How to report crypto theft to the police

Secure remaining funds and preserve evidence first (see our first-24-hours guide). Police processes differ by country and even by station. Many units still treat crypto as unfamiliar; your job is to make the facts easy to verify on a public explorer.

This article is general information, not legal advice. It does not create an attorney-client relationship and does not tell you which statute applies in your jurisdiction.

• Your identity and contact details as required by local filing rules.
• Approximate UTC time when funds left your control.
• Networks and assets involved (for example ETH on Ethereum, USDT on Tron).
• Source wallet addresses you controlled and outgoing transaction hashes.
• Explorer links to those transactions.
• Description of the method: phishing site, fake support, malware, romance scam, investment fraud, etc.
• Any communication with the attacker (exports, not just screenshots).
• If available: a path analysis naming later hops and any labeled custodial cash-out.

Avoid dumping unrelated wallets or speculative theories. Officers and analysts need a clean starting event.

1. Who you are and how you held the assets (self-custody vs exchange).
2. What happened in chronological order.
3. Exact on-chain identifiers (hashes/addresses) for the loss event.
4. What you have already done (secured funds, contacted an exchange, hired analysis).
5. What you are asking for (record of the complaint; investigation if available).

Bring printed or PDF copies of explorer pages and any investigation report. Keep originals. Do not hand over seed phrases under any circumstance.

A professional report can package hops, amounts, times, and confidence-labeled service attributions so a non-specialist can follow the story. It may point to a KYC exchange deposit cluster as a letter recipient candidate. It cannot promise freezes, arrests, or recovery.

If you commission MBTrace, you receive that PDF after an analyst accepts the case and you pay the quote. Sample format: /sample-report.pdf on this site.

• Filing a report creates a record; it does not guarantee active tracing by police.
• Cross-border cases are slower and harder.
• Without a custodial cash-out, options may be limited.
• Civil counsel may be needed in parallel — that is a legal decision for you and your advisor.

Many victims leave the station frustrated because nobody “pulled the money back.” That reaction is understandable and also a misunderstanding of what a report does. You are creating a dated record with primary identifiers so that, if a later freeze or mutual-legal-assistance request becomes possible, there is a case file to attach to — not a magician on shift.

Reporting channels vary: national cybercrime portals, local police stations, or specialized financial-crime units. Search your government’s official domain for crypto or cybercrime reporting. Prefer official sites over ads. If you live in one country and the cash-out appears in another, say so clearly in the narrative and keep both jurisdictions’ identifiers ready; you still usually start with where you can file as a victim.

Language matters. Include English ticker symbols and explorer URLs even when the statement is in your local language. Officers who forward cases to cyber units often need machine-checkable links more than polished prose.

A lawyer is not a prerequisite for filing in many places, but counsel can help when amounts are large, when exchanges demand formal process, or when you are being pressured by recovery scammers. Bring the same evidence pack: hashes, times, and any path PDF. Do not let anyone — counsel included — talk you into sharing a seed “for safekeeping.”

• Seed phrases, private keys, or hardware wallet PIN codes.
• Unrelated wallet histories meant to “impress” with volume.
• Unverified screenshots from recovery scammers claiming freezes.
• Speculation about named individuals without primary evidence.

If an officer asks for something safe to provide — explorer links, your statement, ID — cooperate through official channels. If anyone claiming to be police contacts you first on social media and asks for seeds or gift cards, treat it as impersonation until verified via a number you look up yourself.

Keep your case number and copies of everything submitted. If new hops appear (funds move again), document the new hashes and send a short supplement rather than rewriting the whole story. If you later obtain a path PDF, file it as an addendum with the same case reference.

Continue securing accounts. A police report does not stop ongoing phishing. Parallel civil or exchange processes may proceed on different clocks; your consistent evidence pack helps all of them.