The First 72 Hours After a Digital-Asset Loss

You discover that bitcoin has left your wallet without authorization.

The instinct is to act immediately.

Reset the device. Update the firmware. Change every password. Call the manufacturer. Start tracing the funds. Find someone who says they can recover them.

Some of those steps may be appropriate.

But after a significant digital-asset loss, acting quickly and acting correctly are not always the same thing.

The first 72 hours can determine whether remaining assets are protected, critical evidence survives, stolen assets can be traced, insurance rights are preserved, and a future legal claim can be proven.

Protect what remains. Preserve what happened. Then investigate.

First 72-Hour Response Guide

On smaller screens, swipe the table horizontally to view all columns.

Never disclose a seed phrase, private key, or wallet password to someone merely because they claim they can investigate or recover digital assets.

First, determine what happened

Not every missing digital asset presents the same problem.

An unauthorized transaction may require tracing and investigation. A lost seed or passphrase may be an access problem rather than a theft. A custody dispute involving a trustee, employee, business partner, family member, or custodian may principally involve ownership, contractual, fiduciary, corporate, probate, or trust law.

A mistaken transfer presents different options from an unauthorized transaction. A suspected hardware or software failure may require preserving the product and its configuration before anything is changed.

And sometimes the cause is simply unknown.

In that situation, resist the pressure to immediately choose an explanation.

Preserve first. Let the evidence determine what happened.

The first hour: Protect assets without destroying evidence

If additional assets may still be exposed, securing them may be urgent.

But do not automatically reset the affected wallet, update its firmware, or discard the device.

Ask instead: How can we protect what remains without unnecessarily altering evidence of what happened?

If an independently verified custody environment is available, remaining assets may need to be moved there. At the same time, the affected device and its configuration may need to remain intact.

The Coldcard incident illustrates the distinction. Coinkite advised users of affected configurations to install fixed firmware, generate a completely new seed, verify the new wallet, and transfer funds rather than assume a firmware update would repair an already-generated affected seed.^[3]

Fixing a vulnerability and preserving evidence of it are different objectives.

Before altering a potentially relevant device, consider documenting:

• make, model, and serial number;
• firmware version;
• wallet configuration;
• connected storage or accessories;
• physical condition; and
• date and time of documentation.

Preserve photographs and screenshots where useful. For a material loss, consider whether a qualified forensic professional should examine the device before it is changed. NIST describes digital forensics as identifying, collecting, examining, and analyzing data while preserving its integrity and maintaining chain of custody.^[4]

Preserve the transaction record—and the evidence around it

Bitcoin provides a persistent public record of transactions.

Preserve:

• originating and destination addresses;
• transaction IDs or hashes;
• amounts;
• dates and times;
• subsequent known transfers; and
• any existing blockchain analysis.

This is consistent with FBI Internet Crime Complaint Center guidance identifying cryptocurrency addresses, transaction hashes, amounts, asset types, dates, and times as important information when reporting suspected cryptocurrency crime.^[1]

The blockchain may establish where the assets moved. It usually cannot establish how someone obtained the ability to move them.

For that, preserve the surrounding evidence:

• hardware and packaging;
• purchase and shipping records;
• firmware information;
• wallet software and relevant logs;
• emails and messages;
• manufacturer or custodian communications;
• contracts and terms of service;
• internal policies; and
• applicable insurance policies.

Also create a chronology while memories are fresh. Record how the wallet was created, who potentially had access, when it was last known to be secure, when the transaction occurred, when it was discovered, and what happened afterward.

Separate facts from assumptions. If something is unknown, say so.

The first 24 hours: Assemble the right team

A significant digital-asset incident may require several disciplines.

Technical professionals can examine devices and systems, reconstruct events, and trace transactions. Legal counsel has a different role.

Depending on the circumstances, counsel may:

• coordinate the legal investigation;
• identify evidence requiring preservation;
• retain appropriate forensic and blockchain experts;
• analyze potential claims against manufacturers, custodians, vendors, employees, fiduciaries, or others;
• review contracts, warranties, disclaimers, and limitations of liability;
• evaluate insurance and notice requirements;
• address preservation obligations;
• coordinate appropriate law-enforcement reporting;
• pursue subpoenas or discovery; and
• evaluate emergency remedies to identify or preserve assets.

For businesses and family offices, early involvement of counsel can also help structure an investigation with applicable attorney-client privilege and work-product considerations in mind.

Privilege is not automatic. Simply copying a lawyer on an email does not make a communication privileged.

If an insider may be involved

Be particularly careful before confronting a suspected employee, adviser, trustee, family member, or other insider.

Premature confrontation may provide an opportunity to delete communications, alter devices, remove logs, or move additional assets.

That does not mean the person should be presumed responsible. It means evidence should generally come before conclusions.

Review insurance early

Potential coverage may exist under cyber, crime, computer-fraud, fidelity, professional-liability, or specialized digital-asset policies.

Those policies may contain notice requirements, approved-vendor provisions, cooperation obligations, exclusions, sublimits, or restrictions on expenses incurred without insurer consent.

Review potential coverage before substantial investigation and recovery costs accumulate. Avoid declaring a definitive cause of loss before the investigation supports it.

Within 72 hours: Evaluate recovery options

“Recovery” does not necessarily mean only recovering the original bitcoin.

Depending on the facts, several avenues may exist:

• Asset recovery: tracing and attempting to recover the bitcoin or identifiable proceeds.
• Civil recovery: pursuing damages against a legally responsible manufacturer, custodian, vendor, employee, fiduciary, adviser, or other party.
• Insurance recovery: seeking available policy benefits.
• Criminal restitution: potentially obtaining restitution through criminal proceedings.
• Equitable relief: seeking appropriate judicial remedies directed at identifiable assets or proceeds.

A significant matter may involve more than one avenue at the same time.

Consider law enforcement and tracing

Where theft, fraud, or unauthorized access is suspected, prompt reporting should be considered. The FBI encourages victims of cryptocurrency-related crime to report through IC3 and provide detailed transaction information.^[1]

Not every digital-asset dispute belongs with law enforcement. A warranty dispute or disagreement over legal control may be primarily civil. But suspected criminal activity presents different considerations.

Blockchain tracing may identify movement through a centralized exchange or another identifiable intermediary. That can create opportunities to evaluate preservation requests, subpoenas, expedited discovery, injunctive relief, attachment, or coordination with law enforcement.

It does not mean an exchange will freeze assets merely because a victim or attorney asks. The available process depends on the facts, jurisdiction, intermediary, and applicable law.

Speed nevertheless matters. Options available while assets remain connected to an identifiable intermediary may change after they move again.

Beware of “recovery” scams

Someone who has already lost cryptocurrency can become an attractive target for a second fraud.

The FBI has warned about fraudulent cryptocurrency-recovery schemes, including purported recovery companies and fictitious law firms.^[2]

A professional-looking website, technical terminology, or promise of recovery does not establish legitimacy.

Never provide a seed phrase or private key because someone claims it is necessary to trace stolen assets. Blockchain analysis does not require surrendering control of your wallet.

When should you call a lawyer?

Not every mistaken transaction requires a litigation team.

Prompt legal advice becomes more important when:

• the loss is material;
• additional assets remain exposed;
• the assets belong to a business, trust, estate, or family office;
• a manufacturer, custodian, employee, fiduciary, adviser, or other party may be responsible;
• insurance may apply;
• assets have been traced to an identifiable intermediary;
• ownership or authority is disputed;
• multiple jurisdictions are involved; or
• litigation appears reasonably likely.

Early consultation does not necessarily mean filing a lawsuit. Often, the objective is simply to preserve options before they disappear.

What to bring to an initial legal consultation

If available, gather:

• wallet manufacturer and model;
• serial number and firmware information;
• purchase records;
• transaction hashes;
• originating and destination addresses;
• amount transferred;
• screenshots;
• relevant communications;
• contracts and terms of service;
• insurance policies;
• identities of people with potential access;
• a chronology of events; and
• any forensic or blockchain analysis already performed.

Do not send your seed phrase, private key, wallet password, or similar credentials to obtain an initial legal evaluation.

First 72 hours: Quick checklist

• Preserve the affected device.
• Document its firmware and configuration.
• Preserve wallet addresses and transaction hashes.
• Save relevant communications, contracts, and logs.
• Create an incident timeline.
• Identify everyone with potential access.
• Secure remaining assets appropriately.
• Review insurance and notice requirements.
• Consider evidence-preservation obligations.
• Engage qualified forensic or blockchain professionals where warranted.
• Evaluate law-enforcement reporting if criminal activity is suspected.
• Avoid premature accusations and conclusions.
• Be skeptical of unsolicited recovery services.
• Never disclose your seed phrase or private key.

Practice insight

After a significant loss, the understandable questions are: Who did this? Can we recover the assets? Who is responsible? Can we sue?

Those questions matter.

But during the first few days, another may be more important:

What do we need to preserve today so we can answer those questions tomorrow?

The blockchain transaction may remain visible indefinitely. The device configuration, firmware, communications, logs, witness memories, contracts, and surrounding evidence may not.

That is why the legal response to a significant digital-asset incident should begin alongside the technical response—not months later.

Final thoughts

The first 72 hours are about coordinating four objectives: protect the assets, preserve the evidence, determine what happened, and evaluate recovery.

The appropriate response depends on the circumstances. But one principle applies broadly:

Move quickly. Don’t move blindly.

The decisions made immediately after a significant digital-asset loss may determine whether the owner can later identify what happened, establish responsibility, pursue available remedies, and potentially recover what was lost.

Attorney Advertising. This article is provided for general informational purposes only and does not constitute legal, cybersecurity, financial, tax, or other professional advice. Reading or responding to this article does not create an attorney-client relationship. Every matter depends on its particular facts, governing contracts and documents, jurisdiction, and applicable law.