What to do if your cryptocurrency is stolen

Why stolen crypto is hard to get back

Cryptocurrency is controlled by whoever holds the private key (the secret code that authorizes transfers from a wallet). Once a thief has that key, or tricks you into approving a transfer, the transaction is recorded on the blockchain and usually cannot be reversed. The FTC states it plainly: cryptocurrency payments typically are not reversible, and the money comes back only if the recipient sends it back.

The scale of the problem is large. Cryptocurrency was involved in 181,565 complaints and $11.366 billion in losses in 2025, according to the FBI IC3 2025 Internet Crime Report. For wider context, consumers reported $15.9 billion in fraud losses and filed 3 million fraud reports with the FTC in 2025, covering all types of fraud rather than crypto alone, according to the FTC Prepared Statement to the Joint Economic Committee.

Irreversible does not mean untraceable. Every blockchain transfer leaves a permanent public record. That record lets investigators follow funds to exchanges, where accounts can sometimes be frozen through the exchange's internal processes or legal process. Your job is to stop further losses, preserve the record and put it in front of the right agencies quickly.

How crypto is usually stolen

Knowing how the theft happened tells you which accounts and devices to secure. The common patterns are:

• Investment and romance scams: a contact met online persuades you to deposit funds on a fake trading platform that shows false profits.
• Impersonation: callers pose as exchange support staff, government agencies or law enforcement. The FBI has warned about scammers posing as exchange employees who claim your account is under attack and then ask for login details.
• Phishing and wallet drainers: a fake site asks you to connect your wallet and sign a transaction that grants it permission to move your tokens.
• Recovery phrase theft: malware, a fake wallet app or a fake support agent obtains your 12 or 24 backup words.
• Account takeover and SIM swaps: an attacker takes over your email or phone number and uses it to reset your exchange password.

If you sent the funds yourself because someone deceived you, the loss is fraud. If someone moved funds without your action, treat your device, recovery phrase or accounts as compromised. Both should be reported.

Secure what is left before anything else

Thieves often return for remaining balances, and many wallet drainers keep working until permissions are removed. Act on these steps before you start reporting.

Use a clean device and a new wallet

If your recovery phrase may have been exposed, every wallet derived from it is compromised. Create a new wallet with a new recovery phrase on a device you trust, then move remaining assets to it. Do not import the old phrase into the new wallet, and do not type it into any website or form.

Revoke token approvals

A token approval (also called an allowance) is a permission you give a decentralized app to move specific tokens or NFTs from your wallet. Many apps request an unlimited spend limit by default, and approvals stay active after you stop using an app. A malicious approval lets an attacker drain tokens without your recovery phrase. Token approval tools, such as the Etherscan checker described in OpenSea's help article, list active approvals and let you revoke them. Revoking is a blockchain transaction, so it costs a network fee, and these tools are third-party services you should reach by typing their address yourself.

Lock down exchange and email accounts

Change exchange passwords, remove any withdrawal addresses or API keys you did not create, and switch multi-factor authentication (a second sign-in step beyond your password) to an authenticator app or security key. Then secure the email account tied to the exchange, because email is the usual route for password resets.

Contact the exchange the right way

If stolen funds left an exchange account, or passed into one, the exchange may be able to flag or restrict the receiving account. Exchanges act through their own internal processes or in response to legal process, so a prompt report with transaction details helps.

Reach support only through the exchange's official app or the website address you type yourself. Scammers buy search ads and post fake support numbers in forums and social media. The FBI advises hanging up on unsolicited calls about account problems and contacting the exchange through its official channels, and never sharing login information. A real support agent will not ask for your recovery phrase, your password or remote access to your computer.

Document the evidence investigators need

Blockchain evidence is precise, which makes good records unusually valuable. IC3's cryptocurrency guidance identifies transaction details as among the most important information in a complaint. Record:

• Transaction hashes: the TXID, a unique identifier for each transfer. IC3 notes that a Bitcoin transaction hash is a 64-character hexadecimal string.
• Wallet addresses: your sending address and every receiving address. IC3 notes that an Ethereum address is 42 characters including the "0x" prefix.
• Coin types and amounts: the asset, the amount and its approximate dollar value at the time.
• Dates and times: for each transaction, with the time zone.
• Contact details: how you met the person, the platforms used, websites, usernames and phone numbers.
• Screenshots: wallet history, exchange statements, chats and the scam website.

Copy addresses and hashes exactly by pasting them; a single wrong character points to a different record. Keep everything in one folder stored off the affected device.

Where to report stolen cryptocurrency

Reporting rarely produces a quick refund, but it builds the case record that investigators use to connect victims, trace funds and seek seizures. Report to each of these:

• FBI Internet Crime Complaint Center: file at ic3.gov. IC3 encourages complaints even when no money was lost.
• Federal Trade Commission: file at ReportFraud.ftc.gov. If the site is temporarily unavailable, check consumer.ftc.gov for current instructions.
• Chainabuse: report the receiving addresses and scam URLs at Chainabuse, a public reporting platform powered by TRM Labs. It says it will never ask for payment, and it does not recover funds itself.
• Local police: file a report and keep the number for your exchange, bank and tax records.

If the scammer collected identity documents or your Social Security number, also follow our identity theft guide.

Beware of recovery scams

Victims of crypto theft are prime targets for a second scam. The FBI has warned of an increase in companies falsely claiming they can recover funds lost in cryptocurrency investment scams. These operators find victims through social media, messaging apps, and ads placed in search results and comment sections. They collect an up-front fee, then disappear or deliver a vague tracing report and ask for more money. Some claim to work with law enforcement or a law firm.

Keep three facts in mind:

• Law enforcement does not charge victims a fee to investigate a crime.
• Private recovery companies cannot issue seizure orders to recover cryptocurrency.
• Anyone claiming FBI affiliation can be checked by contacting your local FBI field office directly.

Do not send money, identity documents or wallet access to anyone who contacts you offering recovery. Report the contact to IC3 along with your original complaint details.

Crypto ATM and kiosk scams

Cryptocurrency kiosks, often called bitcoin ATMs, convert cash into crypto and send it to a wallet address, frequently by scanning a QR code. Scammers use them because the transfer is fast and hard to reverse. Crypto ATMs and kiosks accounted for 13,460 complaints and $389 million in losses in 2025, according to the FBI IC3 2025 Internet Crime Report.

A 2026 FBI public service announcement describes the usual pattern: unsolicited contact, an impersonated government agency, law enforcement office or utility, and step-by-step instructions to withdraw cash and deposit it at a kiosk. The FBI states that no legitimate law enforcement or government official will call to demand payment through a cryptocurrency kiosk. The FTC similarly warns that anyone who says you can only pay in one of these ways is probably a scammer.

If you paid through a kiosk, keep the receipt and report the transaction ID, wallet address and kiosk location to local police and IC3. You can also contact the kiosk operator through its official website and ask whether it can act on the transaction, but do not expect a reversal.

Taxes and records after a theft

The IRS treats digital assets as property, and its digital assets page explains how transactions are reported. Whether a theft or scam loss can be claimed, and how, depends on the facts and on current law. Confirmed Stolen does not give tax advice. Keep your transaction records, police report and IC3 confirmation, and ask a qualified tax professional how the loss should be handled. The IRS also warns that it does not require you to register digital assets and is not sending letters asking you to do so; treat such a letter as a scam.