When something unexpected happens, remembering where to find help and which facts matter can be difficult. Prepare a non-secret incident handover while you are calm. The document should preserve observations, identify verified support routes and list unanswered questions. It should not attempt to diagnose every event or prescribe improvised rescue transactions.
Prepare the contact routes first
List the services and products you actually use, with their official support or reporting routes. Verify those routes independently of an unexpected message. A public transaction hash or a familiar profile picture does not establish that someone contacting you is legitimate support. Keep the date each route was checked so an old link can be reviewed.
Distinguish provider support, relevant official reporting channels and any qualified adviser you already use. These roles are not interchangeable, and a decentralised network may not have a central support desk that can reverse an action. The US Federal Trade Commission’s consumer material describes cryptocurrency fraud and reporting context for US readers; other jurisdictions have their own appropriate channels.
Build a timeline template
Create fields for observed time, time zone, what you saw, where you saw it and the related reference. Keep observations separate from suspected explanations. “The interface displayed an unfamiliar outgoing entry” is an observation. “This proves how the account was compromised” is a conclusion that may require evidence you do not have.
Preserve original messages, URLs and relevant public transaction references where appropriate. Do not include recovery phrases, private keys, passwords or authentication codes. If a screenshot contains sensitive information, do not circulate it casually. The handover should help the appropriate responder understand the facts without creating another exposure through the document itself.
Rehearse a fictional event
Choose a scenario such as an unavailable device or a suspicious message claiming an account problem. Write three fictional timeline entries and identify which official route would be relevant. Do not send the rehearsal to real support, connect a wallet or enter live credentials. The exercise is complete when you can assemble the information and identify gaps.
Ask a second reader, where appropriate, to distinguish the facts from the assumptions in the rehearsal. If they cannot tell which parts are observed and which are guesses, revise the labels. A short, well-structured account is more useful than a long narrative that mixes timestamps, interpretations and instructions from unknown people.
Give open questions an owner
Record what remains unknown and who should review it through an appropriate route. An unfamiliar transaction, a lost device and a service login issue can require different product-specific responses. The template should not apply the same recovery instruction to every case. It should make the relevant context available to someone qualified to assess it.
Close the rehearsal with changes to the plan, such as replacing an outdated support link or adding a missing time-zone field. If an actual incident occurs, avoid unsolicited offers promising recovery in return for money, secrets or remote access. This preparation kit does not recover funds or guarantee an outcome. Its purpose is to reduce confusion in the handover: the original observations remain intact, the support route is independently identified, and unanswered questions are visible instead of being disguised as a confident diagnosis.
Crypto Incident Preparation Kit helps you organise your own notes in this browser. Keep credentials and recovery material out of your project.