When the issuer loses control of the contract: what to do first
The first task is containment: freeze what you can, confirm what actually happened, and notify the people who rely on the token. Confirm the type of loss before anything else, because it decides who you contact and how fast. For how such facts get checked afterwards, see Factual reports on official sources overview in practice. A compromised admin key is not the same event as a drained function, even if the symptom on-chain looks identical at first glance.
What triggers duties here
"Loss of control" covers several distinct events. An admin key can be stolen. A multisig threshold can be broken by collusion or by a bug. A privileged function can be exploited to mint, freeze, or redirect tokens without authorisation. Each of these changes who can act on the contract, and each carries different evidence to preserve.
If the issuer has genuine market presence within the EU, safeguarding and operational-resilience duties under Regulation (EU) 2023/1114 (MiCA) apply from the moment the anomaly is confirmed, not from the moment the cause is fully understood. Waiting for certainty before acting is the wrong order.
If the affected tokens are then moved on to an exchange or another provider, that receiving provider has its own duty to collect originator and beneficiary information under Regulation (EU) 2023/1113 (TFR). This is the mechanism that later makes tracing possible once the tokens leave the compromised contract.
What changes in your deadlines
Once the loss is confirmed, two clocks run in parallel, and they do not wait for each other. The internal clock is about exposure: every hour the affected function stays live is an hour of additional loss. The external clock is regulatory: an incident of this kind is usually reportable, and the notification obligation does not pause for a full root-cause investigation.
The most common mistake is trying to finish the investigation before sending any notification. A preliminary notification, corrected once the facts are clearer, is safer than a complete but late one. Regulators judge the delay, not just the content.
A second, quieter deadline runs against your own evidence. Logs rotate, snapshots expire, and node providers do not keep every historical state indefinitely. The window to preserve a clean record is shorter than the window to notify.
What to do first
- Pause the affected contract functions immediately — the technical lead executes this, not the board.
- Take a full snapshot of on-chain activity, admin logs, and key-management records before anything else changes.
- Notify your compliance officer within the hour, in writing, with a timestamp attached.
- Prepare a preliminary notification to the competent authority; do not wait for the root cause to be confirmed.
- Contact the assigned partner directly — first response arrives within minutes during business hours.
- Freeze outward communication to token holders until the compliance officer has approved the wording.
Who decides, and on what basis
Several people examine different pieces of the same event, and they do not all use the same evidence. The table sets out who looks at what, and against which standard.
| Decision point | Who examines it | What they look for |
|---|---|---|
| Containment | Issuer's own technical team | Whether the anomaly is confirmed and whether it is reversible |
| Incident notification | National competent authority under Regulation (EU) 2023/1114 (MiCA) | Whether the event meets the threshold for a reportable incident |
| Fund tracing after the event | Receiving provider's compliance team | Whether transfers carry the data required by Regulation (EU) 2023/1113 (TFR) |
None of these three actors waits for the others to finish. Containment and notification typically run at the same time, on separate tracks, with separate owners.
If your situation differs
If the loss happened through a compromised admin key rather than a live exploit, the containment step is the same, but the evidence differs. Preserve key-management logs and access records, not just transaction history.
If the loss of control happened during an airdrop to existing holders, the notification chain runs through the distribution event rather than through the contract admin function. See When a token is airdropped to existing users in for that sequence and its own set of first steps.
If a fork has already duplicated the token before control was lost, treat the two chains as separate incidents. Do not assume that a fix applied on one chain automatically covers the other; each requires its own containment record.
What this page does not cover
This page does not establish where the affected assets currently sit, or through which accounts they moved after the event. That is separate factual work: see Asset report finland.
It also does not establish who the counterparty is, or whether they are in a position to pay or return anything. That question belongs to Debtor report finland.
Nor does it replace advice specific to your own contract terms, your jurisdiction of incorporation, or your particular governance structure. Those depend on documents this page has not seen.
Verified
Checked against Regulation (EU) 2023/1114 (MiCA) and Regulation (EU) 2023/1113 (TFR). Both entered into force on 30 December 2024, and this page reflects that starting point.
Last reviewed: 10 March 2025. Sources: Regulation (EU) 2023/1114 (MiCA); Regulation (EU) 2023/1113 (TFR).
Related situations
See also When a fork duplicates the token: what to do if duplication is part of the same event.
FAQ
What is the first step when the issuer loses control of the contract?
Pause the affected functions and preserve the current state before anything else. The technical lead executes this, not the board, and preservation comes before explanation.
Which deadline is already running?
The internal containment clock starts the moment the anomaly is confirmed. If the issuer has genuine market presence in the EU, a notification clock under Regulation (EU) 2023/1114 (MiCA) starts at the same point, not after the investigation.
Who decides, and on what evidence?
The national competent authority examines the incident against the threshold set out under Regulation (EU) 2023/1114 (MiCA), working from the preliminary notification and the logs preserved at containment. Later fund movements are assessed separately, against the data standard in Regulation (EU) 2023/1113 (TFR).