It Just Happened. Here's What to Do Right Now.
Stolen crypto moves fast. The actions you take in the next few hours have more influence on the outcome than anything that happens later. Work down this list before you do anything else.
Do this in the first 24 hours
- Stop all payments immediately — do not send a 'fee', 'tax', or 'unlock' payment of any kind
- Screenshot the platform dashboard, balance, transaction history, and every support conversation
- Export your chat history from WhatsApp, Telegram, or the app where contact began
- Collect every transaction hash and destination wallet address in full
- Download your exchange account statements and withdrawal confirmations
- Contact your bank or card issuer if any fiat payments were involved
- Revoke any active token approvals if your wallet was drained
- File with IC3 and the FTC — free, and the foundation of every later pathway
Do not do these
Do not confront the scammer or tell them you are investigating
Do not delete the app, close the account, or reset the affected device
Do not engage with anyone who contacts you offering to recover the funds
Do not send additional funds under any circumstances or explanation
Deleting an app or resetting a device destroys evidence that cannot be recovered. Confronting the other party leads to accounts being deleted within minutes. Preserve first, act second.
Why the clock matters
Funds often still sit at the first destination address. Exchange deposits are most likely to be reachable, and fiat wires may still be recallable.
Consolidation and layering begin. Funds move through peel chains, swaps, and bridges. Tracing remains highly effective but the trail lengthens quickly.
Off-ramping through exchanges and OTC desks. Tracing still works, but the number of intermediate hops and jurisdictions grows considerably.
Cases remain workable and are still worth submitting — documentation, reporting, and clustering matter regardless of elapsed time. Expectations should be adjusted.
Reach a coordinator directly
Emergency submissions are prioritised. If you would rather speak to a person first, use any of these — there is no charge and no obligation.