What you do immediately after crypto theft can materially affect the investigation. This 60-minute emergency playbook explains how to secure assets, preserve evidence, alert relevant parties, and start a professional trace.
You notice an outgoing transaction you did not authorize. Your wallet balance has changed. A withdrawal appears on an exchange account that you did not make.
The first reaction is usually panic. The second is often a rush to contact anyone who promises to get the money back.
Neither helps.
If crypto has been stolen, the first hour should be treated as an evidence and containment window. Stolen assets can move through multiple wallets, cross chains, reach centralized exchanges, or enter services that make the trail more difficult to interpret. That does not mean funds become automatically untraceable after 60 minutes, but speed can materially affect the available options.
The goal during the first hour is not to "recover" the crypto yourself. It is to prevent additional loss, preserve reliable evidence, identify what happened, and create the strongest possible starting point for professional blockchain tracing and any legal or law-enforcement action that may follow.
Why the first hour after crypto theft matters
Public blockchains preserve transaction history. An attacker cannot simply delete a Bitcoin or Ethereum transaction after it has been confirmed.
But permanence does not mean there is unlimited time to react.
The practical challenge is what happens next. Stolen assets can be transferred again very quickly. Automated scripts can move funds shortly after a wallet compromise. Assets may also be swapped, bridged to another blockchain, divided among multiple addresses, or transferred toward a centralized service.
Each additional movement increases investigative complexity.
Speed matters most when stolen funds reach a service capable of identifying its customer or restricting an account. A centralized exchange may represent an important investigative choke point because it can possess customer records that do not exist on the blockchain itself.
However, an exchange does not automatically freeze assets because someone reports a theft. Requirements differ between platforms and jurisdictions. Exchanges may request transaction hashes, wallet addresses, identification, a police report, or contact from law enforcement before taking action.
This is why the answer to what to do after crypto theft begins with evidence, not promises of instant recovery.
Minutes 0 to 10: stop further loss and preserve the scene
First determine whether the incident is still active.
If an exchange account has been compromised, secure the account using the exchange's official website or application. Change credentials from a trusted device, review active sessions and API keys, and enable or reset appropriate authentication controls.
If a self-custody wallet may be compromised, the response depends on what has been exposed. A leaked seed phrase is fundamentally different from a malicious token approval or compromised browser session.
Do not enter the affected seed phrase into random websites or "recovery tools." Do not send additional funds to an address simply because someone claims they are required to unlock, verify, or recover the stolen crypto.
If unaffected assets remain at immediate risk, moving them to a newly created wallet from a clean environment may be necessary. The compromised seed phrase should never be reused for the replacement wallet.
At the same time, preserve evidence before it disappears from devices or applications.
Capture screenshots of unauthorized transactions, exchange notifications, wallet balances, malicious websites, emails, text messages and relevant conversations. Do not delete browser history, wallet applications, emails or chat threads simply because they contain scam material.
The blockchain record will remain. Some of the off-chain evidence may not.
Minutes 10 to 20: build an evidence ackage
An investigator needs a precise starting point.
Write down the facts before memory becomes mixed with assumptions. Record when you first noticed the theft and when you last knew the account or wallet was secure.
The most useful initial evidence normally includes:
- transaction hash or transaction ID
- affected blockchain and cryptocurrency
- victim wallet address
- destination address of the unauthorized transaction
- exact amount transferred
- approximate time the incident was discovered
- relevant exchange account information
- screenshots of balances and transaction history
- suspicious emails, messages, websites or applications
- any interaction immediately preceding the loss
- information about whether a seed phrase, private key, password or authentication code may have been exposed
Do not edit screenshots to make them "cleaner." Preserve original files where possible.
Also avoid publicly posting every wallet address and investigative detail on social media. Public exposure can alert the perpetrator, attract recovery scammers and complicate later evidence handling.
Minutes 20 to 40: contact the right parties
Once the immediate evidence has been preserved, escalation should begin.
If the theft originated from a centralized exchange, contact that exchange through its official fraud or security channel immediately.
If blockchain tracing already indicates that stolen assets have reached another centralized exchange, that platform may also need to be notified. A professional investigator can help prepare an evidence-based notification containing the relevant transaction path, transaction hashes, wallet addresses, amounts and timestamps.
It is important to understand the limitation here.
A private investigator cannot compel an exchange to seize or return cryptocurrency. A forensic report can provide evidence, document the transaction path and identify the destination of funds, but freezing, disclosure or seizure may require cooperation from the exchange, law enforcement, a court or another legally authorized body.
Victims should therefore also report serious crypto theft to the appropriate police, national cybercrime authority or relevant reporting body in their jurisdiction.
This may not result in immediate recovery, but reporting still matters. It can help authorities connect cases involving the same wallets, infrastructure or criminal networks, identify patterns across jurisdictions and coordinate action against larger fraud operations.
Useful official reporting portals include:
- European Union: Europol: Report Cybercrime Online
- United States: FBI Internet Crime Complaint Center (IC3)
- Australia: Australian Cyber Security Centre: Report and Recover
For significant cases, legal counsel may also be necessary, particularly where urgent preservation, disclosure or freezing measures could be available.
Bloctopus Intelligence's incident reporting service is designed to organize incident information and supporting evidence into a structured record that can support subsequent communication with exchanges, investigators, legal counsel and relevant authorities.
Minutes 40 to 60: start the blockchain trace
The final part of the first hour should focus on establishing where the stolen assets went.
A block explorer can confirm individual transactions, but a professional trace goes substantially further.
Blockchain investigators reconstruct the movement of assets across addresses and transactions, identify relevant entities where reliable attribution exists, examine interactions with exchanges or other services, and preserve the resulting evidence.
The goal is not simply to produce a colorful transaction graph.
Investigators are looking for actionable points in the flow.
If stolen assets enter a centralized exchange, for example, the exchange may hold information that connects an on-chain address to a verified customer account. If funds move across chains, investigators may need to reconstruct the continuity of the asset flow rather than stopping at the bridge transaction.
Stolen crypto can move within minutes. In some cases, transfers are automated. There is therefore no reliable grace period during which funds remain in the first destination wallet.
That is why professional crypto funds tracking should begin as early as practically possible in significant theft cases.
Which exchanges will freeze stolen crypto?
There is no universal list of exchanges that will automatically freeze stolen funds upon request.
Major regulated centralized exchanges generally maintain fraud, compliance and law-enforcement procedures, but their requirements differ.
A victim report may lead to internal review, but a platform can ask for additional evidence before restricting an account. In other circumstances, formal law-enforcement or judicial involvement may be required.
Useful information typically includes the stolen transaction hash, victim wallet address, traced destination address, amount, timestamps, explanation of the incident and police case information where available.
The stronger the evidentiary chain, the more useful the notification is likely to be.
This is one reason investigators distinguish between saying "the funds went to this address" and establishing a documented transaction path that can be reviewed independently.
Can stolen crypto be traced or recovered?
Often, stolen cryptocurrency can be traced. Recovery is a separate question.
Most public blockchains create permanent transaction records. Investigators can follow movements between addresses and, in appropriate circumstances, identify interactions with exchanges, bridges and other services.
But blockchain tracing does not give an investigator control over the destination wallet.
Actual recovery generally requires an actionable point where technical evidence intersects with legal authority or cooperation from a third party. A cooperative centralized exchange holding the assets is a very different scenario from funds remaining entirely under the control of an unidentified private wallet holder.
Recovery feasibility therefore depends on several factors:
the speed of the response, quality of evidence, transaction path, destination of the funds, available attribution, jurisdiction, platform cooperation and possible legal measures.
Some cases have a realistic recovery path. Others do not.
A credible forensic firm should assess those factors before making claims about what can realistically be achieved.
Bloctopus Intelligence uses a feasibility-first approach and only takes recovery cases where the initial assessment indicates a realistic path toward resolution.
Tracing should never be presented as a guarantee of recovery.
Common mistakes during the first 60 minutes
One of the most damaging mistakes is contacting supposed recovery agents found through unsolicited messages, social media or search advertisements without verifying who they are.
Victims of crypto theft are frequently targeted again.
Be particularly cautious of anyone claiming they have already located the funds, promising guaranteed recovery, asking for a "release fee," requesting wallet credentials, or claiming they can hack the perpetrator.
The CFTC's guidance on recovery fraud specifically warns victims about schemes that exploit people who have already lost money.
Another mistake is waiting several days because the transaction appears irreversible.
Blockchain transactions may be irreversible at the protocol level, but that does not make investigation pointless. The relevant question is where the assets subsequently move and whether an actionable endpoint can be identified.
Finally, do not confuse activity with progress. Sending dozens of poorly documented emails to exchanges is less useful than providing one coherent evidence package showing exactly what happened.
What to do after the first hour
The first hour is about containment, evidence and escalation. The investigation that follows may take considerably longer.
Continue preserving all new communications and transaction information. Obtain a police case reference where appropriate. Do not contact the suspected perpetrator unless advised to do so by relevant professionals. Do not send additional cryptocurrency in an attempt to "unlock" stolen funds.
If the financial loss is significant, a professional forensic assessment can determine whether further investigation is proportionate and whether the transaction path contains realistic recovery opportunities.
The most important thing to remember is that urgency should produce disciplined action, not panic.
Crypto theft does not automatically mean that funds are recoverable. It also does not mean that nothing can be done. A fast, evidence-driven response gives investigators, exchanges, lawyers and authorities the strongest possible factual foundation from which to work.