Ilia Zavialov

Incident

Ilia Zavialov explains what actually helps in the first hours after a crypto theft

English version for the United States.

A crypto theft rarely announces itself as finished. Something is wrong long before it is clear how much has gone, whether access is still open, and which of the next ten actions actually changes the outcome. Most guidance skips straight to warnings about what should have been done earlier, which helps nobody once the funds are already moving. The question that matters in the first hour is narrower: what, out of everything that could be done right now, actually changes what happens next.

·14 min read·Ilia Zavialov

Ilia Zavialov on the first hours after a crypto theft: access, evidence, reporting, recovery

01Why the first hour matters more than the rest of the case

The hour after a theft is discovered divides cleanly into two kinds of work. One kind stops damage that has not finished happening yet: an open session, a live approval, a key that is still valid somewhere. The other kind tries to reverse damage that is already complete, and on a public ledger that second kind almost never succeeds. Confusing the two wastes the only window in which action still changes an outcome.

Ilia Zavialov, who advises clients on digital asset security, describes the same instinct in almost every call: the first question is always about getting the money back, when the question that actually has an answer is whether anything else is still exposed. That instinct is understandable under pressure, and it is aimed at a target the available time cannot actually reach. Panic naturally pulls attention towards the loss rather than the exposure. Redirecting attention towards what remains open, rather than what has already gone, is the single adjustment that changes how the incident unfolds.

Attackers move faster than victims because they have already decided what to do next, while the person on the other side is still working out what happened. A script that drains one wallet does not stop and wait. It checks for other assets, other approvals and other sessions tied to the same key, and it uses each one before anyone has time to react. Matching that speed does not require expertise. It requires knowing, before panic sets in, which three or four actions come first.

02Establishing whether access is still open

Access counts as still open when whatever let the attacker in originally still works. A stolen recovery phrase does not expire on its own. A signature approved on a malicious contract keeps granting the same permission until it is revoked. A session logged into a custodial platform stays valid until it is ended, regardless of who is using it. None of these close by themselves, which is the detail most people miss under pressure.

Checking access means going through each surface in turn rather than guessing. A self custody wallet is checked by confirming whether the phrase involved has been typed anywhere outside the device it was created on. A custodial account is checked through its own session and device list, not through a support chat found by searching. Any application ever connected to the wallet is checked against its permission list, because a permission granted months earlier can still be used today.

Skipping this check is how a single theft becomes several. An attacker who has drained one asset has little reason to stop, and often returns for whatever arrives next, whether that is a new deposit, a reward payment or funds moved in from elsewhere. Establishing that access is closed is what allows every later step, evidence, reporting and anything else, to proceed without the same loss repeating underneath it.

The first hours after a crypto theft, action by action
StepWhat happensWhy the timing matters
Check accessConfirm whether the key, phrase or session behind the theft is still validA closed check is what stops a second loss
Move what remainsTransfer remaining funds to a wallet made from a new phrase on a clean deviceOnly funds that have not moved yet are still within reach
Revoke permissionsCancel token approvals and end active sessions tied to the compromised keyOne approval left standing keeps the exposure open
Record evidenceSave transaction identifiers, addresses, timestamps and full message textChats and profiles used for contact rarely last long
Report to the platformFile through the platform's own reporting route, not a searched contact addressSearch results for support lines fill with impersonators
Notify the bankContact the bank if a card or account funded any part of the lossDispute windows are short and start immediately
File a police reportLodge a report wherever the jurisdiction expects oneOther institutions often require it before acting

03Moving what remains without waiting

Once access is confirmed to still be open, the remaining funds move to a wallet created from a fresh phrase, on a device the attacker has never touched. The old phrase counts as permanently public from that moment, regardless of any plan to reuse it once things calm down. A phrase seen once by an attacker offers no way to confirm it has not been recorded, copied or shared further, so treating it as burned is the only assumption that holds up.

Alongside the transfer, every session and every permission connected to the compromised key gets closed rather than left for later. Token approvals granted to a website are revoked through the wallet or a permission checker, one by one, because a single one left standing keeps the exposure open. Sessions on any exchange or custodial account tied to the same credentials are ended from the account's own security settings, and the password and any linked recovery method are changed from a separate, uncompromised device.

None of this waits for a considered plan, because the assets that have not moved yet are the only ones still within reach. Evidence gathering matters and comes next, but it does not come first, since a screenshot of a balance that no longer exists helps nobody. The order is deliberate: stop the exposure, then document what happened, not the other way round.

04Why finality closes options that felt open a minute earlier

A transaction that has already been confirmed sits behind a technical fact that no amount of urgency changes: enough blocks have been built on top of it that reversing it is no longer practical for anyone, including the network itself. That fact comes from the same mechanism that makes a public ledger trustworthy in the first place, and the mechanism applies identically whether a transfer was a theft or a payment made on purpose. No exchange, bank or platform sits in a position to override it.

People arriving from banking habits expect a call to a support line to freeze a transfer or trigger a hold, because that is how a card payment or a bank transfer often works. A confirmed transfer on a public network has no equivalent lever. No institution sits between sender and recipient with the authority to reverse it, and no support representative, however senior, can undo a block once enough of the network has built on top of it.

This is why the question of whether access is still open matters more than the question of what has already gone. Funds that are confirmed and final are settled in the same sense a completed sale is settled, and no later action changes who controls them. Funds that have not moved yet are the entire remaining scope of what a first hour of action can protect.

05What evidence survives and what disappears within hours

Some evidence exists only for a short window after a theft, and it is recorded before that window closes rather than after. Transaction identifiers, wallet addresses on both sides, exact timestamps and the full wording of any message from the person or account involved are written down or saved immediately, not summarized from memory later. A transaction identifier is the part that stays verifiable regardless of what else happens to the platform or chat where the theft took place.

A chat used to arrange a fake investment or a fraudulent support session is often deleted within hours, sometimes minutes after the victim stops responding. A profile that made first contact gets renamed or removed once it has served its purpose, and a page built to imitate a real service can come down the same day it is reported. This reflects standard practice, since the identity used for first contact is rarely meant to last.

A screenshot taken without the address bar visible proves very little, since it cannot show which site or account produced it. The habit worth building is capturing the full browser window, including the address, alongside the transaction identifier itself rather than a picture of a balance. Saved this way, the record stands on its own later, when a platform, a bank or a police officer asks a question that a partial screenshot cannot answer.

06Reporting in an order that actually has an effect

The platform involved is contacted through its own reporting route, not through a contact address found by searching, because search results for any well-known platform's support line fill with impersonators once a theft becomes visible. A report filed through the platform's own interface reaches the team positioned to act on it, and it creates a timestamped record that later steps can point back to. A screenshot of the submitted report is worth keeping too, since a platform's own queue often moves slower than a bank's or a regulator's.

Where a bank card or account funded any part of the loss, the bank is notified inside its own dispute window, and that window is often short and starts from the moment the transaction posted. Waiting to see whether other steps produce a result before contacting the bank is how a recoverable card dispute becomes an unrecoverable one. The call is made even when the cryptocurrency side of the loss looks unrelated to the card used to fund it.

A police report is filed wherever the jurisdiction expects one, even when the officer taking it is candid about how rarely a cryptocurrency theft gets solved. Its main value shows up later, when a bank, an insurer or another platform asks for it before considering a related claim. Filing it in the first hours, alongside everything else, avoids stalling whichever later step turns out to depend on it.

07The scale behind a single incident

A single theft can feel like an isolated failure of judgment, and the scale of the reported numbers says otherwise. In 2025 the FBI's complaint center recorded 1,008,597 complaints and almost 21 billion dollars in losses, a rise of 26 per cent on the year before. Roughly half of all reported losses in that total involved cryptocurrency in some form, which places a single incident inside a pattern rather than outside one.

The same reporting shows that most attempts do not succeed. Among reports of impersonation collected by the Federal Trade Commission in 2025, four out of five involved no financial loss at all, which means the volume of attempts is far larger than the volume of completed thefts. A theft that has already happened sits in the smaller group, which explains why reporting routes, dispute windows and standard advice exist in the first place.

Knowing the scale changes how a report lands on the other end. A bank's fraud team, a platform's abuse desk and a police officer taking a statement have all seen the same pattern many times over, and none of them treats a cryptocurrency theft as a novelty requiring explanation from first principles. That familiarity works in a victim's favor, and it is a reason to report through the normal channel rather than assume the case is too unusual to fit it.

08The second wave: recovery offers that follow a public loss

A theft that is visible on a public ledger is, in a narrow sense, advertised. The transaction, the amount and often the wallet addresses involved stay permanently readable by anyone who knows where to look, including people who profit from a second approach to someone who has just lost money. Offers to recover the funds for a fee tend to arrive within days of a loss becoming visible, sometimes sooner, and the timing is not a coincidence.

Tracing stolen funds across a public ledger is genuine analytical work, and firms that do it can produce an accurate report showing which wallets the money passed through and where it currently sits. What that report cannot do is change who holds the private key to those wallets. A service that blurs this distinction, implying a traced fund is a returned fund, describes something tracing cannot deliver.

No major exchange or wallet provider sells account or fund recovery as a paid service, and any message claiming otherwise is worth weighing against that fact alone. An advance payment requested before funds are returned functions as a second loss layered on top of the first, aimed at someone already shown to be willing to send money under pressure. That request for payment upfront is, on its own, close to sufficient reason to stop and question the offer entirely.

09Older victims carry a different set of numbers

The numbers behind a theft are not spread evenly across age groups, and the gap has been widening. Losses reported by people aged 60 and older in the United States roughly quadrupled, from about 600 million dollars in 2020 to 2.4 billion dollars in 2024, according to the Federal Trade Commission's report on older consumers. That rate of increase is part of why the pattern gets separate attention in official reporting rather than being folded into the general total.

Where a loss does occur, it tends to be larger. The average loss reported by a victim aged 60 or older reached 38,501 dollars, against an overall average of 20,699 dollars, nearly twice as high. By number of reports, victims in that age group name phishing, fake technical support and investment schemes most often, but by money lost, investment schemes lead by a wide margin at 3.519 billion dollars. That same gap between what gets reported most often and what actually costs the most shows up across fraud categories generally.

Handling an incident on behalf of a parent or an older relative is a different task from handling one's own. Reported patterns suggest the relative may already have been approached more than once before the attempt that finally succeeded. Ilia Zavialov points out that patience during the evidence and reporting steps matters more here, because the full account of what happened often comes out in stages rather than in one telling. None of the earlier steps change for this reason, though the pace at which they happen usually does.

10Questions and answers

Can a crypto theft be reversed after the transaction is confirmed?

No. Once enough blocks have been built on top of a transaction, reversing it stops being practical for anyone, including the network itself, and no institution sits between sender and recipient with authority to undo it. The only usable window sits before that point, which is why checking whether access is still open comes first.

What should I do first if my crypto wallet is hacked?

Establish whether the key, phrase or session that allowed the theft is still valid, then move any remaining funds to a wallet created from a new phrase on a device the attacker has never used. Revoking sessions and permissions happens at the same time, since a single one left open can produce a second loss.

Is it worth paying a company that promises to recover stolen cryptocurrency?

Tracing a theft across a public ledger is real analytical work that can show where funds currently sit, and it does not change who holds the private key to them. No major exchange or wallet provider sells recovery as a paid service, so any advance payment requested before funds are returned counts as a second loss, layered on top of the first.

Should I file a police report for a crypto theft even if it is unlikely to be solved?

Yes. The report becomes useful mainly as the document a bank, an insurer or another platform asks for before acting on a related claim, and filing it early avoids delaying whichever later step depends on it.

Why do recovery scam offers appear so quickly after a crypto theft?

A theft recorded on a public ledger is effectively visible to anyone who checks it, including people who specifically look for recent victims to approach a second time. Offers to recover the funds for an upfront fee often arrive within days of the loss becoming visible, which fits the pattern rather than breaking it.

Why do older victims lose more money to crypto theft on average?

Reported figures put the average loss for a victim aged 60 or older at 38,501 dollars against an overall average of 20,699 dollars, with investment schemes accounting for the largest share of money lost in that age group. Handling an incident for an older relative usually takes longer, because the full account of what happened often emerges in stages.

Written by Ilia Zavialov, digital security consultant. Profile of Ilia Zavialov

11Read next

Back to the blog