Wallet compromise

Investigation

The situation

A wallet owner reports an unexpected outbound transfer. A trace alone cannot explain every cause, so access events and the transaction record need to be considered together.

Records to examine

Collect public addresses, transaction identifiers, relevant timestamps and non-secret records of the incident. Never disclose a seed phrase, private key, password or authentication code.

Investigative work

Confirm the network and transfer sequence, review relevant recipient movements and compare the timing with reported access events. Distinguish on-chain facts from hypotheses about who controlled an address.

Recovery routes to assess

Where a trace suggests a relevant service-provider touchpoint, an evidence package may support a lawful report or request. The provider applies its own procedures. Security remediation should be handled through appropriate trusted channels.

What an investigation can deliver

An evidence-linked transfer map, chronology and explanation of potential next steps and limits.