Estate planning for crypto owners: first steps after a breach

Full transcript

0:10 Hi, I’m Max Dilendorf, a crypto attorney based in New York.

0:14 My law firm has been working in the crypto space since 2017, and since 2019, I have focused specifically on helping victims of cryptocurrency theft recover stolen assets and navigate the legal process. We were among the first to represent individuals whose digital assets were stolen from crypto exchanges, and over the years, we witnessed just how devastating these cyberattacks could be. If your crypto was stolen from a U.S.-based exchange, you’re not alone—and you’re in the right place.

0:53 On this channel, I’ll guide you through the steps you need to take after a theft, based on years of experience and real-world casework. This is Episode 1 of a series designed to help you take immediate action, preserve critical evidence, and begin the recovery process.

1:13 Let’s start with the most important window—the first 24 hours after your crypto is stolen.

1:21 What you do in this timeframe can have a major impact on limiting further damage and improving your chances of recovering your assets. The very first thing you need to do is secure your accounts. [That means changing the passwords for your exchange account, your email, and any connected wallets. Use strong, unique passwords that include a combination of upper- and lowercase letters, numbers, and special characters. Avoid anything you've used before—this is the time to completely reset your digital security.

1:54 Next, enable two-factor authentication, but make sure to use an authenticator app, not SMS-based verification. Text messages can easily be intercepted during a SIM swap attack, which is a common method used by hackers. It’s also important to contact your mobile carrier right away to check whether your phone number was compromised.

2:20 If there’s any sign of unauthorized access, request that your carrier add a security PIN or password to your account to prevent further unauthorized activity.

2:30 Given that your personal data may have been exposed or sold on the dark web, we also recommend freezing your credit reports with all three major credit bureaus—Equifax, Experian, and TransUnion. This helps protect you from identity theft and prevents new accounts from being opened in your name.

2:52 If you still have access to your cryptocurrency exchange account, log in immediately and review all recent activity. Look for unfamiliar logins, changes to account settings, or connected devices you don’t recognize. Revoke access to anything suspicious.

3:12 If your exchange allows you to log out of all active sessions, do it now. Time is critical—every minute matters. In more serious cases, some of our clients choose to hire private cybersecurity firms to scan their computers, phones, and networks for malware or vulnerabilities. This can be a valuable step in identifying how the compromise occurred and preventing it from happening again.

3:40 Additionally, some clients choose to work with blockchain forensic firms to trace where the stolen crypto was sent. That process can be effective in certain cases, but it’s also complex and not without risk—we’ll cover that topic in more detail in upcoming episodes. You should also notify the exchange as soon as possible about the unauthorized activity on your account. Go to the exchange’s official support page and submit a detailed help ticket. Include the date and time of the theft, the amount and type of cryptocurrency stolen, and any wallet addresses or transaction IDs you have.

4:19 Request that your account be frozen immediately to prevent further unauthorized activity.

4:25 Make sure to take screenshots of your submission and save any confirmation emails you receive.

4:32 You’re creating a paper trail, and that documentation is essential if you plan to file a report with law enforcement, hire a forensic team, or initiate arbitration.

4:46 Finally, you need to document everything. Take screenshots of all account activity related to the theft. Save all communications with the exchange, including emails, support tickets, and chat logs.

4:59 Record any wallet addresses your funds were sent to.

5:02 Then, build a timeline of events—when you noticed the theft, what actions you took, and when you took them. Keep everything organized in a secure, password-protected folder, either locally or in the cloud. This file will be critical if you pursue legal recovery later. These actions lay the foundation for everything that follows. Taking the right steps in these early hours can dramatically improve your ability to recover lost funds and hold responsible parties accountable.

5:33 In the next episode, I’ll walk you through how to file an IC3 report with the FBI and explain why it’s an important part of the recovery process—especially if you plan to work with forensic investigators or pursue arbitration. Please subscribe to our channel. And if you need help with your specific case, reach out to a crypto attorney for personalized advice.

5:59 Thanks for watching—and I’ll see you in Episode 2.

A transcript of the recording, so it reads as speech rather than as prose. It explains the law in general terms and is not advice on your own situation, which turns on facts this video cannot know.