If you’ve just been scammed or hacked, the next few hours matter more than anything that comes after. Take ten slow breaths — panic makes people sign things they shouldn’t — then work through this list in order. We’ll be honest up front: full recovery is uncommon. But fast, correct action limits the damage, and there are cases where it genuinely helps. Here’s what to do, and what to expect.
First: stop the bleeding
- Revoke malicious approvals. If the attack involved a signature — a fake mint, a phishing site — the drainer likely holds an allowance on your tokens. Revoke it immediately; our approvals guide shows how, and it takes five minutes.
- Move everything remaining to a brand-new wallet. Not your usual second wallet — a freshly generated one, with a new seed phrase, on a clean device. Assume the compromised wallet is being watched by a sweeper bot that grabs anything deposited into it, forever. Never use it again.
- Lock your email and exchange accounts. Change passwords, rotate 2FA if there’s any chance it was exposed, and check email forwarding rules for ones you didn’t create. The full lockdown sequence is in securing your exchange account.
- Freeze if you still can. If an exchange account is compromised and funds remain, contact support now and ask for an emergency freeze — exchanges can lock accounts and sometimes halt pending withdrawals.
Two edge cases worth stating plainly. If your seed phrase was exposed (you typed it into a site, photographed it, shared it), every account derived from that phrase is burned — generate a new wallet from scratch, not just a new account in the old one. And if your phone number was hijacked in a SIM swap, call your carrier to reclaim the number first; until you do, every SMS-based reset code belongs to the attacker.
Document everything before you touch anything else
Screenshot and save: transaction hashes, the attacker’s addresses, the scam website URL, every chat log and email, the profile that contacted you, and a written timeline while your memory is fresh. Don’t delete the scam app or wipe the device — investigators and exchange compliance teams will ask for exactly this material, and it’s impossible to reconstruct later.
Report it — every channel, same day
- FBI IC3 (ic3.gov) — the main US channel for crypto fraud reports; they aggregate cases and have driven real seizures.
- FTC (reportfraud.ftc.gov) — quick to file, feeds consumer-protection enforcement.
- Local police. Often a dead end technically, but a police report number is required documentation for insurance claims, some exchange investigations, and tax purposes.
- Every exchange the funds touched. If you can trace your coins to a deposit address at a known exchange, report it to that exchange’s fraud team with the transaction hash. Exchanges can — and do — freeze accounts receiving stolen funds. This is the single most realistic recovery lever, and it decays by the hour.
The tracing part is real
Blockchains are public ledgers: your stolen coins’ journey is visible to anyone. Professional blockchain-forensics firms — Chainalysis, TRM Labs, Elliptic — exist precisely to follow these trails, and law enforcement agencies worldwide use them. Large cases do occasionally end in seizures and partial victim restitution, typically when funds land at a regulated exchange or a mixer gets sanctioned. The realistic obstacles are speed (funds hop chains and mix within hours) and jurisdiction (the thief is usually abroad). Report fast anyway — a freeze request that lands while coins sit at an exchange is worth more than any investigation afterward.
The second scam: “recovery agents”
Read this paragraph twice. Within days, you will be contacted — in comment sections, Reddit DMs, Telegram — by people who “recovered $80k for a client just like you.” Every single one is a scammer. No private company can reverse a blockchain transaction or “hack back” your funds; that capability does not exist for sale. The script is always the same: upfront fees, then taxes, then “unlock charges,” until you stop paying. Some are the original scammers returning for a second harvest, which is why victims who post publicly get targeted hardest. Anyone guaranteeing recovery is lying; legitimate forensic firms work for law enforcement and institutions, not through Instagram DMs.
Honest expectations
Most stolen crypto is not recovered — that’s the truth no one selling hope will tell you. Crypto scams have cost victims over $10 billion in recent years, and only a small fraction returns. Report anyway: your IC3 filing joins thousands of others that build the cases leading to actual seizures, and pig butchering networks have been dismantled on exactly this kind of aggregated evidence. Filing takes an hour and costs nothing; not filing guarantees nothing happens.
Taxes on stolen or lost crypto
The rules vary by country and are genuinely messy. In the US, personal theft losses have generally not been deductible since the 2017 tax overhaul (outside federally declared disaster areas), though narrow arguments exist and guidance keeps evolving — the details belong in a conversation with a crypto-literate tax professional, not a blog post. Other countries treat theft disposals differently again. See our crypto taxes guide for the baseline, then talk to a professional before claiming anything.
Afterward: protect what’s left, and yourself
Re-audit everything using the guides linked above, and be ready for the emotional aftershock — shame is the normal response, and it’s what scammers count on to keep victims quiet. You were targeted by professionals running an industrial process; reading how these schemes work helps both your defenses and your perspective. Talking about it openly is how the next person doesn’t fall for it.
Where to go next
Work through checking and revoking token approvals, lock down your accounts with our exchange security checklist, and study the patterns in how to spot crypto scams so there’s no second time.
This guide is educational only and is not financial, legal, or tax advice. Recovery outcomes vary; consult qualified professionals for your situation. Read our full disclaimer.