BAC-L3-SEC-112Blockchain security
Incident response and on-chain forensics
What to do in the two hours after a compromise is discovered — and how to reconstruct what happened afterwards.
- Level
- L3 — Infrastructure engineer
- Duration
- 3 h
- Track
- Blockchain security
- Maintainer
- Blockchain Security Engineer
Learning objectives
- 01Carry out the first containment measures
- 02Reconstruct a timeline from on-chain data
- 03Communicate an incident without worsening exposure
Guided lab
Investigate a simulated incident and reconstruct the full transaction timeline.
Independent lab
Write the incident response plan for your own infrastructure.
Security angle
Containment precedes analysis: preserve evidence without letting the attack continue.
Assessment
Reconstructed timeline plus a peer-reviewed response plan.