Incident response, and your layered plan

Lesson 10 of 10

By the end of this lesson you’ll have the first hour after a theft written down in the order it has to happen, know who to report to and what each of them can and can’t do, and leave with a plan in three tiers that you’ve filled in yourself.

A collage of an old steamship's hull cut open on a black torn sheet, showing its engine room, cabins and cargo holds. One compartment is full of deep blue water, the rooms either side are dry, and small crewmen turn a wheel to shut a heavy door.

Your first hour, in the right order

Scams and How to Stay Safe, lesson 5, gives the first hour for a beginner. At this level the order depends on which route from lesson 1 the thief took, and getting it wrong costs money.

A bar reading First, stop. Sign nothing else. Under the question Which route did the thief take, three branches. Phrase or key out leads to Move first, no gas to that wallet. Signature given leads to What you signed sets the order. Account taken leads to Lock the exchange, then new passwords.

The first hour: your first move on each route.

Phrase or key out: Move first. Never send gas to the compromised wallet.

Signature given: What you signed sets the order. An approval: revoke, then move. An unused permit: move, then revoke. A delegation: reset it to the null address, then move.

Account taken: Lock your exchange account, in its own app or on its site with the address typed in yourself, before you change any password.

In every case, stop. Disconnect the wallet from every site, close the page, and sign nothing else. The person who messages you in the next ten minutes offering help is the thief or someone who watches for victims.

Continue with The Crossover Pro

The rest of this story, plus two paid editions a week. $24.99 a month, or $249 a year. Already a member? Sign in above.

Subscribe to Pro

Incident response, and your layered plan

Your first hour, in the right order

Continue with The Crossover Pro

Keep Reading