The direct answer
Containment first, evidence second, freeze third, paperwork fourth. The first hour determines whether your funds are still in a reachable account. Do not spend it arguing with a support chat or reading recovery offers in your inbox.
If you do only three things: move any remaining assets to a new wallet, preserve every transaction hash and screenshot, and get a written police report number. Everything else builds on those three.
Step 1: Contain the theft (first 15 minutes)
The attacker may still have access.
- Move remaining funds from the affected wallet and any wallet derived from the same seed phrase to a brand-new wallet on a clean device.
- Revoke token approvals for the compromised address if it still holds assets on any chain.
- Disconnect dApps and log out of all sessions.
- Change exchange passwords and remove any API keys, then confirm 2FA is on and the recovery email is yours.
- Check for malware on the device you used. Revoke access, run a trusted scan, and consider a full reinstall. A clipboard hijacker or an infostealer may still be running.
- Secure the seed phrase. If it was exposed, treat it as permanently burned.
Do not delete the compromised wallet yet. You need its history for evidence.
Step 2: Preserve evidence like it will be examined in court
You have minutes before apps update, chats get deleted, or you accidentally overwrite something.
- Transaction hashes for every transfer out of your wallet, with dates and amounts.
- The receiving addresses, ideally in a text file rather than a screenshot, so they can be copied accurately.
- Screenshots of the wallet before and after, with timestamps visible.
- Chat logs and emails from any person involved — export them if the platform allows.
- Platform records: account statements, deposit confirmations, KYC emails.
- A written timeline in your own words: what you did, when, and in what order.
Save a copy on a separate device or drive. Keep the original messages unedited.
Step 3: Request a freeze at the receiving exchange
This is the highest-leverage step most victims never take. Stolen crypto is only spendable on-chain, and cashing out usually requires a regulated exchange with identity checks.
- Identify where the funds went. Use a block explorer to follow the first hops. If the receiving address belongs to an exchange, that exchange’s compliance team can act.
- Email compliance, not general support. Address it to the fraud or compliance team. Include the transaction hashes, receiving deposit address, amounts, dates, your identity documents, and the police report number.
- Be concise and factual. One page, chronological, with an evidence list. Compliance teams triage hundreds of messages.
- Follow up once, politely, after a few business days and reference your case number.
- Ask for written acknowledgment that the request was received.
Step 4: Report to police and the national fraud agency
A police report is not a formality; exchanges and courts require it.
- US: FBI IC3 at ic3.gov, plus the FTC at ReportFraud.ftc.gov and your local police department.
- UK: Action Fraud, plus your local police force.
- EU: your national cybercrime unit and the local police.
- Australia: Scamwatch and ReportCyber.
- Canada: the Canadian Anti-Fraud Centre.
Provide the evidence pack and the transaction details. Ask for the report number and a copy of the report itself.
Step 5: Contact your bank and payment providers
If any fiat moved — a deposit to a scam platform, a card payment, a wire — call your bank’s fraud line the same day. Card payments can sometimes be reversed under chargeback rules; wire transfers are harder but not always impossible if reported immediately. Report the receiving account, not just the platform name.
Step 6: Get a forensic assessment before paying anyone
A trace does two things: it tells you whether recovery is realistic, and it produces the report that a court or exchange needs. Have it done by a firm with a verifiable registration and a named analyst.
Before engaging anyone, ask what they charge, what they deliver, and whether they can put the scope in writing. Pay nothing to an unsolicited “recovery agent,” and never share your seed phrase — a legitimate investigator does not need it.
If the amount is significant, engage a lawyer early. Forensics proves the flow; counsel makes an institution or a court act.
Step 7: Handle the aftermath
- Tax treatment. Losses from theft may be deductible in your jurisdiction, depending on whether they are treated as a capital loss, a casualty loss, or a theft loss. Rules differ and change. Get professional advice and keep your evidence.
- Account hygiene. Assume any credential that touched the compromised device is exposed. Rotate passwords, revoke API keys, and review active sessions.
- Credit and identity. If you shared identity documents with a fake platform, watch for identity theft and consider a credit freeze.
- Your support network. Report the crime to someone you trust. Shame is what scammers count on, and it delays reporting.
What not to do
- Do not pay a “recovery fee” before an assessment is documented.
- Do not share your seed phrase with anyone, ever.
- Do not send more crypto to “unlock” a withdrawal.
- Do not confront the thief in a way that tips them off before a freeze request is in.
- Do not waste the first day arguing with exchange support chat instead of filing reports.
- Do not assume small amounts are pointless. Aggregated reports help investigators connect cases.
A one-page incident record
| Field | What to record |
|---|---|
| Date and time (UTC) | Exact moment of the unauthorized transfer |
| Chain and asset | Bitcoin, Ethereum, USDT-TRC20, etc. |
| Compromised address | The wallet that lost funds |
| Transaction hash | Every outgoing transfer |
| Receiving address | First hop and subsequent hops |
| Amount lost | Per asset, with the price at the time |
| Suspected cause | Drainer, malware, fake platform, support scam, physical theft |
| Reports filed | Police number, IC3 number, exchange ticket |
| Contact log | Who you contacted, when, and what they said |
This record becomes the backbone of every later conversation.
FAQ
Can stolen crypto be recovered?
Sometimes, when funds are still traceable and reachable and you report quickly enough for an exchange to freeze them. A confirmed transaction cannot be reversed.
How long do I have?
Freezing depends on the funds not being cashed out. Hours and days matter. Police and legal routes remain open much longer.
Do I need a lawyer?
For anything substantial, yes. A lawyer can obtain court orders and deal with exchanges that ignore individual requests.
Will the police investigate a small loss?
Possibly, especially as part of a pattern. File anyway; aggregation is how these cases get built.
Is it worth paying a recovery firm?
Only after a documented assessment, and only with a vetted firm. Paying a large upfront percentage is a common mistake.
What if I gave the scammer remote access to my computer?
Disconnect, reinstall the operating system or restore from a clean backup, rotate every credential, and move funds to a new wallet generated on a clean device.
Disclaimer: This article is general information, not legal, tax, or financial advice. Report theft promptly to the authorities in your jurisdiction.