Contact
How to reach us, by urgency.
If you are in the middle of an incident, skip everything else and email the on-call address. Otherwise pick the channel that matches your need.
Active incident on-call
Funds moving, key exposed, front-end serving malicious code, signer compromised.
Received 24/7. Initial triage within 24 hours; active incidents first.
Vulnerability disclosure
Researcher submitting a vulnerability for coordinated disclosure. PGP-encrypted submissions preferred.
General inquiries
Press, partnerships, speaking, training requests, or constituency questions.
Response within 2 business days.
Coordinating with another CERT
Cross-team incident coordination with national CERTs, vendor PSIRTs, and peer response teams over bilateral channels.
Email us with your team name and PGP key; we coordinate per incident over encrypted channels.
Secure channel
PGP public key.
Encrypt anything sensitive — exploit details, attacker addresses, signer compromise reports. Verify the fingerprint before use.
Fingerprint
5F94 3ED1 1E50 CF31 2128 C493 CCC7 D9EC 9415 723D
-----BEGIN PGP PUBLIC KEY BLOCK----- mDMEasb3PBYJKwYBBAHaRw8BAQdAdI+lHdENWJhUI6BBD2eSiL/YD9BecBRSVnN5 vzaDpGe0RjB4Q0VSVCAoQmxvY2tjaGFpbiBDb21wdXRlciBFbWVyZ2VuY3kgUmVz cG9uc2UgVGVhbSkgPGNlcnRAMHhjZXJ0LmNvbT6ItQQTFgoAXRYhBF+UPtEeUM8x ISjEk8zH2eyUFXI9BQJqxvc8GxSAAAAAAAQADm1hbnUyLDIuNSsxLjEyLDAsMwIb AQUJA8JnAAULCQgHAgIiAgYVCgkICwIEFgIDAQIeBwIXgAAKCRDMx9nslBVyPWDO AQCnIeUICZl+aTUB0khzZgzNx9rFEYDEmHhk7TLtyZtnYAEA2Z92tFWjtcxce3vh qL2ZKxR+f5gmlJV9VqK6OAX7fw24MwRqxvdCFgkrBgEEAdpHDwEBB0BJaeKet7bT XlG9D1GODnr9Qi868sKgVrRPYdz5sFIzJokBEQQYFgoAQhYhBF+UPtEeUM8xISjE k8zH2eyUFXI9BQJqxvdCGxSAAAAAAAQADm1hbnUyLDIuNSsxLjEyLDAsMwIbAgUJ A8JnAACBCRDMx9nslBVyPXYgBBkWCgAdFiEEYKSQVlslxPlBa7bvN71Ntyv5nGsF AmrG90IACgkQN71Ntyv5nGuFmwEA4nb46uHmvRnlUqdzrCfk3C6Pzv73wg69xp1I YJns/VUBAIhH3mI8r51BDW4WAdLqBx8oXAsC8seANSgvZ7fnuYQMPWkBANyJwdwb 8X+uy3CL4wJgL+mliFd20WwnGaZ+gKkc6CMTAQDmqsRuy/mZWT1MOHGAVDG+n1Hn LnI/ad/CvP/o1qZbDbg4BGrG90ISCisGAQQBl1UBBQEBB0AI4KScyxzHmdIKoSKz I0lG5ai+Nw0kg2uxPA4LDOosGgMBCAeImgQYFgoAQhYhBF+UPtEeUM8xISjEk8zH 2eyUFXI9BQJqxvdCGxSAAAAAAAQADm1hbnUyLDIuNSsxLjEyLDAsMwIbDAUJA8Jn AAAKCRDMx9nslBVyPSp6AP9+uO2a37K315EfqHGp7Yl54jCAqFJYhRW+17UsiXtU WgEAx6NU70tvxaj8/l7cPq2mTiQq6d9bv6ZyAlfUrvN9EQ0= =q5/y -----END PGP PUBLIC KEY BLOCK-----
What to include
Give us enough to act.
- What happened, in one sentence (e.g. 'Bridge contract drained').
- Affected chain(s) and contract addresses.
- Transaction hash(es) — at minimum the attacker's first malicious tx.
- Whether funds are still moving and any estimated USD at risk.
- Whether you have already contacted exchanges, the project, or law enforcement.
- How you want to be reached for follow-up (email, Signal, etc.).