The first 24 hours after crypto theft or fraud: a practical checklist

First, stop any continuing loss

If a wallet may still be exposed, disconnect it from unfamiliar sites, revoke suspicious token approvals and move unaffected assets to a new wallet created on a clean device. If an exchange account is involved, change its password, review active sessions and strengthen two-factor authentication.

Do not send another payment to release, verify or insure the missing funds. A demand for tax, gas, clearance or unlocking fees is a reason to stop and verify independently.

Preserve evidence before contacting anyone

Create one folder and save original files rather than edited screenshots. Record:

• Transaction hashes, wallet addresses, asset names, networks, amounts and times.
• Full chat and email exports, phone numbers, usernames and profile links.
• The website address, app name, account page and any displayed balance.
• Bank, card or exchange statements showing how the assets were purchased and sent.
• A short timeline written in your own words, including every request for further payment.

Notify the organisations that may be able to act

Contact your bank or exchange immediately through contact details you verify yourself. Give them the transaction references and ask that the report be passed to the fraud or compliance team. If the funds reached a centralised service, that service may hold account information, but it decides what action it can take and may require a police or court request.

In the UK, report the loss through Report Fraud and notify the FCA where a regulated financial service or unauthorised investment firm is involved. In France, the AMF advises victims to gather evidence and make a complaint to the judicial authorities. Use the official sources below to confirm the current route for your country.

What an on-chain investigation adds

An investigator can validate the transaction trail, follow movements across wallets and services, identify likely exit points and turn the findings into a sourced evidence file. That can make reports to exchanges, lawyers and authorities more specific.

Tracing does not reverse a transaction and cannot guarantee a freeze or recovery. A careful first review should tell you whether there is a useful technical lead before paid work begins.