Crypto Stolen - What to Do: A Step-by-Step Guide

If Your Cryptocurrency Has Been Stolen

Losing cryptocurrency is stressful, but it does not mean that further action is pointless. On most blockchains, transactions are public: the movement of funds can be traced, recipient addresses recorded, and materials prepared for law enforcement and exchanges. It is equally important to understand the limitation: the mere fact that a transfer is visible on-chain does not reveal the identity of an address's owner and does not guarantee recovery.

The first hours matter most. The sooner you secure any remaining funds, preserve evidence, and record the details of the incident, the higher the chance that subsequent analysis and outreach lead to a result. At the same time, it is important not to harm your own case: trying to contact the suspected scammer directly, or to "recover" funds through dubious intermediaries, often leads to further losses.

The steps that follow fall into several directions: securing your position, preserving evidence, reporting to law enforcement, engaging with exchanges and services, and analyzing the movement of funds. Here is how to proceed.

In short: the first thing to do is secure your remaining assets, preserve all evidence, and record the details of the incident. Do not delete correspondence, screenshots, or payment confirmations.

Types of Crypto Incidents

To decide what to do, first identify the type of incident. It shapes both your first actions and which evidence matters most.

Scams

Fake investment platforms, promises of guaranteed returns, fraud in P2P deals, deception in buying or selling crypto, and fake "recovery services" for previously stolen funds.

Phishing

Fake wallet and exchange sites, messages linking to counterfeit login pages, attempts to extract a seed phrase or private key, and impersonation of support staff.

Drainer Attacks

Connecting a wallet to a malicious site, signing a dangerous transaction, granting unwanted token allowances, and having assets drained after interacting with a smart contract.

Hacking and Theft

Unauthorized transfers, wallet compromise, and theft of assets without the owner's consent.

Extortion

Demands to transfer crypto under threat, blackmail using personal data, and other forms of coercion to hand over digital assets.

The Match Systems incident report form includes these categories and an "Other" option. Note: the chosen category reflects the reporter's description of the situation and does not mean Match Systems has confirmed any wrongdoing associated with the address.

First Actions After Discovering the Theft

Step 1. Secure Your Remaining Assets

If you have reason to believe a wallet is compromised: stop using it to store new funds; from a safe device, check the state of your other wallets; if necessary, move remaining assets to a new, secure wallet; review and revoke dangerous token allowances where applicable; change compromised passwords and enable additional protection on linked accounts.

Important: do not follow a one-size-fits-all script. Moving assets can be dangerous if the attacker still controls the wallet and monitors incoming activity - in some cases this triggers an instant sweep. Assess the situation before moving funds.

Step 2. Do Not Delete Evidence

Preserve correspondence with the suspected scammer, emails, links to sites and listings, screenshots, receipts and payment confirmations, account and service details, and notifications from your wallet or exchange.

Step 3. Record the Transactions

Note the transaction hashes, amounts, timestamps, blockchain names, and the sender and recipient addresses.

Step 4. Record the Related Addresses

Save the addresses the funds were sent to, along with any other addresses that may be connected to the movement of the stolen assets.

Step 5. Never Share Secret Data

Neither Match Systems nor any other analytics firm needs your seed phrase, private keys, or wallet passwords. Registering an incident only requires details of what happened and the supporting evidence. Anyone asking for this data under the guise of "recovery" is a scammer.

What Evidence to Collect

The more complete the information, the more concretely the incident can be assessed. Key materials:

• hashes of the original transactions;
• sender and recipient addresses;
• the network and type of cryptocurrency;
• the amount and time of each transfer;
• a description of the circumstances;
• links to suspicious sites;
• correspondence with the suspected scammer;
• payment confirmations;
• information on exchanges, swappers, and services the funds may have passed through;
• details of any prior actions taken and responses received.

A transaction hash lets you locate a specific transfer on-chain, while an address lets you analyze related operations. This data does not always reveal the attacker's identity, but it forms the basis for further analysis. If you do not have everything, save what you can and do not delay recording the incident just because some data is missing.

Why Recording the Attacker's Addresses Matters

The addresses that received the funds are the starting point of any analysis. By recording them and the transactions linking an address to the incident, it becomes possible to trace onward movement, identify subsequent transfers, and account for possible links to exchanges, swappers, and other services. Reuse of an address, or new transactions from it, can also matter for the analysis.

An important caveat: one address does not always correspond to one person. It may belong to an exchange, a swapper, a cross-chain bridge, a service, or a smart contract. Recording an address therefore records the fact of a fund movement - it is not an assertion that the address belongs to a scammer. Registering a report does not, by itself, change an address's AML status.

Where to Report After a Crypto Scam

Law Enforcement

File an official report and keep its reference number if one is issued. Where possible, attach transaction hashes, addresses, and other evidence. Many subsequent steps - requests to exchanges, obtaining account-holder data, procedural actions - may require the involvement of authorized bodies.

Crypto Exchanges and Services

If the funds reached a centralized exchange or another service, contact its official support and provide what you have: transaction hashes, addresses, amounts, timestamps, and your law enforcement report number, if any. Keep in mind: an exchange is not obliged to freeze funds or disclose account-holder information, and this cannot be guaranteed.

Blockchain Analytics Specialists

Professional analysis can help when you need to trace the movement of stolen assets, structure a large number of transactions, make sense of links between several addresses, or prepare analytical materials for further work with law enforcement and services. Match Systems specializes precisely in investigating crypto incidents and analyzing blockchain transactions.

How Match Systems Can Help

Match Systems offers an incident registration form - the Incident Report. Through it, you can state the claimed loss amount, add transaction hashes, specify one or more addresses, choose an incident category, describe what happened, provide available details on related transactions and addresses, optionally leave contact details for updates, generate a preliminary PDF report, and download it to pass to law enforcement, a lawyer, an exchange, or another relevant party.

What happens after you submit a report:

1. You submit the details of the incident.
2. The system generates a preliminary PDF report based on the information provided.
3. You receive a document describing the incident, with the specified addresses and transactions, recommendations, and Match Systems contacts.
4. The information may be reviewed by Match Systems specialists.
5. If contact details are provided and notification is available, you may receive updates on wallets related to the incident.

The key point: even if you do not know where to begin, you can structure the information about the incident, record the addresses and transactions, and obtain a document to use for further action.

What the Preliminary Report Is

The preliminary PDF report may include: the date of creation, the claimed loss amount, the blockchain and specified addresses, the reporter's categorization of the addresses, transaction hashes, a description of the incident, recommendations for further action, and information about Match Systems. The document gathers the incident details in a structured form convenient for sharing with third parties.

Important caveats. The report is generated from information provided by the user; its registration does not confirm the accuracy of the stated circumstances; the document itself is not proof of guilt of the address owner; generating the report does not mean a full investigation has begun, and it does not guarantee a freeze or recovery of funds. The preliminary PDF is a structured record of an incident - not an expert opinion, a court document, or the result of a completed investigation.

Can Stolen Cryptocurrency Be Recovered?

The honest answer: recovery is possible but not guaranteed, and there is no universal success rate. The prospects depend on whether the onward movement of funds can be traced, whether there are transfers to centralized exchanges or other identifiable services, the availability of data and evidence, the time elapsed since the incident, the ability to approach the relevant platforms, whether a case has been registered and law enforcement involved, and the further movement of the assets.

It is important to distinguish three different tasks: tracing transactions; identifying possible points of interaction with centralized services; and the actual freezing or recovery of funds. Solving the first does not guarantee solving the others.

Separately: if the assets sit in a self-custody wallet, there may be no technical means to freeze them directly - the possibilities depend on the specific asset, network, and circumstances. A realistic assessment of prospects is only possible after reviewing the available materials.

What to Do If the Loss Is Small

A small loss does not remove the value of recording the incident: the evidence is worth preserving, and the incident worth reporting officially. For incidents with a claimed loss under $5,000, Match Systems offers a simplified registration form: a short sequence of steps, the ability to add several transaction hashes and several addresses, no mandatory email to submit, generation of a preliminary PDF, and the ability to download and share the document.

The simplified form makes registering and structuring information easier - but it does not mean every incident is automatically accepted into a full, paid investigation.

Common Mistakes After Crypto Theft

• deleting correspondence and other evidence;
• failing to save transaction hashes;
• ignoring related addresses;
• re-engaging with suspicious sites and smart contracts;
• handing a seed phrase or private key to third parties;
• trusting promises of guaranteed recovery;
• paying extra "fees" to unknown parties under the pretext of "unblocking" funds;
• expecting that a single report will automatically lead to recovery;
• not filing an official report with law enforcement;
• publishing unverified accusations against address owners.

A specific warning about secondary scammers who pose as crypto recovery specialists and exploit victims' vulnerable position. The hallmark of such schemes is a promise of guaranteed recovery and a demand for upfront payment, especially to a personal wallet. A professional assessment of prospects always comes after analysis, never before it.

Step-by-Step: What to Do Right Now

1. Secure your remaining assets and linked accounts.
2. Save correspondence, emails, links, screenshots, and payment confirmations.
3. Record transaction hashes, addresses, amounts, timestamps, and network names.
4. Gather available details on other addresses related to the incident.
5. File a report with law enforcement and keep the confirmation.
6. If the funds reached an exchange or service, contact its official support.
7. Register the incident via the Match Systems Incident Report.
8. Download the preliminary PDF and use it for further communication.
9. If needed, check with Match Systems whether further analytical review of the situation is possible.

How to Report an Incident via Match Systems

Registration takes a few simple steps. You state the loss amount; add the hash or hashes of the original transactions; choose the network and specify the addresses related to the incident; select the incident category; describe the circumstances; add further addresses if needed; decide whether you want to receive updates; and review and generate the PDF report.

Email is not required for registration itself. If you want to receive updates, you can leave contact details as the form allows.

Report the incident

Faced with crypto theft, phishing, or a scam? Record the incident, save the related addresses and transactions, and receive a preliminary PDF report. Match Systems will review the information provided within its available process and, where grounds and possibilities exist, help determine the next steps.

Conclusion

After a crypto incident, it is important not to lose evidence and to record transactions and addresses as early as possible. Reporting to law enforcement and engaging with exchanges can be important elements of what follows. Blockchain analysis helps make sense of fund movements but does not guarantee their recovery. Match Systems provides a way to structure the information about an incident and submit it for review.

Report the incident