Act quickly, but do not try to reverse the blockchain transaction yourself. Secure any accounts that may still be exposed, contact the exchange or custodian that received the cryptocurrency, and file an FBI Internet Crime Complaint Center (IC3) report at www.ic3.gov. Provide wallet addresses, transaction hashes, asset amounts, timestamps, communications, and every related account or website. An exchange may flag or freeze a destination account, but only under its internal procedures or legal process; a freeze is not a blockchain rollback and recovery is never guaranteed.
This is a U.S.-focused guide. The reporting sequence is also useful elsewhere, but agency names, legal processes, and restitution procedures vary by country.
As an Amazon Associate I earn from qualifying purchases.
What to do in the first hour
- Stop communicating with the suspected thief and any “recovery” agent. Do not send another payment, password, seed phrase, one-time code, identity document, remote-access session, or wallet approval. The FBI warns that recovery fraudsters often demand upfront fees and impersonate law enforcement or legal services.
- Secure accounts that may still be exposed. Using the exchange or wallet provider’s official website or telephone number, change passwords, sign out suspicious sessions, revoke unfamiliar token approvals where the product supports that feature, and enable multifactor authentication. If somebody claiming to represent an exchange calls or messages you, leave the conversation and navigate independently to the service’s official site; do not use a link or phone number supplied by the caller.
- Notify every relevant exchange or custodian immediately. Contact the service used to send the funds and any identifiable service that received them. Ask whether the destination account can be flagged or frozen and provide your police or IC3 case number when available. Use only official support or law-enforcement channels.
- File an IC3 complaint without waiting for a perfect file. The FBI says, “Do not wait. Go to www.ic3.gov and click on ‘file a complaint’.” Submit the information you have now and add material later if the portal permits.
- Make additional reports that match the facts. Consider the FTC’s ReportFraud.ftc.gov, the CFTC complaint channel at CFTC.gov/complaint, the SEC tip, complaint and referral form at SEC.gov/tcr, and local police. Local reporting is particularly important for a stolen device, identity theft, threats, or another local crime.
- Preserve original evidence. Export records and retain transaction hashes, wallet addresses, screenshots, emails, texts, phone numbers, domain names, app names, exchange statements, bank or card records, and a dated timeline. Do not crop or edit screenshots; keep original files and message headers when possible.
Make a quick incident note while events are fresh. Write down when contact began, what the person promised, what you were instructed to do, each authorization or transfer, when you realized money was missing, and every subsequent call or message. A contemporaneous timeline is often more useful than a later recollection assembled from memory.
Free tools Windows power users keep installed
One-click scans. No signup required.
What “freeze” means in cryptocurrency theft
A confirmed blockchain transaction normally cannot be reversed by a victim, a miner, or an ordinary customer-service request. The practical target is a centralized exchange, broker, hosted wallet, payment processor, or other custodian that receives the funds after they leave your wallet. That company may be able to restrict withdrawals while it investigates or responds to a court or law-enforcement request.
#1 Best Overall
The FBI’s warning is explicit: Private sector recovery companies cannot issue seizure orders to recover cryptocurrency. Cryptocurrency exchanges only freeze accounts based on internal processes or in response to legal process.
A freeze can stop or delay movement from an account; it does not erase the transaction, return coins automatically, or establish that you will be paid.
Custodial account versus self-custody wallet
If the receiving address belongs to an identifiable exchange account, the service may be able to place a hold on that customer’s withdrawals. You should give the service the exact address and hash and ask for its fraud or law-enforcement team. If the address is a self-custody wallet, no company controls the private key and an exchange cannot simply lock the wallet. The same is true of assets that have already moved through several personal wallets, bridges, mixers, or other services. Reporting is still important because later movements may reach a regulated custodian.
When an exchange can act
- Internal controls: An exchange may flag an account under its fraud, sanctions, anti-money-laundering, or security procedures. Its decision is discretionary and governed by its terms and applicable law.
- Legal process: A subpoena, seizure order, restraining order, warrant, or other process may require or authorize action. Victims generally cannot issue such orders themselves.
- Timing: A prompt alert can matter before funds leave a custodial platform. Once assets move through self-custody wallets, mixers, bridges, or multiple services, an exchange may have no account it can control.
What a freeze cannot do
- It cannot roll back a confirmed transfer on a public blockchain.
- It cannot prove that the person controlling a receiving address is identified or solvent.
- It does not guarantee restitution, even if an account is restricted.
- It does not make an unverified tracing or recovery company legitimate.
Information to send to an exchange
Send a short, factual incident summary and attach the records the exchange requests. Include:
- Every sending and receiving wallet address.
- The asset and quantity, such as BTC, ETH, or USDT, plus the approximate fiat value at the time of transfer.
- The exact date, time, and time zone for each transfer.
- Every transaction ID or hash, copied directly from the wallet or blockchain explorer.
- The exchange, broker, ATM, decentralized application, website, or wallet application involved.
- How contact began and the names, usernames, email addresses, telephone numbers, domains, and messaging accounts used.
- Copies or exports of messages, invoices, payment instructions, QR codes, call records, and account notices.
- Your IC3 complaint number, local police report number, and any existing exchange ticket number.
Ask the support team to preserve relevant records, route the matter to its fraud or law-enforcement liaison, and tell you what additional proof of ownership it needs. Do not send a seed phrase or private key; a legitimate investigator does not need those secrets to verify a transaction. Keep a copy of your submission and the ticket number so every later report can reference the same facts.
How to file an IC3 complaint
IC3 is the FBI’s primary federal intake for internet-enabled cryptocurrency theft and fraud. File at www.ic3.gov as soon as you can. A missing detail should not delay the initial submission.
Rank #2
- Ideal for Gifting
- Ideal for a bookworm
- Compact for travelling
Transaction data
- Each sending and receiving address.
- Asset type and quantity, with approximate dollar value when the transfer occurred.
- Exact date and time, including time zone.
- Transaction ID or hash for every transfer, including failed or related transactions when relevant.
People, services, and communications
- The exchange, broker, ATM, dApp, website, wallet application, or payment service used.
- How the contact began, including an advertisement, social-media account, dating profile, job offer, investment pitch, or support message.
- Names, aliases, usernames, email addresses, telephone numbers, domains, social profiles, and cryptocurrency addresses.
- Message exports, email headers, invoices, QR codes, payment instructions, call logs, and screenshots in their original form.
Chronology and references
- A dated narrative from the first contact through the transfer, discovery of the theft, and any later demand or threat.
- When you noticed the loss and what account or device was compromised.
- Your local police report number, exchange ticket number, bank or card dispute number, and other agency references, if available.
Use plain descriptions rather than conclusions. State what you saw, what you authorized, what you did not authorize, and when each event occurred. If the portal allows updates, add new hashes, addresses, or contact details instead of filing contradictory duplicate narratives. Save the confirmation page or complaint number in at least two secure locations.
Which agencies and services should receive a report?
| Route | Best use | What to provide | What it may accomplish |
|---|---|---|---|
| IC3 and the FBI | Internet-enabled cryptocurrency theft, fraud, extortion, and cross-state or international schemes | Addresses, amount and asset, dates and times, hashes, communications, websites or apps, exchanges, and a timeline | Creates a federal complaint record and can support investigative coordination or later legal process |
| Exchange or custodian | Fastest possible operational alert when funds may have reached a hosted account | Hashes, destination address, asset and amount, proof of your account or wallet ownership, and an IC3 or police number when available | May flag, restrict, or preserve an account under internal procedures or legal process |
| FTC at ReportFraud.ftc.gov | Consumer-fraud reporting and pattern information | How the scheme worked, contact details, payment records, and losses | Adds a regulatory consumer-fraud record and directs victims to relevant channels |
| CFTC at CFTC.gov/complaint | Conduct involving commodities or derivatives | Trading or solicitation details, account information, communications, and transaction records | Provides a subject-matter complaint to the commodities regulator |
| SEC at SEC.gov/tcr | Conduct involving securities or securities-related investment activity | Offering or promoter information, communications, funds sent, and supporting records | Provides a subject-matter complaint to the securities regulator |
| Local police or other national law enforcement | Stolen devices, identity theft, threats, coercion, or crimes requiring a local case record | Identification, timeline, device details, communications, financial records, and the suspected location if known | Creates a local report and may support subpoenas, warrants, or victim-assistance procedures |
These routes are complementary, not a sequence in which you must wait for one agency before contacting another. Tell each recipient about the other reports so records can be matched. The exchange is usually the fastest place to request an operational flag; IC3 and the FBI are the core internet-crime route; FTC, CFTC, and SEC reports add regulatory records; and local police create a local case record for device, identity, threat, or coercion issues.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchHow to preserve evidence without creating a new security risk
- Record the blockchain facts first. Copy addresses and hashes as text and save the wallet or exchange export. Check that a copied address begins and ends with the same characters shown in the original record.
- Save communications in context. Export complete conversations where possible. Keep the sender’s address, message headers, profile URL, attachment names, and the date and time visible.
- Capture websites and applications. Save the exact domain, app name, account identifier, support ticket, and relevant screens. Do not download unknown software offered by the suspect.
- Build a timeline. Use one time zone and identify conversions. List contact, instructions, each authorization or transfer, discovery, account-security actions, and every follow-up.
- Protect the evidence. Store a read-only copy separately from the compromised device or account. Keep originals and note when each file was exported.
Never publish a seed phrase, private key, password, authentication code, recovery code, or full identity document in an online complaint, email thread, or public post. Redact copies only when sending them to a recipient that does not need the unredacted version, while retaining the original privately. If a phone or computer was stolen or remotely accessed, avoid wiping it until local investigators advise you; preserve relevant account alerts and login records from a separate, trusted device.
What to expect after reporting
Possible investigative paths
Investigators may follow the movement of funds across public addresses, request records from a custodian, identify the account holder, or seek legal process. Public visibility of a transaction does not itself reveal a person’s identity, and a visible address may be controlled through intermediaries or stolen credentials. An exchange may ask for proof that you owned the sending wallet or account before discussing records.
Why recovery is uncertain
Outcomes depend on where the funds move, whether they reach a cooperative exchange, the quality of identifying evidence, and whether authorities obtain usable legal process. A custodian can decline to act under its internal rules, and assets may be moved before a request arrives. The FBI does not promise recovery. Do not treat a blockchain explorer’s labels or a private tracing report as proof that funds are recoverable.
What a later seizure process may require
In a 2025 seizure notice, the FBI and Secret Service said identified victims might later need exchange records, proof of wallet ownership, and bank statements to petition for seized funds. Keep those records even after an exchange closes your initial ticket. A seizure is a government action; it is not the same as an exchange’s temporary account restriction. Follow the instructions in any official notice and verify the sender independently.
Recovery scams to avoid
Victims who report a theft are often targeted again because their loss is now visible in posts, complaint forms, or stolen contact lists. The FBI warns that fraudulent operators may claim to be investigators, lawyers, exchange staff, or government agents. They may provide an inaccurate tracing report, stop responding, ask for progressively larger payments, or promise a guaranteed release.
- Do not pay an unsolicited upfront “tax,” “bond,” “unlock,” “gas,” “court,” or tracing fee.
- Do not give a recovery firm a seed phrase, private key, password, one-time code, or remote access.
- Do not trust caller ID, logos, case numbers, or documents supplied by the contact.
- Verify any government or exchange contact through a website or number you locate independently.
- Do not let a caller pressure you into keeping the matter secret or acting before you can verify the request.
The FBI’s rule is simple: Law enforcement does not charge victims a fee for investigating crimes.
If someone asks for money to make an investigation happen, treat that as a new fraud report and preserve the request. A legitimate agency or exchange will not need your seed phrase to open a complaint.
Questions victims commonly ask
Can an exchange freeze a wallet?
An exchange can potentially restrict an account it controls, not a self-custody wallet or the blockchain itself. It may act under internal procedures or legal process, and it is not required to honor an informal request in every case.
Should I wait until I know every transaction hash?
No. File IC3 and notify relevant custodians with the facts you have, then supplement the record if permitted. Waiting for a perfect reconstruction can give funds more time to move.
Recommended Free Tools
Rank #4
Can a confirmed crypto transfer be reversed?
Usually not. A confirmed public-blockchain transfer is generally permanent. Recovery depends on intervention at a custodian, a cooperative recipient, or a later legal seizure or restitution process.
Can I get stolen cryptocurrency back?
Sometimes victims recover assets through a cooperative custodian, legal process, or a later seizure and restitution procedure, but no agency or exchange can promise that result. The location and movement of the funds, identifying evidence, and available legal process determine what is possible.
What if the thief contacted me again after I reported?
Do not respond, negotiate, or click links. Save the new messages, numbers, domains, and payment demands, then add them to your exchange and IC3 records and report any threat to local police.
Should I hire a private tracing company?
Be extremely cautious. Private companies cannot issue seizure orders, and an impressive-looking tracing report does not create authority over an exchange. Never pay an unsolicited upfront fee or surrender credentials. Verify any professional independently and understand that no private provider can guarantee recovery.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →How serious is cryptocurrency fraud in the United States?
IC3 recorded more than 69,000 cryptocurrency-related complaints and over $5.6 billion in reported losses in 2023, including about $3.9 billion attributed to investment fraud. The FBI created its Virtual Assets Unit in February 2022 to centralize cryptocurrency investigative expertise. FBI Director Christopher Wray said in a 2024 release that scams targeting cryptocurrency investors were “skyrocketing in severity and complexity.” These figures describe reported complaints and losses, not every theft or the amount any individual victim will recover.
Best Value
- It can be a gift option
- Comes with secure packaging
- Helpful in various ways
A practical reporting checklist
Before sending a report, assemble one folder containing a one-page chronology, a transaction spreadsheet, original message exports, screenshots, exchange statements, bank or card records, and a list of all addresses and hashes. Label each file with the date and time zone. Keep an unredacted copy offline or in a separate secure account, and send only the information the recipient requests. Record every ticket, complaint, and case number and quote those numbers in follow-up messages. This organization makes it easier for an exchange, IC3, local police, or a regulator to connect your evidence without requiring you to repeat the story inaccurately.
Frequently Asked Questions
How quickly should I report stolen cryptocurrency?
Immediately. Alert the relevant exchange or custodian and file an IC3 complaint with the information you have; do not wait for a perfect reconstruction.
What information does IC3 need?
Provide sending and receiving addresses, asset and amount, approximate value, exact dates and times with time zone, transaction hashes, services used, contact details, communications, websites or apps, and a chronological narrative.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Is there a fee to have law enforcement investigate?
No. The FBI states that law enforcement does not charge victims a fee for investigating crimes. Anyone demanding payment to open or accelerate an investigation is a potential recovery scam.
Can I report to more than one agency?
Yes. IC3, the exchange, FTC, CFTC, SEC, and local police serve different purposes and can receive complementary reports. Give each one the other case or ticket numbers.
What should I do if an alleged recovery agent contacts me?
Stop communicating, send no money or credentials, preserve the messages and caller details, and verify any claimed government or exchange identity through an independently located official website or phone number.
What documents could be needed if funds are later seized?
A 2025 FBI and Secret Service seizure notice said identified victims might need exchange records, proof of wallet ownership, and bank statements to petition for seized funds. Keep those records.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →The Bottom Line
There is no victim-controlled blockchain “undo” button. Secure exposed accounts, preserve original evidence, alert every identifiable custodian, and file IC3 and any appropriate local or regulatory reports immediately. A freeze is discretionary or tied to legal process, recovery is uncertain, and anyone demanding an upfront recovery fee should be treated as another scam.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
