Crypto Hack Incident Response

Blockchain incident response looks different depending on what was hit, so we scope fast around your specific loss.

We trace stolen assets through the chain of addresses, flagging where they hit mixers, bridges, or centralised exchanges that respond to law-enforcement and compliance requests. Reaching a regulated off-ramp is the point where recovery becomes realistic, so identifying that hop quickly is a priority. We also flag when funds have been split across many wallets to muddy the trail, a common tactic, and keep following the significant branches rather than losing them in the noise. Where a transaction crosses a bridge to another chain, we pick the trail back up on the far side.

We assemble transaction hashes, address clusters, timestamps and a written narrative into a report your lawyers, your insurer and the police can actually use. Chainalysis-style clustering and attribution underpin the analysis, presented so a non-technical reader understands where the money went and why we believe so.

An honest word on recovery

Be wary of anyone promising guaranteed recovery of stolen crypto. Most “stolen crypto recovery services” that make that promise are themselves a scam. We do not guarantee funds back, because no honest firm can. What we do is maximise the realistic paths: fast freezes at exchanges, a solid evidence trail, and the reports that let law enforcement and civil action proceed.

We start within minutes of your call: what was taken, from where, and what access the attacker still holds. We identify assets still at risk and the fastest legitimate action to protect them.

We cut the attacker off. That can mean revoking malicious token approvals, rotating keys and moving remaining assets to fresh, secured wallets, locking down the exchange account, and killing the sessions or devices the intruder used to get in.

We find and remove the root cause, whether that was malware stealing clipboard addresses, a phished seed phrase, a leaked API key, or a poisoned dependency in your signing workflow. Moving funds to a new wallet is pointless if the same infostealer is still running on your machine.

We support the recovery effort: freeze requests to exchanges, coordination with your legal team and, where appropriate, law enforcement, and a clean rebuild of the wallet and custody setup so you can operate again safely.

We redesign how keys are stored and transactions are approved so a single mistake cannot drain everything again. For most clients that means hardware or multi-sig custody, strict approval hygiene, and monitoring that alerts on unexpected movement.

We examine the devices, exchange logs, and wallet history to reconstruct the intrusion. Common root causes we find are infostealer malware, a phishing site that captured a seed phrase, a blind-signed drainer transaction, an exposed API key, and account takeover via a compromised email or SIM.

Everything is preserved to a defensible standard: device images, log exports, and on-chain records with hashes and timestamps, handled so the material holds up for insurers, regulators and any court proceedings that follow.

We move you to hardware wallets or multi-signature custody with clear approval rules, so no single compromised device or person can authorise a total loss. Blind-signing is retired in favour of verified, human-checked transactions.

We set up watch alerts on your addresses so an unexpected outflow triggers a warning in seconds, not the next time someone opens the app. For teams, we separate the machines used for signing from everyday browsing and email, where most drainers arrive.

Training the humans

Technology only goes so far when the attack targets people. We run your team through the specific tricks that led to the loss, from fake support agents and lookalike domains to malicious approval prompts, so the next attempt is recognised and refused rather than clicked. Most crypto thefts we investigate hinged on a single human decision made in a hurry, and a short, honest walkthrough of what that looked like does more than any policy document.

If the attacker also accessed customer records, KYC documents or personal data alongside the funds, GDPR notification duties can apply. In many cases that means informing your supervisory authority within 72 hours of becoming aware, and telling affected people if they are at high risk. We help you judge whether the threshold is met and document the decision either way, so a reasonable choice is recorded rather than left to memory.

For regulated firms across Europe, a crypto theft may also carry reporting duties to a financial regulator, and a criminal complaint is usually worth filing to unlock exchange cooperation. We prepare the technical evidence in the format investigators expect and can join calls with your legal counsel so nothing is lost in translation between the on-chain facts and the paperwork.

Containment and the first on-chain trace begin the same day, usually within the first hours. A full tracing and forensic report typically takes a few working days depending on how many hops and how many chains are involved, but freeze requests and protective moves never wait for the report. You get what we know as we learn it.

An unexpected zero balance after opening a wallet app. A withdrawal from an exchange account that was not authorised. A “support agent” who turned out to be a scammer with your recovery phrase. A treasury signer who approved a transaction that was not what it appeared to be. If any of that just happened, act now rather than searching for reassurance that the funds will come back on their own.