Crypto Stolen? The First 24 Hours: A Step-by-Step Emergency Runbook

You just opened your wallet and the balance is zero. Or the exchange sent a security email while you were asleep. The next 24 hours decide most of what is still decidable: whether the rest of your assets survive, whether the evidence holds up, and whether the trail is still warm enough for anyone to act on.

This is the opening runbook of our stolen-crypto recovery series. It covers the first day only — triage, containment, evidence, reporting. The later stages (how exchanges freeze funds, how tracing actually works, how recovery scams work, and what a real case file looks like) get their own deep dives. If you have five minutes, read the BLUF above and the two tables; if you have an hour, read it all before acting.

One warning before anything else: the highest-risk window for a second loss is the 24 hours right after the first one. Panic is the attacker’s unpaid accomplice. Every step below exists because someone skipped it and lost more.

Step 1 — Triage: what was actually compromised? (Minute 0–15)

“Stolen crypto” is four different emergencies wearing the same coat. The containment move for each is different, and doing the wrong one first wastes the minutes that matter. Check your situation against this table before touching anything:

Intrusion type	What you’ll see	What the attacker has	What is still safe
Malicious approval (wallet drainer)	Tokens left your wallet after you signed a transaction on a site; NFTs or ERC-20s gone, ETH still there	Permission to spend specific tokens	Your seed phrase, your ETH, every unapproved token
Seed phrase compromise	Entire wallet emptied including ETH/gas, or assets moved while you did nothing	Total control of the wallet	Nothing in that wallet; other wallets are unaffected
Device malware (clipboard hijacker, session thief)	Funds sent to an address you didn’t paste; browser wallet drained from a device you use	Whatever your device can reach	Assets on other devices, hardware wallets used correctly
Exchange account breach	Exchange login alerts, withdrawals you didn’t make, API keys you don’t recognize	Your exchange account and its balances	Your self-custody wallets, other exchanges

How to tell them apart in practice:

Approval theft is the signature of a wallet drainer: you connected to a site, signed what looked like a claim, and later — minutes or weeks — specific assets disappeared while your gas balance stayed. The transaction that robbed you was technically valid because you authorized it in advance. Open the token-approval list for your address on any approval checker, and the permission is sitting there in plain sight.

Seed compromise looks different: everything goes, including ETH, in one sweep or a rapid series, and the seed phrase was exposed somewhere — a photo, a cloud backup, a “verify your wallet” phishing page, a fake support chat. If ETH left without you signing anything recent, assume the keys themselves are gone.

Device malware announces itself through substitution: you pasted an address and it changed in flight (address poisoning and clipboard hijackers both work this way), or a remote session used your unlocked browser wallet while it was live. The device is the crime scene; keep using it and you keep feeding it.

Exchange breach is the only type where you are not your own first responder — the exchange has its own incident pipeline. Your job is speed: change the password from a clean device, revoke sessions and API keys, and open a ticket with their security team with timestamps. Freeze requests to other exchanges matter here too, because stolen exchange funds usually attempt exits through other exchanges.

The triage table has one more use: it tells you whether your remaining assets are actually at risk. If what you signed was an approval, the attacker cannot take anything else until you sign something new — which means you have time to do everything calmly. If the seed leaked, you are in a race.

Step 2 — Containment: secure what remains (Hour 0–2)

If it was an approval

Stop transacting from the wallet. Every new signature is a new roll of the dice on the same compromised table.
From a clean browser session — not necessarily a new device, the keys are intact — revoke the malicious approval and every stale approval you no longer need. Revoke is itself a transaction, so keep a little gas aside for it.
Sweep the affected tokens and anything sharing approvals to a fresh wallet at your leisure, not at gunpoint. Then prevent the next drainer — the habits that matter are turnkey and cheap.

If the seed phrase leaked

Generate a new wallet on a clean device — one that is plausibly not infected. If your daily machine met the attacker (you typed the phrase into a phishing page from it), assume it is compromised. A phone that never touched the attack or a freshly booted machine is safer than the crime scene.
Evacuate in priority order: gas tokens first (without ETH you cannot move anything on Ethereum and most EVM chains), then high-value assets, then the rest. If gas costs are painful, move the top assets and decide about dust later — dust attack leftovers are not worth dying for.
Fund the new wallet’s gas from the old one only if the old wallet still has assets and you are sure the leak channel (cloud sync, photo backup, phishing page) is closed. Otherwise use a small deposit from an exchange or a friend.
Never re-import the burned seed into any device “just to check.” The phrase is radioactive now and forever.

If it was device malware

Disconnect the device from the internet after gathering what you need from it. Order matters: evidence first (Step 3), then quarantine.
Do not “quickly check” your other wallets from that machine. Move nothing, sign nothing, type no phrases on it.
Plan a rebuild: fresh OS or factory reset before that hardware touches a wallet again. Hardware wallets survive device malware only if every confirmation was read on the device screen — if you approved blind prompts out of habit, treat the hardware wallet as suspect too.

If it was an exchange breach

Password change and full session/API revocation from a clean device, then 2FA re-enrollment if the attacker rotated your settings.
Open the exchange’s security ticket immediately with timestamps of the unauthorized withdrawals. Exchange-side freezes of outbound transfers are sometimes possible within minutes — this is the one path where genuine “instant freeze” exists, and it belongs to the exchange, not to a stranger in your DMs.
Export everything the account shows: withdrawal history, login logs, API key list. Accounts get locked during investigations and you want the records first.

The containment rules that apply to all four types

Do not deposit from the compromised wallet to your own exchange account. Tainted funds landing on a KYC-verified account freeze the account and make you look like part of the laundering chain.
Do not send funds to any address given to you by anyone who contacted you after the theft. That includes “security researchers,” “white hats who can trace it,” and anyone with a wallet screenshot as proof.
Do not wipe anything yet. The phishing site URL, the DM thread, the installer, the email headers — all of it is evidence (Step 3).

Step 3 — Build the evidence package (Hour 2–12)

Cases get worked when the file is complete. Law enforcement units and exchange fraud desks triage by how much work a report saves them — a precise, self-contained package jumps the queue; “my crypto got stolen please help” does not.

Build it once, properly, in a text document you can paste anywhere:

Item	What exactly	Where to get it
Theft transactions	Every tx hash, with chain and timestamp	Block explorer, your wallet history
Attacker addresses	Every receiving address you can see, including later hops	Explorer view of the tx, 2–3 hops out
What was taken	Asset, amount, USD value at time of theft	Explorer, price on the day
Your addresses	The wallet(s) drained	Your wallet
Attack vector	The site URL, the app, the DM account, the email, the fake support thread	Browser history, chat apps — do not delete any of it
What you signed	Function name if visible (approve/permit/transfer), or exact UI screenshot of the prompt	Wallet’s transaction history, screenshots
Timeline	When contact started, when you signed, when funds moved, how you noticed	Chat timestamps, explorer timestamps
Evidence of identity (if pursuing legal freeze)	Proof you own the drained address — a signed message from the wallet, or a small send you control	Wallet’s sign-message feature

Two details that strengthen the file more than victims expect:

Follow the funds two or three hops yourself. You do not need to be a chain analyst — open the explorer, click the attacker’s address, watch where the money went. If it consolidates into a labeled address (an exchange hot wallet, a known mixer, a sanctioned entity), write that down with the hop distance. “Funds moved to address X, which is labeled Binance hot wallet, 3 hops out, 40 minutes after theft” is the single sentence that makes an exchange fraud desk act. The full tracing discipline is its own craft — we cover it here.

Preserve the social engineering, not just the transaction. How they found you, what they promised, which platform carried the approach — this is the metadata that connects your case to others. Fraud desks aggregate by vector; your thread might be the hundredth entry in a pattern they are already building.

Step 4 — Report and request freezes (Hour 12–24)

Three channels, in parallel. None of them replaces the others.

Law enforcement. In the US, file with the FBI’s IC3 (ic3.gov). Elsewhere, your national cybercrime or financial crime unit — most large economies now have a virtual-asset-capable desk. Paste the evidence package, keep the complaint number, and expect silence: IC3 cases aggregate, and your file may join a larger investigation months later. That is not failure — it is how the big cases were built. The public recovery record — Colonial Pipeline, KuCoin, Bitfinex — runs on exactly this aggregation.

Exchange freeze requests. For every labeled exchange address your two-hop trace found, send that exchange’s abuse/fraud channel (usually abuse@ or a web form) a short message: theft tx hash, your address, their labeled address as destination, timestamp, asset/amount, your case number if you have one. Do not write an essay — fraud desks triage on parseability. One paragraph, five facts, done.

Platform reports for the vector. The phishing site’s registrar/host, the fake social account, the Telegram user — report them all. This rarely recovers your funds, but it shortens the attack’s life for the next victim, and takedown records sometimes surface later as corroboration in aggregate cases.

What reporting in the first 24 hours actually buys you: the funds are, statistically, still on identifiable paths. The real recovery pipeline works when stolen funds approach an exit that answers to someone — an exchange with KYC, a compliant bridge, an OTC desk. Every hour of delay widens the distance between the theft and the last point where a freeze order can land.

The five panic mistakes (any of which can cost more than the original theft)

Paying a “recovery service” that contacted you. They watch complaint threads and DM freshly robbed victims within hours. The upfront fee is the entire product. The full anatomy of this economy: crypto recovery scams explained. No exceptions have been documented — not one public case exists of a DM-initiated recovery service returning stolen funds.
Moving remaining assets to the same wallet type that just failed. If a signature trick beat you, evacuation to a fresh hot wallet and revoking everything is the fix. If your device is compromised, a new wallet generated on that device is a new donation. Match the fix to the triage table.
Continuing to transact from the compromised wallet. Every transaction from a drained wallet tells the attacker your new addresses, your habits, and sometimes your exchange deposit addresses — which is exactly the map they need for round two.
Deleting the attack artifacts to “clean up.” The phishing DM, the malicious site, the installer — victims purge these out of shame or tidiness and destroy the strongest evidence they had. Screenshot, archive, keep.
Announcing the theft publicly with full details. A public post with your address and timeline is a targeting brief for recovery scammers, and it can complicate a later legal process. Report to institutions; vent to people who already know you.

After the first 24 hours

The emergency is over; the process begins. From here the work splits into the tracks this series covers next: how exchange freezes actually work on the inside, how to write reports that get read, how to spot the recovery-scam second wave, and what a real traced case looks like hop by hop. Two of those tracks are already published — start with how stolen crypto is recovered for the pipeline view, and crypto recovery scams explained for the predators who will find you in week one.

If the theft was an approval signature, also read how to prevent wallet drainers before you rebuild your habits — the same trick that worked once works again on the same wallet, forever, until the approvals are gone and the workflow changes.

Limitations

This runbook is triage, not legal advice. Jurisdictions differ on reporting channels, on whether signing a message for proof-of-ownership is safe in your specific situation (it is safe for standard sign-message prompts, dangerous if prompted by an unfamiliar site), and on how exchanges respond to freeze requests — response quality varies from hours to never. Nothing here promises recovery: the honest base rate is that most small thefts are never returned, and the practices above maximize your position in the cases where recovery is possible. What they reliably prevent is the second theft, which is the one you still control.

Frequently Asked Questions

What is the very first thing to do when crypto is stolen?

Do not touch the compromised wallet. First diagnose what actually happened: if a malicious token approval was signed, your seed phrase is still safe and remaining assets need one revocation-and-move cycle; if the seed phrase itself leaked, every asset in that wallet is already lost and the only move is evacuation to a fresh wallet generated on a clean device. Transferring from the compromised wallet to an exchange first — the instinctive move — is a mistake: it burns gas, exposes your exchange identity, and can get your legitimate account frozen in the investigation.

Should I move remaining funds to an exchange for safety?

Not from a wallet the attacker can still transact from, and not as the first move. If the compromise is a token approval, the attacker cannot touch your other assets — revoking and moving to a fresh wallet is enough. If the seed phrase leaked, move to a brand-new wallet generated on a clean device first; an exchange deposit can follow once you control a clean address. Depositing directly from the drained wallet also pollutes your exchange account with tainted funds, which can freeze your legitimate account.

Can stolen crypto actually be recovered?

Sometimes, and almost never by 'recovery services' that contact you first. Public recoveries — Colonial Pipeline, KuCoin, Bitfinex — all followed the same path: on-chain tracing plus law enforcement plus exchange freezes or key seizures, over months to years. The variables that decide whether a case gets worked are speed of reporting, quality of the evidence package, and whether funds reached identifiable off-ramps. Details: our pipeline walkthrough.

Who do I report a crypto theft to?

In the US, the FBI's Internet Crime Complaint Center (IC3) — crypto cases are aggregated and joined to larger investigations. Elsewhere, your national cybercrime unit; most G20 countries now have one that handles virtual asset crime. In parallel, if you can identify the exchange where stolen funds landed via a labeled deposit address, send that exchange's abuse channel a concise freeze request with transaction hashes, addresses, timestamps, and your case number. Reports filed in the first 24 hours measurably outperform late ones because funds are still traceable.

Someone messaged me saying they can recover my stolen crypto. Is it real?

No. Recovery scammers monitor complaint threads, Telegram groups, and public posts for fresh victims and arrive within hours of a theft. Their tells: upfront fees, requests for your seed phrase or wallet access, proof that consists of wallet screenshots, and results promised in days. Legitimate recovery runs through law enforcement and courts, takes months, and never starts with a stranger DMing you.