Lost crypto to a hack or a scam? What to do first
Work in this order: stop further losses, keep the evidence, report it. The steps below are general information, not legal advice.
Beware of recovery scams
No one can guarantee recovery. Anyone who contacts you offering to recover funds for an upfront fee is running a scam. ChainHint never sends private messages to victims and never asks for upfront fees.
First steps
Pick what happened. Each list starts with what stops further losses.
A drainer emptied my wallet
- Revoke the approvals the drainer was given. Revoke.cash lists them per network and revokes each one. Revoking costs a network fee.
- Move whatever is left to a new wallet whose seed phrase has never been typed into a website.
- Sign nothing else the site or a “support” account sends you — a “revoke” or “claim” link included.
- Write down the drainer's address and the site's URL before they disappear.
My seed phrase or private key leaked
- Create a new wallet on a clean device: a new seed phrase, never typed into a website or photographed.
- Move everything that is left to it, most valuable first. Assume the old wallet is watched — a sweeper bot can take anything sent to it, gas included.
- Stop using the old seed phrase and every account derived from it. Revoking approvals does not help here: whoever holds the key can sign anything.
- Work out how it leaked — a phishing site, a fake wallet “sync”, malware, a photo in cloud storage — and secure that device or account.
A fake investment or trading platform took my money
- Stop sending money. A “withdrawal fee”, “tax” or “unlocking deposit” is part of the scam; no payment releases the balance the platform shows.
- Save everything before it is deleted: the chats, the platform's URL, the app you were told to install, the names and numbers used.
- Collect the transaction hash of every deposit you made — it is how an exchange or the police follow the money.
- Report it to the police and, where the platform posed as an investment firm, to the financial regulator (see below). This scheme is often called pig butchering.
I entered my details on a phishing site
- If you typed your seed phrase into it, treat the wallet as leaked and follow the steps above — now.
- If you connected your wallet and signed something, revoke the approvals as for a drainer.
- If you entered an exchange password or a 2FA code, change the password, reset 2FA, and check the account's withdrawal addresses and API keys. Contact the exchange through its own website, never a link you were sent.
- Save the phishing site's URL and a screenshot — it goes in your report.
Evidence to keep
- The transaction hash of every transfer out of your wallet, and of every deposit you made to a scam.
- Your wallet address, and every address the funds went to.
- Screenshots of the conversations, with usernames, phone numbers, profile links and dates visible.
- The website or app: its URL, and screenshots of what it showed you.
- The date and time of each event, with the time zone.
- The amounts: which asset, how much, and what it was worth at the time.
Keep the originals and do not edit the screenshots. Write a short timeline while you still remember it.
Where to report
Report to the police of the country you live in. Keep the case or reference number — it is what an exchange or a stablecoin issuer will ask law enforcement for.
United States
Start with IC3. Add the FTC for any scam, and the CFTC or the SEC only when the scam posed as a trading or investment platform.
| Where | When to use it | Link |
|---|---|---|
| Where FBI Internet Crime Complaint Center (IC3) | When to use it Any crypto fraud, scam or hacked wallet. The FBI's central intake for cyber-enabled crime — file here first. | Linkic3.gov |
| Where FBI field offices | When to use it To reach an agent in person — a large amount, or a scammer still in contact with you. Have your IC3 complaint at hand. | Linkfbi.gov |
| Where FTC — ReportFraud.ftc.gov | When to use it Any scam. The FTC shares reports with its law-enforcement partners; it does not resolve individual reports. | Linkreportfraud.ftc.gov |
| Where CFTC — submit a tip or complaint | When to use it Only if you were drawn into a fake trading platform — crypto, forex or futures. | Linkcftc.gov |
| Where SEC — tips, complaints and referrals | When to use it Only if you were sold a fake investment — a platform, fund or token offered as one. | Linksec.gov |
| Where FinCEN MSB Registrant Search | When to use it To check a platform that claims to be a registered money services business. Not a complaint form. FinCEN states that registration is not approval, and that fraudsters cite their listing to look legitimate. | Linkfincen.gov |
European Union
Report to the police of the country you live in. Europol keeps the list of each member state's online reporting site.
| Where | When to use it | Link |
|---|---|---|
| Where Europol — report cybercrime in your country | When to use it Links to each member state's police reporting site. Where a country has none online, report at a local police station. | Linkeuropol.europa.eu |
United Kingdom
England, Wales and Northern Ireland report to Report Fraud; Scotland reports to Police Scotland. Add the FCA when a financial firm was involved.
| Where | When to use it | Link |
|---|---|---|
| Where Report Fraud England, Wales and Northern Ireland | When to use it The national police reporting service for fraud and cybercrime. actionfraud.police.uk now redirects here. | Linkreportfraud.police.uk |
| Where Police Scotland Scotland | When to use it Scotland reports to Police Scotland rather than Report Fraud — online, or by calling 101. | Linkscotland.police.uk |
| Where FCA — report a scam | When to use it Only if an investment, trading or crypto firm was involved — the FCA looks into scams that involve the financial services it regulates. | Linkfca.org.uk |
Ukraine
Report to the Cyber Police. To open a criminal case, file a statement with the National Police: call 102 or go to a police station.
| Where | When to use it | Link |
|---|---|---|
| Where Cyber Police of Ukraine — online report | When to use it The Cyber Police Department's online form, in Ukrainian. Handled as a citizen's appeal. A criminal case is opened by a statement to the National Police (102). | Linkticket.cyberpolice.gov.ua |
Canada
Report online through the national system and to your local police.
| Where | When to use it | Link |
|---|---|---|
| Where National Cybercrime and Fraud Reporting System | When to use it The RCMP's online report, shared with the National Cybercrime Coordination Centre and the Canadian Anti-Fraud Centre. | Linkreportcyberandfraud.canada.ca |
Every link here was opened and read by a person; the oldest of those checks was on 28 October 2026. ChainHint is not affiliated with any service listed.
Can the funds be frozen?
Only by someone able to freeze them: a centralised exchange the funds were deposited to, or the issuer of a stablecoin such as USDT or USDC, which can block its own token at an address — the thief's own wallet included. Coins such as BTC or ETH in a wallet only the thief controls cannot be frozen by anyone.
Exchanges and issuers usually act on a request from law enforcement, not from the victim. That is why the report comes first: a police or IC3 case number is what lets that request move faster.
Trace where your funds went
Paste the address the funds went to, or your own. ChainHint follows the transfers to exchanges, bridges and mixers and shows where they are now. A trace supports your report; it is not a recovery service.
Common questions
What should I do first after crypto is taken from my wallet?
Stop further losses before anything else: revoke the approvals a drainer was given, or, if your seed phrase leaked, move what is left to a new wallet. Then save the evidence — transaction hashes, addresses, screenshots — and report it to the police where you live.
Where do I report crypto theft or a crypto scam?
To the police where you live. In the US, file with the FBI's Internet Crime Complaint Center (IC3). In the EU, use your country's police reporting site, listed by Europol. In England, Wales and Northern Ireland, use Report Fraud; in Scotland, Police Scotland. In Ukraine, the Cyber Police; in Canada, the National Cybercrime and Fraud Reporting System.
Can stolen crypto be frozen?
Only by someone able to freeze it: a centralised exchange the funds were deposited to, or the issuer of a stablecoin such as USDT or USDC, which can block its own token at an address. Both usually act on a request from law enforcement, so a police report and its case number come first. Coins such as BTC or ETH in a wallet only the thief controls cannot be frozen by anyone.
Can someone recover my crypto for a fee?
No one can guarantee recovery. Anyone who contacts you offering to recover funds for an upfront fee is running a scam. ChainHint never sends private messages to victims and never asks for upfront fees. The FBI's IC3 says it never contacts people directly for information or money.
The platform says I must pay a fee before I can withdraw. Should I pay it?
No. A demand for a withdrawal fee, a tax or an unlocking deposit is part of the scam, and no payment releases the balance a fake platform shows you. Stop sending money and report it.
This page is general information, not legal advice. ChainHint is not a law firm or a law-enforcement agency, does not file reports on anyone's behalf, and does not freeze funds.