Lesson 8 — Incident response: the first 60 minutes

Recognise compromise early. The indicators that matter: outbound transactions on a wallet you did not sign for; unexpected login alerts from exchanges; sudden loss of cellular service (SIM swap signal); password-reset emails you did not request; password-reset emails you cannot read because the inbox now has rules forwarding them somewhere; new browser extensions you did not install; new SSH keys, new email forwarding rules, new browser sync devices. Check all of these the moment something feels off. Most compromises announce themselves through at least one of these signals minutes or hours before the loss completes.

Triage in this order: stop the bleeding, then preserve evidence, then report. Stop-the-bleeding means immediate revocation of approvals (revoke.cash from a clean device), moving any remaining funds in compromised wallets to a known-clean wallet on a known-clean device, changing email passwords from a known-clean device, locking exchange accounts, and contacting your mobile carrier to suspend the SIM that may have been swapped. Order matters — every second of delay is more value drained. Do not log into a potentially-compromised wallet on a potentially-compromised device to 'check what happened.' Use a clean phone or laptop.

Preserve evidence before it decays. Screenshots of every relevant page, every transaction hash, every email or DM the attacker sent, every URL of any site you interacted with in the relevant window, every wallet address involved, exact timestamps. Save them to a folder on a device that is not the compromised one. This evidence is what law-enforcement reports, exchange-fraud desks, and blockchain-analytics firms (if you later engage one through proper channels) will work from. Scammers also delete their accounts and domains within hours of detection — capture now or lose forever.

Report through the right channels. In the US: file with the FBI IC3 (ic3.gov), report to the FTC (reportfraud.ftc.gov), and contact your exchange's fraud department directly via the official site (never an emailed link). In the UK: Action Fraud (actionfraud.police.uk) and your bank if any fiat moved. In the EU: your national police's cybercrime unit and, depending on jurisdiction, the relevant data-protection authority if personal data was involved. Add any malicious addresses to Chainabuse (chainabuse.com) — the community database. None of these channels guarantee recovery; they are the entries on the record that may eventually let funds be traced or future similar attacks blocked.

Within hours of any public crypto incident, you will be contacted by 'recovery experts,' 'ethical hackers,' 'crypto lawyers,' and 'IRS specialists' offering to recover your funds for an upfront fee. They are a second scam — specifically, an entire ecosystem of operators who watch for victim-disclosure posts and engage immediately. There is no legitimate service that recovers stolen crypto for a fee. Real recovery, when it happens, happens through law enforcement seizing funds at off-ramps after attackers eventually try to cash out, sometimes months or years later. Anyone offering to recover funds within days or weeks for a payment is selling you a second loss. Block, do not engage, do not pay.