Crypto Stolen? What to Do Right Now: Incident Response Guide
Lesson 10 of 10 · Beginner
First, work out what was exposed
In the first minutes after a theft, most mistakes come from haste and fear. Before doing anything, take a breath and work out which scenario you are facing, because the right response differs in each:
| Scenario | Sign | Main action |
| Recovery phrase or private key leaked | All assets, or the network's main coin (used for fees), left without your signature | Migrate immediately to a completely new wallet |
| Malicious approval or signature | Only specific tokens left through transferFrom, after you used a site | Revoke approvals and move what remains |
| Exchange account compromise | Unknown login, changed settings, withdrawal or a new API key | Contact official support at once and lock the account |
If you are not sure which scenario it is, assume the worst case: that the key has leaked.
The step-by-step protocol
- Do not use the infected device. If malware is possible, do the next steps from a different device that is more trustworthy.
- Create a new wallet with a completely fresh recovery phrase, on a clean device. Never use the old wallet again, even after “cleaning” it.
- Move what remains, starting with the most valuable assets. If the attacker runs a “sweeper” bot, any fee you send to the old wallet may be taken the moment it arrives; so do not send fees one after another, and if that happens, know that rescuing the rest needs specialist and trustworthy help.
- Revoke approvals (for the malicious-signature scenario) and, if you had delegated the wallet to a contract, revoke the delegation.
- Secure related accounts: change the email and exchange passwords from a clean device, end all active sessions, delete API keys and check the withdrawal allowlist.
- Clean the device. In serious cases, reinstalling the operating system is the surest way.
Speed matters, but the right kind of speed. A hasty decision (such as typing your recovery phrase into a “rescue your assets” site) can destroy what remains.
Preserving evidence and reporting officially
Even if you have no hope of getting the money back, collect the evidence in full. A good file improves the chances of any later action:
- The hashes of all outgoing transactions, the destination addresses and the exact time of each.
- The address of the phishing site, the name of the fake app, the scammer's user ID on messaging platforms and screenshots of conversations.
- Payment receipts and any correspondence with “support” or a “fund manager”.
Then report:
- The police: your national or local cybercrime unit is the body that handles online financial crime.
- The destination exchange: if you can see in the explorer that the money went to a centralised exchange, contact that exchange's official support immediately. Exchanges can sometimes temporarily freeze the assets before the attacker withdraws them, usually at the request of legal authorities.
- The stablecoin issuer: issuers such as Tether can blacklist addresses, but they usually act on the request of legal authorities. Your police report is typically a prerequisite.
Can crypto fraud be traced?
The honest answer has two parts. Tracing is almost always possible, because the blockchain is public and every transfer is recorded. But recovering the money happens only in particular circumstances: when the assets reach a cooperating centralised entity (an exchange or an issuer) and are frozen under a legal request before they move further.
Professional hackers know this and pass the money quickly through swaps, cross-chain bridges and mixing tools. There are cases where a large share came back: according to TRM Labs, in the attack on the Liquid Network (September 2026), about 85 percent of the roughly 319 million dollars stolen was returned. But these are exceptions and should not set your expectations. International pursuit is usually slow and complex, and its legal cost is not justified for small amounts.
So, realistically: report and keep the evidence, but plan your finances on the basis that the money is lost.
The “recovery” trap: the second scam
Victims of theft and fraud are the main target of a second wave of scams. Days or weeks later, someone turns up claiming they can get your money back. The signs:
- A firm promise to return the money, usually through a “counter-hack” or a “special tracing tool”.
- A demand for an upfront fee, a “case opening cost” or a percentage before any result.
- Impersonation of the police, a law firm, an exchange or even blockchain analytics companies.
- A request for the recovery phrase of the old or the new wallet “for tracing”.
- They contact you, not the other way round, after you mentioned what happened in a group or on social media.
Nobody can take stolen money back on a blockchain by “hacking”. The real route runs only through legal authorities and the centralised entities the funds reached.
Common mistakes
- Continuing to use the old wallet after the recovery phrase leaked, even after revoking approvals.
- Sending fees one after another to a wallet that a sweeper bot empties.
- Changing passwords from the same device that is probably infected.
- Deleting conversations and records out of shame or anger instead of keeping them as evidence.
- Paying an upfront fee to a “recovery company” or a “white-hat hacker”.
- Delaying notice to the destination exchange when the path of the money is visible in the explorer.
What do volume and data say here?
After a theft, the explorer is your best tool for understanding what happened and building a case:
- Find the starting point: locate the first unusual transaction in the wallet's history. Was there a suspicious Approve or signature recorded before it? This helps identify the scenario.
- Follow the money: click the destination address and look at the later transfers. If the funds reached an address labelled as a centralised exchange, give that information, with the transaction hashes, to that exchange's support and to the police.
- Recognise the sweeper pattern: if every small fee deposit is moved to a fixed address within seconds, an automated bot is watching your wallet.
- Evidence from the original source: a link to each transaction's page in the official explorer is more credible than a screenshot.
This data does not return the money, but it makes your report precise and actionable.
📊 See real gold futures volume behind these ideas: free order flow course · today's gold volume map
Frequently asked questions
Can crypto fraud be traced?
Tracing transactions on the blockchain is almost always possible, but money is recovered only when it reaches a cooperating exchange or issuer and is frozen under a legal request. Reporting to the cybercrime police where you live is the official route.
What is the first thing to do if I get hacked?
Work out what was exposed, and if you are unsure, assume the key leaked. From a clean device, create a new wallet, move what remains and secure your linked accounts.
Can crypto recovery companies be trusted?
People who promise firm recovery and ask for an upfront fee are almost always scammers. The real route is reporting to legal authorities and to the exchange the funds reached.
Education only, not a recommendation to buy or sell; we never give signals. Price examples are illustrative. Test any method on a demo account first, with strict risk management.