What to Do Immediately If Your Crypto Is Stolen

Key Takeaways

In the fastest hacks documented in 2025, stolen crypto moved within seconds of the theft and was fully laundered within minutes. The first 60 minutes after you notice are the part of the response that decides most outcomes.
The first priority is containment: revoking any malicious approvals, disconnecting compromised sessions, and rescuing remaining funds where that's actually possible. Evidence capture comes immediately after.
Treat the compromised wallet as no longer yours. Stop interacting with it, and don't send a "rescue" transaction unless you have a clean device and a fresh wallet ready.
If your phone lost signal or you signed something on a website, those details matter. They point investigators toward the attack vector and shape the response.
If the stolen funds include stablecoins, the first 60 minutes are when a freeze through law enforcement is most achievable. Once funds convert out of stablecoin form, that option closes.
Contact Match Systems before you do anything else that takes time. The earlier we see the transaction hash, the more of the trail is still actionable.

Why the First 60 Minutes Matter So Much

In our work, we see a single variable separate the cases that end in recovery from the cases that don't. It isn't the size of the theft. It isn't the sophistication of the attacker. It's how quickly the victim acted.

The reason comes down to the speed at which stolen crypto moves. A 2025 study by blockchain analytics firm Global Ledger analyzed 119 hacks in the first half of the year and found that in the fastest documented case, funds moved within four seconds of the breach — more than 75 times faster than the average exchange or DeFi alerting system. In another incident, the entire laundering process took two minutes and 57 seconds, faster than a laptop's screen timeout. By the time most victims even confirm the theft has happened, the assets are already in motion.

The same study found that in 68% of cases, hackers moved funds before the attack was publicly known, and one in four hacks were fully laundered before any alert was issued. By H2 2025, that figure had risen to 84.6%.

This is why the first 60 minutes carry so much weight. Every minute the victim spends panicking, posting on Telegram, or trying random recovery sites is a minute the attacker uses to fragment funds across wallets, swap them through DEXs, or bridge them to a chain with less monitoring. The window doesn't close at the one-hour mark, but it narrows sharply with every passing minute. What you do in the first 60 is what you have most control over.

Minute 0-15: Stop the Bleeding

The first 15 minutes should produce one thing: containment. If anything is still recoverable, it's recoverable now.

If you still have valuable assets in the same wallet that was compromised, the most urgent question is whether they can be moved to safety. The honest framing is that this depends entirely on how the theft happened. If your seed phrase or private key was exposed, the wallet is no longer yours, regardless of what's still in it. Attackers routinely run automated scripts that sweep any incoming gas the moment it arrives, so sending a rescue transaction often fails and just hands them the gas fee. A genuine rescue requires a clean device and a freshly created wallet whose keys have never touched the compromised environment. Even then, treat it as a low-probability play. Move fast, expect it to fail, and don't compound the loss by sending more funds chasing a recovery.

If the theft involved a malicious approval or Permit signature rather than seed phrase exposure, the situation is different. The attacker holds standing permission to drain tokens as they arrive, but the wallet itself is still under your control. Open your wallet's connected sites and token approvals panel and revoke anything granted to an unfamiliar address. This is the one action that genuinely benefits from being done immediately, and it can stop ongoing damage even when the initial theft is already complete.

Disconnect any browser extension wallets from the suspicious site you interacted with, if applicable. Close the browser tab, do not refresh or revisit the site. Once containment is handled, you've done what you can to limit additional loss. The next priority is documenting what was already taken.

Minute 15-30: Confirm and Capture

Now the priority is building a complete record of what was stolen. Without it, nothing investigators do later has anywhere to start.

Open a blockchain explorer (Etherscan for Ethereum, Tronscan for Tron, BscScan for BNB Chain, and so on) and find the unauthorized transaction. Don't rely on your wallet's interface, which a sophisticated attacker can manipulate. The blockchain is the source of truth.

Capture the following:

The transaction hash of the theft (a long alphanumeric string starting with 0x on most chains)
The attacker's receiving address
The amount and the token type
The exact timestamp
Screenshots of the explorer page showing all of the above

If multiple transactions were involved, capture all of them. Some drainers split the theft across several outgoing transfers to multiple fresh addresses; investigators need the full picture, not just the first one.

If you have any context about how the theft happened (a link you clicked, a transaction you signed, a phone that lost signal), write it down now while it's fresh. Even uncertain details matter.

Minute 30-45: Lock Down What's Connected

Crypto theft is rarely a single-wallet event. Attackers who get one foothold often pivot to others, and the connected accounts surrounding the wallet are usually next.

Change the password on your email account first. Almost every crypto-adjacent account ties back to email for password resets, so an attacker with email access can chain into exchange accounts, custodial wallets, and recovery flows. Use a new password, set from a clean device.

Change passwords on any centralized exchange accounts you use, and immediately review the security settings. Replace SMS-based two-factor authentication with an authenticator app or hardware key. SMS 2FA can be defeated by a SIM swap, and many cases we investigate include exactly that step.

If your phone suddenly lost signal in the minutes or hours before you noticed the theft, treat it as a possible SIM swap in progress. Call your mobile carrier from a different phone, lock the account, and ask for confirmation that no recent SIM transfer has been authorized. The fact that you contacted them is also part of the evidence trail.

Minute 45-60: Get Specialists Involved

By minute 45, the evidence is captured, the immediate exposure is closed, and the connected accounts are secured. The remaining priority for the first hour is getting the case into the hands of people who can move on it.

This is the point to contact Match Systems. The first thing we ask for is the transaction hash and the attacker's address — the same evidence captured in the first 15 minutes. From there, the investigation begins: mapping the address graph, identifying which exchanges or services the funds are heading toward, and determining the most effective response path for the case. Direct relationships between investigators and exchange compliance teams move faster than navigating official channels alone, and the earlier we see the case, the more leverage that relationship can produce.

If the stolen assets include stablecoins like USDT or USDC, this hour matters even more. Tether and Circle can restrict specific addresses at the request of law enforcement, and that intervention path is most achievable while the funds are still in stablecoin form. We coordinate with authorities to initiate that process. Once the funds are swapped out, the option closes.

Some victims also want to file a police report or contact a national cybercrime unit in this window. That's appropriate, but it shouldn't replace contacting investigators. Official channels often take weeks to produce action, while exchange-side intervention through specialist firms can move within hours.

The 60-Minute Checklist

Time	Priority
Min 0-15	If your wallet isn't fully compromised, revoke unfamiliar token approvals and disconnect from suspicious sites. A rescue transaction from a clean device may be possible if only an approval signature was abused. Do not send a rescue transaction blindly; if your seed phrase is exposed, attackers' scripts will likely intercept it.
Min 15-30	Find the theft transaction on a blockchain explorer. Capture the transaction hash, attacker's address, amount, token, and timestamp. Note any context about how it happened.
Min 30-45	Change passwords on email and connected exchange accounts. Replace SMS 2FA with an authenticator app. If your phone lost signal, call your carrier and lock the account.
Min 45-60	Contact Match Systems with the transaction hash and attacker's address. If stablecoins were stolen, this is when a freeze through law enforcement is most achievable.

After the First Hour

The first hour is about triage. The hours and days that follow are about preserving options and supporting the investigation that's now underway.

Don't pay anyone who contacts you offering recovery. Within hours of a theft, victims are often approached by accounts promising to recover the stolen funds for an upfront fee. These are almost always follow-up scams, sometimes run by the same group that stole the funds in the first place, working from a list of fresh victims. No legitimate firm asks you to send crypto to a wallet to unlock your stolen funds, and no legitimate firm guarantees recovery.

Preserve everything. Screenshots, message logs, emails, anything that records what happened or led to it. Some of this will matter for the legal process, and some of it will matter for the investigation itself.

Stay in contact with the investigators you've engaged. The work continues, often quietly, for days or weeks. The closer the communication, the better the chance of acting on opportunities as they appear.

FAQ

How fast do hackers actually move stolen crypto?

Faster than most people imagine. In the documented cases analyzed by Global Ledger in 2025, the fastest first movement after a hack was four seconds, and the fastest complete laundering took under three minutes. In 68% of cases, funds moved before the breach was publicly known. This is the reason the first hour matters so much. The window for intervention is measured in minutes, not days.

Can I recover my crypto if I notice the theft after an hour?

Often yes, but the odds depend on what's happened in the meantime. Funds that have reached a centralized exchange but haven't yet been withdrawn can still be flagged through a legal notice to compliance. Stablecoins that haven't been converted yet can still be subject to an issuer freeze on law enforcement request. Cases reported within the first day are generally the ones with the strongest prospects. The longer the delay, the more the trail fragments.

Should I move my remaining funds out of the hacked wallet?

Only if you have a clean device, a brand-new wallet whose keys have never been exposed, and a realistic expectation that the attempt may fail. If your seed phrase was compromised, attackers often run scripts that sweep incoming gas instantly, so a rescue transaction can hand them the gas without recovering anything. Capture the evidence first, then decide whether a rescue is worth attempting based on what's left and how the theft happened.

Do I need to file a police report immediately?

Filing a report is appropriate, but it shouldn't be the only thing you do, and it shouldn't delay contacting investigators. Official law enforcement channels often take weeks to produce action. Specialist investigation firms with direct relationships to exchange compliance teams can move within hours. Doing both in parallel is the standard approach, and the order in which you do them can be advised by the investigators you engage.

What does Match Systems actually do once contacted?

Once we have the transaction hash and the attacker's address, we map the flow of funds across wallets and chains, identify the most likely intersection points where stolen assets will touch a regulated exchange, and coordinate with those exchanges' compliance teams to flag or freeze the account. If stablecoins are involved, we coordinate with law enforcement to initiate an issuer freeze. The work is procedural and time-sensitive, and the earlier it starts, the more of the trail is still actionable.

In crypto theft investigations, time matters more than most victims realize.

Once funds are bridged, mixed, or withdrawn through OTC channels, recovery becomes significantly harder.

Match Systems works with exchanges, stablecoin issuers, and law enforcement to trace stolen assets and support legal recovery, drawing on a proprietary address labeling database and direct compliance relationships built over years of active investigations.

Start a case assessment: https://matchsystems.com