How to Recover Stolen Cryptocurrency: First Steps

First Identify What Was Actually Stolen

“Stolen crypto” can mean an unauthorised exchange withdrawal, a wallet drained after a seed phrase was exposed, or a transfer made after an attacker controlled an email, phone or device. It can also mean social engineering that persuaded the victim to approve a transfer. A withdrawal freeze, fake dashboard balance or release-fee demand is different and should not be reported as on-chain theft without checking the facts.

Why the First Hours Matter

The blockchain entry is usually permanent, but surrounding evidence is fragile. A provider may flag an internal account, preserve login records or stop a pending withdrawal. A fake domain, profile, chat or payment page may disappear quickly. Early reporting reduces reconstruction from incomplete screenshots.

The Europol report on cryptocurrencies and criminal finances explains why public-ledger analysis can support tracing while cross-border structures, pseudonymous addresses and activity outside the blockchain still create investigative limits. A visible address is a lead, not automatically a person’s identity.

What to Do in the First 24 Hours

1. Stop Communicating with the Suspected Attacker

   Do not negotiate, threaten or send a final payment. A tax, gas fee, bond, compliance deposit or “unlock” request is not proof that assets are recoverable. Save it and stop responding.

2. Secure the Device and Primary Accounts

   From a trusted device, change the email password, terminate unknown sessions and replace compromised two-factor authentication. Contact the mobile operator if a SIM swap is possible. Do not use message links to log in.

3. Contain a Self-Custody Wallet Compromise

   If a seed phrase or private key may have been exposed, assume all assets it controls are at risk. After checking for malware, create a new wallet with a new seed and move remaining assets. If remote access or malware is suspected, use a clean device or obtain technical help before signing anything.

4. Freeze an Exchange or Custodial Account

   Use the provider’s genuine application or website. Request an urgent withdrawal freeze, session termination, review of the destination, preservation of access logs and a case number. Revoke API keys and unfamiliar permissions.

5. Contact the Bank and Payment Provider

   If fiat was used, notify the card issuer, bank or payment institution immediately. Ask about recall, card-blocking, chargeback or fraud-review options. Give the payment reference, recipient, date, amount and connection to the crypto theft.

6. Record the On-Chain Facts

   Copy the transaction hash, network, token, amount, sender, destination and confirmation status. Record UTC time and save the block-explorer page. State clearly if the transfer is still pending.

7. Preserve the Surrounding Evidence

   Export messages and emails, save statements and exchange activity, capture the full URL and account context, and keep originals separate from working copies. Do not delete messages or suspicious files.

8. Report to the Competent National Authority

   File a police, cybercrime or prosecutor report, normally starting with your country of residence. Include the transaction schedule and identify platforms or accounts that may hold records. Report to the platform and authority in parallel where urgent.

9. Secure Other Services

   If the same password, email or device was used elsewhere, change those credentials and review other exchanges, payment apps and cloud accounts.

For general EU consumer steps, see the European Commission guidance on online scams which advises consumers to contact their bank, secure accounts and report the matter to the relevant authority in their country.

Evidence That Makes a Recovery Review Possible

Send a structured evidence pack rather than unexplained screenshots. Establish the access event, actual loss, asset path and parties that may still hold records or funds.

Use consistent file names such as 2026-09-10_exchange-withdrawal.csv or 2026-09-10_chat-export.zip. Keep a short index explaining what each file proves. For a company, preserve contracts, invoices, authorisation records and the responsible wallet or account holder.

Prepare a Transaction and Incident Timeline

A review should not depend on a reader guessing from screenshots. Prepare one chronology with a row for every material event. Include:

• date and time in UTC, with local time where it helps explain an account alert;
• first contact, suspected compromise and the moment the loss was discovered;
• network, token, amount, source address, destination address and transaction hash;
• the account, wallet, device or payment service involved;
• the instruction or representation that caused an approved transfer, if any;
• the provider, police or authority contacted, the channel used and the case number; and
• what remains uncertain, such as the identity of the recipient or whether a device was infected.

Separate facts from inferences. “The exchange history shows a withdrawal at 14:02 UTC” is a fact; “the recipient is the scammer” remains a theory until additional evidence links the address to a person or service.

What to Write to a Platform or Authority

The first notice should be short and action-oriented. A useful opening is:

“I report an unauthorised transfer or suspected crypto theft discovered on [date]. The affected account or wallet is [identifier]. Transaction details: [network, asset, amount, hash and destination]. Please freeze or flag any account under your control, preserve relevant records, confirm the case number and tell me what evidence is required.”

Attach the transaction schedule, chronology and indexed files. Avoid presenting a suspected identity as a proven criminal. Clear wording helps the provider see an identifiable transaction rather than a general complaint.

Where EU and EEA Victims Should Report

No single EU victim portal can freeze a blockchain address. Use routes, each for the part of the incident it can affect:

• Bank, card issuer or payment institution for the fiat funding payment, card compromise or account transfer.
• Exchange, wallet provider or other crypto-asset service provider for the account, withdrawal, deposit address or internal transfer.
• National police, cybercrime unit or prosecutor for suspected theft, fraud, unauthorised access and identity misuse.
• The provider’s formal complaint channel and, where appropriate, the national competent authority if a regulated provider does not handle the complaint properly.

If the provider is an EU crypto-asset service provider within MiCA, use its complaint procedure after the urgent security notice where necessary. The procedure is not a promise of reimbursement, but it creates a clearer record of the provider’s response.

Article 71 of Regulation (EU) 2023/1114 MiCA requires in-scope providers to maintain effective and transparent complaint procedures, accept complaints free of charge, investigate them in a timely and fair manner and communicate the outcome within a reasonable period. National rules and the legal entity providing the service still determine the available escalation route.

What Legitimate Recovery Work Can and Cannot Do

A credible review normally follows five stages:

1. Containment review. Check whether a wallet, exchange, email, device or payment account remains exposed and whether a platform can act on a pending or internal transfer.
2. Transaction mapping. Organise hashes and addresses into a documented flow. Treat bridges, decentralised applications, mixers and service labels as leads, not conclusions.
3. Counterparty identification. Look for a custodial exchange, payment provider or company where records may connect an address to a real entity. A blockchain label alone is not proof of ownership.
4. Legal and provider escalation. Use the evidence for preservation requests, complaints, police reporting or a civil route where jurisdiction, value and evidence justify the cost.
5. Cost and outcome review. Keep tracing, identification, freezing and restitution separate. Reassess the likely reachable amount before paying for further work.

No legitimate professional can hack an exchange, calculate a private key from a public address, secretly reverse a confirmed transaction or guarantee seizure and return. A useful result may be a platform freeze, stronger report, service identification, civil claim or restitution. None is automatic.

When Specialist Support May Be Proportionate

Consider legal or forensic assistance when the loss is material, several countries or providers are involved, the recipient may be identifiable, a provider rejects a complete report or a deadline is approaching. A specialist can separate technical facts from legal conclusions and choose a realistic escalation route.

A Get a Free Case Assessment from P&P can be useful before extensive work. Ask for a written scope, required evidence, first deliverable, fees and the point at which further work needs approval. Treat guaranteed recovery or an unexplained “release” payment as a warning sign.

Get a Free Case Assessment

Common Mistakes After a Crypto Theft