Bitcoin Emergency Kit
When something goes wrong, stop. Identify what happened before you make it worse. Do not share seed phrases, private keys, PINs or 2FA codes.
If you are a TBA client: contact your adviser or support before high-risk action in suspected compromise, scams, coercion, or time-critical inheritance.
If you are not a TBA client: use this page to classify the situation. For threats, scams, legal or estate matters, go to the appropriate professionals or authorities first. TBA is not your first port of call.
Never share your seed phrase, private key, signing-device PIN, cloud backup, 2FA code, exchange password or wallet recovery details with anyone.
If someone asks for those details, assume it is a scam. The Bitcoin Adviser will never ask for seed phrases or private keys.
What has happened?
Choose the situation that matches what you know. You do not need to decide how severe it is first.
Lost phone or signer is usually an access or continuity problem. Shared seed phrase or private key is a security emergency, because someone else may now be able to authorise transactions.
I shared or exposed my seed phrase or private key
A security emergency because someone else may now be able to authorise transactions.
Open checklistI may be dealing with a scam
Contact, pressure or unexpected requests often mean social engineering, not a technical fault.
Open checklistI lost a phone, signing device or signer
Usually an access or continuity problem, not evidence that the Bitcoin has been stolen.
Open checklistSomeone has died
Estate access is a legal and process problem first. Rushing devices often makes recovery harder.
Open checklistI am being physically threatened
Personal safety outranks Bitcoin. Funds behind collaborative security cannot usually be moved by one person alone.
Open checklistMy exchange or service is unavailable
Outages and phishing spike together. Official status channels matter more than DMs offering help.
Open checklistMy transaction has not confirmed
Usually low risk. Most delayed transactions are waiting in the mempool, not lost.
Open checklistI sent Bitcoin to the wrong address
Confirmed sends are usually irreversible. Unconfirmed sends may still need fast, careful help.
Open checklistChecklists
Each section starts with the single most important instruction. Open the full checklist only if you need more detail.
I shared or exposed my seed phrase or private key
Treat the affected key or wallet path as compromised. Do not enter the seed anywhere else or attempt an improvised recovery.
Open full checklist
Do this first
- Treat the affected key or wallet path as compromised.
- Do not enter the seed or private key anywhere else.
- Do not attempt an improvised recovery or vault move on your own.
- Do not announce the exposure publicly or in DMs.
What may have happened
Someone may now be able to authorise transactions from that wallet path. The right next step depends on how the Bitcoin is held.
What not to do: type the words into a website or app; follow unsolicited “recovery” help; rush a transfer because someone is pressuring you.
Next steps
- TBA collaborative vault: contact TBA before attempting a move.
- Other multisig: contact the known coordinator or provider through a verified channel.
- Single-sig: qualified help may be time-critical, but the first rule is the same: do not enter the seed anywhere else and do not attempt improvised recovery. Never use unsolicited DMs.
TBA client route
Contact support before attempting a vault move. Stop. Do not initiate another transaction until you have spoken with your adviser. The appropriate next steps depend on your setup. See How signing works.
Non-client route
Seek an independent Bitcoin security professional through a verified channel. Do not use strangers offering recovery help. TBA is not your first port of call for this incident.
Related guide: Bitcoin Scam Protection Guide
I may be dealing with a scam
Stop all contact.
Open full checklist
Do this first
- Stop all contact. Block numbers, emails and accounts.
- Preserve evidence: screenshots, TXIDs, addresses, URLs, messages.
- Classify what was exposed before taking further action.
What may have happened
Someone may have tricked you into sharing information, sending Bitcoin, or installing software. Transition periods from exchange to self-custody are a common target.
What not to do: send more Bitcoin; continue the conversation; install remote access software; enter a seed phrase into any website.
Next steps: classify what was exposed
- Funds already sent: preserve TXIDs and report through official channels for your country.
- Seed phrase or private key exposed: follow the seed exposure checklist.
- Account credentials exposed (exchange password, email, 2FA, wallet PIN, cloud backup): change passwords from a safe device; revoke sessions; contact the official platform support only.
- Remote access installed: disconnect the device from the network; get trusted technical help before using that machine for any wallet or exchange login.
- Personal information only: document it; watch for follow-on phishing; do not over-react into seed exposure behaviour.
TBA client route
Contact support so we can help classify exposure. Do not act alone on a suspected compromise. Do not initiate another transaction until you have spoken with your adviser.
Non-client route
Use your national cybercrime or scam-reporting body and the exchange or wallet’s official support channel. TBA is not your first port of call for scam response.
Related guide: Bitcoin Scam Protection Guide
Someone has died
Stop family members experimenting with devices.
Open full checklist
Do this first
- Stop family members experimenting with devices, PINs or wallets.
- Gather death certificate, will or probate documents, and proof of authority.
- Locate any Estate Plan Protocol or Bitcoin-related documents without guessing PINs.
What may have happened
A beneficiary or executor needs to locate and access Bitcoin. The path depends on how it was stored and whether there is a documented estate plan.
What not to do: guess PINs; reset devices; let multiple family members experiment with wallets.
Next steps
Do not photograph, email or upload any seed phrase or recovery material you find.
| Situation | First route |
|---|---|
| Deceased was a TBA client | Contact TBA with evidence of death and authority documents |
| Another collaborative provider was used | Contact that provider through its verified support channel and obtain legal authority |
| Single-sig self-custody | Preserve devices and documentation; use a controlled, documented recovery process |
| Storage method unknown | Do not reset devices or move files; preserve everything and seek qualified assistance |
TBA client route
If the deceased was a TBA client, contact support with authority documents so we can assess authority and coordinate with the executor. Recovery is not automatic in every case.
Non-client route
Engage a qualified lawyer or executor adviser first. TBA is not your first port of call for inheritance matters unless the deceased was a TBA client.
Related guides: Inherited Bitcoin? Start Here · Bitcoin Executor Support · Estate Planning & Inheritance
I am being physically threatened
Your physical safety comes first. Do what is necessary to reduce immediate harm. Seek safety and contact emergency services before contacting TBA.
If you are in immediate danger, contact emergency services / police now. Bitcoin advice can wait.
Open full checklist
Do this first
- Prioritise personal safety. Comply with physical threats to reduce harm; you are not expected to fight.
- Contact emergency services when you can do so safely.
- After you are safe, contact support and authorities where appropriate.
What may have happened
Someone is using threats to make you access or move Bitcoin. With 2-of-3 collaborative security, your key alone cannot move vault funds.
What not to do: promise you can send everything immediately; reveal recovery shortcuts; explain workarounds that could help an attacker.
Next steps
Once safe, secure accounts and rebuild structure where needed. Some holders use small decoy wallets as an optional personal-safety measure. A decoy wallet is not your core security model.
TBA client route
Contact us after the incident. We are trained to recognise signs of coercion and may refuse suspicious signing requests.
Non-client route
Emergency services / police first. TBA is not your first port of call during an active threat.
Related guide: Physical Attack Preparedness Guide
My exchange or service is unavailable
Verify through official channels.
Open full checklist
Do this first
- Check the exchange official website, app status page, or verified social account.
- Type the URL yourself. Avoid links from DMs or email.
What may have happened
The platform may be in maintenance, under stress, or in a serious incident. Panic withdrawals and phishing spike during outages.
What not to do: share login credentials with anyone offering to “restore access”; click status links from unknown senders.
Next steps
If insolvency is announced, document balances and expect a long process. Only keep on exchanges what you are actively trading.
TBA client route
Contact support if you need help classifying whether this is an outage, phishing attempt, or something that affects a planned vault move.
Non-client route
Use the exchange or wallet’s official support channel only.
Related guide: Collaborative Security
My transaction has not confirmed
Check the TXID before doing anything.
Open full checklist
Do this first
- Look up the TXID on mempool.space.
- If not time-critical, waiting is often reasonable.
What may have happened
Your transaction is waiting in the mempool. Most delayed transactions are not an emergency. Your Bitcoin is usually still controlled by you.
What not to do: pay random “accelerator” services or share keys with anyone claiming they can unstuck a transaction.
Next steps
If timing matters, fee bumping may be possible depending on your wallet and transaction. Detail lives in the tracking guide.
TBA client route
If the transaction relates to a vault or meaningful value, contact support. We can help you verify broadcast status and next steps.
Non-client route
Use a block explorer and your wallet’s official support. Avoid third-party “fix” services.
Related guide: Bitcoin Transaction Tracking Guide
I sent Bitcoin to the wrong address
Check confirmation status on a block explorer before taking further action.
Open full checklist
Do this first
- Check confirmation status on a block explorer.
- Do not send more Bitcoin trying to “reverse” a payment.
What may have happened
Bitcoin transactions cannot be reversed by the network. Recovery depends on whether the payment is still unconfirmed and who controls the destination.
What not to do: send a second payment to “fix” the first; share seed phrases with anyone offering reversal.
Next steps
- If unconfirmed, get expert help quickly; options are limited and not guaranteed.
- If confirmed to an address you do not control, funds are usually not recoverable unless the recipient cooperates.
TBA client route
Contact support promptly with the TXID so we can help you classify confirmation status and realistic options.
Non-client route
Use a block explorer and, if needed, a qualified independent professional. Avoid unsolicited recovery offers.
Related guide: Bitcoin Transaction Tracking Guide
Common questions
Is a stuck Bitcoin transaction an emergency?
Usually no. Most delayed transactions confirm later. Check the TXID, avoid scam accelerators, and use the transaction tracking guide if you need fee options.
What should I do if I shared my seed phrase?
Treat it as a security emergency. Do not enter the words anywhere else or attempt an improvised recovery. See the seed exposure checklist. TBA clients should contact support before attempting a vault move.
Can TBA move my Bitcoin for me?
No. TBA cannot initiate a transaction or move client Bitcoin alone. In collaborative security, only you can start a transaction, and two keys must approve it. We may help classify the incident and route you into a supported process. Do not improvise a vault-company recovery yourself. See How signing works.
What if the deceased was a TBA client?
Contact support with authority documents. See Inherited Bitcoin? Start Here and the inheritance checklist.
Should I use a Bitcoin recovery service?
Be extremely cautious. Many are scams. Legitimate help is rare and expensive. Never share seed phrases. For lost single-sig with no backup, recovery may be impossible.
Keep this page before you need it
Bookmark this page for yourself, your family or your executor. Use your browser’s Print dialog and choose Save as PDF for a one-page triage sheet (classification and prohibitions only; no recovery steps).
The printable sheet is designed for offline use. Check the last-reviewed date so you know when a saved copy may be stale.
Resources & support
TBA can help clients classify the incident, preserve evidence, verify authority, and determine the supported next step. That may include a key refresh or vault migration when appropriate. Do not follow public DIY instructions for using a vault company key. How signing works →
- Continuity
- Security Centre
- Bitcoin Scam Protection Guide
- Inherited Bitcoin? Start Here
- Bitcoin Executor Support
- Physical Attack Preparedness
- Collaborative Security
- Estate Planning & Inheritance
- Transaction Tracking Guide
- Contact · Find your adviser
Reminder: The Bitcoin Adviser will never ask for your seed phrase, private key, signing-device PIN or 2FA code.
If you are unsure, do not act alone.
Last reviewed: 28 July 2026 · Version EK-2026-07