Crisis post-mortems from asset managers don't usually go public. KPK's account of the April rsETH exploit does: roles, decisions, where automation stopped and humans took over, and every process change that shipped after. Hypernative is in their monitoring stack.
1/ A month before the rsETH exploit, KPK ran a drill simulating an oracle failure: detection, escalation, decisions under incomplete information, down to building the exit payloads.
On 18 April, a real incident occurred. New article: Inside the War Room.