Blockchain & Crypto

What lives on chain is transaction and state data, which can be resynced from the network — but most of what actually runs the business does not live there. What becomes unrecoverable after encryption is typically KYC records and ID images, user and ticketing systems, risk rules and models, matching and deposit/withdrawal ledgers, internal approval and reconciliation records, and the index databases built for query performance.

An index database can in principle be rebuilt from chain data, but a full archive resync is expensive. In practice we plan it as "rebuildable but slow", keep a snapshot that imports quickly, and spend the offline and immutable backup budget on the off-chain data that has no second source.

Treat them as potentially exposed until forensics says otherwise. We check whether tooling was dropped on the signing hosts, whether script injection or clipboard substitution is present, the access times on key backups and seed files, HSM and multisig operation logs, and whether every on-chain transfer maps to an internal approval.

Wherever an access or transfer cannot be explained, rotate keys, replace multisig signers and migrate funds per the plan rather than waiting for recovery to finish. An attacker's assurance that they "only encrypted files and did not touch the wallets" has no evidentiary value and cannot be used as a basis for that judgement.

Move the exfiltration assessment to the front of the engagement rather than waiting for systems to come back. Forensics establishes whether data left, which fields were involved and how many people are affected — from anomalous egress traffic and destinations, staged archives, object storage and external transfer records, and bulk export or search behaviour on accounts — and states the basis and confidence.

That conclusion drives the content of regulatory reporting and the scope of user notification. In parallel, note that once ID images, addresses and phone numbers are exposed, the most common follow-on harm is not the data itself but impersonation scams aimed at your users; public cases show these follow closely, so user warnings and support scripts should be prepared at the same time.

Technically easy, and for exactly that reason riskier — and we do not make payments or negotiate on a client's behalf. For a licensed or regulated crypto business, transferring funds to an extortion crew runs straight into sanctions screening and anti-money-laundering duties. Where US business, US dollar clearing or a US-connected party is involved, the US Treasury's OFAC advisory on potential sanctions risks for facilitating ransomware payments, updated in 2021, identifies such payments as a sanctions risk and applies strict liability, so liability can attach even without knowledge, and some ransomware brands have links to sanctioned entities. Whether and how far that applies to a given business is a question for counsel in its own jurisdiction. The transfer also stays on chain as a durable, searchable record.

It is a poor trade on results too. Chainalysis's 2026 report puts the share of victims paying in 2025 at about 28%, meaning most organisations completed recovery through backups and incident response. Payment neither retrieves KYC data that has already been exfiltrated nor prevents a second extortion attempt.

It depends on three things: whether you have a trustworthy recent snapshot, which chain and client you run, and how deep your indexes go. With a clean snapshot, a node usually catches up to the chain head after import and can serve RPC fairly quickly. Without one — a full archive resync from genesis — public experience generally runs from several days to several weeks, and the archive data volume on major chains also sets the hardware and bandwidth floor.

Our practice is to restore public capability in tiers: get query RPC and basic endpoints available first, then fill in historical depth and analytics, rather than keeping the door shut until indexing is fully caught up. We give a range with its reasoning after assessment rather than committing to a single number.