My crypto was stolen: what to do in the first 24 hours

Treat the incident as an active compromise until you prove otherwise. If a hot wallet, browser extension, or device may still be under attacker control, move remaining funds to a fresh wallet created on a clean device — after you understand whether approvals or malware are still active.

• Do not reuse seed phrases from a compromised wallet on a new device.
• Create a new recovery phrase offline if you need a destination for remaining assets.
• Revoke token approvals on EVM chains if a drainer used permit/approve flows (see our wallet-drainer guide).
• Change passwords and enable 2FA on exchange accounts, email, and cloud backups tied to crypto logins.

Never share seed phrases or private keys with “recovery agents,” Telegram helpers, or anyone claiming they need them to reverse a transaction. Legitimate tracing does not require keys.

Block explorers keep public history, but your local context disappears fast: chat logs, phishing URLs, screenshots, and the exact time you noticed the loss. Capture that now.

1. Write down networks involved (Bitcoin, Ethereum, Tron, Solana, etc.) and approximate UTC time of the theft.
2. Copy source wallet addresses and outgoing transaction hashes from the explorer.
3. Save URLs of phishing sites, dApps, or “support” chats (do not reconnect a compromised wallet to them).
4. Export email headers or SMS if a SIM-swap or account takeover was involved.
5. Note amounts and assets (BTC, ETH, USDT, USDC, and so on) as displayed on-chain.

A clear time window and a source hash make later tracing cheaper and more accurate. Vague “sometime last week” reports create blind branches.

Right after a theft, scammers often contact victims with guaranteed recovery offers. Common patterns: urgency, secrecy, requests for seed phrases, “gas fees” or “taxes” before funds are released, and screenshots of fake dashboards.

Blockchain transfers are generally irreversible. No honest service can promise to reverse a confirmed transaction. Treat recovery guarantees as a red flag. Read our guide on spotting fake recovery experts before you pay anyone.

If funds may have reached a known exchange or custodial service, early contact with that service’s compliance or fraud desk can matter. They may already flag the deposit cluster; they will not reverse the chain for you, but a letter-ready path helps them locate the deposit.

You usually need transaction hashes, amounts, timestamps, and — when available — a defensible label for the receiving hot wallet or deposit cluster. Our exchange compliance guide covers how to write that contact without overclaiming.

On-chain tracing follows value from a source event through hops, bridges, and splits, looking for where funds enter a KYC service or otherwise leave a usable trail. It produces a document: path, labels with confidence, and either a cash-out candidate or a clear dead end.

• Helps when you need evidence for police, counsel, or an exchange letter.
• Helps when you do not know which service (if any) received the funds.
• Does not recover coins, freeze accounts by itself, or guarantee a KYC recipient exists.
• May end in mixers, unhosted wallets, or unlabeled clusters — and an honest report will say so.

MBTrace sells that investigation PDF (quoted per case, from $50+, typically 24–48h after payment). Payment is taken only after an analyst reviews and accepts the case. It is not a recovery service.

Authorities and lawyers work from documents, not Telegram threads. Bring transaction hashes, explorer links, a timeline, and — if you have one — a path report that cites hops and limitations. Our police reporting guide outlines what evidence usually helps, without promising any legal outcome.

This article is general information, not legal advice. Local reporting channels and evidence rules differ by country.

1. Secure remaining funds and revoke risky approvals.
2. Save hashes, times (UTC), networks, and phishing URLs.
3. Ignore anyone asking for seeds or “recovery fees.”
4. Contact relevant exchanges with facts only.
5. Decide whether you need a letter-ready on-chain path report.
6. Prepare a police/counsel packet with primary sources.

Assume your email or phone may also be under attack if the theft involved SIM-swap, password reset, or exchange account takeover. Use a secondary channel to contact exchanges and counsel when possible. Do not approve new devices on accounts until you understand the breach path.

If you posted about the theft publicly, expect inbound DMs. Do not share seed phrases, screenshots of seed cards, or remote-desktop access. Point helpers to public transaction hashes only. Move sensitive follow-up to official support tickets you open yourself from bookmarked URLs.

• Bookmarks beat search ads for exchange login and support pages.
• Record who contacted you, when, and from which handle — useful if a second scam starts.
• Tell family not to wire money for “recovery fees” on your behalf.

Not every case needs a paid path report on day one. If funds clearly remain in your own wallet after a failed phishing attempt, priority is securing keys. If a large transfer already left to an unknown cluster, a scoped investigation helps you see whether a KYC door exists before you spend weeks guessing.

When you do commission work, prefer services that never ask for seeds, quote after review, deliver a document with named limits, and refuse recovery guarantees. That filter alone removes most of the recovery-scam market. MBTrace is built around that filter: analyst review first, PDF path second, no recovery promise.

Keep a written timeline even if you pause. Memory fades; explorers do not replace the story of how you were socially engineered or which device was compromised.