The crypto preservation checklist

Preservation comes before identification, before authority, before anything. One wrong action (a reset, an update, a guessed PIN, a photographed recovery sheet) can close the only path to the assets. These are the rules in full.

PDF: Download the one-page first-48-hours checklist.

Do now

• Leave every item exactly as found.
• Note where each item was found, by whom, and when (this becomes the evidence record).
• Keep original packaging, cables and accessories with hardware wallets.
• Keep devices off networks where possible; do not update or charge them.
• Put paper notes, metal plates and documents somewhere safe, dry and private.

Preserve devices and media

• Do not guess PINs, repeated wrong attempts wipe many hardware wallets.
• Do not factory-reset, reinstall or wipe anything.
• Do not photograph, scan or type recovery words anywhere. The only legitimate place it is entered is the official device or wallet software from the official channel that you are certain is genuine, after authority is confirmed.
• Keep working copies of wallet files on the original medium; make a verified copy only under forensically careful conditions.
• Do not open, decrypt or “explore” encrypted files, see encrypted drives and containers.
• An empty battery is not a problem; a wiped device is.

Document, without secrets

• An inventory of what exists: devices, accounts, files, notes, locations.
• A record of who handled what and when (chain of custody).
• Never write seed phrases, private keys or passwords into any document or log.
• Record the classification of each finding: fact, inference or assumption.

What never to do

• Never send secret access material to anyone, not by email, form, message or phone.
• Never enter recovery words into a website, app or “verification” tool. The one legitimate entry is on the official device or in wallet software you have verified yourself, after authority is confirmed.
• Never pay an upfront “unlock” or “release” fee to anyone.
• Never act on pressure: a demand for immediate action is a warning sign, not an official process.
• Never log into the accounts of the person who passed away without established authority.
• Never share the seed phrase to “prove” anything: no official process asks for it.

Why preservation is the whole job at first

The estate’s legal and tax questions can wait a day; the condition of the devices and the security of the secrets cannot. Preservation is not a delay to be rushed through, it is what makes every later step possible. Access to crypto usually requires several components (device, PIN, seed phrase, possibly a passphrase, the right software version), and a single careless action can destroy one irreversibly. The device side is covered in old computer or phone with a wallet.

Verify before any technical work

Before any specialist is involved: confirm the identity of the person or company, confirm what they will do, what they will never ask for, and that authority documents are in place.

If you need to know who can help, in what order, and how to verify anyone you contact, see who can help with inherited crypto.