The first 24 hours: a critical action plan after a crypto scam

Falling victim to a crypto scam can feel overwhelming, especially in the first few hours when uncertainty and urgency take over. However, what you do next can make a significant difference. Acting quickly can help limit further losses, preserve critical evidence, and increase the chances of tracking or even recovering stolen funds.

This guide walks through the first 24 hours after discovering a scam, breaking down the response into clear, practical steps. From immediate damage control to reporting the incident and protecting yourself from follow-up scams, it provides a structured approach to help you stay in control and respond effectively in a high-stress situation.

Immediate action plan (hours 0-6)

In the first six hours, the main goal is damage control. Scammers often rely on a victim’s panic to extract even more money or cover their tracks, so it’s crucial to remain composed in those critical moments.

I. Stay composed and stop the bleed

The moment you realise something is wrong, the first instinct is to act. Take a breath and do not send any more money. Scammers will often invent “tax fees” or “activation costs” to convince you that your funds are just one payment away and get you to impulsively send them more money. Don’t - (a legitimate platform will never ask you for a payment to withdraw your own funds).

II. Sever communication

Stop all communication with the scammers immediately. Do not confront them and don’t threaten them with involving the police; the moment you let them know you’re aware of the fact that they’re scamming you, they get a head start. They might move your funds through a mixer to erase traces or delete their accounts.

III. Secure remaining assets

Assume anything the scammers accessed may still be compromised and act quickly to contain damage. Move remaining funds to a new, clean wallet (preferably a hardware (cold) wallet) and never reuse the same wallet or seed phrase. Revoke any suspicious permissions if you interacted with unknown platforms. Treat your device as compromised, especially if the scammers convinced you to download any type of downloadable files: remove suspicious software, scan it, or use a trusted device. At the same time, secure your accounts on a trusted device by changing passwords, enabling app-based two-factor authentication, and checking for unauthorised access.

IV. Document everything

Collect and preserve all evidence as early as possible. Take screenshots and create a structured “evidence folder” including transaction IDs / hashes (TXIDs) of the fraudulent transfers, wallet addresses (both yours and the scammer’s), and all communications (conversations, phone numbers, emails, URLs of fake websites or platforms, and any documents you shared).

Record precise dates, times, and time zones for every key action (first contact, each transfer, account changes), along with platform identifiers (usernames, profile IDs, Telegram/WhatsApp handles, Discord IDs) and email headers where possible. Export full transaction data (not just TXIDs), note any exchanges or services used, and clearly distinguish your transactions from scammer-controlled ones. Include any signs of account compromise, such as unauthorised logins, password resets, or 2FA changes. Organise everything into a clear chronological timeline: how you were contacted, what was promised, and the exact amounts sent or stolen while keeping original files unedited and well-structured for investigators. Given the importance of accuracy and detail, consider engaging a professional to properly compile and organise the evidence.

Reporting and investigation (hours 7-18)

Once the immediate threat is neutralised, it is crucial to respond to the incident as quickly as possible. In cases of crypto scams and stolen funds, crypto exchanges and local authorities such as the police and national fraud agencies are key actors who can take action and potentially assist in recovering your assets.

Be aware that so-called “white hackers” and similar services offered online are almost certainly scams. Legitimate professionals will not offer services such as “hacking” or “full crypto recovery.” Instead, their work is typically described as preparing a comprehensive blockchain forensic report for law enforcement or assisting in applying pressure on exchanges to freeze or recover funds through proper legal channels.

In the following steps, fast and effective cooperation with professionals and authorities is essential to enable appropriate countermeasures:

• Notify the platform (crypto exchange)

  If you sent funds from a centralised exchange (e.g. Binance), contact their fraud or support department immediately. Provide all relevant details that you have previously compiled for the documentation, so they can flag the recipient address, monitor fund movements, and potentially freeze assets if they reach another custodial platform. Speed is critical, as delays significantly reduce the chances of intervention.

• File a report with local authorities (police)

  Submit a detailed report including all collected evidence. Authorities will require structured and comprehensive documentation, so ensure your evidence folder and timeline are clear and complete. Working with a professional to compile a forensic report can improve the quality of your case and increase the likelihood of active investigation and recovery efforts.

• Report to national or international authorities (fraud agencies)

  Report the incident to relevant national or international cybercrime agencies (e.g. IC3 in the US, Europol in the EU). While this may not lead to immediate recovery, it helps authorities track scam networks, link cases across jurisdictions, and take coordinated action against large-scale operations. Some of the best portals for communication with the relevant authorities are listed below, organized by jurisdiction.

• EU: https://www.europol.europa.eu/report-a-crime/report-cybercrime-online

• USA: IC3.gov

• AUS: https://www.cyber.gov.au/report-and-recover/report

Preventing further damage (hours 19-24)

Protecting yourself after a crypto incident is not just about immediate damage control, but about preventing further losses and avoiding additional scams. Many victims are targeted again, often by actors posing as recovery specialists. Taking informed, cautious steps early can significantly reduce long-term risk. The following guidelines focus on protecting your assets, your data, and your decisions going forward.

• Beware of recovery scams

  Be cautious of so-called “recovery experts” or “ethical hackers” who promise to retrieve your funds for an upfront fee. These are almost always scams. Legitimate recovery does not involve “hacking the blockchain,” but rather legal processes, forensic analysis, and cooperation with authorities and exchanges

  
  

• Consult a professional

  Consider engaging a blockchain forensics expert or legal counsel specialising in digital assets. They can perform chain analysis, trace where your funds moved, assess whether recovery is realistic, and help you take appropriate legal or procedural steps

  
  

• Improve your security

  Strengthen your security to prevent further incidents. Educate yourself on common scam techniques (e.g. pig butchering, rug pulls), enable app-based two-factor authentication, keep your private keys secure, and review any custodial wallets or applications that have access to your funds