The first day after a crypto theft does not decide whether the money comes back — that is decided later, by an exchange, an issuer or a court. What it decides is whether those parties will ever have anything to act on. Funds that reached an exchange are there for days, not weeks; evidence that is not preserved today is argued about for months; and the wallet that was drained once can be drained again by tonight. This is the sequence for the first twenty-four hours, in the order that matters, with the parts that cost nothing marked as such.
Hour 0–1: how do you stop the bleeding?
Before any report, before any call, make sure the theft is over.
- If a wallet was drained — a seed phrase entered somewhere, a malicious signature, malware on the device — assume the wallet is still compromised. Move whatever remains to a new wallet created on a device you trust, and stop using the old one. Revoke the token approvals on the affected addresses so that a drainer contract cannot take the next deposit; how that mechanism works is on the wallet drainer page.
- If an exchange account was taken over — a phishing login, a SIM swap, a reset password — change the password and the two-factor method from a clean device, end all other sessions, and tell the exchange's support that the account was compromised. If the phone number was hijacked, call the carrier first; the attacker still holds it until you do.
- If you paid a platform or a person — an investment site, a "trader", a romance contact — there is nothing to secure on your side, and the hour is better spent on the next step. Do not send any further payment for any reason, including a "withdrawal fee" or a "tax" to release your balance. That request is the same scam, continued.
Hour 1–3: what evidence should you preserve?
Everything that follows — the report, the exchange's decision, the court's decision months from now — is built on what you save in this hour. Do not "clean up" anything.
- The transaction hashes of the theft and every address the funds went to — copied from your own wallet or exchange history, not from the scam site.
- Amounts, assets and dates, per transaction, not as one total.
- The platform or person: site address, app name, usernames, phone numbers, wallet addresses they gave you — exactly as they appeared to you.
- How contact started: an ad, a message, a dating app, a "wrong number". The entry vector identifies the scheme.
- Every conversation, as full-screen screenshots or exports, uncropped, with timestamps. Keep the chat open; scammers delete groups and accounts within days.
- The state of the device: which wallet software, which browser extension, whether the seed phrase was ever typed anywhere. If malware is suspected, do not wipe the machine yet — it is evidence too.
This is the same material a professional investigation starts from. Organised now, it saves days later; assembled in a month, half of it will be gone.
Hour 3–6: what exactly happened?
Not every theft is the same case, and the type changes both the odds and the next step. A wallet drainer is a single transaction with a receiving address and a trail to follow. A fake exchange is a platform whose "balance" never corresponded to assets — the deposits are the loss, not the dashboard figure. A romance or investment scheme has a long payment history and, often, many other victims whose evidence combined is what moves a police unit. A rug pull is a token whose liquidity was withdrawn, with a different set of recoverable and unrecoverable parts. Which one you were in — and what can realistically follow each — is set out, type by type, on the scam types page. Reading the right one before you report makes the report better.
Same day: where do you report — and why all three at once?
These three run at the same time, not one after another, and none of them costs anything.
- The national cybercrime portal. In the US the FBI's Internet Crime Complaint Center (IC3); other countries have their own. It builds the official record and feeds the pattern-level investigations that take large operations down.
- A police report where you live. This is the step people skip and the one that matters most for recovery: in our casework, a police report is what turns a provisional freeze at an exchange into a formal block, typically two to three days after it is filed. File it even if the local police seem unfamiliar with crypto; the case reference is what every later step will ask for.
- The exchange or platform the funds moved through, via its official support or compliance channel, with the hashes and addresses attached. Exchanges act on evidence, not on distress; a freeze request with a proper evidence pack takes 2–4 days to process at an exchange, and a request to a stablecoin issuer through its published procedure is answered in 24–62 hours.
Where to file, by country, and what to include so the report can be acted on, is on the reporting page.
Same day: get the transactions flagged, and decide whether it is a case
There is one action in the first day that most victims do not know exists. The stolen transactions can be submitted to the screening providers exchanges rely on, so that the funds are stopped at the next compliance desk they touch — with or without a legal step, and before any freeze request is written. In our process this happens within four hours of intake. It is the fastest thing in the whole sequence and it buys the time the legal steps need.
That is also the point at which to decide whether the loss justifies an investigation. Reporting is free; a professional investigation is not, and below a certain size it cannot pay for itself. Our published threshold is a loss from $200,000, with smaller cases reviewed individually. The assessment costs nothing, is answered within two business hours, and includes the answer that there is nothing worth investigating — which, for a share of the people who ask, is the honest one. What a case consists of after that, step by step, is on the recovery process page.
What not to do in the first day
- Do not pay anyone who contacts you. Within days you will be approached by a "recovery agency", a "law firm" or an "officer" who has "located your funds" and needs a fee to release them. No agency will assign your case to a firm that contacts you; we do not cold-message victims. This applies to us: if someone approaches you in our name, it is not us.
- Do not send "test" transactions to the thief's address, or reply to a "refund" offer that requires a payment.
- Do not post your addresses, hashes or the seed phrase in public groups asking for help. The addresses are fine to share with the police and the exchange; the seed phrase is never fine to share with anyone.
- Do not try to negotiate with or track down the thief yourself. Contact with the thief produces nothing an exchange or a court can use, and it tells the operator that you are still reachable.
- Do not wait for the "right moment" to report. The funds are moving now. A report filed today with the hashes in it is worth ten filed next month.
Days 2–4: what comes after?
If the funds reached an exchange and the request arrived while they were there, a provisional hold can be in place within days: 2–4 days for an exchange, 24–62 hours for an issuer's response, plus two to three days for the police report to convert the hold into a formal block. That is the freeze — the point at which the case becomes winnable, not the point at which it is won. What follows is legal work in the jurisdiction of the venue, carried out by lawyers admitted there — in our cases partner law firms under our case management; we do not practise law — and it runs on a different clock: a return from an exchange on a court decision in 6–9 months, a first payout from a stablecoin issuer 12–20 months in, complex or multi-jurisdiction cases 6–36 months. Both clocks, with the dates they were measured, are on our figures page, and the difference between them is explained in Crypto Recovery vs. Freeze in 2026: Two Clocks, Real Timelines. Anyone who tells you the money will be back within days is describing the first clock as if it were the second — or describing nothing at all.
If the funds are traceable and the loss is significant, send us the transaction hashes: the assessment is free and answered within two business hours, including when the answer is that there is nothing to pursue. Write through the contact page or message @StarCompliance on Telegram.
Questions people ask on the first day
Is it too late if the theft was yesterday, or last week?
Later is worse, but the question is where the funds are now, not when they left. Funds sometimes sit at a venue for a long time, and a trace can establish whether they still do. Report today regardless; the report is what every later step needs.
The exchange asked me for documents. Which ones?
The hashes, the receiving addresses, the amounts and dates, and a description of how the theft happened — the same list as above, organised. If a police report exists, its reference number; if it does not yet, file it, because that is what turns a provisional hold into a formal block.
Should I hire a lawyer first or an investigator first?
Whoever you engage, the investigative question comes first: where are the funds and can that party be asked. A lawyer with no endpoint has nobody to serve; an investigator with no lawyer cannot turn a freeze into a return. In our cases the two run together, with the legal steps carried out by partner firms in the relevant jurisdiction.
My loss is below $200,000. What should I do?
The four free steps — preserve, report to the portal, report to the police, notify the exchange — are worth doing at any size, and they are the whole of what makes sense for many losses. If the loss is part of a larger scheme with many victims, a coordinated police report by the victims carries more weight. Smaller cases are reviewed individually, and the assessment is free.
Will anyone contact me offering to recover the funds?
Expect it. Within days a "recovery agency", a "law firm" or an "officer" may claim to have located your funds and ask for a fee to release them. Do not pay. We do not cold-message victims; if someone approaches you in our name, it is not us.
How quickly can the stolen transactions be flagged?
In our process, within four hours of intake: the stolen transactions are submitted to the screening providers exchanges rely on, so the funds are stopped at the next compliance desk they touch.
This article is informational material, not legal advice, and no outcome is promised: decisions on freezing and releasing funds are made by exchanges, issuers and courts. Figures are from StarCompliance casework and are published, with the period each covers, on our figures page.
