Corporate wallet compromise response

Business Crypto Wallet Hacked? Incident Checklist

Stop routine use of the affected wallet, establish who can authorize emergency action, secure unaffected assets through a controlled process, and preserve the transaction, signer, device and approval records. Start tracing any outgoing transfers while legal, security, treasury and compliance teams coordinate the response.

Recoveris helps businesses follow stolen treasury assets and identify opportunities for exchange or issuer action while their security team contains the compromise. Our investigators reconstruct the asset flows and support coordination with service providers, counsel and authorities, giving the incident lead a clearer basis for decisions as the situation develops.

Request a business case review Open the incident checklist ↓

For treasury, security and compliance teamsUpdated 16 September 2026

Corporate incidents where coordination changed the outcome

Case experience

A compromised business wallet can put several teams and service providers under pressure at once. These Recoveris cases show how tracing and coordinated intervention can preserve options while assets are moving.

ASSET FREEZES AND LAUNDERING DISRUPTION

Upbit: response to a USD 35M+ hot-wallet compromise

After tokens were stolen from Upbit’s Solana hot wallet, Recoveris identified likely destination wallets and followed movements across chains and services. Investigators coordinated with exchanges, token issuers, a bridge provider and privacy-service operators.

Parts of the stolen assets were frozen and several laundering routes were disrupted. USD 35M+ describes the incident value, not an amount recovered; the published account does not quantify the total frozen.

For the incident lead: an active trace helped multiple counterparties act on the same developing picture.

USD 1.6M FROZEN, PLUS 1 BTC PRESERVED

Corporate payment fraud followed into crypto

Fraudulent wire transfers totalling approximately USD 40M entered a cross-chain laundering scheme. Recoveris prioritised unspent stablecoins, prepared findings for law enforcement and traced onward transfers through exchange services.

The response secured approximately USD 1.6M in stablecoin freezes and a courtesy freeze of 1 BTC pending formal action. This was payment fraud followed by crypto laundering, rather than a compromise of the company’s wallet keys.

For treasury teams: the initial payment method and the later asset trail both matter when deciding where intervention remains possible.

Read the published corporate case accounts. Sources: Recoveris’s own case narratives. Freezing and preserving assets are separate from returning them. Previous outcomes do not guarantee a result in another incident.

Business crypto wallet incident checklist

Establish authority

Name the incident lead and confirm who can pause payments, rotate access, create a clean wallet, contact providers and approve emergency transactions.

Stop routine activity

Suspend ordinary use of the affected wallet or account. Do not let staff continue testing it, signing transactions or replying to an attacker independently.

Identify the exposure

Distinguish private-key or seed compromise from a malicious approval, compromised signer, exchange login, API key, insider action or payment redirection.

Secure unaffected assets

Use a clean environment, verified destination and the organization's approval process. Check whether the destination or remaining signers depend on the same exposed systems.

Preserve records alongside containment

Capture transaction IDs, balances, pending requests, signer and access logs, device records, messages and alerts where safe. Record each containment action and its authorizer without delaying necessary protection.

Trace and report

Map unauthorized flows, identify service touchpoints and contact custodians, exchanges, insurers and appropriate authorities with supported facts and reference numbers.

Do not improvise treasury movements

Speed matters, but an emergency transfer still needs a verified destination, clean signing path and documented authority. A rushed move can expose the remainder, breach internal controls or make the incident record harder to reconstruct.

Request a business case review

What Recoveris contributes to your wallet incident response

FOLLOW THE LOSS

Reconstruct unauthorised transfers

We follow the asset path across wallets, networks and services, identify material movements and explain the limits of the trace. Your security team investigates and contains the underlying systems or access compromise.

LOCATE INTERVENTION POINTS

Identify parties that may be able to act

We assess supported links to exchanges, custodians and token issuers, together with observable balances. These findings help prioritise engagement while relevant assets may still be reachable.

COORDINATE TECHNICAL INPUT

Support provider and authority engagement

Recoveris supplies investigative findings and supports contact with relevant services and authorities within the agreed scope. Restrictions, disclosure and return decisions remain with those parties and the applicable legal process.

INFORM BUSINESS DECISIONS

Explain the asset position and open questions

The investigation documents the flow of funds, known service touchpoints and uncertainties. Agree which updates and findings the incident lead needs for management, counsel, insurers or other stakeholders.

Evidence to preserve after a corporate wallet compromise

ON-CHAIN

Complete transaction set

Wallet addresses, transaction hashes, networks, token contracts, amounts, timestamps, approvals, bridge activity and observable balances.

ACCESS

Signer and system records

Authentication events, device and endpoint logs, API use, role changes, password resets, remote sessions and security alerts.

AUTHORITY

Corporate approval trail

Treasury instructions, signer decisions, payment requests, policy exceptions and the record of each emergency action taken after discovery.

COMMUNICATIONS

Messages and provider contact

Original emails, chat exports, call notes, domains, tickets, custody records and responses from exchanges, issuers, insurers or authorities.

Preserve source files and create a response log

Screenshots are helpful, but original exports, headers and system logs usually contain more context. Maintain one chronology showing discovery, decisions, evidence collection, outbound notices and every wallet transaction made during containment.

Investigators with financial-crime and exchange experience

Corporate incidents require an understanding of asset movements, service-provider processes and digital evidence. The wider Recoveris team includes the following specialists; assignments depend on the needs of the matter.

Umberto Buonora

Head of Investigations

More than 14 years with Italy’s Guardia di Finanza, including cybercrime leadership. Developed virtual-asset seizure methodology used by Italian law enforcement.

Umberto’s professional profile

Dawid Koperski

Blockchain Investigations Manager

Former Global Investigations Lead at MoonPay, with experience in fraud, risk and compliance. His background includes building compliance frameworks and investigating financial crime.

Dawid’s professional profile

Alessandro Rella

Blockchain Investigations Manager

Digital forensics and open-source intelligence specialist with more than 25 years of experience. Former Guardia di Finanza investigator who worked with prosecutors in Italy.

Alessandro’s professional profile

Give the response a clear owner and an agreed scope

INITIAL BRIEF

Send the incident facts you already have

Identify the organisation and authorised contact, discovery time, affected assets and networks, known transaction hashes and custody model. Explain whether funds are still moving, what containment has occurred and which providers have been contacted. Flag missing records.

RESPONSIBILITIES

Connect investigation with the incident lead

Nominate a contact across security, treasury and legal. Agree who authorises investigative work and external engagement. Containment and system restoration remain with your qualified security responders; counsel determines legal strategy and notification duties.

COMMERCIAL SCOPE

Agree deliverables, timing and fees

Define the assets and starting transactions in scope, priority questions and reporting needs. Recoveris provides a written scope and fee proposal before paid investigation begins. Discuss availability and timing against the incident facts; submitting the form does not establish a response-time commitment.

CONTROLLED DISCLOSURE

Keep one chronology and verified contact routes

Record decisions, containment actions, notices and responses. Agree how sensitive files will be shared, limit access to those who need it and verify external recipients. Counsel should assess regulatory, contractual and insurance notifications before public statements are made.

The response checklist follows general incident-management principles; wallet-specific decisions depend on architecture and the incident. NIST incident-response guidance.

Support for the next stage

Broader support for Business and VASPsExplore ongoing investigation support, Aftercare Protocol and other institutional services once immediate incident priorities are addressed. An individual's wallet was hackedUse the separate victim-facing guide for personal wallet containment and reporting. Understand the recovery processSee how tracing, intervention and legal authority fit together after assets move.

Questions from treasury and incident teams

FAQ

What should a business do first after a crypto wallet is hacked?

Activate the incident process, stop routine use of the affected wallet, identify the compromise type, secure unaffected systems and assets through an approved process, preserve signer and transaction evidence, and notify the relevant custodian, exchange, insurer or authority through verified channels. Avoid improvised transfers that bypass corporate approvals.

Should a company move its remaining crypto immediately?

A controlled transfer may be appropriate when keys, signers or permissions are exposed, but the decision depends on the wallet architecture and incident facts. Use a clean environment, verified destination, required approvals and documented authority. An uncoordinated transfer can destroy evidence, create operational risk or send assets into another compromised setup.

What evidence should be preserved after a corporate wallet compromise?

Preserve wallet addresses, transaction hashes, chain and token details, signer and approval logs, access records, device alerts, API activity, emails and chats, custody records, treasury approvals, relevant policies, and all reports or service-provider responses. Keep original files and record who collected each item and when.

What if only one multisig signer was compromised?

Treat the signer and its surrounding device, credentials and communications as compromised until assessed. Review the signing threshold, remaining signers, pending transactions and administrative permissions. Changes or asset movements should follow the organization's approved governance and be coordinated with qualified security and legal advisers.

Can an exchange reverse a stolen cryptocurrency transaction?

A confirmed blockchain transaction is generally not reversed by an exchange. If traced assets reach a service, the service may be able to preserve account information or restrict activity under its policies and applicable law. Any freeze, disclosure, restraint or return of assets is a separate decision and cannot be guaranteed.

When does a business need blockchain forensics after a wallet hack?

Forensic tracing is useful when assets have left the wallet, the transaction path crosses addresses or networks, service touchpoints must be identified, or the organization needs a documented record for counsel, law enforcement, an insurer, auditors or management. The scope should be agreed with the incident and legal teams.

Corporate incident response

Bring the asset trail into your incident response

Tell us which business assets are affected, when the incident was discovered and who is coordinating the response. Include known transactions and any immediate reporting deadline. Never send seed phrases, private keys, passwords or one-time codes.

Request a business case review

This page provides general information and is not legal, cybersecurity, regulatory or financial advice. Incident actions depend on the wallet design, corporate authority, evidence and applicable law. Recoveris provides blockchain forensic analysis and investigative support. Asset freezes, disclosures and recovery outcomes depend on third-party and legal decisions and are never guaranteed.