You just realized your crypto is gone. Maybe you clicked a link that looked like your exchange login, maybe you signed a weird transaction in your wallet, or maybe you just sent Bitcoin to the wrong address. Panic sets in immediately because everyone says blockchain transactions are irreversible. That’s half-true. While you can’t hit “undo” on a decentralized ledger, you aren’t completely helpless. The difference between losing everything and potentially recovering some assets often comes down to how fast and correctly you react in the first few hours.
Incident response in crypto has evolved from a niche tech skill into a structured discipline involving blockchain forensics, legal coordination, and rapid containment. Whether you are an individual who lost savings to a phishing scam or a business dealing with a wallet breach, knowing the exact steps to take right now is critical. This guide breaks down what to do after a hack, a phish, or a mistaken transfer, based on current industry standards and regulatory guidance from 2025 and 2026.
Immediate Containment: Stop the Bleeding
The very first thing you must do is stop all further movement of funds. If you think your wallet or account has been compromised, do not try to move your remaining assets to a new wallet yet. If the attacker still has access to your private keys or session cookies, they will simply follow your funds to the new location. Instead, isolate the infected device. Disconnect it from the internet to prevent any remote access tools from exfiltrating more data.
If this involves an exchange account, change your password immediately from a clean, uncompromised device. Enable multi-factor authentication (MFA) if it isn’t already on, but be aware that if the attacker has control of your email or phone number, they might bypass this. Contact the exchange’s support team to freeze withdrawals temporarily. For self-custody wallets, the priority is documentation. You need to gather every piece of evidence before it disappears from your memory or gets overwritten by new activity.
- Stop sending any more crypto.
- Disconnect the compromised device from Wi-Fi and Ethernet.
- Do not interact with scammers; they will only try to extract more money.
Documenting the Incident for Forensics
To trace stolen funds or prove a mistaken transfer, you need hard data. Blockchain analytics firms like Chainalysis is a leading provider of cryptocurrency intelligence software that enables organizations to track illicit flows of crypto assets and TRM Labs rely on specific identifiers to map transaction paths. Without these, recovery is nearly impossible. You need to record the following details immediately:
- Transaction Hashes (TXID): This is the unique fingerprint of every transaction. Find it in your wallet history or on a block explorer like Etherscan or Blockchain.com.
- Wallet Addresses: Record both your sending address and the recipient’s receiving address. If it was a hack, note the address where the funds were drained to.
- Timestamps: Note the exact date and time of the unauthorized or mistaken transfer.
- Communication Logs: If this was a phishing scam, save screenshots of emails, chat logs, SMS messages, and website URLs. Do not delete them.
If personal information like your Social Security number or credit card details was also stolen during the incident, place a fraud alert or security freeze on your credit reports through Equifax, Experian, and TransUnion. This prevents identity theft from compounding your financial loss.
Reporting to Authorities and Regulators
Many people skip this step because they believe law enforcement can’t help with crypto. That’s a misconception. Reporting creates an official paper trail that can trigger freezes at centralized exchanges and contribute to broader investigations that shut down scam operations. In the United States, you should file reports with multiple agencies to maximize visibility.
| Agency | Role in Recovery | When to Use |
|---|---|---|
| FBI IC3 | Collects data on cybercrime; shares intel with global partners. | All hacks, phishing, and scams. |
| FTC | Tracks consumer protection violations and patterns. | Scams involving false promises or fraud. |
| SEC/CFTC | Regulates securities and commodities; can sanction bad actors. | Investment scams or unregistered token offers. |
| Local Police | Files initial incident report required for insurance claims. | High-value losses or local jurisdiction crimes. |
State attorneys general, such as those in Massachusetts and Ohio, have issued updated guidance in 2025 and 2026 emphasizing that victims should provide wallet addresses and transaction hashes when filing complaints. These identifiers allow investigators to use blockchain analytics to trace funds to known high-risk services or centralized exchanges, which may then freeze the assets pending legal orders.
Mistaken Transfers: Can You Get It Back?
A mistaken transfer is different from a hack because there is no criminal intent, but the technical challenge is similar: the money is on the blockchain. If you sent crypto to the wrong personal wallet address, recovery is usually impossible. The blockchain does not have a customer service department. However, if you sent funds to a centralized exchange or a custodial platform, there is a chance of recovery.
Exchanges like Coinbase have specific asset recovery programs. For example, Coinbase allows users to request recovery for unsupported crypto assets or wrong-network deposits. As of late 2022 and continuing into 2026, their policy typically involves a fee structure-often 5% of the amount recovered above $100. This fee covers the operational cost of manually constructing a transaction to return the funds. If the amount is small, it may not be economically viable for the exchange to process it.
Here is the process for mistaken transfers:
- Confirm the Destination: Check if the receiving address belongs to a known exchange or platform. You can often identify this using blockchain analytics tools that tag addresses.
- Contact Support Immediately: Reach out to the platform’s support team with your transaction hash, timestamp, and proof of ownership. Do not wait.
- Check Network Compatibility: If you sent Ethereum-based tokens on the Bitcoin network, the funds are likely lost unless the exchange has specific infrastructure to retrieve them. Some exchanges decline recovery due to technical limitations or policy restrictions.
If the exchange refuses to help despite having the technical ability to recover the funds, you may need to escalate through legal counsel or regulatory complaints. Firms like Dilendorf Law have helped clients pursue litigation against U.S. exchanges for declining to recover wrong-network deposits, arguing negligence or unfair practices.
Professional Incident Response for Businesses
If you represent a company, DAO, or large holder, amateur efforts won’t suffice. Professional incident response firms offer specialized services that combine blockchain forensics with legal and operational expertise. Companies like Sygnia, Chainalysis, and CryptoSec provide retainer-based services or on-demand support for breaches.
Sygnia’s framework emphasizes preparation and resilience. They recommend maintaining pre-approved response protocols for common scenarios like smart contract exploits or key leaks. When an incident occurs, their teams work to isolate the threat, trace funds across multiple chains, and coordinate with exchanges to freeze assets. Chainalysis offers a 24/7 hotline for subscribers, enabling immediate tracing of stolen funds. Their analysts use proprietary data to identify where the crypto is moving and whether it has passed through mixers or privacy coins.
For businesses, having an incident response plan ready before a crisis is crucial. Tabletop exercises, recommended by TRM Labs, simulate breach scenarios to test your team’s readiness. These drills ensure that decision-makers know who to call and what actions to authorize within minutes, not days. Delaying response allows attackers to launder funds through cross-chain bridges, making recovery exponentially harder.
Prevention and Future Resilience
While incident response is vital, prevention remains the best strategy. The rise of sophisticated phishing kits and AI-driven social engineering means that even experienced users can slip up. Adopting hardware wallets for significant holdings, using multi-signature setups for business accounts, and verifying URLs meticulously can reduce risk. Additionally, staying informed about current threats through resources like the California DFPI and Experian’s security alerts helps you recognize emerging scam tactics.
Remember, the crypto ecosystem is maturing. Regulatory bodies are taking fraud more seriously, and technological tools for tracing illicit funds are becoming more accessible. By acting quickly, documenting thoroughly, and leveraging professional resources when needed, you improve your chances of mitigating damage and potentially recovering lost assets.
Can I recover crypto sent to the wrong address?
If you sent crypto to a random, non-custodial wallet address, recovery is generally impossible due to the irreversible nature of blockchain transactions. However, if the destination address belongs to a centralized exchange or custodial platform, you may be able to recover the funds by contacting their support team immediately. Some exchanges, like Coinbase, offer asset recovery services for a fee, typically around 5% for amounts over $100. Success depends on the exchange's technical capabilities and internal policies regarding wrong-network or unsupported asset deposits.
What should I do immediately after discovering a crypto hack?
First, stop all further transactions and disconnect the compromised device from the internet to prevent additional data loss. Do not attempt to move remaining funds to a new wallet, as the attacker may still have access to your keys. Next, document all details including transaction hashes, wallet addresses, and timestamps. Then, report the incident to relevant authorities such as the FBI IC3, FTC, and your local police department. If you suspect identity theft, place a fraud alert on your credit reports.
How long does it take to trace stolen crypto?
Tracing stolen crypto can begin immediately using blockchain analytics tools, as all transactions are publicly recorded. However, the complexity increases rapidly if funds are moved through mixers, cross-chain bridges, or privacy-focused cryptocurrencies. Professional incident response firms can often identify the flow of funds within hours, but recovering them requires coordination with exchanges and law enforcement, which can take weeks or months. Speed is critical; the longer you wait, the more difficult it becomes to freeze assets.
Is it worth hiring a professional crypto incident response firm?
For individuals with small losses, professional services may be cost-prohibitive. However, for businesses, high-net-worth individuals, or cases involving significant sums, hiring a firm like Chainalysis, Sygnia, or CryptoSec can significantly improve recovery odds. These firms have established relationships with exchanges and law enforcement, access to advanced forensic tools, and experience navigating complex cross-jurisdictional issues. Many operate on a retainer basis, allowing for faster response times during a crisis.
What information do I need to provide when reporting a crypto scam?
You should provide detailed documentation including transaction hashes (TXIDs), your wallet address, the scammer’s wallet address, timestamps of all interactions, and screenshots of communications such as emails, chats, or website URLs. If personal information was compromised, include details about what was shared. Providing this specific data allows investigators to use blockchain analytics to trace funds and link them to known criminal clusters or exchanges, increasing the likelihood of action being taken.
Write a comment