Contain the affected signing paths first, then freeze further value movement where the protocol allows it, preserve evidence and move to verified communication. The critical decision is to stop additional authorisation before the attacker completes further transfers or governance changes, because recovery becomes harder once value has been dispersed.
Why the first minutes after a compromise matter most
The immediate priority is to stop the attacker from using the same signing path again. In practice, that means separating the compromised path from any remaining trusted control plane, then deciding whether the protocol can safely freeze movement or whether a broader containment step is needed to avoid further loss.
This is not the moment to optimise for full forensic completeness before action. If the compromise still has live authorisation, every minute increases the chance of additional transfers, governance changes, or destructive actions that make recovery more difficult.
Preserve the timeline as you act: note who observed the event, what was disabled, which permissions were changed, and when custody changed. That record matters because later recovery, claims, and incident review depend on proving exactly when control was lost and re-established.
How to contain value movement without making recovery harder
Containment should focus on the smallest set of signing, approval, or execution paths that can still move value or alter protocol state. If the system supports a pause, freeze, or emergency control, use it only through verified channels and only to the extent needed to block further abuse.
Where a full freeze is not possible, teams should reduce blast radius by revoking exposed approvals, disabling compromised automation, and removing any remaining routes that let the attacker repeat the same action. The goal is to make the compromised path non-functional before the attacker can escalate from theft to persistence.
Teams should also treat communication as part of containment. Use a verified incident channel, confirm decision-makers out of band, and avoid issuing operational instructions through accounts or infrastructure that may already be under attacker influence. A bad message at this stage can extend the compromise rather than end it.
What evidence and follow-up actions matter after the path is blocked
Once the immediate movement path is contained, teams should preserve artefacts that explain the compromise mechanism, not just the financial impact. Relevant evidence includes transaction history, signature material exposure, admin actions, access logs, wallet or bridge configuration changes, and any governance events triggered during the incident.
If the compromise may have exposed reusable secrets, sessions, keys, or delegated permissions, those should be rotated or revoked before normal operations resume. That is especially important when the attacker may have captured credentials that can still authorise new actions even after the visible compromise is closed.
Recovery should be verified, not assumed. A system is not safe simply because the original wallet or bridge is quiet; teams need evidence that the attacker cannot still sign, relay, approve, or replay actions through another path.
Risk and Threat Considerations
A bridge or wallet compromise often turns into a race between containment and attacker follow-on action. The immediate risk is not only theft, but also governance tampering, approval abuse, and the loss of recovery options once value has been routed through multiple hops or wrapped into new assets.
Failure mechanism: The attacker retains live authorisation long enough to execute more transfers, alter control settings, or remove recovery leverage before defenders freeze the path or revoke access.
Impact: Losses compound quickly, evidence becomes harder to interpret, and recovery may require more disruptive steps such as broader freezes, contract-level interventions, or mass credential rotation.
Practitioner Guidance
What to prioritise: Decide first whether the compromise can still authorise new value movement. If yes, containment outranks investigation, because the attacker’s next action is usually more damaging than the ambiguity you lose by pausing forensics.
What to verify: Confirm which signing path, admin role, or approval route is actually compromised before restoring service. Teams often overestimate the safety of a single disabled key and miss a second path that can still trigger state changes.
Decision rule: If the protocol or platform supports an emergency freeze that can be executed through a trusted channel, use it early; if not, narrow the blast radius by revoking the smallest set of permissions that blocks repeat abuse without destroying all recovery options.
Practitioner takeaway: The right first move is to stop further authorisation, not to prove every detail of the intrusion. Once live control is gone, recovery becomes a managed problem; while it remains live, it is an attacker-controlled one.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 27, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org