Short answer
What to do in the first 24 hours after crypto theft
In short: stop further losses, save the TXIDs and chats, write to the exchange that received the funds the same day, and file a police report. A transaction cannot be reversed, but in the first day stolen coins may still sit on an exchange or in a stablecoin that its issuer can freeze. The sooner a request arrives there, the better the chance it is reviewed in time.
The 24-hour plan
- Hour 0–1: stop further losses. If your seed phrase leaked, create a new wallet on a clean device and move whatever is left. If you signed a malicious transaction, revoke the token approvals. If your exchange account was hacked, change the exchange and email passwords, reset 2FA, delete API keys and ask support to lock withdrawals.
- Hour 1–3: save the TXIDs and evidence. For every outgoing transfer write down the transaction hash (TXID), network, amount, time and receiving address. Export the full chats with the scammer, save links to the websites and profiles, and receipts for buying the crypto. Keep one timeline: date, time, what happened, TXID.
- Hour 3–12: write to the exchange. Open the receiving address in a block explorer (Etherscan, Tronscan, BscScan). If the funds reached an address labelled as an exchange, write to its compliance or security team via the official website: TXIDs, addresses, amounts, a short description and a request to review and hold the funds. If USDT or USDC was stolen, keep the addresses for a request to Tether or Circle.
- Hour 6–24: file a police report. Exchanges and issuers usually freeze funds on an official request, so the report is not a formality. Attach the timeline and TXIDs, get the report number and send it to the exchange in a follow-up email.
- Same day: your bank. If you bought the crypto by card or bank transfer to send it to the scammer, file a fraud claim with your bank.
- Before the day ends: a case review. Send a lawyer the TXIDs and the timeline — they will tell you whether a realistic legal route exists: a freeze request, a claim against the exchange, a lawsuit.
If more than a day has passed, the plan is the same — hour by hour and day by day in the first 48 hours after crypto theft; how to write the report — in reporting crypto theft to the police.
What not to do
- Do not pay anyone who writes “we found your money” — that is the second scam. How to tell: honest lawyer or recovery scammer.
- Do not enter your seed phrase on any “check” or “restore” website, and never share it.
- Do not top up a fake platform to “unlock withdrawal” — it will not let you withdraw.
- Do not delete chats or apps, however much you want to.
Honest about the chances
Even a perfectly followed plan does not guarantee recovery. An exchange may refuse without a court order, funds may move through a mixer or an OTC desk, and the police may not open a case. The first day only gives a chance that a request reaches a place where funds can still be frozen. More: can stolen crypto be recovered?
Free first review of your case
Tell us what happened. Within one business day we will reply whether anything can realistically be done — a freeze request, a claim, a police report — and what it would cost. We do not guarantee recovery and never ask for seed phrases or private keys.
Prefer the main page? Free first review — Crypto Recourse. Ref. H-cryptorecourse-006.Questions we are asked
What is the very first thing to do?
Make sure nothing else can be taken: move what is left to a new wallet, revoke approvals or lock the exchange account. Then save the transaction hashes.
Where do I find the TXID?
In your wallet’s or exchange’s transaction history: open the outgoing transfer and copy the transaction hash, or find it in a block explorer by your wallet address.
Do I need the police if the exchange can freeze the funds?
Yes. Most exchanges and stablecoin issuers act on an official request from law enforcement, so the police report is usually what makes a freeze possible.