Crypto Stolen? What to Do in the First Hour, and What to Skip
Crypto stolen? A first-hour checklist: protect what's left, lock exchange accounts, save the evidence, report to IC3 and the FTC, and skip paid recovery offers.
Video coming soon.
Key takeaways
- First decide whether you sent the coins or someone took them. Xaman's help page says the first usually leaves your account intact; the second means it's compromised.
- If your recovery phrase may be exposed, protect what's left first: move it to a new wallet with a new secret, made on a device you trust.
- Lock exchange accounts, reset your email from a clean device, and revoke token approvals on Ethereum-style wallets.
- Tell the exchange it was a fraudulent transaction, save every transaction hash and message, and report to ic3.gov, ReportFraud.ftc.gov and your local police.
- Skip anyone selling recovery for a fee. Xaman says these offers are almost always a second scam.
If your crypto was just stolen, spend the first hour protecting what’s left, not chasing what’s gone. Decide whether you sent the coins or someone took them, move any remaining funds away from a possibly exposed key, lock your exchange accounts, tell the exchange, save the evidence, and report to the FBI, the FTC and your local police. Skip anyone who offers to get it back for a fee.
The FBI’s guidance for crypto scam victims has a three-word line about reporting: “Do not wait.” This article puts the first hour in order, using the published guidance from the FBI, the Federal Trade Commission (FTC), the Xaman wallet and the XRP Ledger docs. It is education, not legal advice, and the minute-by-minute order at the end is Bullrunners’ suggestion, not an official one.
Did you send the crypto, or was it taken?
The first question after a crypto theft is whether you sent the coins yourself or someone took them without you. Xaman, an XRP Ledger wallet, splits its scam help page along that line. If you sent funds to a scammer, through a fake investment, an airdrop or a fake offer, Xaman says your account is most likely still intact. If someone took funds without your permission, or you may have shared your secret, the account is compromised.
That answer changes the first hour. If you sent it, the job is mostly reporting. If it was taken, someone may still hold the key to whatever is left. The XRP Ledger docs put it bluntly: “If a malicious actor learns your master private key (or seed), they have full control over your account.”
How do you protect what’s left after a crypto theft?
You protect what’s left by putting it behind a key the thief doesn’t have. For an XRP Ledger account, Xaman gives two routes. One is to “re-key your account and disable the master key for the compromised account.” The XRP Ledger docs explain why: “You cannot change or remove the master key pair, but you can disable it.” The other is to “create a new account, move your remaining funds to the new account, then delete the compromised account.”
Any new account needs a brand-new recovery phrase, made on a device you trust and written on paper. If you don’t know how the leak happened, Xaman says “Do not restore from a backup.” Restoring could bring the problem back with your apps. Our seed phrase guide covers how to store a new one.
Should you revoke token approvals after a wallet is drained?
Yes, on Ethereum and similar networks you should revoke token approvals after a drain, but it isn’t enough if your recovery phrase leaked. Trust Wallet describes token approvals as “the permissions granted by wallet owners to smart contracts,” and warns that unlimited approvals “pose large security risks if the contract is compromised.” Etherscan’s approval checker says revoking stops contracts or addresses spending your assets. Trust Wallet notes that “revocation may require gas fees.”
Bullrunners’ reading of how keys work: if the thief has your recovery phrase, they can sign anything you can, so revoking approvals won’t protect you. In that case, move what’s left to a new wallet. Our step-by-step guide to revoking token approvals and our explainer on wallet drainers cover this in more depth.
How do you lock exchange and email accounts?
Lock any exchange account a thief may be inside, then secure the email it uses. Coinbase’s help center, for example, says locking your account “will sign you out from all devices,” and that while locked you can’t trade, transfer crypto or change account settings. Coinbase also says some actions stay restricted for a period after unlocking. Other exchanges have their own tools, and menu names change between app versions.
For email, the FTC’s guide to a hacked account says to update your security software and run a scan first, then change the password and turn on two-factor authentication. Do those resets from a device you trust, not the one you think was compromised.
Can stolen crypto be reversed?
Stolen crypto generally can’t be reversed once the transaction confirms. Xaman’s help center says “All transactions on the XRPL are final and permanent.” The XRP Ledger docs say “there is no privileged administrator who can undo or reverse any transactions after they have applied.” The FTC adds that crypto payments “don’t have the same legal protections as credit and debit cards do.”
Recovery does sometimes happen, through law enforcement. On June 18, 2025, the US Attorney’s Office for the District of Columbia announced a civil forfeiture complaint against more than $225.3 million in crypto it alleged was tied to confidence scams. The FBI and Secret Service used blockchain analysis, and court filings, as reported by Decrypt, say Tether and the exchange OKX helped identify and freeze the funds. It is never promised, and it runs through agencies and companies, not strangers.
Who should you contact after crypto is stolen?
Contact the exchange first, then file reports with the FBI, the FTC and your local police. The FTC’s page says: “Contact the cryptocurrency exchange or ATM operator immediately.” Tell them it was a fraudulent transaction and ask them to reverse it and refund your money. That may mean two exchanges: the one you sent from and the one the coins landed at.
Before you file, gather what the FBI asks for. Its 2023 guidance says “the most important information you can provide are transaction details”: addresses, the amount and type of crypto, the date and time, and the transaction ID, also called the hash. A transaction hash is the receipt number for a blockchain payment. Add where you first met the scammer, which exchanges you used and the timeline. Xaman says: “Do not delete the chat history or the app conversation before you file the report.”
| Report to | Where | Why |
|---|---|---|
| FBI Internet Crime Complaint Center | ic3.gov (type it yourself) | The FBI’s central hub for reporting cyber-enabled crime |
| Federal Trade Commission | ReportFraud.ftc.gov | The FTC’s fraud reporting site |
| Local police | Your police department | Xaman says exchanges, banks and insurers often require a police report number |
What should you skip after a crypto theft?
Skip anyone who offers to recover your crypto for a fee. Xaman’s page says “the most common follow-up to a scam is a recovery scam,” with people posing as recovery agents, blockchain trackers or even Xaman support, and “these are almost always a second scam.” The IC3 homepage says it “will never directly contact you for information or money” and does not work with law firms or crypto services.
The never list:
- Never pay a stranger to recover crypto.
- Never share a recovery phrase with anyone calling themselves support. Xaman says its support “will never ask you for your account secret.”
- Never delete the evidence.
- Never restore an old phone backup before you know how the leak happened.
Our guide to crypto recovery scams explains the fake law firms and agencies in detail.
The first-hour crypto theft checklist
Bullrunners’ suggested order, built from the guidance above:
- Minutes 0 to 5: Decide what happened. Did you send it, or was it taken?
- Minutes 5 to 15: Stop the bleed. Move what’s left to a new secret, revoke approvals on Ethereum-style wallets, lock exchange accounts and reset your email from a clean device.
- Minutes 15 to 30: Contact the exchange. Call it a fraudulent transaction and ask about a reversal.
- Minutes 30 to 60: Save every hash, address, amount, time and message. Report to IC3, the FTC and local police. Keep each report number in one folder.
- After that: Ignore anyone selling recovery for a fee.
Speed doesn’t guarantee a win. If a thief still holds your key and moves fast, you may lose the race for what’s left. That is the strongest reason to plan before you need to.
What to check tonight
If nothing has happened to you, list every wallet and exchange you use and check how much of it one recovery phrase controls. Read your own wallet’s help page on theft now, not on the bad day, because every wallet handles this differently.
Sources
- FBI IC3: Guidance for Cryptocurrency Scam Victims (August 2023)
- FTC: What To Do if You Were Scammed
- Xaman Help Center: I’ve been scammed
- US Attorney’s Office, DC: Largest Ever Seizure of Funds Related to Crypto Confidence Scams (June 18, 2025)
- XRP Ledger docs: Cryptographic Keys
- Coinbase Help: Lock or unlock your compromised account
Frequently asked questions
What should I do first if my crypto is stolen?
Work out whether you sent the coins yourself or someone took them without you. If someone took them, assume they still have your key and move whatever is left to a new wallet with a new recovery phrase before anything else.
Can stolen crypto be reversed?
Not on the XRP Ledger. Xaman's help center says all XRPL transactions are final and permanent, and the XRP Ledger docs say no administrator can undo a transaction after it applies.
Where do I report stolen crypto in the US?
The FBI's Internet Crime Complaint Center at ic3.gov, the FTC at ReportFraud.ftc.gov, and your local police. Xaman notes that exchanges and insurers often ask for a police report number.
What information does the FBI want when I report crypto theft?
The FBI's 2023 guidance says transaction details matter most: the addresses, the amount and type of crypto, the date and time, and the transaction ID (hash). If you're unsure whether something is relevant, include it.
Should I revoke token approvals after my wallet is drained?
On Ethereum-style wallets, yes, because revoking stops contracts spending your tokens. If your recovery phrase is exposed, revoking isn't enough: move what's left to a new wallet.
Are crypto recovery services legit?
Treat any paid recovery offer as a red flag. Xaman says they are almost always a second scam, and IC3 says it never contacts victims for money and doesn't work with law firms or crypto services.
Education and commentary only, not financial advice. Crypto is volatile and you can lose money. Do your own research and speak to a qualified advisor before making investment decisions. Figures are as of October 14, 2026 and may have changed since.
