Recover report and avoid secondary harm

Recovery involves people, legal process, accounts and daily life. Assign one coordinator so the family does not have to repeat the same decisions to many providers.

In the first safe hours

Arrange medical care and a safe place to stay. Establish who is accounted for and who needs support. Contact local police, the insurer or crisis provider where applicable, and the relevant legal and technical responders. Freeze or suspend affected financial access through verified channels where available.

Save original messages and records securely, including the relevant time zone. Do not edit originals, publish accusations or contact suspected offenders to investigate. A police report, provider reference and concise incident timeline help different teams work from the same facts.

The incident evidence pack

• Who reported the event, safe callback information, time and location.
• What happened, distinguishing observed facts from assumptions.
• People, accounts, devices or addresses potentially exposed.
• Relevant transaction hashes, chains, amounts and destination addresses.
• Messages, emails with headers where available, URLs, receipts and booking records.
• Actions already taken, by whom, at what time, and resulting case numbers.

Exclude seeds, private keys, full passwords and unnecessary personal data. Share only with verified recipients who need the information. Use a safe channel and preserve a controlled copy.

During the following days

Review all related accounts and permissions, not only the visibly affected one. Replace compromised recovery paths. Consider whether home, school, staff, signers or future travel plans need changes. Reconcile bank and exchange statements and monitor for identity misuse.

Engage appropriate legal advice on notification, reporting, insurance conditions, employment matters and any disclosure obligations. Do not assume reporting to one provider satisfies every requirement. FBI IC3 can be a relevant additional reporting route for a US connection; it is not an international emergency dispatch service. [S07] [S08]

Protect the person from the aftermath

Offer practical and psychological support, time away from trading and a trusted person to help with administration. Avoid blame, forced retelling or a public post written in the first shock of an incident. Decide what colleagues or clients need to know with professional advice.

Expect recovery scams. A person claiming access to insiders, law enforcement powers or guaranteed on chain recovery should be independently verified. Legitimate tracing is not the same as legal seizure or repayment. [S08]

Close the incident deliberately: document what changed, test the new process with small values or dummy accounts, update the private plan and remove temporary access. Keep a short lesson for this guide only after identities, methods and sensitive locations are safely redacted.