A step-by-step action protocol for the first hours after theft — from data collection to freezing funds on exchanges. Proven across 600+ successful cases.
When your crypto is stolen, every minute counts. The first 24 hours determine whether you'll recover your assets before the attacker routes them through mixers or OTC desks. Panic is the last thing you should do. Instead, follow a proven protocol we've refined across hundreds of cases in partnership with Match Systems.
The core objective at this stage is to stop the flow and preserve the evidence trail. Every action the attacker takes leaves a digital footprint on the blockchain, but the further the funds travel from the breach point, the harder recovery becomes. Your first move isn't finding who did it — it's cutting off their exit routes immediately.
Before taking any active measures, compile a complete information package:
This data is essential for filing an investigation request, submitting freeze requests to exchanges, and preparing a police report. The more complete your dossier, the faster the recovery mechanism activates.
Immediately after gathering information, reach out to specialists in stolen cryptocurrency recovery. We at Crypto Reclaim provide free initial assessment: we analyze recovery probability, identify the freeze window, and map the optimal action sequence.
What happens during triage:
You can submit a request through the website form or directly via our Telegram bot. Response comes within hours, not days — timing is critical here.
As soon as we receive theft data, the flagging process begins. Attacker addresses are pushed to Chainalysis, TRM Labs, Crystal Blockchain databases, and our proprietary feeds used by major exchanges and payment services.
Why does this matter? When the attacker attempts to deposit stolen funds at a centralized exchange, the risk control system automatically blocks the operation. The funds freeze on deposit, the exchange records the transaction, and we receive notification to immediately file a freeze request.
The flagging process takes anywhere from several minutes to a couple of hours. The faster an address hits the blacklists, the higher the chance of intercepting funds before withdrawal. Learn more about the flagging mechanism in our dedicated article.
The scenario unfolds differently depending on where the stolen assets currently sit. Each situation demands its own tactics.
This is the best possible outcome. If the money landed on Binance, Coinbase, Kraken, OKX, or any other regulated platform, we have direct communication channels with their compliance teams.
We send an official freeze request, attaching:
Tier-1 exchanges respond within hours. Funds are blocked pending investigation, giving us time to prepare the complete documentation package for recovery. This service is provided free of charge — what matters is acting before the attacker withdraws.
Detailed instructions for working with exchanges are in our "How to Request an Exchange Freeze" guide.
If stolen cryptocurrency sits on a non-custodial address with no activity signs, there's no direct way to freeze it. But that doesn't mean you should give up.
We set up real-time wallet monitoring. Any fund movement — even a transfer to an intermediate address — is instantly captured, and we receive a push notification. Once the money starts moving toward an exchange, swap, or bridge, the freeze protocol activates.
Technically, it works like this:
Setup details are in the "Wallet Tracking: Why You Need It and How It Works" section.
The most complex but not hopeless case. When the attacker uses decentralized exchanges, cross-chain bridges, or swap services, the path becomes convoluted but doesn't disappear.
Our analysts:
Even if funds split into dozens of small transfers, we keep following every thread. Sooner or later, most scammers attempt fiat conversion — and that's our entry point.
When you approach the police or an exchange requesting to freeze stolen funds, words alone won't suffice. You need a document proving the theft and showing the asset movement path. That's the incident investigation analytical report.
What's included in the report:
Such reports are accepted by exchanges, law enforcement, and courts. They provide ready-made evidence, enabling decisions to be made much faster.
In practice: without a report, 9 out of 10 freeze requests get ignored. With a report — most are processed within 24-48 hours. Learn more about structure and cost in the article "What Is an Incident Report and How It Improves Recovery Odds".
Many victims postpone going to the police, considering it a useless formality. In reality — without a case number, most exchanges will refuse to freeze funds. Law enforcement is needed not so much to catch the criminal (though that's possible too), but to legitimize requests to exchanges and payment services.
To ensure your report is accepted and a case opened, prepare three documents:
The problem is that most police officers lack tools for investigating crypto thefts. Therefore, the more complete and clear your information, the higher the probability the case won't be shelved.
We help prepare all three documents, adapt them to specific regional requirements, and when necessary, consult investigators on technical matters. Step-by-step instructions are in "How to File a Police Report: Templates and Process".
The first 24 hours are critical. After that, the probability of withdrawal through mixers or OTC sharply increases. But even if several days have passed, chances remain — we've handled cases with successful freezes after a week or more.
Technically — yes, through blockchain explorers. Practically — it's difficult. Scammers use mixers, bridges, multiple transfers between addresses. Without specialized tools (Chainalysis, TRM, Crystal) and experience, you'll easily lose the trail.
Directly — rarely. But a case number is needed for exchange requests. Without it, most platforms won't freeze funds. Plus, in some cases police actually track down scammers — especially if it's a repeating scheme.
If funds went through P2P or OTC desk, the trail isn't lost. We request recipient data from the exchange (KYC, bank details), pass it to police. From there — it's law enforcement and banks' work.
Initial assessment and triage are free. Full investigation cost depends on case complexity: number of transactions, obfuscation techniques used, jurisdiction. We quote the price after analyzing the situation.
Depends on reaction speed and where the money went. If funds are on a regulated exchange and you contacted us in the first hours — chances are high (60-80%). If time passed and money is fragmented through mixers — harder, but not impossible (20-40%).
A non-custodial wallet cannot be blocked — that's a blockchain feature. But you can mark it as criminal in analytics systems, and then exchanges automatically block withdrawal attempts. Effectively the wallet becomes "toxic" and useless to the scammer.