If your funds are gone - through a scam, a phishing attack, a wrong transfer, or a collapsed platform - the decisions you make in the next 48 hours matter more than anything that comes after. This page walks you through exactly what to do, step by step, in plain language.
You are not alone. Crypto fraud affects millions of people every year. Many feel shame or confusion - but acting quickly and methodically is what separates cases with a chance of resolution from those that go nowhere.
Panic leads to mistakes. The first hour is not about recovery - it's about stopping any further damage and locking down what you still have.
If your wallet was compromised through a phishing site or malicious approval, the attacker may still have active permissions. Go to your wallet settings and revoke all token approvals. Use a tool like Revoke.cash (for Ethereum-based chains) to see and cancel all existing permissions in one place. Do this before anything else.
Change the password on any email account, exchange account, or platform connected to the affected wallet. Use unique, strong passwords for each. Enable two-factor authentication (2FA) using an authenticator app - not SMS - on every account. If you used the same password anywhere else, change those too.
Scammers frequently follow up a theft with a second approach - claiming you need to send a small amount to "unlock" your funds, pay a "gas fee" for recovery, or verify your wallet. This is always a lie. No legitimate service requires you to send additional crypto to recover what was taken. Stop all transfers until you've read and understood this guide.
Your documentation is the foundation of any case. Whether you go to the police, an exchange, or a lawyer - they will all ask for the same things. Collect them now while they're still accessible.
The single most important piece of information. Find it in your wallet's transaction history. It's a long string of characters - copy it exactly and save it in multiple places. This hash lets anyone trace exactly what happened to your funds on the blockchain.
Save every message, email, social media conversation, and voice note exchanged with the scammer. Screenshot the profiles of anyone involved - names, profile pictures, usernames, platform links. Scammers delete accounts quickly. Capture before they disappear.
Write out, in chronological order, every interaction from first contact to the moment funds were lost. Include dates, times, and what was said or done at each step. A clear timeline transforms a confusing story into an actionable case file for investigators.
Note every wallet address that played a role - yours, the address you sent funds to, and any others visible in the transaction chain. These addresses are permanent identifiers that investigators and exchanges can use to trace activity and link accounts.
If a fake investment platform or scam website was involved, take full-page screenshots of it - the homepage, any "dashboard" showing your fake balance, withdrawal pages, and any terms or contact information displayed. Also note the URL exactly as it appeared in your browser.
Record the exact amount lost - in both the original cryptocurrency and its approximate fiat value at the time of the loss. Authorities and exchanges need both figures. Note the blockchain network the transaction occurred on (Ethereum, Bitcoin, BNB Chain, Tron, etc.).
You don't need specialist tools for this. A free block explorer will tell you exactly where your funds traveled - and whether they reached a real exchange.
The blockchain your funds were on determines which tool to use. Ethereum and ERC-20 tokens → Etherscan.io. Bitcoin → Blockchain.com. BNB Chain → BscScan.com. Tron/USDT → Tronscan.org.
The transaction detail page will appear. Confirm the "From" address is yours, the amount matches, and the status shows "Success". If it shows "Failed", your funds never actually left your wallet.
This opens that wallet's full transaction history. You can see where funds went next. Look for labels - if the explorer shows "Binance Hot Wallet", "Kraken Deposit", or any named exchange, your funds entered a regulated platform. That's the most actionable outcome.
Note each wallet the funds passed through, how much moved, and the timestamps. After 3–5 hops, the trail usually ends at an exchange, a mixer, or a dormant wallet. Each outcome has a different next step - our tracing tool can help you interpret what you find.
Best case for actionability. File a fraud report with the exchange and a police report in your jurisdiction. Law enforcement can formally request a freeze.
Monitor the address. If funds haven't moved, there may still be time for a legal intervention if you act quickly.
The trace may stop here. Document the last known address. Report anyway - regulators track mixer activity, and patterns across cases do get investigated.
Official reports matter for three reasons: they create a legal paper trail for future proceedings, they contribute to aggregate intelligence that leads to real investigations, and they are required before any exchange will cooperate with a freeze request.
Most countries have a national cybercrime reporting unit. Search for "[your country] cybercrime report" or contact your local police station. Always request a crime reference number - you will need it for any exchange complaint.
When filing any report, include: your transaction hash, all wallet addresses involved, the total amount and currency, the timeline of events, and copies of all communications. The more specific your report, the more actionable it becomes.
Victims of crypto fraud are specifically targeted for follow-up scams. Knowing what to avoid is as important as knowing what to do.
Any company or individual that promises to recover your crypto in exchange for an upfront payment is almost certainly a scam. Legitimate investigative or legal services do not guarantee outcomes and do not ask for crypto payments before delivering results. You would be losing money a second time.
Your seed phrase (the 12 or 24 word recovery phrase for your wallet) is the master key to everything in it. No recovery service, support agent, or platform will ever need it. Anyone who asks for it - under any circumstances - is attempting to steal what remains in your wallet.
If someone contacts you out of the blue - via Telegram, WhatsApp, social media, or email - claiming they can help recover your specific lost funds, treat it as a scam immediately. Scammers monitor victim communities and fraud-related posts, and will target people who have already suffered a loss.
Fraud victims often feel shame and wait before taking action. This is understandable, but time genuinely matters. The faster a complaint reaches an exchange or law enforcement, the greater the chance that funds haven't yet been withdrawn. Every day of delay reduces the window for intervention.
Reading this guide means you're already thinking clearly about a situation that's designed to leave people paralysed. The next step is to trace your specific transaction - and understand exactly where your funds went.
Our tracing tool takes your transaction hash and generates a plain-language report: where the funds moved, how many hops, whether they reached an exchange, and what the findings suggest you should do next.