Securing, Reporting, and Recovering Digital Assets: A Practical Checklist

Technology > Digital Assets and Cryptocurrency | Published 26 July 2026 - Updated 23 August 2026 | UpLaw - uplaw.us

Digital assets punish delay in a way almost nothing else in personal finance does. There is no fraud department that reverses a transfer, no password reset that recovers a lost key, and no deposit insurance that makes you whole when a platform fails. Everything below is either something you do in advance, cheaply, or something you wish you had done.

Work through the sections that apply to you. Anything marked ⚠ is a step where the common instinct is wrong.

---

Section 1 — Establish what you actually hold

☐ List every place value sits. Exchange accounts, hardware devices, software wallets, browser extensions, staking arrangements, lending platforms, and anything held by a third party on your behalf. ☐ For each one, answer a single question: who can move these assets without my involvement? If the answer is anyone other than you, the assets are somebody's liability rather than your property. ☐ Record addresses, not keys, in your inventory. ☐ Note the approximate amount and the acquisition history for each location. ☐ Identify which holdings are long-term and which are trading balances. They call for different custody. ☐ Flag anything you cannot currently access — an old device, a forgotten platform, an exchange that no longer exists. ☐ ⭐ Do this in writing. The most common cause of total loss is that nobody, including the owner's family, knew what existed.

---

Section 2 — Secure self-custodied holdings

☐ Use a hardware device for any material holding. Software wallets on internet-connected machines are for spending money, not savings. ☐ Write the recovery phrase on paper or metal. Never a photograph, a note application, an email, a password manager entry, or a cloud document. ☐ Make two backups and store them in separate physical locations, protected against fire and water. ☐ ⚠ Test recovery on a spare device before you rely on the backup. An untested backup is a hypothesis, and roughly a third of them are wrong — a transcription error, a missed word, a wrong order. ☐ Never enter a recovery phrase anywhere but the wallet software itself. No legitimate support desk, airdrop claim, or validation tool ever needs it. ⚠ This single rule prevents most self-custody theft. ☐ Consider multi-signature or threshold custody for significant holdings, so no single loss or compromise is fatal. ☐ Verify receiving addresses on the hardware device screen, not on the computer, and send a small test transfer first. ☐ Review and revoke outstanding token approvals periodically; an old unlimited approval is a standing permission to drain the wallet. ☐ Use a separate low-value wallet when interacting with unfamiliar applications. ☐ ⚠ Do not discuss holdings publicly or in detail. Physical coercion targeting known holders is documented and increasing.

---

Section 3 — Secure the accounts around the assets

☐ Enable a hardware security key on email, exchanges, and anything linked. Text-message authentication is defeated by carrier-account takeover. ☐ Set a port-out passcode with the mobile carrier, and ask that no changes be permitted without it. ☐ Use a unique password on the email account that receives exchange notifications; that account is the master key to everything. ☐ Turn on withdrawal address allowlisting where the platform offers it, with a delay before new addresses activate. ☐ Turn on withdrawal notifications so an unauthorized transfer is visible immediately. ☐ Check for and remove stale API keys with withdrawal permissions. ☐ Review connected devices and sessions on each account.

---

Section 4 — Diligence a platform before funding it

☐ Read the title paragraph in the terms of service. Does the platform take title to deposited assets, or hold them for you? ⭐ This determines whether you own property or hold an unsecured claim if the platform fails, under 11 U.S.C. § 541. ☐ Read the insolvency paragraph. Silence is not comfort. ☐ Ask whether customer assets are segregated, and whether the answer appears in the terms or only in marketing. ☐ Check registrations and licenses, including money transmitter licensing in your state. ☐ Identify the operating entity and its jurisdiction. An offshore entity with no domestic presence is effectively unreachable. ☐ ⚠ Treat "insured" claims skeptically. Deposit insurance covers bank failure, not platform failure or asset loss. A private crime policy covers what its terms say, on the custodian's behalf. ☐ Understand what "proof of reserves" shows. Assets at a moment — not liabilities, and therefore not solvency. ☐ Keep only what you are trading on the platform. Move the rest to custody you control. ☐ See not your keys, not your coins.

---

Section 5 — Records for tax

☐ Record every acquisition: date, asset, quantity, dollar price, and fees. ☐ Record every disposition, remembering that a disposition includes trading one asset for another, spending, and converting into a dollar-pegged token. All are sales under 26 U.S.C. § 1001. ☐ ⚠ Do not assume anything is deferred. 26 U.S.C. § 1031 is limited to real property; there is no like-kind exchange for these assets. ☐ Label transfers between your own wallets. They are not dispositions, but in raw data they look exactly like sales. ☐ Record receipts — rewards, airdrops, staking income, and compensation — at fair market value when received, as income under 26 U.S.C. § 61. ☐ Choose an identification method and apply it consistently. ☐ Export records from every platform annually, including platforms you have stopped using. ⭐ Exchanges fail, and their records fail with them. ☐ Determine character — capital or ordinary — under 26 U.S.C. § 1221. ☐ Document losses carefully if claiming them under 26 U.S.C. § 165; timing for theft and worthlessness is contested. ☐ Expect information reporting under 26 U.S.C. § 6045 to surface discrepancies between your return and broker filings. ☐ See tax controversy for individuals.

---

Section 6 — Estate and incapacity planning

☐ Create an inventory describing what exists and where, without keys, stored where a fiduciary will find it. ☐ Write access instructions and store them separately and securely. ☐ ⚠ Never put a recovery phrase in a will. A will becomes a public record on probate. ☐ Grant explicit authority over digital assets in the will and in any power of attorney, referencing the state fiduciary access statute. ☐ Consider holding assets in a trust with a successor trustee who knows the arrangement exists. ☐ Consider multi-signature or threshold custody so that death or incapacity of one person is survivable. ☐ Have the conversation. Tell the person who will administer the estate that the assets exist and where the instructions are. ☐ Review after any change in custody, amount, or fiduciary. ☐ See digital assets in estate planning and administration and powers of attorney and advance directives.

---

Section 7 — Before you buy a token or invest in a project

☐ Ask what the return depends on. If it depends on a team's continued effort, you are describing an investment contract under Howey, whatever the token is called. ☐ Read the promotional material as evidence. Projections of appreciation, emphasis on the team's expertise, and roadmap language are exactly the facts the test asks about. ☐ Check whether the offering is registered or exempt. An unregistered offering of a security violates 15 U.S.C. § 77e. ☐ Understand that the antifraud provisions apply regardless — 15 U.S.C. § 77q and 15 U.S.C. § 78j reach misstatements whether or not registration was required. ☐ If the instrument is styled as a note or a loan, apply the parallel analysis in Reves. ☐ Identify who is solvent and reachable. ⭐ A claim against an anonymous overseas promoter is not a remedy; it is an expense. ☐ Check whether leverage or derivatives are involved, which brings the commodities framework at 7 U.S.C. § 1a, 7 U.S.C. § 2, 7 U.S.C. § 6c, and 7 U.S.C. § 9. ☐ Assume you can lose all of it, and size the position accordingly. ☐ See investor rights and securities claims.

---

Section 8 — Recognizing the schemes

Each of these has a recognizable shape. If a situation matches, stop.

☐ The patient relationship. Weeks of warmth, then an introduction to a platform. ⚠ Any investment advice from a romantic contact you have not met in person is the scheme. ☐ The platform that will not release funds. Withdrawal blocked pending a "tax," "fee," or "compliance deposit." ⭐ No legitimate platform requires new deposits to release existing funds. ☐ The recovery service. Contacts you after a loss, promises to trace and recover, requires payment up front. Victim lists circulate; this is usually the same operation. ☐ The support impersonator. Reaches you first, by message or phone, and asks you to "validate" or "sync" your wallet by entering the recovery phrase. ☐ The giveaway. Send assets, receive more back. Never. ☐ The urgent approval. A site asks you to sign a transaction you do not understand, often described as claiming a reward. ☐ The guaranteed return. Fixed percentages on a volatile asset are paid from new deposits until they are not. ☐ The insider tip about a launch. Usually a coordinated exit at your expense. ☐ The address that looks right. Malware substitutes a visually similar address at paste. ⚠ Always verify the full address on the device screen.

---

Section 9 — Emergency: the first forty-eight hours

⭐ Elapsed time is the single largest determinant of whether recovery is possible. Work down this list in order, and do not stop to assign blame.

Hours 0–2 — contain

☐ Stop transacting from the affected device or wallet. ☐ If a key may be exposed, generate a new wallet on a clean device and move remaining assets immediately. ☐ Revoke outstanding token approvals from the compromised address. ☐ Capture every transaction hash, address, timestamp, and amount. ☐ Screenshot everything — chats, the platform interface, promotional pages, support conversations — before it is taken down.

Hours 2–12 — notify the people who can actually act

☐ Notify the exchange the assets departed from, in writing, with hashes; ask it to preserve records and flag the destination. ☐ If a destination exchange is identifiable, notify it and request a freeze. ⭐ This is the realistic recovery path: a regulated intermediary that can hold funds, not the ledger. ☐ Notify the bank behind any fiat funding and ask about recall and fraud claims; timeliness controls the answer. ☐ Reset credentials on email, the carrier account, and every linked account, using a hardware key where available.

Hours 12–48 — report and preserve

☐ File reports with law enforcement and with the securities and financial regulators. ☐ Consult counsel where amounts are material, securities claims are plausible, or a solvent facilitator exists. ☐ Open a loss file: what was held, cost basis, dates, movement, and supporting documents. It serves both recovery and the tax treatment under 26 U.S.C. § 165. ☐ ⚠ Ignore every unsolicited offer of help. Never pay a fee to recover stolen assets. ☐ See responding to fraud, a scam, or financial exploitation and consumer fraud and financial exploitation.

---

Section 10 — If a platform freezes, halts withdrawals, or files

☐ Screenshot your balances and transaction history immediately, before access is restricted. ☐ Download every available statement and export. ☐ Locate and save the terms of service in effect, particularly the title and insolvency paragraphs. ⭐ This document, not the balance display, determines your position. ☐ File a claim in any proceeding, by the bar date. Missing the bar date extinguishes the claim entirely. ☐ Record the valuation date used, since it may differ substantially from the value when you deposited. ☐ Preserve communications with the platform, including promotional statements about safety and segregation. ☐ Do not send additional funds to unlock a withdrawal, under any explanation. ☐ Watch for claim-purchase offers, and evaluate them against the realistic recovery and the delay. ☐ See consumer bankruptcy for how creditor priority actually works, and elder financial exploitation where an older adult is affected.

---

Section 11 — For a business that touches customer value

☐ Map the flow of funds precisely. Who holds value, at what moment, and under what authority? ⭐ If customer value passes through your control, you are probably a money transmitter, whatever the product is called. ☐ Analyze status under 31 U.S.C. § 5312, which defines financial institutions functionally. ☐ Register and build a written anti-money-laundering program meeting 31 U.S.C. § 5318: policies, a designated compliance officer, training, and independent testing. ☐ Implement customer identification and ongoing monitoring. ☐ Establish reporting and recordkeeping consistent with 31 U.S.C. § 5313 and the rules at 31 C.F.R. part 1010. ☐ ⚠ Never structure transactions to avoid reporting, and never assist a customer in doing so. 31 U.S.C. § 5324 makes the avoidance itself the offense, with penalties under 31 U.S.C. § 5321 and 31 U.S.C. § 5322. ☐ Screen customers and counterparties against sanctions lists, with blocking and reporting procedures. ☐ Obtain state money transmitter licenses, jurisdiction by jurisdiction. This is usually the larger burden. ☐ Review marketing against the unfair and deceptive practices standard at 15 U.S.C. § 45, and against the securities-law regulations at 17 C.F.R. part 230 and 17 C.F.R. part 240 where an instrument may be a security. ☐ Write the terms of service honestly, stating who holds title and what happens on insolvency. ☐ Segregate customer assets operationally, and verify the segregation rather than asserting it. ☐ Document key management — multi-signature, hardware modules, recorded ceremonies, and tested recovery. ☐ Build the tax information reporting function under 26 U.S.C. § 6045. ☐ Check enforceability of any arbitration clause against 9 U.S.C. § 2. ☐ ⚠ Do all of this before launch. Retrofitting a compliance program after the first regulatory inquiry costs several times as much and rarely satisfies anyone. ☐ See starting and running a small business and data privacy and security.

---

Section 12 — In litigation, divorce, or judgment enforcement

☐ Ask directly, in writing. Interrogatories and document requests should name wallet addresses, exchange accounts, and complete transaction histories, not merely "cryptocurrency." ☐ Subpoena exchanges. They are reachable, they hold identity records, and they respond to process. ☐ Follow the fiat. Bank transfers to and from exchanges are ordinary, traceable records. ☐ Read tax returns for reported dispositions and for the absence of them. ☐ Ask at the debtor's examination, under oath, and follow with a turnover order. ☐ ⚠ Understand the limit of contempt. It reaches a person who controls a key and refuses; it does not reach a genuinely lost key, and proving which is which is the case. ☐ Address valuation date explicitly in any division or judgment; volatility makes the date worth more than the argument. ☐ Preserve evidence early through a litigation hold covering devices, wallets, and platform accounts. ☐ See civil discovery, judgment enforcement and debtor exemptions, and divorce and dissolution.

---

Section 13 — Annual review

Once a year, in an hour:

☐ Confirm every backup is where you believe it is, and legible. ☐ Test recovery of at least one backup on a spare device. ☐ Update the inventory to reflect new holdings, closed accounts, and moved assets. ☐ Revoke stale token approvals and unused API keys. ☐ Export records from every platform, including dormant ones. ☐ Reconcile the year's transactions and confirm you can substantiate basis. ☐ Confirm the fiduciary named in your documents still knows the assets exist and where the instructions are. ☐ Reassess whether the custody model still fits the amount at stake. ☐ Confirm the estate documents still grant explicit digital-asset authority. ☐ ⭐ Every item above takes minutes. Each one prevents a category of permanent loss.

---

Section 14 — Red flags that justify stopping entirely

☐ Anyone asking for a recovery phrase or private key, for any stated reason. ☐ A request to pay a fee, tax, or deposit in order to withdraw your own funds. ☐ Guaranteed or fixed returns on a volatile asset. ☐ Pressure to act before a deadline you did not set. ☐ An investment introduced by someone you met online and have never met in person. ☐ A platform you cannot find registered anywhere, operated by an entity you cannot identify. ☐ Marketing that emphasizes insurance or safety without naming the insurer or the policy. ☐ An unsolicited offer to recover assets you already lost. ☐ A support representative who contacted you first. ☐ Any instruction to move assets to a "safe" or "validation" wallet.

---

Section 15 — Worked example: a first hour done correctly

Devi wakes to a notification that four transfers left her wallet overnight. She is not sure how. Here is the hour that follows, in order, because the order is the point.

Minute 0. She does not open the wallet software on the affected computer. She uses her phone, on a different network, to look up the wallet address on a block explorer and confirm the transfers are real.

Minute 5. She checks whether anything remains. There is a smaller balance in a second asset at the same address. She treats that as already compromised — because it is, if the key is exposed — and prepares to move it.

Minute 10. On a clean device she generates a new wallet, writes the phrase on paper, and verifies the address on the device screen. She sends a small test transfer, confirms it, and then moves the remainder.

Minute 20. She revokes every outstanding token approval on the compromised address. If the loss came from an approval rather than a key compromise, this closes it.

Minute 25. She copies the four transaction hashes, the destination addresses, the amounts, and the timestamps into a document. She takes screenshots of the block explorer pages.

Minute 30. She traces the destination addresses one hop at a time. Two of them deposit into an address that a block explorer labels as belonging to a large exchange. ⭐ That label is the most valuable thing she will find all day, because an exchange can freeze an account and an address cannot.

Minute 40. She writes to that exchange's compliance address with the hashes, the amounts, the timestamps, and a plain statement that the funds are stolen, requesting a freeze and preservation of records. She writes to her own exchange as well.

Minute 50. She changes her email password and enrolls a hardware security key, then calls her mobile carrier and sets a port-out passcode.

Minute 60. She files a report with law enforcement and with the financial regulator, referencing the same hashes.

Over the following days she learns how the key was exposed — a browser extension installed months earlier, updated into malware. Nothing about that discovery would have changed the first hour, which is why she did not spend the first hour on it.

⚠ Two weeks later she receives a message offering to recover the funds for a fee, from someone who knows the exact amount stolen. She does not reply. Her details reached that person from the people who took the money.

---

Section 16 — Quick reference

Situation	First move	Governing provision
Platform halted withdrawals	Screenshot balances; save the terms	11 U.S.C. § 541
Assets stolen from a wallet	Move what remains; revoke approvals; notify the destination exchange	—
Fraudulent investment platform	Notify the sending exchange and the bank the same day	15 U.S.C. § 78j
Unreported trading history	Reconstruct basis; consider amended returns	26 U.S.C. § 1001
Holder died with self-custody	Search for written instructions; do not experiment on the only backup	—
Business accepting customer value	Analyze money transmission before launch	31 U.S.C. § 5312
Token offering planned	Analyze the transaction under the investment-contract test	15 U.S.C. § 77e
Opposing party hiding assets	Subpoena exchanges; follow the fiat	—

☐ Print this checklist and keep it with the inventory. ⭐ The people who recover are the ones who already knew what to do at two in the morning.

---

Related Documents

• Not Your Keys, Not Your Coins: What the Law Says About Digital Assets
• Digital Assets and Cryptocurrency: A Comprehensive Guide to Custody, Regulation, Fraud, Tax, and Recovery
• The Digital Asset Custody and Fraud Recovery Toolkit