Custody Incident

Overview

Context and purpose

A custody incident affects the systems, people, keys, records, or legal arrangements used to hold assets. Examples include private-key compromise, unauthorized withdrawal, lost signing access, reconciliation breaks, incorrect address use, insider misuse, or third-party service failure. The initial signal may be ambiguous, so teams must rapidly determine affected assets, wallets, customers, chains, counterparties, and remaining authority. Moving assets defensively can reduce loss but may also destroy evidence or create operational and legal complications. Response plans should define emergency signers, transaction approval, evidence preservation, communications, regulatory assessment, reconciliation, and recovery. Post-incident work includes root-cause remediation, key rotation, control validation, customer treatment, and monitoring for delayed attacker activity. Effective handling of Custody Incident connects detection, triage, preservation, containment, eradication, recovery, communication, regulatory assessment, and lessons learned through one auditable timeline. Custody Incident should distinguish an alert, suspected event, confirmed incident, material impact, and restored service because each state requires different decisions and notifications.

How it works

A custody incident is an event that threatens control, availability or integrity of protected assets or their signing infrastructure. Suspected credential theft, lost backups and unauthorized transfers require different containment paths.

Practical checks and failure points

Preserve logs and chain evidence, isolate compromised systems, communicate carefully and rehearse recovery procedures in advance.

Related concepts

Cold Custody · Asset Custody