Crypto Hack Recovery Guide: What to Do When Your Crypto Is Stolen

Immediate Steps (First 30 Minutes)

1. Disconnect the compromised device from the internet. If you suspect malware or a compromised computer, pull the ethernet cable or disconnect from WiFi immediately. This stops ongoing data exfiltration. Do not turn off the computer — forensic analysis needs the device powered on and memory preserved.

2. Do NOT transfer remaining funds yet. If the hacker compromised your computer, they may have your new wallet addresses too. Transferring to a new address on the same compromised device just gives the hacker access to the new wallet. Use a different, known-clean device (a friend's computer, a library computer) to create emergency wallets.

3. Identify what was taken. Check all your wallets, exchange accounts, and DeFi positions. Make a list of what was stolen: which tokens, how much, from which wallet address, at what time (check the blockchain transaction timestamp). Save the transaction IDs (TXIDs) — they are critical for tracing.

4. Change passwords on all exchanges — from a clean device. Use a different device to log into every exchange account you have. Change passwords, revoke API keys, and withdraw remaining balances to fresh wallets created on the clean device. If the exchange supports address whitelisting, enable it and set a 24-48 hour withdrawal delay.

Trace the Stolen Funds

You can trace stolen crypto on the blockchain yourself using block explorers. Etherscan for Ethereum, Solscan for Solana, Blockchain.com Explorer for Bitcoin. Paste the wallet address that was drained and look at the "Outgoing Transactions." Follow where the funds went. The hacker will typically move funds through multiple wallets — look for patterns. If they used a crypto mixer (Tornado Cash on Ethereum, Wasabi Wallet for Bitcoin), tracing becomes much harder but not impossible. Save every intermediate address and transaction hash.

If you are not comfortable doing this yourself, use professional blockchain analytics tools. Chainalysis and TRM Labs work with law enforcement but are not available to individuals. However, you can use free tools like Dune Analytics, Arkham Intelligence (free tier), or OXT Research (for Bitcoin) to follow the money. Take screenshots of every step of the chain — they will be evidence for law enforcement.

Report the Hack

Local law enforcement: File a police report in your jurisdiction. Bring your ID, a list of stolen assets with current USD value, transaction IDs, wallet addresses, and any evidence of the hack (screenshots, emails, messages). Most local police will not investigate crypto crimes, but a police report is required for insurance claims and tax loss deductions.

FBI IC3 (US): File a complaint at ic3.gov. The FBI's Internet Crime Complaint Center aggregates crypto crime reports. They have a Cryptocurrency Intelligence Unit that investigates large-scale hacks. Include every transaction ID, wallet address, and timeline detail. IC3 complaints are shared with field offices and task forces.

Secret Service (US): For significant losses ($100k+), the US Secret Service has a Criminal Investigative Division focused on cryptocurrency crimes. They work with exchanges to freeze funds if the hacker deposits at a compliant exchange.

Exchange support: If the stolen funds were sent to a specific exchange (Coinbase, Kraken, Binance), contact that exchange's support immediately with the TXID and destination address. If the funds have not been withdrawn yet from that exchange, they can freeze the account. Time is critical — most exchanges will freeze funds if contacted within hours of the deposit.

Warning: Recovery Scams (The Second Hack)

Within hours of posting about your hack on Bitcointalk, Reddit, or Twitter, you will be contacted by recovery scammers. They claim they can "hack back" the thief, exploit a smart contract vulnerability, or use "on-chain forensics" to recover your funds — for an upfront fee. These are all lies. Legitimate crypto recovery experts do not ask for upfront payments. Blockchain tracing firms do not work with individuals. No one can reverse a blockchain transaction.

Common recovery scam tactics: "I work with a team of ethical hackers who can access the hacker's wallet" (impossible — you cannot access a wallet without the private key). "I have a contact at the exchange who can reverse the transaction" (no exchange can reverse a confirmed blockchain transaction). "Pay a small fee and I will recover 10x that amount" (you pay and never hear from them again). "I need you to connect your wallet to this site to verify ownership" (this drains your remaining funds).

If anyone contacts you offering recovery services, ignore them. The only legitimate paths to recovery are: law enforcement action leading to seizure, exchange compliance teams freezing deposited funds, or insurance claims if you had a crypto theft insurance policy. Recovery rates for crypto theft are below 1%. Accept this and focus on damage control. Learn to identify crypto scams before they happen →

Tax Implications of a Hack

In the US, a crypto theft may qualify as a casualty loss deduction under IRS Section 165. The rules changed significantly under the TCJA (2017-2025): casualty losses were only deductible if attributed to a federally declared disaster. For tax years 2026 and beyond under the TCJA sunset provisions, check current law — personal casualty losses may again be deductible subject to the 10% of AGI floor. Theft losses from crypto are treated as occurring in the year you discovered the theft. You will need the police report, transaction records, and proof of cost basis and fair market value at the time of theft. Consult a crypto CPA — this is a complex area. Crypto tax rules explained →

Preventing Future Hacks

After recovering from a hack, your security setup needs a complete overhaul. Use a hardware wallet (Ledger or Trezor) as your primary storage — never store significant funds in hot wallets or on exchanges. Use a dedicated computer or Chromebook for crypto transactions that never visits suspicious sites or opens emails. Enable a hardware wallet passphrase (BIP39) as a hidden wallet — even if someone steals your physical Ledger, they need the passphrase too. Use multi-sig for large holdings (e.g., a 2-of-3 setup where keys are stored in different physical locations). Never save seed phrases digitally — not in a password manager, not in a photo, not in a Google Doc. Use a metal seed plate stored in a fireproof safe. Revoke all unnecessary smart contract approvals on your wallets using Revoke.cash or Etherscan's token approval checker. Full crypto wallet security guide →