Avg attacker reconnaissance time for peer-class protocols

Evidence summary #

Cat 11 static reconnaissance metric. No documented pre-strike reconnaissance activity for any known threat actor against Beefy core contracts. Beefy's historical incident record shows external exploits affecting upstream wrapped protocols (Sonne 2024, Balancer V2 2025) — Beefy was not the reconnaissance target in these events. Beefy's demonstrated defensive-pause monitoring capability (multiple proactive pauses across 5.6 years) indicates active monitoring that would surface USPD-class 78-day reconnaissance indicators. For yield-optimizer protocols, reconnaissance would focus on upstream wrapped protocols, not the vault aggregator layer. Class-average reconnaissance time: 30-78 days based on DeFi incident DB.

Sources #

Methodology #

Report the average number of days of attacker reconnaissance activity before a strike on peer-class protocols (lending/DEX/bridge/perps), sourced from the hack database.

See the full factor methodology and distribution across all protocols →