HomeLost or Stolen Crypto? A Recovery Decision TreeCrypto RecoveryLost or Stolen Crypto? A Recovery Decision Tree

Lost or Stolen Crypto? A Recovery Decision Tree

The direct answer

“Crypto recovery” is not one problem. It is at least six, and the right path depends entirely on which one you have. A forgotten wallet password, a lost phone, a transfer to the wrong address, a drained wallet, and a paid scam are all “lost crypto” in casual speech — and each has a completely different recovery method, cost, and success rate.

Use the decision tree below before you pay anyone anything.

Step 1: Identify which loss you have

Your situationRealistic pathTypical odds
You control the wallet but forgot the password or PINPassword recovery, backup restoration, expert assistanceModerate to high
You lost the device but have the seed phraseRestore in a new walletVery high
You lost both the device and the seed phraseBrute force, backup forensics, partial seed analysisLow to moderate
You sent crypto to the wrong addressNegotiation with the recipient or exchange; usually no reversalLow
Your wallet was drained by malware or a malicious signatureTracing, exchange freeze, police reportModerate if fast
You paid a scammer or fake platformFreeze, reporting, legal claimsLow to moderate
The exchange collapsedBankruptcy claim processDepends on estate

The six sections below handle each type in order.

2. You control the wallet but forgot the password or PIN

This is the most recoverable category, because the keys exist on your machine and you have legal ownership. Common situations: a Bitcoin Core or Electrum wallet file with a forgotten password, a MetaMask or Trust Wallet password you stopped using, a hardware wallet PIN, or an encrypted backup.

What works:

  • Recover the backup first. Check for seed phrase backups in password managers, cloud notes, safe deposit boxes, old phones, and printed copies. Search for “seed”, “recovery phrase”, and “12 words” in your password manager and cloud storage.
  • Try likely passwords methodically. Wallet encryption has no backdoor, but it also has no lockout. Build a candidate list from the words and patterns you actually use. Never run untrusted “wallet password recovery” software you downloaded from an ad.
  • Use a professional only if the wallet file is real. A specialist can attempt a dictionary-based attack on an older, weakly encrypted wallet file. This is legitimate computational work, not hacking, and it needs the wallet file plus any hints. It cannot work if the file is corrupted or if the password is long and random.
  • Beware “recovery” software sold to you. Fake tools that “brute force lost crypto” are a common malware delivery method. They exist to steal whatever wallet files you feed them.

What does not work: contacting the wallet provider and asking for a password reset. Self-custody has no reset button by design.

3. You lost the device but have the seed phrase

Restore immediately, and do it in a safe place:

  1. Install the wallet software from the official source and verify the domain and signature.
  2. Choose “restore from seed phrase” and enter the words in the correct order and language.
  3. Check whether the restored wallet shows the expected balance. If it shows zero, you may have used a different derivation path — try advanced restore options with the correct path, especially if the wallet is an Ethereum-style HD wallet.
  4. If the balance appears, move the funds to a fresh wallet you create on a clean device, then retire the old seed phrase.

If the balance is zero after a correct restore, the funds were probably moved by someone else. Treat it as a theft and follow section 5.

4. You lost both the device and the seed phrase

This is where the odds fall. What remains:

  • Backups of the seed phrase in imported browser profiles, phone backups, encrypted ZIP files, or old paper. Check whether your phone’s cloud backup contains an old wallet app with its encrypted data.
  • A partially known seed phrase. If you remember most words but not all, or the order, a specialist can sometimes search the remaining space. This works only if the unknown portion is small.
  • A passphrase mismatch. Some wallets use an optional BIP39 passphrase on top of the 12 or 24 words. If you restored the words but see an empty wallet, try the passphrases you might have set.
  • Typo analysis. A single mistyped word means a different, usually empty, wallet. If the words you have produce no balance, a specialist can test plausible corrections.

What does not work: any claim that a company can “regenerate” an unknown 24-word phrase. The search space is astronomically large. Any provider promising that is either misinformed or a scam.

5. Your wallet was drained

Speed dominates everything here.

  1. Stop the leak. Disconnect the compromised wallet from all sites, revoke token approvals, and move any remaining assets in other wallets on the same device or seed phrase.
  2. Identify the drain. Check your transaction history for the signature that authorized the transfer. Was it a malicious “approve”, a fake airdrop claim, a wallet drainer site, or a compromised seed phrase? The answer tells you whether other wallets are at risk.
  3. Trace the outgoing funds. Note every transaction hash and the first receiving address. Report the theft with those hashes.
  4. Contact exchanges. If funds flow to a centralized exchange deposit address, notify its compliance team immediately and include the police report number.
  5. Report to police and IC3 or your national equivalent. The report is required for most downstream recovery work.
  6. Decide whether to pursue. A forensic assessment will tell you whether the funds are still in frozen-reachable accounts. If they were bridged and dispersed across multiple chains, expectations should be low.

6. You sent crypto to the wrong address

If the address is a “fat finger” variant of your own address, you cannot reverse the transfer yourself, but the destination may be recoverable:

  • Was it a copy-paste malware swap? Clipboard hijackers replace your copied address with the attacker’s. This is theft and is traceable.
  • Does the receiving address belong to an exchange? Contact the exchange with the transaction hash. Many exchanges will credit the deposit to their own customer, though they are not obliged to help you.
  • Is it an unused address with no controller? Then the funds are permanently locked.
  • Was it a typo with an invalid checksum? Most wallets reject invalid addresses, so the transaction would never have been broadcast.

Never pay a “wrong address recovery” service that claims it can reverse a confirmed transfer. It cannot.

7. The exchange collapsed

If the platform is in bankruptcy or administration, you are a creditor. Find the court-appointed trustee or receiver, check the bar date for claims, and file a proof of claim with supporting transaction records. Do not pay a third party a large fee to “register” your claim before checking the official process, which is usually free.

8. You were scammed

Follow the freeze-first sequence: preserve evidence, report to the platform and police, contact your bank, then pursue tracing and legal options if the amount justifies it. Avoid the second wave of fraud — unsolicited “recovery” offers that ask for fees, seed phrases, or crypto payments. See the dedicated scam recovery guide for the full sequence.

9. What to never do

  • Never share a seed phrase or private key with anyone, including “support” and “recovery agents”.
  • Never install wallet-recovery software from an advertisement or a direct message.
  • Never pay a percentage of your loss to an unverified firm before work is documented.
  • Never send more crypto to recover crypto. That is how the average loss doubles.

FAQ

Can lost crypto be recovered without the seed phrase?

Only in limited cases — a known wallet file with a weak password, a mostly complete seed phrase, or a recoverable device backup. If the keys are gone and unrecoverable, the funds are gone.

How much does lost crypto recovery cost?

A diagnostic or forensics assessment can range from a few hundred to several thousand dollars. Success fees, where offered, commonly run 10–30% of recovered value.

Can I recover crypto sent to the wrong address?

Only if the recipient cooperates or an exchange credits the deposit. A confirmed transfer to an uncontrolled address is permanent.

Does the blockchain have a refund function?

No. There is no reversal, chargeback, or support channel at the protocol level.

How long does recovery take?

Backup and seed-phrase restoration takes minutes. Tracing takes days to weeks. Legal and bankruptcy routes take months to years.

What records do I need?

Transaction hashes, wallet addresses, dates and amounts, screenshots, chat logs, exchange statements, and any police report number.

Disclaimer: This article is general information, not legal or financial advice. Never share a seed phrase or private key with anyone. Outcomes depend on your specific facts.