Discovering an unauthorized crypto transfer is disorienting. Move quickly—but do not let panic push you into destroying evidence, sending more funds, or trusting someone who promises a guaranteed recovery.
Blockchain transactions are generally difficult to reverse. That does not mean every response is futile. Speed, accurate records, and the path the assets take can affect what options may be available. The steps below are a general starting point, not a substitute for advice about a particular incident.
The immediate checklist
- Stop communicating with the suspected scammer and do not send additional money.
- Use a clean, trusted device to secure email, exchange, and financial accounts.
- Preserve wallet addresses, transaction hashes, messages, screenshots, and account records.
- Notify the involved exchange or platform through its official support channel.
- Submit a detailed report to the FBI Internet Crime Complaint Center (IC3).
Step 01Identify what was compromised
Determine whether the loss came from a custodial exchange account, a self-custody wallet, a deceptive investment platform, a malicious wallet approval, SIM swapping, phishing, or disclosure of a seed phrase or private key. The response differs. An exchange login may be secured through the platform, while a compromised seed phrase means the wallet itself should no longer be trusted.
Do not continue using a compromised device or wallet for sensitive activity. If you believe malware may be present, preserve what you need and obtain qualified technical help before making changes that could destroy logs or evidence.
Step 02Contain further loss
From a device you reasonably believe is clean, change the passwords for affected exchanges and the email account connected to them. End unfamiliar sessions, replace compromised multi-factor authentication, and contact your mobile carrier if SIM swapping is suspected. Use official apps or independently located support pages—not links supplied in messages.
Step 03Preserve the blockchain trail
The FBI identifies transaction details as especially important. Record the sending and receiving wallet addresses, the cryptocurrency and amount, the date and time, the network used, and the transaction ID or hash. Save the exact information as text as well as screenshots.
| Preserve | Examples |
|---|---|
| Transaction data | Hashes, wallet addresses, token, amount, network, timestamps, block-explorer links |
| Communications | Emails with headers, texts, chats, social profiles, usernames, phone numbers, voice messages |
| Account records | Statements, login alerts, withdrawal notices, support tickets, device and session history |
| Payment trail | Bank wires, card payments, exchange deposits, conversion records, source-of-funds documents |
| Your timeline | When contact began, instructions received, transfers made, and when the loss was discovered |
Step 04Notify exchanges and service providers
Contact the sending platform immediately if an exchange account was used. If the stolen assets appear to reach a known exchange, provide that platform with the transaction information and any law-enforcement report number. Ask that your notice be preserved and obtain a ticket or case number. A platform may require a request from law enforcement or legal process before restricting an account or disclosing customer information.
Be precise and truthful. Do not publicly accuse an identifiable person or company based only on a wallet-tracing guess.
Step 05Report the incident
The FBI advises cryptocurrency scam victims to report promptly through IC3.gov and provide as much transaction information as possible. Depending on the facts, reports to local law enforcement, the FTC, the SEC, the CFTC, a state attorney general, or another regulator may also be appropriate.
Save the report confirmation and complaint number. A report does not guarantee recovery, but it creates a record and may help investigators connect related conduct.
Step 06Consider legal and forensic options early
Counsel can help assess potential claims, identify relevant jurisdictions, preserve evidence, communicate with platforms, and evaluate whether emergency court relief or third-party discovery is realistic. A reputable blockchain investigator may help map transactions and identify exposure to regulated services. The appropriate response depends on the amount, timing, location, available evidence, and path of the assets.
No lawyer, investigator, or tracing firm can honestly promise that stolen cryptocurrency will be recovered. Ask for written scope and fee terms, the person’s qualifications, and an explanation of what any tracing work can—and cannot—establish.
Step 07Avoid becoming a victim twice
Loss victims are frequently targeted by “recovery” scammers. They may impersonate government agencies, law firms, hackers, investigators, or exchange personnel. They often claim funds have already been located and demand an advance tax, bond, gas fee, or cryptocurrency payment before release.
Step 08Keep a single, organized case file
Maintain an unedited evidence folder plus a working copy. Keep a contact log recording whom you notified, when, what was provided, and any ticket or report number. Preserve original filenames and metadata where possible. Do not post transaction details or your full strategy publicly while the matter is being assessed.