Discovering that your crypto has been stolen is a jarring experience. The first instinct is panic — and panic leads to poor decisions. Here is a clear and honest guide to what you should do in the immediate aftermath.
Step 1: Stop the Bleeding
If the attacker still has access, every second counts. Immediately revoke any connected wallet permissions on platforms like revoke.cash. Move any remaining funds to a completely new wallet with a freshly generated seed phrase on a clean device. Do not reuse the compromised wallet for anything.
Step 2: Document Everything
Take screenshots of every transaction, every message, every website you interacted with. Record the wallet addresses the funds were sent to. This documentation is essential for any report or investigation.
Step 3: Report to the Relevant Authorities
Report crypto theft to your national cybercrime unit. In the US this is the FBI’s IC3 (ic3.gov). In the UK, Action Fraud. Reporting does not guarantee recovery, but it creates a record and contributes to investigations that have led to arrests and fund recoveries.
Step 4: Report to the Exchange, If Applicable
If stolen funds were sent to a centralized exchange address, report it to that exchange’s security team immediately. Exchanges can sometimes freeze funds that arrive from reported theft wallets.
An Honest Assessment
Most stolen crypto is not recovered. Companies claiming they can recover stolen crypto for an upfront fee are almost universally scams. Be very cautious about anyone who contacts you offering to retrieve your funds.
— Lior H