Incident
The first hours after a crypto theft: what actually helps
English version for the United States.
After a theft the useful work is narrow and time limited. Stopping further loss is achievable. Returning what has gone usually is not, and the difference decides where the first hour should be spent.
01Stop the ongoing loss first
The first question is whether access is still open. A compromised key keeps working, and an attacker who has drained one asset returns for the next one that arrives.
Remaining funds move to a wallet created on a clean device with a phrase the attacker has never seen. Active sessions are ended, permissions granted to sites are revoked, and the compromised phrase is treated as public from that moment.
02Preserve evidence before it rotates
Transaction identifiers, addresses, timestamps, the exact wording of any message and the profile that sent it are recorded immediately. Chats get deleted, profiles get renamed and pages come down within hours.
Screenshots are taken with the address bar visible, and the transaction is saved by its identifier rather than by a screenshot alone, because the identifier stays verifiable.
| Order | Action | Why it comes here |
|---|---|---|
| 1 | Move remaining funds to a clean wallet | Access may still be open |
| 2 | Revoke permissions and end sessions | Stops repeat withdrawals |
| 3 | Record identifiers, addresses and messages | Evidence disappears within hours |
| 4 | Report to the platform through its own route | Search results lead to impersonators |
| 5 | Notify the bank if a card or account was used | Dispute windows are short |
| 6 | File a report where the jurisdiction requires it | Other institutions ask for it |
| 7 | Treat every recovery offer as a second loss | Advance payment returns nothing |
03Report in the order that has effect
The platform is notified through its own reporting route, not through a chat found in search. Where a bank account or card was involved, the bank is notified within its dispute window, which is short and starts running immediately.
A police report is filed where the jurisdiction requires one for any later step. It rarely returns the funds directly and it is often the document other institutions ask for.
04Recovery last, and with clear eyes
Offers to return the funds for a fee arrive quickly after a public loss, because losses are visible on chain and the people behind them are findable.
Tracing is genuine work that produces an accurate report about where the funds went, and it changes nothing about who controls them. No major platform sells account recovery as a service. Any advance payment for a promised return is a second loss.
05Questions and answers
What is the very first thing to do after a crypto theft?
Establish whether access is still open and move anything remaining to a wallet created on a clean device with a phrase the attacker has never seen. Stopping further loss is the part that is achievable.
Should I pay a service that promises to recover my funds?
No. Tracing produces a report and does not change who controls the money, and no major platform sells account recovery. An advance payment for a promised return is a second loss.
Is it worth filing a police report for stolen cryptocurrency?
It rarely returns the funds by itself, and it is frequently the document that banks, platforms and insurers require before they will act, so it is filed early rather than late.
Written by Ilia Zavialov, digital security consultant. Profile of Ilia Zavialov
06Read next
- How a Crypto Transfer Actually Works, Step by Step How crypto works
- Types of Crypto Scams and How Each One Is Built Scam types
- Protecting a Crypto Wallet: Measures That Actually Hold Protection