Compromised Crypto Wallet: A Private Key Incident Runbook
Quick answer. Assume the attacker can sign: in the first 15 minutes, name an incident commander, freeze routine signing, isolate the device and preserve logs. Then move remaining funds to new keys, pause and revoke what the key controls, rotate signers and brief counsel.
Video transcript
A compromised private key is live signing authority in someone else's hands. It keeps that power until you remove it onchain. Transactions are generally irreversible, so minutes matter.
Assume the attacker can sign. Your goal is to stop new signatures, not to find the attacker.
In the first 15 minutes, name an incident commander, freeze routine signing, isolate the suspect device without wiping it, revoke sessions and export logs.
Then contain. Move remaining funds from a clean device to new keys, pause contracts through a separate role, revoke approvals, and bring Safe modules into scope.
Against a sweeper bot, Flashbots may help only when remaining assets exceed one thousand dollars. It cannot recover funds already moved, so treat it as a fallback.
A bare key cannot rotate in place. Add clean signers, remove the suspect one and reset the threshold. Guardian's USDT0 Hedera review noted five owners with a one signature threshold, so fix weak quorum too.
Before returning to production, find the leak. Image isolated devices, trace pipelines and cloud access, and check offchain keys like oracle publishers.
No single reporting deadline applies everywhere. Brief legal and compliance first, and let counsel set each clock.
Read the full runbook and template, then rehearse it. Guardian's Managed Security watches privileged calls and multisig transactions around the clock. Talk to us at guardian.security.
Why Minutes Matter
A compromised private key is live signing authority in someone else's hands. It keeps that power until you remove it onchain.
Ethereum transactions are atomic and generally irreversible, the Ethereum Foundation notes in its Trillion Dollar Security report. A theft cannot be rolled back once it lands. Ethereum Foundation
This runbook is for companies running EOAs, multisigs and offchain signers. Individuals should start with our guide to a drained crypto wallet; Safe owner swaps are detailed in our compromised signer runbook.
The First 15 Minutes
Assume full signing authority until evidence proves otherwise. The goal is to stop new signatures, not to find the attacker.
NIST SP 800-61r3, final since April 2025, is the current NIST incident response guidance. It maps response onto CSF 2.0: containment, eradication and incident notification sit under Respond, and recovery communications under Recover. National Institute of Standards and Technology
The checklist below applies NIST's containment and evidence principles to a key. Run it before anyone debates the cause.
Then scope from the worst case: every balance, role, approval and offchain right the key was ever granted. Narrow it only with evidence.
- Declare the incident and name one incident commander who approves every emergency action.
- Freeze routine signing, deployments and scheduled payouts across every wallet and signing service.
- Isolate the suspect laptop, phone, HSM client or signer service from the network. Do not wipe it.
- Revoke SSO, cloud, API and wallet-provider sessions for the affected person or service.
- Move the war room to a channel the attacker cannot read, and confirm identities by voice or video.
- Export transaction, endpoint and identity logs before retention limits or the attacker remove them.
- Start the timeline: detection time, reporter, suspect key, affected chains and addresses.
- Page the holders of pause, guardian and upgrade roles so they are ready to sign.
Contain: Move, Pause, Revoke
Containment removes what the key can still reach. Work from the largest exposure down.
If funds remain in an exposed EOA, move them from a clean device to addresses made in a new key ceremony.
MetaMask warns against adding accounts to a compromised Secret Recovery Phrase. Generate a completely new phrase instead. MetaMask
A sweeper bot can take gas before a normal rescue lands. MetaMask describes Flashbots bundles in which a clean sponsor account pays gas for the compromised executor.
Flashbots takes requests only at whitehat.flashbots.net, for wallets whose remaining assets exceed $1,000. It cannot recover funds already transferred out. Flashbots
MetaMask reports the recovery team takes 5% to 10% of what it recovers. Treat it as a fallback, not the plan.
If the key holds admin power over contracts, have a separate pause or guardian role halt them. If the suspect key is the pause role, go straight to the governance or upgrade path.
Revoke token allowances, permits and operator approvals the key granted. The Ethereum Foundation report warns that if an approved contract is later compromised, an unlimited approval still in place can drain the funds. Ethereum Foundation
Bring modules into scope. On a Safe, calls through execTransactionFromModule can bypass normal signature checks, Safe's documentation says. Safe
Disable guards, delegates, keepers and bots that sign with the exposed key or act on its behalf, where the design allows.
Rotate Signers and Keys
A bare key cannot rotate in place; its replacement is a new address. Our key rotation guide covers that migration for each key type.
On a Safe, owner and threshold changes are Safe transactions. removeOwner removes an owner and sets a new threshold in one call. Safe
The threshold is the minimum number of owners needed to execute. If suspect signers could reach it alone, move assets to a new Safe rather than race them.
Safe says Safenet flags transactions that change signers, threshold, modules, guard or fallback handler, though removing a module or fallback handler is not flagged. Safe advises stopping and verifying flagged transactions independently; apply that to your own rotation transactions.
Quorum matters as much as fresh hardware. In Guardian's USDT0 Hedera deployment review, finding L-01 (Low, acknowledged) noted that the Safe-like wallet owning the ProxyAdmin had five owners and a one-signature threshold. Guardian
There, one compromised owner could authorize an upgrade. A rotation should fix a weak threshold, not just reissue a device.
- Generate replacement keys on clean hardware, under a witnessed and recorded ceremony.
- Confirm each new address with its holder by voice or video, never through the suspect channel.
- Add the replacement signers, then remove the suspect signer and set the new threshold.
- Choose a threshold that restores the intended quorum and stays achievable with the signers you trust.
- Read the owner set, threshold, modules and guard onchain from a second source before resuming.
- Change cloud, API, CI and deploy credentials that shared a device or vault with the key. National Institute of Standards and Technology
Investigate the Root Cause
Do not return to production until you know how the key leaked. A new key on the same compromised laptop or pipeline is the next incident.
Offchain keys can be as powerful as wallets. In Guardian's Veranta V2 review, finding I-09 (Informational, acknowledged) noted that a compromised publisher key could sign arbitrary price and confidence values. Guardian
Guardian classed it as an operational trust assumption, not a permissionless bug. Keys like it still belong on the incident scope list.
- Image isolated devices before anyone reinstalls or reissues them. National Institute of Standards and Technology
- Trace CI/CD runs, cloud IAM changes, wallet software and dependency updates across the window.
- List every key and role reachable from the compromised system, not only the one that signed.
- Check offchain signing keys too: oracle publishers, relayers, bots and exchange API keys.
- Rebuild affected systems from clean artifacts, then rotate every related credential.
Notify and Report
NIST treats communication with internal and external parties as a high priority during recovery. Decide early who speaks, to whom and with what approval. National Institute of Standards and Technology
No single crypto incident reporting deadline applies everywhere. Clocks depend on licenses, jurisdictions, customers and contracts, so counsel should set them.
Our incident reporting requirements matrix compares DORA, NYDFS, SEC, VARA and MAS clocks side by side.
Record who approved each notice and when it went out. Regulators, auditors and insurers will ask for it.
- Legal and compliance: first, to decide which notice duties apply and when each clock starts.
- Custodians and wallet providers: to flag, restrict or monitor affected accounts.
- Insurers: within the notice terms of each policy.
- Counterparties and customers: through messages counsel has approved.
- Chain analytics providers: to label and track attacker addresses.
- Law enforcement: in each jurisdiction where you, your customers or the funds sit.
Runbook Template
Copy this into your incident plan and fill in names before you need it. Our DeFi incident response plan guide covers roles, contacts and drills around it.
Rehearse the template in a tabletop with the people who hold each role. A first run during a real compromise is too slow.
If nobody watches signing overnight, compare MDR and an incident response retainer before the next incident.
Guardian's Managed Security announcement publishes a 15-minute SLA on Critical alerts, watched around the clock. It does not define when the clock starts or what counts as Critical, so confirm both in the contract. Guardian
| Step | Owner | Evidence to keep | Red flag |
|---|---|---|---|
| Declare | Incident commander | Detection time, reporter, suspect key | Debating the cause before freezing |
| Freeze | Treasury and ops leads | Halted queues, deploys and payouts | A scheduled payout still runs |
| Isolate and preserve | Security engineer | Device images, endpoint and identity logs | A suspect device wiped or reused |
| Move funds | Signers on clean devices | Hashes, new addresses, ceremony record | Gas sent to the exposed address |
| Pause and revoke | Role holders | Pause transactions, revoked approvals | Pause role held by the suspect key |
| Rotate | Trusted signers | Old and new owner sets, threshold | Suspect signers can still reach threshold |
| Root cause | Security lead | Timeline, IAM, CI and dependency changes | New keys issued on old devices |
| Notify | Legal and compliance | Each notice, approver and time sent | Messages sent before counsel review |
| Close | Incident commander | Open risks, owners, review date | Final state never checked onchain |
Frequently Asked Questions
How should an offchain signing key be held after a compromise?
Apart from the systems it serves. In Veranta V2 finding I-09, Guardian recommended keeping the publisher key separate from operator infrastructure, preferably behind quorum signing or an HSM, with backend sanity checks against independent sources before signing. Guardian
Is Flashbots recovery reliable enough to plan around?
No. MetaMask calls its Flashbots steps a general guide that needs significant technical know-how, and suggests redundant endpoints to avoid latency. Flashbots says to deal only with Discord members holding its whitehat, whitehat-associate or serv.eth roles. MetaMask, Flashbots
Our wallets are MPC or HSM based. What changes?
Owner swaps and thresholds become vendor operations, not Safe transactions. Ask your provider now for its emergency freeze, policy change and key replacement steps, who can trigger each, and how long each takes. Then rehearse them.
Related reading
- private key exposed github
- what is web3 mdr
- private key management digital assets
- safe multisig monitoring
- social engineering multisig signers
Sources
- National Institute of Standards and Technology: NIST SP 800-61r3 Incident Response Recommendations
- Safe: Safe removeOwner reference
- Safe: Safe Smart Account concepts
- Safe: What Safenet checks and what results mean
- MetaMask: What to do if you have a sweeper bot on your wallet
- Flashbots: Flashbots Whitehat Hotline
- Ethereum Foundation: Trillion Dollar Security: Security Challenges Overview
- Guardian: Veranta V2 Review, finding I-09
- Guardian: USDT0 Hedera Deployment, finding L-01
- Guardian: Managed Security
- Guardian: Guardian Announces Managed Security
- Guardian: Terms & Disclaimer
Have Someone Watching When a Key Goes Wrong
Guardian's Managed Security monitors privileged calls, ownership changes and multisig transactions around the clock, and verifies each multisig transaction before it is signed.