Read This Part First
If this just happened, you probably feel sick, and you are probably about to do something unhelpful — refreshing a block explorer, posting the attacker’s address on social media, or searching for someone who can get your money back.
Three things to hold onto before anything else.
One: stop further loss before investigating what happened. Understanding the attack can wait twenty minutes. Securing what’s left cannot.
Two: do not post publicly yet. Public loss posts become a targeting list for a second wave of fraud aimed specifically at you. More on this below, and it matters enormously.
Three: be realistic. Most stolen crypto is not recovered. That is a hard thing to read and it is true. The purpose of the next 24 hours is to stop the bleeding, preserve evidence, and prevent the follow-on attacks — not to undo what happened.
This guide is organised as triage. Work through it in order.
Step 1: Secure What Remains (First 15 Minutes)
Before diagnosing anything, check every wallet and account you control.
If any assets remain in the compromised wallet, move them now to a wallet created on a device you’re confident is clean. If you don’t have one, a hardware wallet you already own and haven’t used on the affected machine is the safest destination. Speed matters here — many drainers run in stages and return for later deposits.
If you have other wallets derived from the same seed phrase, they are also compromised. Move those too.
If exchange accounts share a password or email with anything involved, change those passwords now, from a different device. Rotate 2FA where your exchange supports it.
Do not send anything back to the compromised wallet, ever, including later. Some victims receive small incoming transfers afterwards — that’s often address poisoning or bait, not a refund.
Step 2: Diagnose the Attack Type (Next 30 Minutes)
This is the fork in the road. The response is completely different depending on which happened, and getting it wrong wastes the window.
Type A — Signature or approval compromise
What it looks like: you interacted with a website or dApp, connected your wallet, and signed something. Tokens left your wallet via a contract. Your ETH or native balance may be untouched while tokens are gone.
What’s compromised: a permission, not your keys.
What to do: revoke all approvals on that address — including both Permit2 layers, the outer approval to the Permit2 contract and the inner sub-allowances it holds. Use revoke.cash, typed directly into your browser.
Understand what revocation does and doesn’t do. It recovers nothing. What has left the wallet has left, and a signature that’s already been exploited cannot be unwound. What it does is stop the same permission being used a second time, which is not theoretical — drainers routinely return.
Treat the address as burned regardless. Related: How Wallet Drainers Work in 2026: Full Technical Breakdown
Type B — Seed phrase or private key exposure
What it looks like: you entered your recovery phrase into a website, an app, a “support” chat, a browser pop-up, or read it aloud to someone. Everything went, including native balance, often across multiple chains simultaneously.
What’s compromised: everything derived from that seed, permanently.
What to do: every wallet from that seed is gone and will remain gone. Revocation is irrelevant — the attacker is you, cryptographically. Create a new wallet on clean hardware and never reuse that seed for anything.
A stolen seed phrase cannot be made safe by changing a password, and there is no partial remediation. This is the most severe category.
Type C — Device or browser compromise
What it looks like: you can’t identify a specific bad signature or disclosure. Possibly a malicious browser extension, infostealer malware, or a ClickFix-style prompt that had you paste a command into a terminal.
What’s compromised: potentially your entire device, including saved passwords, session cookies, and any key material it touched.
What to do: a new wallet created on the same machine is also compromised. This is the mistake that turns one loss into two. Rebuild on a different, clean device. Assume exchange sessions and saved credentials are also taken, and rotate them from elsewhere.
Audit and remove browser extensions. In 2026, campaigns were documented where attackers bought legitimate extensions and pushed malware through automatic updates — and crucially, users receive no notification when an extension is removed from the store, so the malware keeps running. Related: The Extension You’ve Trusted for Years Can Be Sold to a Thief
Type D — Custodial or exchange account
What it looks like: funds withdrawn from an exchange account rather than a self-custody wallet.
What to do: this is the one category with a real counterparty. Contact the platform immediately through its official support channel — reached by logging in directly, never through a link or a number from a search result. Many exchanges can freeze accounts and some can halt withdrawals in progress. File whatever incident report they provide.
Change the password and email password, rotate 2FA, and check for mail-forwarding rules or new API keys you didn’t create.
Type E — Address poisoning
What it looks like: you sent funds yourself, to an address that looked right, and they went to a stranger. Nobody hacked anything.
What to do: there is no technical remediation. Document it, report it, and change the behaviour that caused it — verify full addresses rather than first and last characters, and use an address book. Related: Address Poisoning: The Attack That Works Because You Copy and Paste
Step 3: Preserve Evidence (Next Hour)
Do this before you forget details, and before you start telling people.
Record:
- The attacker’s receiving address, and the spender contract address if a drainer was involved
- Transaction hashes for every unauthorised movement, with timestamps
- The URL of any site you interacted with, exactly as it appeared — including any typo in the domain
- Screenshots of the signature request if you still have them, the site, and any message that led you there
- A written timeline while it’s fresh: what you clicked, when, in what order
If malware is suspected, do not wipe the affected device immediately. Disconnect it from the network and leave it alone — it is evidence, and premature cleanup destroys the only record of how this happened.
Step 4: Report (Same Day)
Reporting rarely recovers funds. Do it anyway, for three reasons: it creates a record you may need for tax or insurance, it feeds the datasets that protect other people, and in some jurisdictions it is a precondition for any later legal process.
Report to your national police. In most EU countries this can be done online. Have your evidence package ready.
Report to your national financial regulator if a platform was involved — the AFM in the Netherlands, the AMF in France, BaFin in Germany, or the equivalent.
Report the addresses to blockchain abuse databases such as Chainabuse, and to the relevant security trackers. This flags the contract for other users and occasionally contributes to enforcement.
If an exchange was involved, file their internal incident report as well as the police report.
Law enforcement action does happen. In April 2026, the FBI working with authorities in Dubai, China and Thailand dismantled at least nine overseas scam centres and arrested hundreds of suspects, and the FBI’s Operation Level Up has notified roughly 9,000 victims and recovered around $562 million. Those outcomes rest on reports that individual victims filed.
Step 5: Recognise the Second Attack
This is the most important section in this article.
Within hours of a public loss post, you will be contacted by people offering to recover your funds. Blockchain forensics specialists. Crypto recovery lawyers. Someone who “knows a guy at an exchange.” Services with professional websites, case studies, testimonials and success statistics.
The overwhelming majority of these are the second half of the same scam. They monitor loss posts, approach victims who have just demonstrated both that they hold crypto and that they can be deceived, and extract a second payment — an upfront fee, a “gas cost,” a “retainer,” a “release fee” — against a recovery that never comes.
This works because the victim is desperate, because the offer arrives at the exact moment hope is most valuable, and because the first loss has already demonstrated the vulnerability.
The rules:
- Never pay an upfront fee for recovery. Legitimate legal representation works on retainer through a verified firm you found independently, not through someone who contacted you.
- Anyone who approaches you unsolicited after a loss is running a scam. Without exception. Legitimate investigators do not cold-message victims.
- Never give a “recovery service” your seed phrase, private key, or wallet access. No legitimate process requires it.
- Be sceptical of recovery content generally, including articles that look informative and end with a recommendation for one specific service. That pattern is itself a funnel.
If you want professional help, find a regulated law firm in your own jurisdiction, through your own search, and verify it against the national bar register before you contact anyone.
Related: delay your public post. If you want community help tracing funds, understand that posting an address also publishes your victimhood. Consider reporting through official channels first, and if you do post, expect the inbound and ignore all of it.
Step 6: Record the Loss for Tax (This Week)
In most jurisdictions, cryptocurrency theft has tax treatment — often as a capital loss, though the rules vary substantially and some countries treat theft differently from investment loss.
Document it properly while the evidence is assembled: transaction hashes, dates, fair market value at the time of loss, and your police report reference. Crypto tax software such as Koinly or CoinTracking can calculate the loss and produce a record for your return.
This is also relevant to DAC8: your 2026 transaction data is being reported to tax authorities regardless, and an unexplained disappearance of assets is better accompanied by a documented theft than left as a gap. Related: The First DAC8 Reporting Year Closes in December — What EU Crypto Holders Need to Do Now
Disclosure: TrueToCrypto earns a commission if you subscribe through these links, at no additional cost to you.
Step 7: Rebuild (This Month)
Only once the above is done.
Start clean. New seed, generated on a device you trust, ideally a hardware wallet you initialise yourself. If your old loss was Type C, the device matters as much as the wallet.
Fix the specific failure. The useful question isn’t “how do I get better at security” — it’s “what exactly happened, and what single change would have prevented it?” Blind-signed an unreadable payload? Enable simulation and preview-binding. Entered a seed in a browser? Understand that no legitimate recovery flow ever asks for that. Malicious extension? Dedicated browser profile with near-zero extensions.
Compartmentalise. A capped hot wallet for anything experimental, cold storage for holdings. This converts future failures from catastrophic to annoying, and it’s the highest-leverage structural change available.
If you’re rebuilding and don’t have hardware: our beginner’s hardware wallet guide is where most people should land. Related: The Best Hardware Wallet for Beginners in 2026
Frequently Asked Questions
Can stolen crypto be recovered?
Occasionally, through law enforcement action against organised operations, or where funds move to an exchange that freezes them. Rarely, and never quickly. Any service promising recovery for an upfront fee is lying.
Should I post the attacker’s address publicly?
It can help community tracing. It also marks you as a victim and attracts recovery scammers. Report to official channels first; if you post, expect the inbound and ignore all of it.
My funds went to an exchange address — does that help?
Potentially. Exchanges can freeze funds if alerted quickly with a law enforcement reference. File the police report immediately and provide the reference to the exchange’s compliance team through official channels.
Can I reuse my wallet after revoking approvals?
Technically yes for Type A. We’d advise against it — you don’t always know everything that was granted, and the cost of a fresh address is zero.
How long do I have?
For securing remaining assets: minutes. For revocation: hours. For reporting and evidence: days. For tax documentation: weeks. The order matters more than any individual deadline.
The Bottom Line
Work in this order: secure what’s left, diagnose the type, preserve evidence, report, ignore everyone who contacts you offering help, document for tax, rebuild clean.
The hardest part isn’t any of those steps. It’s accepting that the money is probably gone while there is still a well-funded industry telling you it isn’t. The people who lose a second time are almost always the ones who couldn’t let go of the first.
If you’re reading this because it just happened: you are not stupid, and you are not alone. The current generation of attacks defeats experienced, technical people routinely, and the shift through 2026 has been toward targeting exactly those people. Do the steps. Then stop.
Transparency: TrueToCrypto may earn affiliate commissions from links in this article; none appear in the emergency triage sections, by editorial policy. TrueToCrypto does not offer, endorse, or accept payment from any crypto recovery service. This article is educational and is not legal, financial, or investigative advice.
Contact: info@truetocrypto.com
If you have been the victim of crypto theft and need to report it, contact your national police and financial regulator. We cannot recover funds and will never contact you offering to.
