Avg attacker reconnaissance time for peer-class protocols

Evidence summary #

Bridge class reconnaissance: IoTeX attack planned 6–18 months in advance; Drift (2026) was 6-month social engineering operation; Kelp DAO attacker funded 10 hours before exploit (rapid); Ronin had minimal pre-strike reconnaissance. Bridge class shows high variance (10 hours to 18 months). Wormhole 2022 attacker did not exhibit documented extended reconnaissance — exploit appears opportunistic on vulnerability discovery | Class average: 30–180 days; Wormhole-specific historical: minimal observ...

Sources #

Methodology #

Report the average number of days of attacker reconnaissance activity before a strike on peer-class protocols (lending/DEX/bridge/perps), sourced from the hack database.

See the full factor methodology and distribution across all protocols →