Video · HNW Cybercrime Defense
Cybercrime Attorney: What to Do After You’re Hacked or Crypto Is Stolen
If your accounts were hacked and your money is gone — especially if that money was crypto — time is critical. The evidence that could identify the attacker is already being deleted. Not by the hacker, but by the companies that hold it.
Dilendorf Law Firm, New York 374 words, transcribed
If your accounts were hacked and your money is gone — especially if that money was crypto — time is critical. The evidence that could identify the attacker is already being deleted. Not by the hacker, but by the companies that hold it.
In this episode, New York attorney Max Dilendorf explains what to do in the first days after a breach to preserve the evidence your case depends on.
He covers how long companies like Google, Apple, Dropbox, and crypto exchanges keep login records, and the five-step preservation protocol to follow before that evidence is gone.
Dilendorf Law Firm represents cybercrime victims in matters involving stolen crypto, data breaches, ransomware attacks, and account takeovers.
Preservation is the one step you fully control — and it has to come first. If you’ve been hacked or your funds were stolen, act quickly. Every hour matters.
Full transcript
0:09 If your accounts were hacked and your money is gone, especially if that money was crypto, the evidence that could identify the attacker is already being deleted.
0:21 Not by the hacker, but by the companies that hold the evidence.
0:25 Google, Apple, Dropbox, LastPass, your exchange.
0:29 All of them keep logging records, IP addresses and device data for a limited time.
0:35 For many, it's around 90 days.
0:38 Some are far shorter. A number of VPN providers keep logs for days or don't keep them at all.
0:44 Same with self-custody crypto wallets. Retention can be as short as seven days.
0:49 No law requires most of these companies to hold anything for you. So when that window closes, the records are gone and so is your evidence. I'm Max Dilendorf. I've been a digital asset lawyer since 2017 and my firm represents cybercrime victims, stolen crypto, data breaches, ransomware attacks and account takeovers. Which is why I'm telling you this now instead of after.
1:16 In the first days, not the first month, first you should export everything that's still under your control. Download your full email and account history before anything gets deleted. Attackers usually delete the phishing email and security alerts from your mailbox on their way out.
1:36 So, an export that you make today may be the only surviving copy of how they got in.
1:41 Second, find the phishing link that you clicked. That domain was registered, hosted and paid for. Every one of those steps left a trace and will be needed for your case investigation. Third, screenshot every security alert and login notification.
1:57 If crypto was taken, save the transaction hashes and the receiving addresses too.
2:02 That blockchain keeps the records permanently.
2:05 But only your own logs showing how the attackers got in.
2:11 Fourth, send written letters requesting companies to preserve evidence.
2:16 Send it to your email provider, cloud storage, password manager, phone carrier, VPN and the exchanges that receive the funds.
2:24 Finally, turn off cloud backup on your authenticator codes. Keep them on device only.
2:31 Law enforcement may take months to request these records. By then many will be gone.
2:36 Preservation is the only step that you fully control. Do it first.
2:40 If this happens to you, reach out. Link is in the description.
A transcript of the recording, so it reads as speech rather than as prose. It explains the law in general terms and is not advice on your own situation, which turns on facts this video cannot know.
Discuss Your Matter
Confidential consultations by appointment.