Account abstraction is a long-term answer, but what should we do if the attack comes earlier than expected?