Your Support Team Shouldn't Need to Read a Block Explorer

It's 3am UTC. Someone in your Discord pastes a transaction hash and the message: "did i just get drained??"

What happens next is mechanical. A moderator opens the block explorer, scrolls past gas limits and method calls and log topics, decodes the transfer, translates 0xa9059cbb into "this was an ERC20 transfer," cross-references the destination address, then types something like "looks like you swapped on Uniswap, here's the route." The user replies with a follow-up. Maybe the same flow runs five more times.

That same conversation will run two hundred times in this channel tonight. The moderator wasn't hired for forensics. The protocol didn't budget for it either.

The notification gap

The Drift exploit on April 1 ran for about twelve minutes. 31 withdrawal transactions drained $285M while the team raced to detect, pause, investigate, and post. The first X post telling users to halt deposits arrived after on-chain analytics firms had already flagged the active attack. Wasabi on April 30 followed the same shape: the attacker started draining at 07:48 UTC, kept going for roughly two hours, and the official acknowledgment showed up afterward.

This isn't anyone's fault. The sequence has to be: detect, pause, investigate, post. Posting first risks broadcasting an exploit before the contract is safe. Pausing first protects the funds. Communication is last because it has to be.

But during that gap, the people who deposited into the protocol have no answer to the question they care about most: is my position safe right now. They get told to "monitor official channels," and the official channel is silent.

The "am I affected?" flood

April 18, Kelp DAO: a forged LayerZero message drained 116,500 rsETH, about $292M. Within hours, nine downstream protocols had paused something. Aave froze rsETH and WETH markets. Around $8.45B fled Aave's pools in the next forty-eight hours. The Aave forum's incident report counted 119 borrower positions at liquidation risk after the dust settled.

Each of those protocols got the same wave. Discord channels filled with the same five questions: am I affected, do I need to do anything, where is my money, can I withdraw, what should I revoke. Same questions, hundreds of times, in parallel across nine protocols. Each answer requires looking at the user's specific position. The volunteer mod can't batch them.

Revoke.cash maintains a permanent page at revoke.cash/exploits called "Check If You're Affected." It exists because every exploit produces this exact flood, and someone built a static site as the least-bad triage tool. The existence of that page is the evidence.

The revoke.cash gap

After Wasabi, the official guidance was to revoke approvals at revoke.cash. Within hours, a phishing account named "Wascbi Profocol" posted a fake revoke link in the same threads where users were asking what to do. Per Blockzeit's coverage, it "apparently misled several people."

Read what the official advice actually asks of a user. Identify which contracts you've approved. Recognize the real protocol's account from the impostor. Open a tool you've probably never used. Sign a transaction whose effects you can't preview. Do all of this fast, while panicking, while scammers are setting up imitation links.

The revoke.cash advice is correct. It's also incomplete in a way that matters. Users following the safety procedure got drained again because the procedure assumed knowledge they didn't have, on the day they could least afford a wrong click.

Where support stops scaling

Protocols have monitoring. Hypernative, Blockaid, Cyvers all detected the recent exploits within seconds. Protocols have docs, audit reports, X accounts, Discord, status pages.

What's missing isn't information. It's the staffing math. A protocol with 50,000 users, three supported chains, and one exploit a quarter has support load that scales with all four variables: user count, chain count, exploit frequency, and the surface area of questions any one user might ask. Discord-shaped support doesn't scale on any of those axes. It doesn't matter how good your moderators are.

Morpho moved its public Discord to read-only on February 1, 2026. Co-founder Merlin Egalite, on record: "Discord is actually full of scammers. people would get phished while actually searching for answers despite heavy monitoring, safeguards, etc." DefiLlama is moving off Discord too. Nifty Gateway co-founder Duncan Cock Foster called Discord moderation "one of the most exhausting processes of his business." The volunteer-mod model is being abandoned by the protocols that built it. Not because it's wrong in spirit. Because the unit economics broke.

What the workflow looks like instead

The piece I've been building is the translation layer. TxDesk (txdesk.io) takes one input, an address or transaction hash, plus a question in plain English. It runs the lookups a moderator would run, against the user's actual on-chain state, and returns the answer in seconds.

What this looks like for a user:

They paste a tx hash and ask "what happened?" Back comes a paragraph: it succeeded, here's the destination, here's the fee, here's the contract method called, this looks like a Uniswap swap.

They ask "will I get liquidated if ETH drops 20%?" Back comes a current health factor, the price each collateral asset has to fall to before liquidation, and a number for either how much debt to repay or collateral to add to get to safety. The user sees the answer to the question they asked, not a dashboard they have to interpret.

They paste a Sui package ID and ask "is this safe?" Back comes a risk level, whether they're on the latest version (the deprecated-version pattern is what bit Scallop), and whether the upgrade authority sits behind a single private key (the pattern that bit Volo). A full security scan runs in 1.7 seconds.

They paste a failed transaction. Back comes one of eight failure categories with two or three concrete fixes, computed from their wallet state, not generic advice.

39 tools across 43+ chains. Every field is tagged with whether the data fully loaded, partially, or didn't load at all. The agent can't invent values. After every recent exploit, the trust failure was as costly as the exploit itself. This part can't be sloppy.

Every exploit in April produced the same support failure. Different attack vector each time, same broken communication on the user side. The fix isn't more moderators, faster Discord triage, or better Twitter posts. It's an answer that runs in seconds, against the user's actual on-chain position, the moment the user asks. Support stopped scaling somewhere around 10,000 users. The fix isn't a bigger team.