the developer's personal computer and stole the mnemonic seed phrase held on it. That seed controlled the private keys to the bZx protocol deployments on the Binance Smart Chain and Polygon, which were not behind a multisig or timelock. With the keys, the attacker drained about 55 million dollars from those deployments. The Ethereum deployment survived because it was governed by a timelock the stolen key could not bypass. The attacker's work, the phishing, the malware, the key theft, had been underway before a single token moved, and the defenders' clock did not start until funds were already leaving.
- The decision point
- The bZx loss did not begin when the funds moved; it began with a phishing email, and the interval between that email and anyone noticing was the window in which everything on two chains was lost. Every incident runs on three clocks. The attacker's preparation clock, the recon and the phishing and the waiting, is long and is not yours to control. Your detection clock runs from the first hostile event to the moment you notice, and your response clock from noticing to acting. Detection is usually the longest of the three and the one a defender most controls, because an attack does not announce itself and a defender who assumes it begins when funds move has already conceded the whole preparation. Shortening detection, watching the exposures that precede a drain rather than only the drain, is the highest-leverage move a user or a small team can make.
- Recorded loss
- $55,000,000
What you will be able to answer
- →How did the bZx compromise begin?
- →What are the three clocks in an incident?
- →Which clock dominates, and which do you control?
- →Why did bZx's Ethereum deployment survive?
Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.
It is free. We do not sell the list and there is nothing to buy at the end of it.
Sources and review
- https://bzx.network/blog/prelminary-post-mortem
- https://rekt.news/bzx-rekt/
- https://www.ibm.com/reports/data-breach
Confidence high·Volatility medium·Reviewed 2026-09-14·Owner unassigned
Contested
The bZx loss is reported at about 55 million dollars across the Binance Smart Chain and Polygon deployments; exact figures vary by source and asset prices. bZx's own postmortem describes the phishing email and the compromised developer mnemonic as the root cause.
The general claim that detection time usually exceeds response time in the loss window is drawn from industry incident-response reporting; specific durations vary widely by incident and are not asserted for bZx precisely.