# CZB Crypto Incident Response

Canonical HTML: https://czb.com/en/crypto-incident-response.html

CZB incident response helps preserve evidence, triage suspicious activity, review public-chain movements, and prepare escalation materials.

## First-Hour Priorities

- Preserve transaction hashes, addresses, screenshots, domains, platform notices, and event times.
- Separate affected systems from normal operations when safe and authorized.
- Review active approvals, suspicious domains, device exposure, operational accounts, and recent transaction paths.
- Prepare concise escalation material for platforms, internal governance, legal counsel, or compliance teams.

## Outputs

- Incident timeline and evidence index.
- Public-chain tracing summary with confidence notes.
- Approval and suspicious interaction review.
- Escalation package.
- Post-incident remediation plan.

## Boundaries

CZB cannot guarantee third-party platform action, freezing, blocking, enforcement, or asset-return outcomes.