BA-10 · LESSON 08

Incident response

KEY DEFINITIONS

Terms used in this lesson

UTXO: Unspent transaction output: one discrete chunk of bitcoin that can be used as a transaction input.
Oracle: A system that reports outside information, such as a market price, for use by a protocol.
UTC: Coordinated Universal Time: the global time standard used to record an incident timeline without local timezone ambiguity.

Preparation includes detection, communication, key rotation or migration, evidence preservation, and safe recovery procedures.

65 min Difficulty 3/5 Not started

VISUAL MODEL

See the whole mechanism before going step by step

Use the diagrams to orient yourself. Then the guided explanation below teaches every part in depth.

4 explanatory views

CONCEPT-SPECIFIC MAP · privacy boundaryObservable evidence creates inferences, not automatic proofSelect any state to inspect its exact role.

RELATIONSHIP MAPCompeting paths and resolution

01
OBSERVABLEAmount, script, timing
Chain and network observers see different subsets of transaction and propagation data.
02
HEURISTICProbabilistic link
Wallet patterns can support a guess but do not prove a real-world identity.
03
RISKIncident response
The Incident response lesson identifies which evidence or failure is in scope.
04
CONTROLReduce or separate evidence
Address discipline, coin selection, local verification, and routing choices change exposure.
05
RESIDUALExplicit remaining observer
Every mitigation leaves assumptions and observers that must be named honestly.

Rule shown: Privacy improves by reducing linkable evidence and separating observers, while preserving verifiable spending rules.

STAGE 1 OF 5OBSERVABLE: Amount, script, timing

Chain and network observers see different subsets of transaction and propagation data.

Governing relationship: Privacy improves by reducing linkable evidence and separating observers, while preserving verifiable spending rules. Complete path: 1. OBSERVABLE, Amount, script, timing. Chain and network observers see different subsets of transaction and propagation data. 2. HEURISTIC, Probabilistic link. Wallet patterns can support a guess but do not prove a real-world identity. 3. RISK, Incident response. The Incident response lesson identifies which evidence or failure is in scope. 4. CONTROL, Reduce or separate evidence. Address discipline, coin selection, local verification, and routing choices change exposure. 5. RESIDUAL, Explicit remaining observer. Every mitigation leaves assumptions and observers that must be named honestly.

1. State transitionWhat exists, what changes, and what results

BEFORE

One key in a 2-of-3 Bitcoin wallet may have leaked; the other two remain secure and available.

MECHANISM

Confirm observable indicators, affected assets, time range, chain state, and whether the event is theft, attempted theft, privacy leak, availability loss, or software defect.

AFTER

A threshold can provide recovery time, but only a rehearsed migration turns remaining authority into containment.

Text equivalent: Starting from One key in a 2-of-3 Bitcoin wallet may have leaked; the other two remain secure and available. The mechanism begins when Confirm observable indicators, affected assets, time range, chain state, and whether the event is theft, attempted theft, privacy leak, availability loss, or software defect. The resulting lesson is A threshold can provide recovery time, but only a rehearsed migration turns remaining authority into containment.

2. Mechanism pathSelect a stage to inspect its job

STAGE 1 OF 5

Detect and classify

Confirm observable indicators, affected assets, time range, chain state, and whether the event is theft, attempted theft, privacy leak, availability loss, or software defect.

Complete path: 1. Detect and classify: Confirm observable indicators, affected assets, time range, chain state, and whether the event is theft, attempted theft, privacy leak, availability loss, or software defect. 2. Contain safely: Pause vulnerable services, isolate systems, restrict credentials, or prepare emergency transactions without destroying evidence or alerting an attacker prematurely. 3. Preserve evidence: Record Coordinated Universal Time (UTC) timelines, immutable copies, hashes, logs, configurations, versions, and decision owners with access controls. 4. Recover through valid mechanisms: Move UTXOs to new policies, rotate application credentials, rebuild clean systems, reconcile chain and databases, and verify every successor state. 5. Communicate and improve: Give affected users accurate bounded facts, coordinate required disclosures, identify root causes, and test remediation against recurrence.

3. Rule and failure boundaryWhat accepts the result and where it can stop

ACCEPTED PATH

Each incident plan applies scenario-specific containment, evidence capture, valid recovery state transition, independent verification, communication, and recurrence review.

CHANGED CONDITION

Wiping evidence, changing only a wallet password, skipping UTXO migration, or declaring recovery before successor verification leaves the incident unresolved.

Important distinction: Rotating a wallet password neutralizes a leaked Bitcoin private key. A copied private key remains valid for its existing output conditions. Funds must normally move to outputs controlled by fresh keys and policy.

Text equivalent: The accepted path is enforced by Each incident plan applies scenario-specific containment, evidence capture, valid recovery state transition, independent verification, communication, and recurrence review. If the required condition changes, Wiping evidence, changing only a wallet password, skipping UTXO migration, or declaring recovery before successor verification leaves the incident unresolved.

Loading lesson visuals...

Learn the idea

Incident response is the prepared process for detecting, containing, understanding, communicating, and recovering from a security event. A runbook records roles and actions. Evidence preservation keeps logs, hashes, devices, and timelines useful for diagnosis. Key rotation moves authority to new keys; for Bitcoin that often requires spending funds to new outputs, not editing old keys.

GUIDED EXPLANATION1/5 ideas inspected

Detect and classify

Confirm observable indicators, affected assets, time range, chain state, and whether the event is theft, attempted theft, privacy leak, availability loss, or software defect.

The worked example follows the explanation

Inspect every idea above to open it.

Important distinction“Rotating a wallet password neutralizes a leaked Bitcoin private key.”

A copied private key remains valid for its existing output conditions. Funds must normally move to outputs controlled by fresh keys and policy.

FINISH LEARNING FIRST

The questions unlock after every required learning activity

Inspect every guided idea, open the worked example, rebuild its mechanism, and complete the deterministic lesson tool. Your progress is saved automatically.