It is common for victims of cryptocurrency theft to skip filing a formal report, on the assumption that nothing will come of it. That assumption is understandable but often wrong, and skipping the report closes off options that only exist if a formal record is created. Reporting does more than start an individual investigation. It feeds a larger pool of data that agencies use to identify patterns, connect your case to related incidents, and in some situations, support the freezing of funds at an exchange before they are fully laundered. Filing a report costs very little time and creates a paper trail that several later steps, including insurance claims, tax loss documentation, and civil recovery efforts, may eventually depend on.
Report immediately, before doing anything else
Speed matters more with cryptocurrency theft than with almost any other financial crime, because stolen funds can move through multiple wallets, cross chain bridges, and mixing services within hours. The narrow window in which an exchange might still be able to flag or freeze a deposit tied to your theft closes quickly once funds are layered through several additional hops. Our guide on the first 24 hours after a crypto theft covers the broader set of immediate actions to take, of which filing a report is one part.
Where to file a report in the United States
FBI Internet Crime Complaint Center (IC3)
The FBI's Internet Crime Complaint Center, accessible at ic3.gov, is generally the primary starting point for reporting cryptocurrency theft in the United States. The online complaint form asks for details about the incident, including transaction records, wallet addresses, and any communication with the person or platform involved. After submission, you receive a complaint identifier that can be referenced in any later follow up.
Federal Trade Commission (FTC)
The FTC accepts consumer fraud reports at reportfraud.ftc.gov. The FTC does not typically investigate individual cases directly, but it aggregates consumer fraud data that feeds into broader civil enforcement actions and public trend reporting, and filing here is a quick additional step alongside an IC3 report rather than a substitute for it.
SEC and CFTC, where applicable
If the theft involved what could be classified as a securities offering, such as a fraudulent token sale or investment scheme, the Securities and Exchange Commission accepts tips through its online portal. If the underlying asset or scheme more closely resembles a commodity or derivatives product, the Commodity Futures Trading Commission accepts reports as well. Filing with the agency most relevant to your specific situation, in addition to IC3, increases the chance your report reaches a team positioned to act on it.
State and local law enforcement
A local police report is often necessary even for a case that is ultimately investigated at the federal level, since banks, insurance providers, and some exchanges require an official police report number before they will process a related claim or dispute. Filing locally also creates a record that can be referenced if the case eventually escalates.
File with more than one relevant agency rather than choosing just one. Each captures the incident differently, and together they create a more complete record than any single report alone.
What victims outside the United States should know
Most countries have an equivalent national reporting body for cybercrime or financial fraud, and filing with your own country's authority is generally the correct first step if you are not a US resident. It can still be worthwhile to file with IC3 as well if the platform, exchange, or counterparty involved is based in or has operations in the United States, since US based platforms are more directly reachable by US law enforcement requests.
Information to gather before you file
- Transaction hashes or IDs for every transfer connected to the theft, along with the sending and receiving wallet addresses involved.
- The exact cryptocurrency type and amount lost, along with the date and time of each relevant transaction.
- The name and URL of any platform, exchange, or website involved, including screenshots of the interface at the time of the incident.
- All communications with the person, support account, or platform involved, including usernames, emails, and phone numbers if available.
- A clear written timeline of events in your own words, from first contact or first sign of compromise through the point funds were lost.
For guidance on preserving this kind of material properly, particularly for a business or higher value case where documentation standards matter more, see our guide on preserving evidence after a wallet compromise.
Keep your report numbers for tax and insurance purposes
Beyond supporting a possible investigation, a formal report has practical value that is easy to overlook in the immediate aftermath of a theft. Some tax jurisdictions allow theft losses to be documented for reporting purposes, and having an official complaint number, whether from IC3, the FTC, or a local police report, is often required as supporting evidence for that kind of claim. If any part of the stolen funds passed through a bank transfer, a credit card, or a linked payment app at any point, whether to originally purchase the cryptocurrency or as part of the scam itself, a police report is also frequently a prerequisite for disputing that specific transaction with the bank or card issuer, even though the bank generally has no ability to reverse the cryptocurrency transfer itself.
What actually happens after you report
It is important to set realistic expectations. Most individual reports are not immediately assigned to an investigator, particularly for smaller dollar amounts, since agencies receive an enormous volume of similar complaints and prioritize based on scale, pattern connections to other known cases, and the likelihood of a successful outcome. Your report is far from wasted even when it does not result in an individually assigned case. It contributes to the aggregated data that helps identify repeat offenders, connects your incident to a broader pattern that may already be under investigation, and in some cases supports a freeze request at an exchange if the destination wallet is later flagged. Our guide on whether stolen crypto can be recovered covers the realistic range of outcomes in more detail.
Reporting to the exchange directly
In addition to filing with law enforcement, contact the exchange associated with the destination wallet, if one is identifiable, as quickly as possible. Major exchanges have compliance teams that can flag or freeze an incoming deposit tied to a reported theft, particularly if contacted before the funds are withdrawn or converted further. Our guide on exchange cooperation trends covers how exchange responsiveness has evolved and what realistically increases the chance of a successful freeze request.
Beware of recovery scams after you report
Filing a public or semi public report, including in online forums seeking advice, unfortunately makes victims a target for a second wave of fraud. Individuals and fake firms claiming to guarantee fund recovery for an upfront fee routinely target people who have just reported a theft. Our guide on warning signs of fake recovery agents covers how to identify these approaches, and the rule to remember above all else is simple: a legitimate investigator does not need to be paid an upfront fee to guarantee recovery of funds that may never be recoverable at all.
No legitimate recovery service can guarantee that stolen cryptocurrency will be returned. Any firm making that promise, particularly in exchange for an upfront fee, should be treated as a warning sign rather than reassurance.
Firms like Coin Trace work alongside, not instead of, formal law enforcement reporting, focusing on blockchain tracing and case documentation that can support an investigation already opened through channels such as IC3, rather than positioning themselves as a replacement for the reporting process or a guarantee of recovery.
Frequently asked questions
Yes. Every report contributes to the aggregated data that agencies use to identify patterns and repeat offenders, and a small individual loss may be part of a much larger scheme already under investigation. A police report may also be required later for insurance or tax purposes regardless of the dollar amount involved.
There is no guaranteed timeline, and many individual reports do not receive a direct follow up at all, particularly for smaller losses. The complaint identifier issued at submission remains useful as a reference point if the case is later connected to a broader investigation or if you need documentation for other purposes.
Most reporting portals, including IC3, request identifying contact information because it may be needed for follow up or verification, but the details are handled as part of a law enforcement process rather than made public. If anonymity is a specific concern, consult the reporting agency's own privacy guidance before filing.
Treat any unsolicited contact claiming guaranteed recovery, especially one requesting an upfront fee, with significant suspicion. Verify any firm's legitimacy independently before engaging, and never send additional funds, no matter how the request is framed, to someone claiming it is needed to recover funds you have already lost.
No, filing an initial report with agencies such as IC3, the FTC, or local police does not require legal representation. A lawyer may become useful later if you pursue civil recovery action or need to navigate a dispute with an exchange or financial institution, but the initial reporting step is designed to be accessible without one.
Sources and further reading
- Cryptocurrency Investment Fraud · Federal Bureau of Investigation
- How to Report Cryptocurrency Fraud and Hacks to the FBI IC3: Step-by-Step Guide · Crypto Legal
- The Landscape of Seizable Crypto Assets in 2025 · Chainalysis