Custody Incident

Overview

A custody incident affects the systems, people, keys, records, or legal arrangements used to hold assets. Examples include private-key compromise, unauthorized withdrawal, lost signing access, reconciliation breaks, incorrect address use, insider misuse, or third-party service failure.

The initial signal may be ambiguous, so teams must rapidly determine affected assets, wallets, customers, chains, counterparties, and remaining authority. Moving assets defensively can reduce loss but may also destroy evidence or create operational and legal complications.

Response plans should define emergency signers, transaction approval, evidence preservation, communications, regulatory assessment, reconciliation, and recovery. Post-incident work includes root-cause remediation, key rotation, control validation, customer treatment, and monitoring for delayed attacker activity.

A custody incident is an event that threatens or causes unauthorized asset movement, loss of access, record errors, or safeguarding failure. Effective handling of Custody Incident connects detection, triage, preservation, containment, eradication, recovery, communication, regulatory assessment, and lessons learned through one auditable timeline. Custody Incident should distinguish an alert, suspected event, confirmed incident, material impact, and restored service because each state requires different decisions and notifications. Custody incidents require rapid asset protection without losing evidence, accountability, reconciliation, communication, or legal and customer obligations.

A production treatment of Custody Incident should test the use of unauthorized asset movement, loss of access, record errors, or safeguarding failure within the relevant asset, decision, or service state. The Custody Incident context record for unauthorized asset movement, loss of access, and record errors should preserve source data, configuration or policy version, responsible actor, exception, and outcome. Review of Custody Incident should determine whether safeguards addressing unauthorized asset movement, loss of access, and record errors changed exposure in practice, not merely whether a document or setting existed.