Bitcoin Emergency Kit

⏳ Transaction Not Confirming

Immediate Tools

What's Happening?

Your transaction is in the mempool (waiting area) competing with other transactions for inclusion in a block. Miners prioritize transactions with higher fees.

• Check Transaction Status

  Look up your transaction ID (txid) on a block explorer like mempool.space. This shows if it's been broadcast and its position in the mempool.

• Determine If It's Really Stuck

  Transactions with fees above 1 sat/vB usually confirm within 24-48 hours. If your fee is competitive, just wait.

• Options If Truly Stuck

  Option A - Wait: The mempool eventually clears. Your transaction will either confirm or be dropped (usually after 2 weeks), returning funds to your wallet.

  Option B - Replace-by-Fee (RBF): If you enabled RBF when sending, you can bump the fee. Check your wallet's "advanced" or "transaction details" options.

  Option C - Child-Pays-For-Parent (CPFP): If you're the receiver, you can spend the unconfirmed transaction with a high fee to incentivize miners.

• Prevention for Next Time

  Always check current fee rates before sending. Enable RBF (Replace-by-Fee) in your wallet settings for future flexibility.

Lost Wallet Access

Recovery Decision Tree

• Do you have your seed phrase?

  YES: You can recover! Proceed to Step 2.

  NO: Skip to Step 4 for limited options.

• Restore Using Seed Phrase

  With seed phrase, you can recover in any compatible wallet:

  • Download a reputable wallet (Sparrow, BlueWallet, Electrum)
  • Select "Restore from seed" or "Import wallet"
  • Enter your 12 or 24 words in the correct order
  • Your Bitcoin will reappear once wallet syncs
  ✓ Success: This is why "Not your keys, not your coins" matters. Your seed phrase IS your Bitcoin.

• Forgot Password (But Have Seed Phrase)

  Wallet passwords only protect the app, not the Bitcoin. Simply restore from seed phrase in a new wallet instance and set a new password.

• No Seed Phrase? Limited Options

  Without your seed phrase, options are extremely limited:

  For Custodial Wallets (Exchange, Cash App, etc.):

  • Contact customer support immediately
  • Go through account recovery process (email, 2FA, ID verification)
  • They control the keys, so they can help

  For Self-Custody Wallets:

  • If you have an encrypted backup file + password, you may recover
  • Some wallets save backups to cloud (check iCloud, Google Drive)
  • Check for paper backups in safe places
  • Professional recovery services exist but are expensive and not guaranteed

Prevention

• Multiple backups: Write seed phrase on metal, store in safe deposit box
• Test recovery: Practice restoring with small amounts first
• Inheritance plan: Ensure trusted person can access if you're incapacitated

❌ Sent to Wrong Address

Situation Assessment

• Check Transaction Status

  Look up your transaction on a block explorer. Has it confirmed yet?

  Not confirmed (0 confirmations): There MAY be options. See Step 2.

  Confirmed (1+ confirmations): Transaction is final. See Step 3.

• If Not Yet Confirmed

  Option A - Replace-By-Fee (RBF):

  If you enabled RBF and the transaction hasn't confirmed, you MAY be able to replace it with a transaction sending to the correct address. This requires technical knowledge - consult your wallet documentation or a Bitcoin expert immediately.

  Option B - Double-spend (Advanced):

  If RBF wasn't enabled and fees are very low, some wallets allow creating a competing transaction. Success is not guaranteed and requires technical expertise.

  Time Sensitive: Act within minutes. Once a transaction confirms, these options disappear.

• If Transaction Confirmed

  Outcomes depend on who controls the receiving address:

  • Sent to your own wrong address: If you control it (typo in your own address book), your Bitcoin is safe. Access that wallet.
  • Sent to someone you know: Contact them and politely request they return it. This relies entirely on their honesty.
  • Sent to a stranger/random address: Funds are effectively lost. You can try contacting them if it's an exchange/known entity, but they have no obligation to return it.
  • Sent to invalid/non-existent address: Most wallets won't let you send to invalid addresses. If you somehow did, funds are lost forever.

• Learning Experience

  This is painful, but remember: Bitcoin's irreversibility is a feature, not a bug. It prevents fraud and chargebacks. Moving forward:

  • Always double-check addresses before sending
  • Send small test transactions first
  • Use QR codes instead of typing addresses
  • Save verified addresses in your wallet's address book
  • Be extra careful with large amounts

🏦 Exchange/Service Down

Immediate Actions

• Verify the Outage

  Check multiple sources:

  • Exchange's official Twitter/X account
  • Status page (e.g., status.coinbase.com)
  • DownDetector.com
  • Reddit: r/Bitcoin, r/CryptoCurrency, exchange-specific subreddits

  If many users report issues, it's likely a temporary technical problem.

• Determine Outage Type

  Technical Outage (Common):

  Site down for maintenance, high traffic, or technical issues. Usually resolved in hours. Your funds are safe.

  Security Incident (Rare but Serious):

  Exchange pauses withdrawals due to suspected hack or security breach. Monitor official communications closely.

  Insolvency/Exit Scam (Very Rare):

  Exchange suddenly disappears or announces bankruptcy (e.g., FTX, Mt. Gox). See Step 4.

• What You Can Do While Waiting

  • Document everything: Take screenshots of your balance, transaction history, emails
  • Contact support: File a support ticket (response may be slow during outages)
  • Be patient: Most outages resolve within 24 hours
  • Stay informed: Follow official channels for updates
  • Don't make rash decisions: Avoid panic selling when access returns

• If Exchange Fails/Goes Bankrupt

  Critical Situation: If an exchange becomes insolvent, recovery is uncertain and may take years through bankruptcy proceedings.
  • File a claim in the bankruptcy case (monitor official announcements)
  • Join creditor groups for collective action
  • Report to authorities (SEC, FBI IC3 in US)
  • Consult a lawyer specializing in crypto cases
  • Set realistic expectations - full recovery is rare

Prevention

• Self-custody: Only keep on exchanges what you're actively trading
• Use reputable exchanges: Stick to well-established, regulated platforms
• Diversify: Don't keep all funds on a single platform
• Regular withdrawals: Move long-term holdings to your own wallet

⚠️ Scam Response Checklist

Immediate Actions

• Stop All Contact with Scammer

  Cease all communication immediately. Block phone numbers, emails, social media accounts. Do not engage further.

• Assess What Information Was Compromised

  If you shared your seed phrase or private keys:

  CRITICAL: Your Bitcoin is at immediate risk!

  • Create a NEW wallet immediately (different seed phrase)
  • Transfer ALL Bitcoin from compromised wallet to new wallet as fast as possible
  • You're in a race against the scammer - act within minutes

  If you sent Bitcoin to scammer:

  Transaction is likely irreversible. See "Sent to Wrong Address" section, but set realistic expectations.

  If you gave personal info (but not keys):

  • Change passwords on all related accounts
  • Enable 2FA everywhere possible
  • Monitor for identity theft
  • Consider credit freeze if SSN/ID was shared

• Document Everything

  Gather all evidence:

  • Screenshots of conversations
  • Transaction IDs (txid)
  • Scammer's wallet addresses
  • Website URLs, social media profiles
  • Emails, text messages
  • Any promises or claims made

• Report to Authorities

  United States:

  • IC3.gov - FBI Internet Crime Complaint Center
  • FTC Fraud Report

  United Kingdom:

  • Action Fraud

  Canada:

  • Canadian Anti-Fraud Centre

• Warn Others

  Help prevent others from falling victim:

  • Report scammer's accounts (Twitter, Telegram, etc.)
  • Share experience on r/Bitcoin, r/Scams (without doxxing yourself)
  • Report fake websites to Google Safe Browsing
  • Warn friends/family if it was a social media scam

Common Bitcoin Scams

Transaction Fee Too Low

Quick Tools

Your Options

• Option 1: Wait It Out (Recommended if Not Urgent)

  Timeline: Low-fee transactions typically confirm within 24-72 hours when mempool clears (weekends, low activity periods).

  Pros: Free, no technical knowledge required, usually works

  Cons: Unpredictable timing, could take up to 2 weeks in extreme cases

  Tip: Check mempool.space to see if fees are trending down. Your transaction will confirm when fee market cools.

• Option 2: Replace-By-Fee (RBF)

  When available: If you enabled RBF when sending (check transaction details)

  How it works:

  • Go to your wallet's transaction history
  • Find the unconfirmed transaction
  • Look for "Bump Fee," "Increase Fee," or "RBF" option
  • Select new higher fee rate
  • Broadcast replacement transaction

  Cost: You pay the difference between original and new fee

  ⚠️ Note: Not all wallets support RBF. Popular wallets that do: Electrum, Sparrow, BlueWallet (advanced mode).

• Option 3: Child-Pays-For-Parent (CPFP)

  Who can use: The recipient of the stuck transaction

  How it works:

  • Recipient spends the unconfirmed Bitcoin in a new transaction
  • New transaction includes high fee to incentivize miners
  • Miners must confirm parent (stuck) transaction to get child's high fee
  • Both transactions confirm together

  When to use: If you're receiving payment and need it confirmed urgently, or if sender doesn't have RBF enabled

• Option 4: Transaction Accelerators (Last Resort)

  What they are: Mining pools that prioritize your transaction for a fee

  Options:

  • ViaBTC: Free accelerator (limited slots, resets hourly)
  • BTC.com: Paid acceleration service
  • Mempool Accelerator: Auction-based acceleration
  ⚠️ Caution: Many "accelerator" services are scams. Only use well-known mining pools. Never pay upfront to individuals claiming they can accelerate transactions.

Prevention

• Check fee estimates: Use mempool.space or your wallet's fee estimator before sending
• Enable RBF by default: Gives you flexibility if fees spike
• Don't cheap out on important transactions: The few extra sats are worth peace of mind
• Time your transactions: Send during weekends or low-activity hours for cheaper fees

🔌 Hardware Device Issues

Common Issues & Solutions

• Device Not Recognized by Computer

  Symptoms: Computer doesn't detect device, no response when plugged in, wallet app can't find device

  Solutions (try in order):

  • Check the USB cable: Ensure you're using a DATA-capable USB cable, not just a charging cable. Try a different cable if available.
  • Try different USB ports: Use USB-A ports instead of USB-C if possible. Avoid USB hubs - connect directly to computer.
  • Use Chrome browser: Some hardware wallets (Ledger, Trezor) work best with Chrome or Chromium-based browsers. Close other browsers.
  • Update wallet app: Download the latest version of your wallet software (Ledger Live, Trezor Suite, etc.)
  • Install device drivers: Windows may need specific drivers. Check manufacturer's website for driver downloads.
  • Restart everything: Unplug device, close wallet app, restart computer, then try again.
  • Try different computer: Test on another computer to rule out OS/port issues.
  🍎 Mac Users: Grant USB permissions in System Preferences → Security & Privacy → Privacy tab → Full Disk Access. Add your wallet app.

• Device Won't Turn On / Dead Screen

  Possible Causes:

  • Battery drained: Some devices (Ledger Nano X, Coldcard Mk4) have batteries. Charge for 30+ minutes.
  • Firmware update interrupted: Device may be in bootloader/recovery mode.
  • Physical damage: Screen or internal component failure.

  Solutions:

  • Charge fully: Use manufacturer-provided cable. Leave plugged in for 1 hour.
  • Force restart: Check manufacturer instructions for button combinations (varies by device).
  • Recovery mode: Try entering recovery/bootloader mode and reinstalling firmware.
  • Contact manufacturer: Most have good warranty/replacement programs.
  ✅ Remember: Even if device is completely dead, your Bitcoin is safe! You can restore on a new device using your seed phrase.

• Multisig Wallet or Vault Not Showing/Working

  Symptoms: Can't see your multisig balance, vault doesn't appear in wallet coordinator software, or device shows different account than expected

  Common Cause: The multisig configuration or vault policy hasn't been registered on the hardware device.

  Solutions:

  • Re-register the multisig wallet: In your coordinator software (Sparrow, Nunchuk, Unchained, Casa), look for "Register wallet" or "Import to device" option.
  • Verify on device screen: After registration, the device should display the multisig configuration details (number of keys, cosigner info). Confirm these match your setup.
  • Check derivation path: Ensure your coordinator software is using the correct derivation path that matches your original setup.
  • For vault services (Unchained, Casa, Theya): Contact support to verify your device is properly enrolled in the vault configuration.
  • After firmware updates: Multisig registrations often need to be redone after updating device firmware.
  💡 Note: Registering a wallet on your device is just for convenience and verification. Your Bitcoin is still safe even if the wallet isn't registered - you just won't be able to verify receive addresses or sign transactions until registration is complete.

• Device Frozen / Unresponsive

  Quick fixes:

  • Unplug device and plug back in
  • Force restart using button combinations (varies by model)
  • Update to latest firmware version
  • Factory reset as last resort (only if you have your seed phrase backed up!)

• PIN Locked / Too Many Failed Attempts

  Security Feature: After multiple wrong PIN entries, devices increase wait times or wipe themselves for security.

  If device wiped itself:

  • This is a security feature, not a malfunction
  • Simply restore using your seed phrase
  • Set a new PIN you'll remember (write it down separately from seed)

  If you forgot PIN but have seed phrase:

  • Factory reset the device (instructions on manufacturer website)
  • Restore from seed phrase
  • Create new PIN

• Firmware Update Failed / Stuck

  If update froze mid-process:

  • Don't panic: This is recoverable
  • Don't unplug: Let it finish or timeout naturally
  • Enter recovery mode: Follow manufacturer instructions to reinstall firmware
  • Contact support: They have specific procedures for interrupted updates
  ⚠️ Never Update Firmware Without Seed Phrase Backup! Always verify you have your seed phrase before updating firmware. Rare bugs can require device wipe.

Device-Specific Resources

• Ledger: support.ledger.com
• Trezor: trezor.io/support
• Coldcard: coldcard.com/docs
• Foundation (Passport): docs.foundationdevices.com

👨‍👩‍👧‍👦 Inheritance Emergency

First: Where Was the Bitcoin Stored?

Select the storage method to see specific recovery instructions:

General Inheritance Guidance

📱 Lost 2FA Device

Immediate Steps

• Find Your Backup Codes

  When you first set up 2FA, you should have received backup/recovery codes. Check:

  • Screenshots folder on computer
  • Password manager (may have stored codes)
  • Email (search "backup codes", "recovery codes", "2FA")
  • Printed paper stored with important documents
  • Cloud storage (Google Drive, Dropbox)

  If found: Use these codes to log in, then immediately reconfigure 2FA with your new device.

• Use Alternative Verification Methods

  Many services offer multiple 2FA options:

  • SMS backup: If you set up SMS as backup, use that to receive code
  • Email verification: Some services send codes to email
  • Hardware key: If you registered a YubiKey or similar, use it
  • Biometrics: Some apps allow fingerprint/face ID as alternative

• Contact Customer Support (For Exchanges/Custodial Services)

  Required documentation typically includes:

  • Government-issued photo ID
  • Selfie holding ID and note with date
  • Recent account activity proof
  • Registered email address access

  Platform-specific contact:

  • Coinbase: Submit support ticket through Help Center → "Account Access"
  • Kraken: Open ticket explaining 2FA loss with ID verification
  • Gemini, Binance, others: Look for "Lost 2FA" or "Account Recovery" in support
  Timeline: Account recovery typically takes 24-72 hours for identity verification. Some exchanges enforce a waiting period (7-14 days) as a security measure.

• For Self-Custody Wallets

  Good news: Most self-custody wallets don't require 2FA to access your Bitcoin—only your seed phrase matters.

  If the wallet app itself is 2FA-protected:

  • Uninstall and reinstall the app
  • Restore from seed phrase
  • Set up 2FA again with new device

Prevention for Future

• Always save backup codes: Store in password manager and print physical copy
• Use multiple 2FA methods: Register both authenticator app AND SMS/email backup
• Use authenticator apps that sync: Authy syncs across devices (unlike Google Authenticator)
• Register hardware security key: YubiKey as backup authentication method
• Test recovery process: Try using backup codes before you need them in emergency

🔑 Forgotten Passphrase (25th Word)

Understanding the Passphrase

The BIP39 passphrase (sometimes called "25th word" or "extension word") is an optional extra layer of security. Your 12/24-word seed phrase + passphrase = different wallet. Without the exact passphrase, you cannot access that specific wallet.

• Try Common Variations First

  If you remember part of it or think you know what it might be:

  • Common passwords you typically use
  • Family names, pet names, important dates
  • Variations with capitals, numbers, special characters
  • Check password manager for clues
  Caution: Each wrong passphrase creates a valid but empty wallet. This is intentional—called "plausible deniability." You won't get an error message; you'll just see a zero balance.

• Check for Written Backup

  Search everywhere you might have written it:

  • Separate from seed phrase (many users store them separately for security)
  • Password manager entries
  • Encrypted notes or documents
  • Physical notebook or safe
  • With lawyer, family member, or in safe deposit box

• Professional Recovery Services (Last Resort)

  If you remember partial information about your passphrase, specialized recovery services may help:

  • BTCRecover: Open-source tool for attempting passphrase recovery
  • Dave Bitcoin: Professional recovery service (charges % of recovered funds)
  • Wallet Recovery Services: Another reputable option
  How it works: If you know parts of the passphrase (length, some characters, patterns), they can run specialized software to try combinations. Success depends on how much you remember.
  ⚠️ Security: Only use well-known, reputable services. They should never ask for your full seed phrase directly—they work with you to attempt recovery on your own computer or use secure protocols.

• Accept the Reality

  If you have zero recollection and no clues:

  • The Bitcoin is likely unrecoverable
  • This is by design—the passphrase is meant to be unbreakable
  • Professional services can only help if you remember something
  • Consider it a very expensive lesson about backup importance

Prevention for Future

• Write it down separately: Store passphrase backup in different physical location from seed
• Use memorable but strong phrases: Passphrase from Diceware or memorable sentence
• Test recovery regularly: Practice restoring with seed + passphrase to verify it works
• Consider not using passphrase: For most users, a strong 24-word seed without passphrase is sufficient security
• If you do use passphrase: Create a small "decoy" wallet without passphrase (with small amount) and main wallet with passphrase

💨 Dusting Attack Concern

Understanding the Risk

• Is This Actually a Dusting Attack?

  Signs it might be dust:

  • Very small amount (typically 1-1000 satoshis / $0.01-$1)
  • From an unknown sender
  • No message or reason for the transaction
  • Multiple similar transactions to different addresses

  Other possible explanations:

  • Change from a batched transaction (normal)
  • Test transaction from someone who has your address
  • Promotional giveaway or airdrop
  • Rounding from exchange withdrawal

• What Dusting Attack Does (and Doesn't Do)

  ❌ What it CAN'T do:

  • Cannot steal your Bitcoin - Receiving Bitcoin is always safe
  • Cannot infect your wallet - No malware via blockchain
  • Cannot access your keys - Incoming transactions can't compromise security

  ⚠️ What it CAN do:

  • Track your activity - If you spend the dust with other coins, an attacker can link addresses
  • Deanonymize you - May connect your Bitcoin addresses to your identity
  • Privacy risk only - Not a financial theft risk

• What You Should Do

  Option 1: Do Nothing (Recommended for Most)

  • Simply ignore the dust—don't spend it
  • Modern wallets (Sparrow, Samourai) let you "freeze" or label suspicious UTXOs
  • The dust will just sit there forever—that's fine

  Option 2: Coin Control (For Privacy-Conscious Users)

  • Use coin control features in your wallet (Sparrow, Electrum)
  • Manually select which coins to spend in transactions
  • Never include the dust UTXO in your transactions
  • Mark dust as "do not spend" or "freeze" in wallet

  Option 3: Move to New Wallet (Extreme Privacy)

  • Create new wallet with new seed phrase
  • Send all Bitcoin EXCEPT the dust to new wallet
  • Leave dust behind in old wallet
  • Only necessary if you need maximum privacy
  Don't Panic and Make Mistakes: The worst thing you can do is panic and make rushed transactions that compromise privacy worse. Dust is annoying but not dangerous.

• Check for Other Scams (Cautionary)

  Sometimes dust comes with a scam message encoded in transaction:

  • Check transaction details on block explorer for any messages
  • Ignore any URLs or promises ("claim your reward", "double your Bitcoin")
  • NEVER enter your seed phrase on websites linked in messages
  • These are phishing attempts—the dust itself is bait

Prevention & Best Practices

• Use coin control: Learn to use UTXO management in your wallet
• Don't reuse addresses: Generate new address for each receive
• Privacy-focused wallets: Samourai, Wasabi have built-in dust detection
• CoinJoin/mixing: For advanced users, breaks blockchain analysis
• Separate wallets: Keep different wallets for different purposes (privacy segmentation)

🍴 Fork Confusion

Understanding Forks

• Do I Have Forked Coins?

  You have forked coins if:

  • You held Bitcoin (BTC) in a wallet where you control the keys
  • You held it BEFORE the fork date
  • The wallet address had a balance at the moment of the fork

  Major fork dates to check:

  • Bitcoin Cash (BCH): August 1, 2017
  • Bitcoin SV (BSV): November 15, 2018 (fork of BCH)
  • Bitcoin Gold (BTG): October 24, 2017
  Exchange Users: If your Bitcoin was on an exchange during the fork, the exchange controls whether you get forked coins. Most major exchanges distributed BCH; others were kept by the exchange.

• Should I Claim Forked Coins?

  Pros of claiming:

  • Free money - BCH and BSV have value you can sell
  • Full utilization of your holdings

  Cons/Risks:

  • Effort and complexity - Technical process
  • Security risks - Exposing keys to claim services or malicious wallets
  • Tax implications - May trigger taxable events
  • Small amounts - May not be worth effort if balance was tiny
  Rule of Thumb: If your Bitcoin balance at fork time was significant (>0.1 BTC), claiming is probably worth it. If tiny, may not be worth the hassle and risk.

• Safe Way to Claim Forked Coins

  Critical Security Steps:

  1. FIRST: Move your Bitcoin to new wallet
     • Create new Bitcoin wallet with NEW seed phrase
     • Send ALL Bitcoin from old wallet to new wallet
     • Confirm it arrives (wait for confirmations)
  2. THEN: Use old wallet to claim forks
     • Now it's safe to use old seed phrase for fork claiming
     • If fork wallet is malicious or compromised, only empty wallet exposed
  3. Claim the forked coins:
     • Download official fork wallet (e.g., Electron Cash for BCH)
     • Import old seed phrase into fork wallet
     • Forked coins should appear
     • Send to exchange to sell or keep in fork wallet
  ⚠️ NEVER skip step 1! Always move your Bitcoin FIRST before exposing your seed phrase to fork wallets. Many fake "fork claim" wallets are scams designed to steal your Bitcoin.

• Fork Wallet Resources

  Legitimate fork wallets:

  • Bitcoin Cash (BCH): Electron Cash (electroncash.org)
  • Bitcoin SV (BSV): ElectrumSV (electrumsv.io)
  • Bitcoin Gold (BTG): Official BTG Core wallet

  Alternative: Use exchanges with fork support

  • Some exchanges (Coinbase, Kraken) help with fork claiming
  • Send Bitcoin to exchange AFTER fork date to potentially claim
  • Check exchange's fork support policy first

Tax Implications

⚠️ Clipboard Malware Alert

Immediate Actions

• STOP - Do Not Send Any Bitcoin

  • Cancel any pending transactions
  • Do not attempt any Bitcoin transfers until computer is cleaned
  • The malware is trying to redirect your Bitcoin to attacker's address
  ✅ Good News: You caught it BEFORE sending! That's the most important thing. Your Bitcoin is still safe.

• Confirm the Malware

  Test to verify:

  1. Copy a Bitcoin address
  2. Paste it into a text editor (Notepad, TextEdit)
  3. If the pasted address is different from what you copied = CONFIRMED MALWARE

  What clipboard malware does:

  • Monitors your clipboard for Bitcoin addresses
  • Replaces them with attacker's address
  • Hopes you don't notice before hitting "Send"

• Immediate Security Actions

  Priority 1: Secure Your Bitcoin

  • If you have a hardware wallet: Bitcoin is likely safe (malware can't steal from hardware wallet)
  • If you have software wallet on infected computer: Your seed phrase may be compromised
  Critical: Assume Keylogger Present Clipboard malware often comes bundled with keyloggers. Assume the attacker has recorded everything you've typed, including passwords and potentially seed phrases.

  Priority 2: Move Bitcoin to Safe Wallet (If Needed)

  1. Use a DIFFERENT, CLEAN device (phone, another computer)
  2. Create new wallet with NEW seed phrase on clean device
  3. From infected computer, send Bitcoin to new wallet address
  4. MANUALLY TYPE or SCAN QR code - do not copy/paste addresses!
  5. Triple-check destination address character by character before sending

• Clean Your Computer

  Option 1: Professional Malware Removal

  • Run Malwarebytes (malwarebytes.com) - free version works
  • Run full system scan
  • Remove all detected threats
  • Restart and scan again

  Option 2: Nuclear Option (Recommended)

  • Backup important files (documents, photos) to external drive
  • Do NOT backup executables or programs
  • Completely wipe and reinstall operating system from scratch
  • Reinstall all programs from official sources
  • This ensures complete malware removal

• Change All Passwords

  From a clean device:

  • Change passwords for all exchanges and wallets
  • Change email passwords
  • Enable 2FA everywhere if not already enabled
  • Review recent account activity for unauthorized access
  Never change passwords from infected computer! The keylogger will capture the new passwords too.

How Did This Happen?

Common infection sources:

• Pirated software or "cracks"
• Fake wallet apps from unofficial sources
• Email attachments or malicious links
• Software downloaded from sketchy websites
• Browser extensions from untrusted sources

Prevention for Future

• Always verify addresses: Check first few and last few characters before sending
• Use hardware wallets: Best defense against software-based attacks
• Never copy/paste for large amounts: Type addresses or use QR codes
• Use address book: Save verified addresses in wallet's built-in address book
• Only download from official sources: Verify URLs carefully
• Keep antivirus updated: Real-time protection catches many threats
• Separate Bitcoin computer: Dedicated device for Bitcoin only (advanced)