It's 3am UTC. Someone in your Discord pastes a transaction hash and the message: "did i just get drained??" What happens next is mechanical. A moderator opens the block explorer, scrolls past gas limits and method calls and log topics, decodes the transfer, translates 0xa9059cbb into "this was an ERC20 transfer," cross-references the destination address, then types something like "looks like you swapped on Uniswap, here's the route." The user replies with a follow-up. Maybe the same flow runs five more times. That same conversation will run two hundred times in this channel tonight. The moderator wasn't hired for forensics. The protocol didn't budget for it either. The notification gap The Drift exploit on April 1 ran for about twelve minutes. 31 withdrawal transactions, $285M out the door, and the protocol's first X post telling users to halt deposits arrived after on-chain analytics firms had already flagged the active attack.…