If your crypto is stolen or hacked, the first hour matters more than any later step. Revoke any active wallet approvals, move whatever remains to a fresh wallet with new keys, and if the theft involved a custodial account, contact the exchange immediately to freeze it. Then report the theft to the FBI’s Internet Crime Complaint Center and local law enforcement, and be aware that on-chain self-custody theft is often unrecoverable and that many advertised recovery services are themselves scams.
Part of our guide: Digital Asset Custody.
The short version
- Act fast. Revoke token approvals, move remaining funds to a new wallet with new keys, and change passwords on linked accounts.
- If it is a custodial account (an exchange), contact them at once to freeze the account and lock withdrawals.
- Report it. File with the FBI’s IC3, notify local law enforcement, and report scams to the FTC.
- On-chain self-custody theft is often unrecoverable, because there is no central party that can reverse a confirmed transaction.
- Be wary of recovery services. Many that promise to get stolen crypto back are a second scam targeting victims.
The first hour after your crypto is stolen
Speed is the only advantage you have, because a thief with your keys is moving funds and you are racing them. Do the containment steps in order and do them fast.
Move what remains. If any assets are still in a compromised wallet, transfer them to a brand-new wallet with keys the attacker has never seen. Do not reuse the compromised seed phrase for anything.
Revoke approvals. If the theft came through a malicious contract or a drainer, revoke the token spending approvals that let it pull funds, using a reputable approval-management tool. Otherwise it can keep draining new deposits.
Lock linked accounts. Change passwords and enable or reset multi-factor authentication on your email and any exchange logins, because those are often the real point of entry.
If it was a custodial account
Custodial theft, where the assets sat on an exchange, is the one scenario with a central party who can act. Contact the exchange’s security or support channel immediately and ask them to freeze the account and halt withdrawals. Exchanges can sometimes lock funds that have not yet left the platform, and speed decides whether that window is still open.
Preserve everything: transaction IDs, timestamps, the addresses funds moved to, screenshots, and any phishing message or link involved. Exchanges, investigators, and law enforcement all work from that record, and it is far easier to gather now than to reconstruct later.
Reporting the theft
Report even when recovery looks unlikely, because reports feed investigations that occasionally trace and seize funds, and because some relief depends on having filed.
File a complaint with the FBI’s Internet Crime Complaint Center (IC3), notify your local law enforcement, and report consumer scams to the Federal Trade Commission. If the theft involved a regulated intermediary, the SEC and CFTC also take reports. Include the on-chain evidence you preserved; the specific addresses and transaction hashes are what make a report actionable.
Why self-custody theft is often unrecoverable
A confirmed on-chain transaction is final. There is no bank to call and no central operator who can reverse it, which is the same property that makes self-custody powerful and makes theft from it hard to undo. Once the keys are compromised and funds have moved, the realistic outcome is often a loss, however unwelcome that is to hear.
That reality is exactly what predatory recovery services exploit. Firms and individuals advertise guaranteed recovery of stolen crypto, ask for an upfront fee or new wallet access, and take that too. Treat any unsolicited offer to recover funds, especially one that contacts you after a public post about the theft, as a second attack rather than a lifeline.
What I actually see
The panic response is the costly one. People, freshly drained, hand keys or fees to the first recovery service that answers, and lose again. The steadier path, containment first, reporting second, skepticism toward anyone promising a reversal, saves more than it feels like it does in the moment.
The second pattern is missing the custodial window. When funds are still on an exchange, minutes matter, and people spend those minutes searching forums instead of contacting the exchange directly.
The third is poor evidence. Victims describe what happened but did not capture the transaction hashes or the destination addresses, and without those the report is far weaker.
Where this goes wrong
The second loss comes from the response, not the theft.
The specific failures: paying a recovery service that was a scam. Reusing the compromised seed phrase on a new device. Skipping the approval revocation, so a drainer keeps working. Waiting to contact a custodial exchange until the funds have already left. And filing no report at all, which forecloses the small chance an investigation offered. None of these bring the crypto back, and each makes the outcome worse.
The decision rule
- Contain first. Move remaining funds to new keys, revoke approvals, and lock linked email and accounts.
- If custodial, contact the exchange immediately to freeze the account.
- Preserve evidence: transaction hashes, addresses, timestamps, and any phishing message.
- Report to IC3, local law enforcement, and the FTC, with the on-chain evidence attached.
- Refuse recovery services that promise to get funds back for an upfront fee or wallet access.
- Consult a CPA before assuming any tax deduction, because theft-loss rules are narrow.
If someone contacts you promising to recover the stolen funds, the safest assumption is that they are the next thief, and the right move is to stop, not to send anything.
A note on the tax side
Do not assume a stolen-crypto loss is deductible. The Tax Cuts and Jobs Act suspended the personal casualty and theft loss deduction for most situations for tax years 2018 through 2025, with narrow exceptions such as federally declared disasters and certain transactions entered into for profit. Whether any deduction is available depends entirely on your facts, so treat it as a question for a CPA rather than an assumption, and see IRS guidance on casualty, disaster, and theft losses before relying on one.
Where this sits
Theft is the failure mode custody policy is built to prevent. Qualified custody versus self-custody is the trade-off behind who holds the keys. What to do when an exchange freezes your account is the related custodial scenario, and sending crypto to the wrong address is the other way funds leave and do not come back. A custody policy is the preventive version of this whole page.
Sources
- FBI, Internet Crime Complaint Center (IC3)
- FBI, Cryptocurrency fraud
- FTC, What to know about cryptocurrency and scams
- CISA, Secure Our World
- IRS, Topic no. 515, Casualty, disaster, and theft losses
Related
- What should I do if my crypto exchange freezes my account?
- What happens if I transfer crypto to the wrong address?
- Qualified custody vs self-custody for crypto wealth
- How to build a crypto custody policy
- What happens if a crypto custodian fails?
Last updated: 5 August 2026.
This article is general education, not legal, tax, or investment advice, and it is not a substitute for law enforcement guidance. Whether stolen crypto can be recovered or deducted depends on your specific facts. Report the theft to the authorities and talk to a qualified professional about your own situation.
