Racing an attacker to move funds is not something you improvise on the day.
The Block reports that Web3Auth says it frontran hackers by moving $5.6 million out of exposed Keplr wallets. The Record reports that the certificate authority DigiCert disclosed a data breach involving business customer information.
Worth a look in your own system this week: how fast you could actually move or revoke whatever holds value for your users. Then the other half of it, which internal systems are reachable from outside and would happily surface an account nobody on your side created.
I review payment, wallet and account flows for that: where custody sits, and what revocation really does when you press the button on it. What is reachable that should not be gets checked too. Days, not months, with scope and timeline in writing first. Send me a description of how your setup is wired and I will tell you what the review would cover.