If crypto was stolen, stop further exposure first: secure connected accounts, move unaffected assets from compromised wallets, revoke malicious permissions, preserve transaction evidence and contact relevant platforms through official channels. Blockchain transfers are usually irreversible, so nobody can guarantee recovery.
Identify the compromised boundary#
Do not start by clicking every “recovery” result. Determine how the assets moved.
- Exchange withdrawal: inspect login history, email changes, API keys and withdrawal records.
- Self-custody transfer you did not sign: suspect seed/private-key exposure or a compromised signer.
- Known contract interaction followed by loss: inspect token approvals, NFT operators and signature activity.
- Transfer you were persuaded to make: treat it as fraud and preserve the conversation and destination details.
Copy transaction hashes and addresses from a trusted block explorer. Record the time, asset, network and amount. This evidence helps platforms and investigators distinguish a login takeover from an onchain approval or social-engineering payment.
Contain the loss without feeding the attacker#
For an exchange account, secure the recovery email from a clean device, change credentials, revoke sessions and API keys, use any account-lock feature, and contact the platform through its independently verified support page.
For a leaked seed phrase or private key, create a wallet with new recovery material and move assets that remain. Do not deposit gas into a compromised address without understanding the risk: a sweeper bot may immediately remove it. Complex rescues should not be attempted through strangers who contact you.
For malicious allowances, revoke the relevant token and operator permissions. If the signer, device or seed may also be compromised, revocation is not enough—migrate the assets.
Preserve a clean evidence package#
Save:
- transaction hashes and full wallet addresses;
- asset names, contract addresses, amounts and timestamps;
- screenshots of account history and security notifications;
- phishing domains, app-store listings and downloaded filenames;
- usernames, phone numbers, email headers and chat exports;
- support ticket numbers and law-enforcement reports.
Do not edit screenshots in a way that removes timestamps or identifiers. Keep originals and work from copies. The FBI’s IC3 asks crypto victims for addresses, transaction IDs, asset details, dates and amounts.
Contact parties that can still act#
A blockchain transaction may not be reversible, but custodial services can sometimes preserve account records, flag addresses, restrict an account under their control or respond to lawful requests. Notify the sending and receiving exchanges quickly if one is identifiable.
Report the incident to the cybercrime or law-enforcement channel in your jurisdiction. U.S. victims can use IC3 and may also report consumer fraud to the FTC. Do not post sensitive recovery information publicly while asking for help.
Avoid the second scam#
Victims are frequently approached by people claiming to be hackers, tracing experts, regulators or lawyers who can “unlock,” “reverse” or “hack back” funds for an upfront fee. The FBI warns that fraudulent recovery services target people who already lost crypto.
Legitimate investigators cannot guarantee recovery. Never give a recovery service your seed phrase, private key, remote access or additional “verification payment.” Verify professional credentials independently and understand the scope before sharing case data.
Learn from the transaction path#
After containment, reconstruct the sequence: where the link came from, which device was used, what was signed, what permissions existed and which alerts were missed. Replace the failed security control rather than merely buying a new wallet.
If a reused password caused the exchange takeover, rotate it everywhere. If the phrase was in cloud storage, replace the wallet and the backup method. If a blind signature caused the loss, adopt simulation and a low-balance interaction wallet.
Frequently asked questions#
Can a blockchain transaction be canceled after confirmation?
Normally no. A recipient may return funds voluntarily, or a custodian may act on assets it controls, but the network does not provide a general chargeback.
Should I message the thief’s address?
Do not send more funds or reveal personal information. Preserve evidence and seek guidance from official reporting channels.
Can an exchange recover self-custody funds?
An exchange cannot rewrite an external blockchain. It may be able to act if stolen assets enter an account it controls and appropriate legal or compliance procedures apply.
Is onchain tracing the same as recovery?
No. Tracing can describe movement and help identify service touchpoints, but it does not itself transfer control back to the victim.
Sources#
- Ethereum.org: Scam Help and Reporting
- FBI IC3: Guidance for Cryptocurrency Scam Victims
- FBI IC3: Fraudulent Cryptocurrency Recovery Services
- MetaMask: Hacked or Scammed
Emergency note: Do not share keys or make additional payments to anyone promising guaranteed recovery. Obtain qualified legal advice for significant losses or cross-border incidents.
Editorial standard
This guide is educational and source-led. Security controls, exchange rules and legal requirements can change; verify critical steps through the relevant official service before acting.
