Crypto theft is devastating — financially and emotionally. But the decisions you make in the next few hours can make a meaningful difference. Here's the complete guide, written to help you stay calm and take the right actions.
First — breathe. Finding out your crypto has been stolen triggers a mix of panic, anger, disbelief, and helplessness that can lead to hasty decisions that make the situation worse. The blockchain is immutable, which means reacting in the wrong way won’t get your crypto back — but it can cost you more.
The good news: there are concrete, legally recognized steps you can take. Some stolen crypto has been recovered, and some losses can be partially offset through the tax system. This guide covers what to do if crypto is stolen — including actions in the first hours, the reporting chain, scam-specific paths, and the prevention lessons that apply to every crypto holder.
Understand What Type of Theft You’re Dealing With
Different types of crypto theft require different immediate responses. Before taking any action, identify what happened:
Wallet or Private Key Compromise
Your seed phrase or private key was exposed — through malware, a phishing website, a compromised device, or possibly a trusted person. If the theft is recent and your wallet still has funds, move remaining assets immediately to a freshly generated wallet on a clean device. Every minute matters if the attacker still has access credentials.
Exchange Account Breach
Your exchange account was accessed by a third party — through a phishing attack, credential stuffing, SIM swap, or weak password. Contact the exchange immediately and request an account freeze. Change your password and disable all API keys from a clean device.
Scam / Social Engineering
You were deceived into sending crypto voluntarily — through a romance scam, fake investment platform, impersonation of exchange support, or a pig-butchering scheme. The crypto was sent by you, which makes recovery more complex since you authorized the transfer. However, reporting is still essential and specific recovery paths exist.
Smart Contract Exploit or DeFi Hack
A protocol you were using was exploited at the code level. Your funds were taken through a vulnerability in a smart contract, not a breach of your personal credentials. In this case, the attack was on the protocol, and recoveries sometimes happen through protocol treasury compensation or insurance funds.
📌 Why Identifying the Type Matters: Exchange breach → contact the exchange first. Wallet compromise → move remaining funds first. Scam send → report to law enforcement immediately since the fraudster’s identity may be traceable through the receiving exchange. DeFi exploit → monitor the protocol’s official communications for compensation announcements.
The Immediate Response — First 4 Hours
The first hours after discovering theft are the most time-sensitive. Here’s what needs to happen in order:
1. Secure Everything Still Intact
- Move any remaining funds in compromised wallets to a completely new wallet generated on a clean, uncompromised device
- Log into your exchange immediately, change your password, and disable ALL API keys
- Enable or upgrade 2FA — use an authenticator app (Google Authenticator, Authy) not SMS
- Revoke all token approvals at revoke.cash — a compromised wallet may have approved malicious smart contracts still draining funds
- Force-logout all active sessions on the exchange account
2. Capture Evidence Before It Disappears
Document everything before taking any action that might overwrite evidence:
- Screenshot your wallet or exchange showing zero balance and the transaction history
- Copy and save all transaction hashes (TXIDs) for the unauthorized transfers
- Note the attacker’s receiving wallet addresses
- Screenshot any phishing emails, fake websites, or suspicious messages received before the theft
- Record every action the attacker took and the approximate timing
- Save your cost basis information — what you originally paid for the stolen crypto, and when
⚠️ Critical: Don’t factory-reset your device or reinstall apps before extracting evidence. Even compromised devices contain valuable forensic information that law enforcement or recovery specialists may need. Back up everything first, then clean the device.
Reporting — Who to Contact and Why
Reporting crypto theft serves multiple purposes beyond just filing a complaint: it creates the legal record needed for tax purposes, enables potential intervention at receiving exchanges, and contributes to patterns that help law enforcement pursue larger operations.
Report to the Exchange Immediately
If your exchange was the entry point — or if you can see that stolen crypto went to a known exchange address — contact the exchange’s fraud or security team with:
- The transaction hash(es) of the unauthorized transfers
- The destination wallet addresses
- A formal written request for account access logs
- A request to flag the destination address under their AML protocols
If the stolen crypto was sent to another exchange, contact that exchange’s compliance team separately. Some exchanges will temporarily freeze funds at a destination address while law enforcement is engaged — this narrow window has enabled partial recovery in documented cases. Use formal written communication — email rather than chat — and reference the transaction hashes specifically.
File Law Enforcement Reports
Even if you’re skeptical that police can help, these reports are legally required for many subsequent steps — including tax loss claims, insurance claims, and formal recovery assistance. File in this order:
- FBI Internet Crime Complaint Center (US): ic3.gov — the primary federal cybercrime reporting portal
- FTC: reportfraud.ftc.gov — particularly for scam and fraud cases
- Your local police: Get a crime reference number — required for insurance and tax purposes even if they can’t actively investigate
- Action Fraud (UK): actionfraud.police.uk
- Your country’s national cybercrime unit — most developed nations have dedicated financial cybercrime teams
💡 Making Your Report Effective: When reporting, provide: the complete timeline of events, all transaction hashes, all wallet addresses involved, approximate USD value at time of theft, evidence of how the theft occurred, and any communications from the attacker. The more specific and organized your report, the more useful it is to investigators who may be tracking patterns across many victims.
Scam-Specific: What to Do If You Were Deceived
Crypto scam victims face a different challenge from hack victims: you authorized the transfer, which makes tracing harder and creates legal complexity around whether the transfer was fraudulent. But scam victims have specific options worth pursuing:
Romance Scam / Pig Butchering
These long-running scams (sometimes months of relationship-building before the ‘investment opportunity’) are increasingly well-documented by law enforcement. Contact your country’s FBI or equivalent specifically referencing pig-butchering or romance scam — this terminology connects your case to organized criminal networks that are actively being investigated, improving the chance of case attention.
The Global Anti Scam Organization (globalantiscam.org) maintains databases of known scam operations and provides victim support. Sharing your case there may connect you with others victimized by the same operation, which strengthens law enforcement cases significantly.
Fake Investment Platform
If the theft involved a fake trading platform or investment scheme, report it to: your country’s financial regulator (SEC in the US, FCA in the UK, ASIC in Australia), your local consumer protection agency, and any social media or app stores where the fraudulent platform operated. Platforms identified as fraudulent can sometimes be de-listed and the organizers pursued, even internationally.
Impersonation Scam
If the attacker impersonated an exchange, celebrity, or government official, report to the platform where the impersonation occurred (Twitter/X, Telegram, Instagram) in addition to law enforcement. Documented impersonation reports can result in account takedowns that prevent further victims.
The Tax Angle — Your Losses May Have Silver Lining
Depending on your jurisdiction and the specific circumstances of the theft, your stolen crypto may generate a tax benefit:
Capital Loss Treatment
In most jurisdictions, crypto theft can be treated as a capital loss at the fair market value of the stolen crypto at the time of theft. This capital loss can offset capital gains from other investments, potentially saving significant taxes. The key requirements: you must have a substantiated cost basis for the stolen assets, you must have documented the theft (which is why the police report and evidence capture steps above matter), and you must report correctly on your tax return.
US-Specific Considerations
The 2017 Tax Cuts and Jobs Act significantly restricted personal theft loss deductions for ordinary tax years (2018–2025). Crypto theft is generally no longer deductible as a theft loss during this period, unless it occurred in a federally declared disaster. However, the capital loss treatment remains available — stolen crypto represents a capital loss at its value at time of theft, which can offset up to $3,000 of ordinary income annually and offset capital gains without limit. Consult a tax professional who specializes in crypto for your specific situation.
💰 The Documentation Chain: For any tax benefit from stolen crypto, you need: (1) proof of original purchase (exchange records, transaction receipts); (2) proof of theft (police report, exchange logs, on-chain transaction records); (3) fair market value of stolen crypto at time of theft; (4) clear timeline connecting your ownership to the theft event. Start building this file the moment you discover the theft.
The Scam Recovery Warning — Don’t Get Victimized Twice
The crypto theft recovery space is heavily infiltrated by scammers specifically targeting recent theft victims. After a theft, you may receive unsolicited messages from ‘recovery specialists’ who claim they can retrieve your stolen funds. Almost all of these are scams.
What legitimate recovery actually looks like versus the scam version:
- Legitimate: Blockchain analytics firms (Chainalysis, TRM Labs, Elliptic) work primarily with law enforcement and regulated entities — they don’t cold-contact individual theft victims promising recovery
- Scam: Any company that contacts you proactively, promises guaranteed or high-probability recovery, requires large upfront fees, or claims to be able to ‘reverse blockchain transactions’
- Legitimate: Legal firms that use blockchain analytics in court proceedings — they have verifiable professional credentials and don’t promise outcomes
- Scam: Anonymous ‘recovery hackers’ on Telegram, social media, or contacted through comment sections and forums
⚠️ The Double Victim Reality: Studies of crypto theft victims show that a significant percentage become victims of recovery scams within days of their initial theft — paying additional fees to fraudsters who claim to be ‘recovering’ funds that have actually been taken permanently. If you’ve been stolen from once, be extremely skeptical of anyone claiming they can fix it for a fee.
Moving Forward — Prevention, Rebuilding, and Perspective
After the immediate crisis passes, channel the painful experience into building stronger security foundations:
- Hardware wallet for significant holdings: Ledger and Trezor are the two most established options — private keys generated and stored offline, immune to most remote attacks
- Dedicated crypto device: A phone or laptop used exclusively for crypto activity, never for email, browsing, or app downloads, dramatically reduces malware and phishing exposure
- Phishing-resistant 2FA: Physical security keys (YubiKey) are the highest form of 2FA — immune to phishing because they cryptographically verify the website’s identity before responding
- Seed phrase security: Metal backup plates stored offline, never photographed, never stored digitally, never entered on any website under any circumstances
- Regular security audits: Monthly review of token approvals (revoke.cash), active exchange sessions, and API key access
🧠 The Post-Theft Mindset: Crypto theft is devastating — but it has happened to some of the most experienced, technically sophisticated people in the space. It is not a reflection of stupidity or naivety. Scammers and hackers are sophisticated professionals. The response that builds the best long-term outcome: document everything, report everything, claim every available tax benefit, learn every security lesson the incident reveals, and rebuild with significantly stronger security foundations.
Frequently Asked Questions
1. What is the first thing to do if crypto is stolen?
The very first action depends on the theft type — but in most cases it’s secure what’s left. If the theft is from a wallet, immediately move any remaining funds to a freshly generated wallet on a clean, uncompromised device. If the theft is from an exchange, log in from a clean device, change your password, revoke all API keys, and contact the exchange security team. Only after securing remaining assets should you focus on documentation and reporting. Every minute your compromised credentials remain active is an opportunity for additional theft. After securing remaining assets: document all transaction evidence, contact the exchange if applicable, file law enforcement reports, and consult a tax professional about loss treatment.
2. Can I get my stolen crypto back?
Occasionally — but the odds are genuinely low for most thefts. Recovery is most likely when: (1) the stolen crypto was sent to a centralized exchange address (where KYC links the receiving address to an identifiable person); (2) you report to law enforcement quickly and they engage that exchange’s compliance team; (3) the theft amount is significant enough to warrant blockchain analytics attention ($100,000+); or (4) the attacker makes traceable mistakes (reusing addresses, accessing accounts from identifiable IPs). The cases where recovery has occurred typically involved rapid reporting (within hours), clear blockchain trails, and cooperation between law enforcement and exchanges. Don’t expect recovery — but don’t skip reporting, because reporting creates the conditions where recovery becomes possible.
3. Should I pay a crypto recovery service?
Almost certainly no. The vast majority of crypto recovery services — especially those that contact you proactively after a theft, promise high success rates, require large upfront fees, or are found through online forums and social media — are scams that will take additional money without recovering anything. Legitimate entities that work in crypto theft recovery (such as blockchain analytics firms) primarily work with law enforcement and regulated exchanges, not individual theft victims who pay them directly. If you do research a recovery service, look for: verifiable company registration, named principals with verifiable professional histories, no guaranteed outcome promises, transparent fee structures, and references from verifiable past cases. These criteria eliminate the vast majority of ‘recovery services’ operating in this space.
4. How do I report crypto theft to the IRS?
In the US, you don’t report the theft to the IRS — you report the resulting capital loss on your tax return. Include the stolen crypto as a capital loss on Form 8949 (Sales and Other Dispositions of Capital Assets) and Schedule D. The loss amount is the fair market value of the stolen crypto at the time of theft minus your cost basis (what you originally paid). You’ll need your original purchase records, evidence of the theft (police report, exchange records), and the fair market value at the time of theft. As noted in the article, the direct theft loss deduction was largely eliminated by the 2017 Tax Cuts and Jobs Act for 2018–2025 — but the capital loss treatment is still available. Work with a CPA who handles crypto taxes to ensure proper reporting.
5. What if I sent crypto to a scammer voluntarily?
If you sent crypto voluntarily after being deceived — through a romance scam, fake investment platform, or social engineering — you still have meaningful steps to take. File a report with the FBI IC3 (ic3.gov) specifically describing the scam type and including all wallet addresses and communication records. The receiving wallet address may be traced to a centralized exchange where law enforcement can potentially identify the operator. Report to your country’s financial regulator (SEC, FCA) if the scam involved a fake investment platform. Contact the Global Anti Scam Organization (globalantiscam.org) — they may have existing cases involving the same operation. From a tax perspective, funds sent to a scammer may still qualify for capital loss treatment, though the specific treatment for ‘investment fraud’ losses vs ‘theft’ losses is complex — consult a tax professional. Voluntary sends are harder to recover than unauthorized transfers, but reporting is still essential both for your own potential benefit and to protect future victims.
You’ve Been Targeted. Now Respond Strategically.
If your crypto has been stolen, the most important thing is to take the right actions in the right order — secure remaining assets, document everything, report to exchanges and law enforcement, explore tax loss treatment, and resist the urge to trust anyone who promises recovery for a fee. Your next steps can meaningfully affect the outcome, even if full recovery isn’t possible.
The crypto you lost was real. The lessons from how it was taken are invaluable. The security posture you build afterward can protect everything that comes next.
✅ Revoke all token approvals immediately at revoke.cash if your wallet was compromised.
✅ File your IC3 report (ic3.gov) today — the reference number matters for tax and insurance purposes.
✅ Consult a crypto-specialist CPA about capital loss treatment — your loss may have real tax value.
👉 Share this guide with anyone in your crypto community who may be at risk — because knowing what to do before it happens is worth more than knowing after.