When compromise is suspected, prioritize stopping further loss over attempting immediate recovery of stolen funds. Document the incident timeline, affected addresses, and suspicious transactions before taking disruptive action.
Do not share seed phrases with anyone offering urgent recovery assistance. Disconnect compromised devices from networks, revoke token approvals where possible, and preserve logs and correspondence as evidence.
Initiate a confidential case review to assess scope, forensic options, and hardening priorities. Hasty fund movements without analysis can complicate evidence preservation and tax or legal reporting.
EnteleCLOS does not guarantee recovery of compromised assets; response planning focuses on evidence, containment, and future protection.