What should you do in the first 24 hours after a crypto theft?

1. Secure what you still control

Assume that the attacker may still have access. Act from a clean device, not from the one that may be compromised.

• Move any remaining funds to a new wallet whose seed phrase was generated on a clean device.
• Revoke token approvals granted to unknown contracts.
• Change passwords and two-factor authentication for email and exchange accounts.
• Disconnect the suspect device from the network but do not wipe it: it is evidence.

2. Preserve the evidence

Collect everything now, while you remember the details. Investigators, exchanges and issuers will ask for the same information.

• Transaction hashes, your addresses and the receiving addresses, with the blockchain used.
• Date, time and time zone of each event.
• Chats, emails (with headers), websites, apps and screenshots linked to the theft.
• Exchange statements and any communication from the platforms involved.

3. Trace the funds and send freeze requests

Stolen funds are often split across many addresses and moved within hours. A quick tracing shows which tokens are involved and which intermediaries have received them. Stablecoins still sitting at an address can be blocked by the issuer; funds that reached an exchange can be frozen in the receiving account.

Requests should be precise: addresses, transactions, amounts and the path from your wallet. Reporting the addresses to industry blocklists also helps other platforms recognise the funds.

4. File a criminal complaint

File with the police or the public prosecutor in the country where you live, bringing the evidence and, if available, the tracing report. Many countries also have online portals or specialised units for cybercrime. Ask for a copy or reference number of the complaint: exchanges and issuers often ask for it before acting.

File even if the thief or the exchange is abroad. Your local authority opens the case and can ask other countries for help when it needs to.

What to avoid

• Paying “recovery” services that contact you or guarantee results.
• Contacting or threatening the thief, or posting the addresses publicly before freeze requests are sent.
• Resetting or discarding devices and accounts that hold evidence.

How Advisorn helps

Advisorn Forensics can start tracing as soon as you send us the transactions, and sends freeze and information requests to the issuers and exchanges involved. We also prepare the technical documentation your lawyer needs for the complaint.