Crypto glossary
Incident post-mortem
An incident post-mortem is the report a protocol, exchange or network publishes after a hack or outage, explaining what happened, why and what will change.
A good post-mortem gives a timeline from detection to resolution, the root cause in technical detail, the amount affected, how users will be made whole and the fixes adopted, such as code changes, new monitoring or revised key management. Many are published on the project's blog or forum within days, sometimes as a preliminary report followed by a fuller version once forensic firms finish their work.
For users, investors and other developers, these documents are among the most useful sources in crypto security. They reveal recurring patterns, such as compromised signers, oracle manipulation or unsafe upgrades, and they show how seriously a team treats responsibility. Auditors and security researchers also cite them to improve checklists and tools.
Read them critically. A post-mortem is written by the party that failed, so it may play down mistakes, blame third parties or present repayment plans more favourably than the details justify. Comparing it with independent analyses from security firms and with on-chain data helps separate facts from messaging. Missing or vague reports after a serious incident are a signal in themselves.
Example
A week after losing funds through a manipulated price feed, a lending protocol publishes a post-mortem detailing the attack transactions, the flawed oracle configuration and a plan to reimburse users from its treasury.