If your crypto wallet appears drained, an exchange reports a security incident, or you receive a suspicious message, the first minutes matter. This reusable crypto scam response checklist explains how to verify what happened, contain further losses, preserve evidence, report the incident, and assess realistic recovery options without creating new risks.
Overview
A suspected hack is stressful, but acting quickly does not mean acting impulsively. Your first objective is to establish whether the problem is real. A delayed blockchain transaction, disabled withdrawal function, account lock, or missing balance can have different causes, and each requires a different response.
Use this order of operations:
- Verify: Check the transaction, account status, or security alert through an independent route.
- Contain: Stop further access, approvals, transfers, and communication with suspected attackers.
- Document: Record wallet addresses, transaction hashes, timestamps, messages, domains, and account activity.
- Report: Contact the exchange or wallet provider through its official support channel and report suspected theft to relevant authorities in your jurisdiction.
- Recover and rebuild: Secure unaffected accounts, evaluate tracing or legal options carefully, and replace compromised credentials or devices.
Do not publish your seed phrase, private key, password, one-time code, or identity documents in a public forum. Legitimate support teams should not need your private key or recovery phrase to investigate a transaction.
Checklist by scenario
If your self-custody wallet was drained
- Open the wallet using the official application or a trusted block explorer. Do not follow links in an alert, direct message, or email.
- Confirm the destination address, asset, network, transaction hash, and approximate time. A transaction that is confirmed on-chain generally cannot be reversed by the wallet provider.
- If assets remain, move them to a newly created wallet whose seed phrase was generated securely. Do not reuse a possibly exposed device, browser extension, or recovery phrase.
- Revoke suspicious token approvals and disconnect unfamiliar applications where the relevant network and wallet tools support this. Review approvals carefully before signing anything else.
- Stop using the compromised wallet. If its seed phrase or private key may have been exposed, treat every address controlled by it as unsafe.
If an exchange account may be compromised
- Reach the exchange by typing its known web address or using an official app. Do not use a support number or link supplied by an unsolicited message.
- Change the exchange password from a clean device and end other sessions if that option is available.
- Secure the email account connected to the exchange. Change its password, review forwarding rules, remove unknown recovery methods, and enable strong multifactor authentication.
- Contact official support immediately. Include your user ID, affected assets, transaction hashes, timestamps, withdrawal addresses, and relevant screenshots, but never include your password, seed phrase, or authentication codes.
- Check whether withdrawals, API keys, address allowlists, and account permissions were changed. Disable unfamiliar API keys and report unauthorized activity.
If the issue is a delayed or failed withdrawal rather than confirmed theft, follow a separate troubleshooting process before assuming a hack. The crypto exchange withdrawal problems checklist can help distinguish operational delays from unauthorized activity.
If you received a likely phishing message
- Do not click further links, open attachments, connect a wallet, scan a QR code, or reply.
- Check the sender, domain, spelling, message urgency, and requested action. A familiar logo or apparent account history is not proof of authenticity.
- Navigate independently to the service’s official website or application and check for notices there.
- If you entered a password, change it immediately from a clean device and secure every account where that password was reused.
- If you signed a wallet transaction, inspect approvals and transfers on the relevant network. If you exposed a seed phrase or private key, move remaining assets to a new wallet as soon as it is safe to do so.
What to double-check
Before contacting support or filing a report, create a simple incident record. Note the exact time zone, account or wallet involved, device used, network, asset, amount, transaction hash, sending and receiving addresses, and the first moment you noticed something unusual. Preserve the original email headers or message links when possible, but do not revisit a malicious site.
Verify addresses character by character. Crypto addresses can look similar, and a copied address may be replaced by malware. Use a block explorer appropriate to the network, and avoid relying solely on a portfolio app or wallet display.
Check whether the event could be explained by a network migration, token contract change, wallet synchronization issue, exchange maintenance, or an incorrectly selected network. The network upgrades and wallet support guide provides a useful review path for those cases.
When reporting, use official exchange support, the wallet developer’s verified support channel, your local police or cybercrime reporting process, and any applicable financial or consumer-protection reporting route. Keep case numbers and copies of every submission. Recovery is not guaranteed, but accurate evidence improves the quality of an investigation and helps identify linked activity.
Common mistakes
- Paying a recovery scammer: Anyone promising guaranteed recovery for an upfront fee, private key, or remote-access session should be treated as suspicious.
- Continuing to use a compromised wallet: A wallet with an exposed seed phrase is not made safe by changing its display name or disconnecting one application.
- Deleting evidence: Keep messages, transaction records, domains, screenshots, and support correspondence in a secure folder.
- Broadcasting sensitive details: Publicly posting a wallet’s full history can attract more scammers and expose personal information.
- Using the same device without checking it: Update operating systems and wallet software, scan for malicious extensions, remove unknown applications, and consider a clean device for account recovery.
- Signing more transactions to “reverse” a theft: A second signature can grant additional permissions or drain remaining assets. Stop and verify the request independently.
After containment, review your broader custody setup. A comparison of exchanges and hardware wallets can help you decide how to separate trading funds, long-term holdings, and emergency access.
When to revisit
Re-run this checklist whenever an exchange announces a security incident, withdrawals change unexpectedly, a wallet extension is updated, a device is lost, or you receive a message requesting urgent account action. Also review it before major travel, tax filing, portfolio rebalancing, or periods when you expect to move funds between platforms.
Set a recurring security review at least periodically. Confirm that exchange contact details still come from official sources, multifactor authentication remains active, recovery email and phone details are accurate, old API keys are removed, and wallet backups are stored offline. Review token approvals and connected applications, and test that you can identify the correct network before sending funds.
Action plan: save this page, prepare a private incident-notes template, bookmark official exchange status pages, and write down the independent reporting channels you would use. If an incident happens, verify first, contain second, document everything, and ignore anyone who pressures you to surrender credentials or pay for guaranteed recovery.
