Triage
Confirm incident type, stop further exposure, preserve transaction hashes, and secure remaining assets.
Extra Page 1
1
2
3
4
5
6
Ethereum Recovery Process
A professional recovery process moves from security to evidence, then tracing, reporting, and escalation.
Evidence Index
Organize messages, domains, wallet screenshots, exchange receipts, and timeline notes.
On-chain Mapping
Follow ETH, ERC-20 transfers, smart contract approvals, swaps, bridges, and split wallets.
Attribution Review
Look for exchange deposit patterns, known services, reused scam infrastructure, and related victims.
Case Report
Build a report with a summary, transaction table, address graph, findings, and limitations.
Escalation Plan
Prepare exchange notices, police report material, attorney summary, or internal incident memo.