If it happens to you
Lesson 5 of 5
You’ll know what to do in the first hour after a theft, where to report it in Ireland, the UK and the US, and how to keep the people who come after victims, online and in person, away from you.
Your first hour
Work out which kind of theft it is first, because each one needs different steps.
Phrase or key leaked: The wallet can never be safe again. Make a new wallet on a clean device, move everything, most valuable first, and never reuse the old phrase for anything.
Approval or permit taken: The phrase is safe. On Ethereum and networks built like it, revoke on revoke.cash. On another network, use your wallet maker’s own guidance. Then move what’s left to a wallet never connected to that site. A permit not yet used can’t be revoked, so if you signed one and your tokens are still there, move them first. Disconnecting isn’t enough: only revoking cancels an approval.
Exchange account taken: The order matters. Lock the account in its app, or on its site with the address typed in yourself, or ask it there to freeze withdrawals. Never search for a support number. Then, on a device you trust, change your email password, then the exchange password and two-factor settings.
If your recovery phrase or private key has leaked, the wallet can never be safe again, so move what you can now. It doesn’t matter whether you typed it into a site, an app asked for it, or a device went missing: nothing you change can take the phrase back.
1
On a clean device, make a new wallet and write down its new phrase.
2
Move everything you can to it, now, starting with the most valuable. Don’t stop to investigate.
3
Expect to lose anything that needs gas you don’t have. Bots watch exposed wallets and take any coin sent in almost as soon as it arrives, so sending gas into a leaked wallet usually feeds the thief.
4
Never use the old phrase again, for anything.
If a site took an approval or a permit, the phrase is safe and the problem is a permission. A permit not yet used can’t be revoked, so if you signed one and your tokens are still there, do step 2 first.
1
Type revoke.cash into your browser yourself, paste the affected address to see its approvals, then connect that wallet and revoke every approval you don’t recognize, starting with the token that was taken. Revoke.cash covers Ethereum and networks built like it. On another network, use your wallet maker’s own guidance.
2
Move what’s left to a wallet that has never been connected to that site.
Disconnecting the site in your wallet’s settings does nothing to the approval. Only revoking does.
If an exchange account was taken over, the order matters.
1
Lock the account in the exchange’s app, or on its site with the address typed in yourself. If you can’t, ask it there to freeze withdrawals. Never search for a support number, because search results carry fake ones. Treat anyone who messages you first claiming to be its support as a scammer.
2
On a device you trust, change the password on the email address the exchange uses. Every reset runs through it.
3
As soon as the exchange lets you, use a device you trust to change its password, check the two-factor settings and log out on every other device.
Keep the evidence
Before you clear anything, save it. Police and exchanges can act on details, and they can’t act on a story.
The addresses: yours, the one you sent to, and the one the funds went on to.
The transaction ID (its hash) for every transaction, from your wallet or a block explorer (a public site that shows transactions).
Screenshots of the site, the app, the chat and the profile, with dates.
Amounts and times, and how you first met the scammer.
The FBI’s advice to victims of investment fraud is to provide transaction details when reporting.
Where to report
Ireland
Report to your local Garda station (
garda.ie); in an emergency, 999 or 112. Also tell your bank right away if any money went by card or transfer, and the Central Bank of Ireland (
centralbank.ie) if a firm posed as authorized.
England, Wales and Northern Ireland
Use Report Fraud (
reportfraud.police.uk), which replaced Action Fraud on 4 December 2025, or call 0300 123 2040. Also tell your bank right away if any money went by card or transfer, and the FCA on 0800 111 6768 if a firm was involved.
Scotland
Report to Police Scotland on 101. Also tell your bank right away if any money went by card or transfer, and the FCA on 0800 111 6768 if a firm was involved.
United States
Report to the FBI’s Internet Crime Complaint Center (
ic3.gov). Also tell your bank.
Anywhere
Report to the exchange or service the funds went to, through its own site. Also tell the platform where you met the scammer.
Reporting rarely gets the money back, and it’s still worth doing. Exchanges freeze funds on a legal request or under their own rules, police build cases from many reports, and your report may stop the next person.
Recovery scams
After a theft comes a second wave. The FBI recorded 10,516 complaints about recovery scams in 2025, with losses of $1.4 billion. That figure may include what victims had already lost to the first scam.
The pattern is a firm that “specializes in crypto recovery”, a law office, or a message claiming to be from the police or the FBI itself. They charge a fee up front, send a vague tracing report or nothing, and ask for more.
They find victims in comment sections under news articles, in search results, and in replies to anything you post about the theft. The FBI says law enforcement does not charge victims a fee for investigating crimes, and private recovery companies cannot issue seizure orders.
So treat anyone who contacts you offering to get your money back as a scammer. Nobody genuine will ask for a fee to try. If you tell your story publicly, expect those messages, and ignore every one.
Your safety afterward
Thieves aren’t only online. CertiK, a security firm that tracks them, counted 72 verified “wrench attacks”, physical attacks to force a handover, worldwide in 2025, up 75% on 2024, with confirmed losses above $40.9 million.
Kidnapping was the most common form. More than 40% of cases were in Europe, and France recorded more than any other country.
January 2025 · A Ledger co-founder
In January 2025 kidnappers took a co-founder of Ledger, the hardware wallet maker, and his partner from their home in central France and demanded a crypto ransom. Police freed him in a raid the next night, and she was found the day after.
The attackers find targets through what people say and show online, and through leaked customer lists.
Never discuss what you hold, in person, on social media or in a group chat. Not the amount, and not the fact.
Have hardware wallets delivered somewhere other than your home, or to a collection point, and give makers and exchanges as little as they’ll accept.
Keep your address, your routines and your family out of your public profiles.
Tell the people you live with that your holdings are private, and why.
The FBI’s SIM-swap warning also tells you not to post about your crypto.
Your next step
Tonight, write four things on one card: your bank’s fraud number, the place you’d report to (from the list above), the exchange’s support address typed from its own site, and the one person you’ll call. Put it where you’d find it in a panic.
Last checked: 6 November 2026
