Discovering that cryptocurrency has been stolen from you, whether through a hacked wallet, a fake platform, or a scam you were manipulated into, is disorienting, and the instinct to do something immediately is understandable. But not every immediate action helps, and some make things worse. This guide sets out a clear sequence, grounded in how blockchain investigators and law enforcement actually use the information victims provide, starting with what to stop doing before what to start doing.
Stop Before You Start
Do not send any further cryptocurrency to anyone in an attempt to recover, verify, or unlock what was already taken. Scammers frequently target recent victims a second time, posing as a recovery expert, a government official, or even a fellow victim, and asking for a fee before they can supposedly retrieve the stolen funds. No legitimate recovery process ever requires you to send cryptocurrency first. If you are contacted this way, treat it as a second scam layered on top of the first, not a genuine offer of help.
Avoid resetting or wiping any device that may have been involved in the theft, since doing so can destroy evidence of exactly how access was gained, which matters for both the investigation and for closing off further exposure.
Preserve the Evidence First
Before contacting anyone else, capture the details that will not be recoverable later if you wait. For every unauthorized transaction, record the exact transaction hash, the sending and receiving wallet addresses, and the date and time. A screenshot of the transaction as shown on a blockchain explorer, along with your own wallet or exchange interface, is usually sufficient and takes only a few minutes.
- Transaction hashes and wallet addresses for every unauthorized transfer
- Screenshots of the transactions from both your own account and a public blockchain explorer
- Any website URLs, usernames, phone numbers, or social media handles connected to how the theft occurred
- Copies of relevant messages, emails, or chat logs, without deleting the originals
- The approximate date, time, and a description of what you noticed and when
The first 24 to 72 hours matter most because funds are most likely to still sit at an identifiable exchange during that window. Once funds move through several additional wallets or a mixing service, tracing becomes significantly harder.
Secure What Is Left Before Anything Else
If there is any chance the theft resulted from a compromised device, a phished seed phrase, or a hacked email account rather than a scam you were persuaded into voluntarily, treat every other account connected to that same device or credential as potentially exposed as well. Move any remaining funds in the affected wallet to a new wallet with a freshly generated seed phrase on a device you are confident is clean, change passwords on any exchange or email account that shared a password with the compromised one, and enable two factor authentication using an authenticator app rather than SMS wherever it is available. Our guide on how seed phrase theft actually happens walks through the most common ways this occurs, which is worth understanding even after the fact, since it clarifies exactly what else might be exposed.
If the theft happened through a fake platform rather than a direct hack, this step matters less, since no wallet compromise necessarily occurred, but it is still worth reviewing whether you reused a password on the fraudulent platform anywhere else, since credential reuse is routinely exploited afterward.
Report It, In the Right Order
File a report with the FBI's Internet Crime Complaint Center at ic3.gov as soon as possible. Select the category that matches what happened, generally investment fraud for a fake platform or Ponzi style scheme, or a more direct fraud or theft category for a hacked wallet or account. Include every transaction hash, wallet address, and identifying detail you preserved in the previous step, since a vague report is far less useful to investigators than a specific one.
File a report with your national consumer protection agency as well, such as the Federal Trade Commission's ReportFraud.ftc.gov in the United States, and file a local police report, even though local police rarely investigate cryptocurrency cases directly. A police report number is frequently required by banks, insurers, or in any later civil recovery process, so it is worth doing even when it feels like a formality.
If you can identify which exchange the stolen funds moved to, contact that exchange's compliance or fraud department directly with your transaction hash and wallet address. If funds are still sitting in an account on a regulated exchange and you reach them with clear documentation quickly enough, a freeze is sometimes possible, though it depends heavily on timing and on that exchange's own policies.
Understand What Happens Next
Filing a report does not mean funds will be recovered, and no legitimate investigator or agency can promise that outcome, since blockchain transactions themselves cannot be reversed by anyone. What a well documented report and a careful trace can do is establish where the funds went and connect that movement to an identifiable service or, in some cases, a broader pattern tied to other victims, which is often what eventually leads to a partial recovery, an asset seizure, or a criminal referral. For a deeper explanation of how that process actually works, see our guide on how blockchain investigators trace stolen funds.
If your situation involved a fake investment platform or exchange rather than a straightforward hack, it is also worth reading how to identify a fake investment platform, since recognizing the exact structure of what happened to you helps when explaining the case clearly to investigators, and helps you avoid the same pattern again.
Writing a Report That Investigators Can Actually Use
The difference between a report that gets attention and one that sits unread is usually specificity. A report that says I lost money in a crypto investment gives an investigator almost nothing to work with. A report that includes exact transaction hashes, the receiving wallet address, the platform's URL and any names or usernames used by the people involved, and a clear timeline of when each transfer occurred gives an investigator a starting point that can actually be checked against blockchain data and other victim reports. Write the report as a factual timeline, in the order events happened, rather than as a narrative focused on how you feel about what happened, since investigators are looking for the specific, checkable facts embedded in that timeline.
- A clear timeline listing each deposit or transfer with its date, amount, and transaction hash
- The full wallet address you sent funds to for every transaction, not just the first one
- The platform's exact URL, along with any alternate URLs it used if it rebranded or moved
- Every name, username, or phone number associated with anyone who contacted you about the opportunity
- How you were first introduced to the platform or person, including the app or channel involved
- Screenshots of the fraudulent balance, any withdrawal attempts, and any fee demands, with dates visible
Watching for the Second Scam
Victim lists compiled from one scam are frequently sold or shared to other fraudulent operators, which means it is common to be contacted again within weeks of a theft by someone claiming they can recover the stolen funds. These offers often reference real details of your case, which can make them feel credible, since the caller may know the platform name or approximate amount lost. That knowledge does not make the offer legitimate, it often just means your information was included in data connected to the original scheme. Our guide on the warning signs of a fake recovery agent covers the specific tactics this second layer of fraud uses in detail, including fabricated law enforcement credentials and fake court documents used to demand an upfront release fee.
Records Worth Keeping for Tax Purposes
Separate from the criminal reporting process, a documented theft or fraud loss can sometimes be relevant when filing taxes, depending on your jurisdiction and the specific circumstances of the loss. Rules in this area vary and change, and specific eligibility depends on facts a tax professional needs to evaluate, but keeping the same detailed transaction records described above, including the original cost basis of the stolen cryptocurrency if you can establish it, preserves the option to explore this with a qualified tax advisor later rather than trying to reconstruct records from memory well after the fact.
Getting Investigative Help
Some cases, particularly larger ones or those involving funds moved across multiple wallets or blockchains, benefit from a dedicated tracing investigation beyond what a report to law enforcement alone provides. Firms such as Coin Trace focus specifically on this kind of blockchain analysis, building a documented account of where funds moved that can support a law enforcement referral or an exchange request, though no firm, including ours, can guarantee that stolen funds will be recovered. Approach any recovery offer with the same scrutiny you would apply to the original scam, verify who you are working with, and never pay a fee upfront in exchange for a promised outcome.
The single most useful thing you can do right now, before anything else, is write down the exact transaction details while they are fresh and easy to find. Everything else in this process depends on having that record.
Frequently asked questions
Yes. Reports contribute to a broader pattern of data that law enforcement uses to identify and eventually act against organized schemes, even when an individual case does not lead to a fast recovery. Reporting also creates a documented record that can matter later if the case develops or if you need it for insurance or tax purposes.
Treat it with serious suspicion, especially if payment is requested before any work begins. This is one of the most common secondary scams targeting people who have already lost funds, and no legitimate recovery process requires an upfront cryptocurrency payment to begin.
Report as soon as possible, since the window during which funds are traceable and potentially still sitting at an identifiable exchange narrows quickly, often within the first few days. That said, reporting later than that is still worthwhile, since it contributes to the overall record and may still connect to an ongoing investigation into the same operators.
Local police rarely have the specialized capability to trace cryptocurrency themselves, but a local report is still useful, both because it can be referred upward to units with that capability and because it creates a formal record often required by banks or in civil proceedings. The FBI's Internet Crime Complaint Center is generally the more specialized reporting channel for cryptocurrency specific cases.
Yes, be cautious by default. Being contacted again shortly after a theft, sometimes by someone who already knows details of your case, is a well documented secondary tactic, since victim information is often shared or sold among fraudulent operators. Verify independently who you are dealing with, and never pay any upfront fee to someone claiming they can release or recover stolen funds.
Sources and further reading
- Internet Crime Complaint Center (IC3) Guidance for Cryptocurrency Scam Victims · FBI Internet Crime Complaint Center (IC3)
- Cryptocurrency · FBI Internet Crime Complaint Center (IC3)
- Cryptocurrency Investment Fraud · Federal Bureau of Investigation