If your crypto was stolen, act in this order: file a report with IC3 and your local police, save every wallet address, transaction hash, and screenshot you can find, then lock down your remaining accounts with new passwords and app-based two-factor authentication. Ignore anyone who contacts you offering to recover your funds for an upfront fee. If your coins passed through mixers or unfamiliar exchanges, a forensic investigator can trace the trail, though outcomes vary by case.
TL;DR:
- Filing comprehensive reports with IC3, local police, and the FTC within days maximizes chances of tracing the stolen funds and building a strong evidence case.
- Preserving transaction hashes, wallet addresses, and communication logs in a dedicated, well-organized folder improves investigation effectiveness and recovery prospects.
- Funds routed through regulated exchanges are the most recoverable, while those passing through mixers or foreign platforms are significantly harder to trace and recover.
- For complex thefts involving mixers or cross-chain transfers, forensic investigators can reconstruct the transaction trail with detailed analysis and chain-of-custody documentation.
- Never pay upfront fees or share private keys with recovery scammers; legitimate law enforcement and forensic services never guarantee outcomes or ask for payments before work begins.
Table of Contents
- Who to report to and exactly what to include in your report
- Immediate technical steps to preserve evidence and limit further loss
- How blockchain tracing and forensic investigations work
- Working with law enforcement and victim compensation options
- Avoiding recovery scams and next steps if official channels stall
- Why speed and documentation change the outcome
- How Recovera Forensics helps when tracing gets complex
- Sources
- FAQ
Who to report to and exactly what to include in your report
Reporting fast matters, but reporting completely matters more. Investigators can only act on what you give them, so treat your first report as the foundation for everything that follows.
File in this order:
- IC3 (Internet Crime Complaint Center): file at ic3.gov as your first stop. The FBI’s cryptocurrency victim guidance treats IC3 as the primary government point of contact for crypto theft, and it asks for wallet addresses, transaction hashes, exact amounts, and timestamps.
- Local police: file a report even if the officer taking it seems unfamiliar with crypto. A police report number gives you an official case reference for banks, exchanges, and any later legal action.
- FTC: report at reportfraud.ftc.gov, which feeds a national database used to track patterns across scams.
- Your state attorney general’s office: many run separate consumer-protection units that can escalate cases involving larger losses.
Before you file anything, gather:
- Transaction hash or TxID for every relevant transfer.
- Sending and receiving wallet addresses.
- Exact amounts and timestamps of each transaction.
- Names of any exchanges, plus the usernames or emails tied to the scammer.
- Screenshots or logs of every message exchanged with the scammer.
Victims over 60 have a dedicated line, the National Elder Fraud Hotline at 833-372-8311, staffed for cases that often involve larger losses and more targeted schemes.
Immediate technical steps to preserve evidence and limit further loss
Evidence decays fast. Exchanges purge logs, chat apps get deleted, and scammers scrub the accounts they used within days. Do this before anything else.
- Export your transaction history. Most exchanges let you download a CSV of your trading and withdrawal activity. Do this immediately, before support tickets or account restrictions slow you down.
- Capture every TxID and wallet address involved in the theft, and paste them into a plain text file you control.
- Secure your accounts. Change passwords everywhere connected to the stolen funds, switch two-factor authentication from SMS to an authenticator app, and revoke any smart-contract approvals tied to your wallet.
- Move remaining assets to a wallet you fully control, ideally cold storage, once you’re confident your devices aren’t compromised.
- Preserve communications. Export emails as .eml files rather than just screenshotting them, since .eml preserves headers and metadata that matter later. Screenshot chats with visible timestamps, and note every domain or app the scammer used.
Do not share your seed phrase with anyone, including someone claiming to help you recover funds. Don’t attempt a bank chargeback on a related crypto purchase without understanding it may flag your account for fraud review instead of returning funds. And don’t send any additional crypto to a so-called recovery intermediary, ever.
Pro Tip: Keep a single dated folder (cloud or local) with every export, screenshot, and log in one place. Investigators move faster when they don’t have to ask you for missing pieces.
How blockchain tracing and forensic investigations work
Every transaction on a public blockchain is permanent and visible, which is both the good news and the bad news. Investigators start with your TxID, then cluster the addresses connected to it, looking for patterns that link them to known exchange deposit addresses or other services with identifiable ownership.
- Tracing typically follows the money through several hops: wallet to wallet, wallet to exchange, or wallet to a service like a mixer.
- Mixers, bridges between blockchains, and privacy coins are the biggest obstacles, since they’re built specifically to break the visible trail.
- Even when a trail leads somewhere, an uncooperative or foreign exchange with no US legal exposure can refuse to respond to requests.
- A completed investigation typically produces a technical report, an evidence chain-of-custody record, and OSINT findings connecting wallet activity to real identities where possible.
Recovery is most realistic when stolen funds land on a regulated exchange that can act on a legal request, according to FBI guidance on virtual currency investigations, which notes that funds routed through mixers or foreign, uncooperative platforms are far harder to recover. That single fact should shape your expectations from day one: speed and destination matter more than almost anything else.
Working with law enforcement and victim compensation options
Filing your IC3 report doesn’t guarantee an investigation opens immediately. The FBI and US Attorney’s offices use IC3 data to spot patterns across many victims, and cases tied to larger schemes or identifiable suspects tend to get prioritized over isolated incidents.
- Keep every case number, officer or agent name, and contact detail organized from your first report onward.
- Expect requests for supporting documents: your original transaction exports, communication logs, and any KYC details from the exchange you used.
- The Department of Justice has run remission and compensation processes in prosecuted cases, including its OneCoin fraud victim compensation program, where victims applied through an official portal to recover funds already seized by the government.
- These programs only apply once a prosecution and asset seizure have occurred, so they’re a possibility, not a guarantee, and the petition process itself requires documentation you should already be preserving.
If your case involves a large loss or a known scheme, it’s worth consulting an attorney about civil options, including a civil claim against identifiable defendants, in parallel with your criminal report.
Avoiding recovery scams and next steps if official channels stall
Scammers target crypto theft victims a second time by posing as recovery experts. The FTC’s guidance on recovery scams is blunt: legitimate agencies never charge an upfront fee or ask for your financial credentials to help you recover stolen funds.
- Treat any unsolicited offer as a scam, especially one that guarantees recovery or demands payment before doing any work.
- Never hand over your seed phrase or private keys, no matter who’s asking or how official they sound.
- Vet any paid forensic or legal service by asking for a sample report, a clear scope of work, and confirmation that you won’t be charged for a guaranteed outcome, since no legitimate firm can promise one.
- If law enforcement progress stalls, keep requesting case updates, maintain your evidence folder, and consider a limited-scope forensic engagement to strengthen your file.
Pro Tip: A checklist for securing personal digital accounts is worth working through even after the immediate crisis passes, since repeat targeting of the same victim is common.
Why speed and documentation change the outcome
The cases that go anywhere share one trait: the victim documented everything within days, not weeks. Funds move fast once a scammer starts converting to another asset or moving through a mixer, and every day of delay narrows what a trace can recover.
A workable evidence checklist looks like this: TxIDs and wallet addresses, exchange CSV exports, .eml copies of every email, timestamped screenshots of chats, and a written timeline of what happened and when. Bring that to any report or investigation, and you’ve done the hard part already.
Recovery outcomes vary widely and no one can promise a result, but a well-documented case gives investigators, prosecutors, and forensic analysts something they can actually work with.
— cristian
How Recovera Forensics helps when tracing gets complex
When stolen funds move through mixers, cross-chain bridges, or a maze of wallets before landing somewhere, the tracing work outgrows what most victims can do alone. That’s the gap forensic investigators fill: reconstructing the full path of a theft into a technical report that holds up with law enforcement, opposing counsel, or a court.
- Funds routed through mixers or multiple wallets often need address clustering and pattern analysis to identify where they ultimately settled.
- Cases headed toward legal action benefit from a report built with chain-of-custody documentation from the start, not assembled after the fact.
- OSINT attribution work can connect wallet activity to real-world identities when public and semi-public data allows it.
Before reaching out, gather your TxIDs, wallet addresses, exchange exports, and communication logs. Recovera’s intake process starts with a review of exactly that material, then scopes an investigation around what’s realistically traceable in your case. You can review the firm’s cryptocurrency scam investigation services and start the intake conversation there.
Sources
- Cryptocurrency Investment Fraud
- Refund and recovery scams
- Justice Department announces compensation process for OneCoin fraud victims
This article is general information, not a substitute for advice from a qualified financial advisor. Consult a qualified financial professional about your own circumstances before acting on anything here.
FAQ
What do you do if someone steals your crypto?
File a report with IC3 and your local police immediately, then preserve every transaction hash, wallet address, and communication tied to the theft. Secure your remaining accounts with new passwords and authenticator-based two-factor authentication, and avoid anyone who contacts you offering paid recovery help.
I lost a large amount when my cryptocurrency was stolen. How can I recover it?
Start with an IC3 complaint and a police report, since these create the official record that any later action depends on. Recovery is most likely when funds sit on a regulated exchange that can respond to legal requests; funds moved through mixers or uncooperative platforms are far harder to trace, according to FBI guidance on virtual currency investigations.
Can the police do anything about stolen crypto?
Police and federal agencies can investigate, and in some prosecuted cases the Department of Justice has run remission programs that returned seized funds to victims, as seen in the OneCoin compensation process. These outcomes depend on whether a prosecution and asset seizure actually occur, so they’re a real possibility rather than a guaranteed result.
How to recover stolen cryptocurrency investment?
File official reports first, preserve your transaction data and communications, and never pay anyone who contacts you unsolicited promising guaranteed recovery, a pattern the FTC explicitly warns against. If the funds moved through complex paths like mixers or multiple wallets, a forensic investigation can trace the flow and produce documentation useful for law enforcement or a civil claim.
