Most of what determines whether stolen crypto can be frozen happens before an investigator is ever hired. Blockchain settlement is fast, and the window between a fraudulent transfer and the funds reaching a jurisdiction that will not cooperate is often measured in hours.
This is the sequence we ask clients to follow. It costs nothing and it protects every option you have later.
Hour 0 to 4: stop the bleeding
Cut the access, not just the transfer. If you approved a token allowance, signed a message, or installed remote-access software, the attacker may still hold a live path to your wallet. Revoke outstanding token approvals from a clean device. Move any remaining balance to a newly generated wallet whose seed phrase has never touched the compromised machine.
Do not send another transaction to "unlock" anything. The single most common second loss we see is a victim paying a "tax", "gas fee", or "compliance deposit" demanded before a withdrawal will supposedly clear. No legitimate platform requires an inbound payment to release your own balance.
Hour 0 to 24: preserve evidence before it disappears
Fraudulent platforms are taken down by their operators, not by regulators, and they go dark quickly. Capture, in this order:
- Transaction hashes for every transfer you made. This is the single most valuable artifact. One hash lets an analyst reconstruct the entire downstream flow.
- Deposit addresses shown to you, including ones you did not use.
- Full-page screenshots of the platform showing your balance, the withdrawal screen, and any error messages. Include the URL bar and the system clock in the frame.
- The complete message history exported rather than screenshotted where the app allows it. WhatsApp, Telegram and WeChat all support chat export.
- Profile artifacts: usernames, phone numbers, profile photos, the original point of contact.
- Email headers, not just email bodies. Headers carry routing data that bodies do not.
Store all of it in one folder with a plain text file recording when each item was captured. Chain of custody matters if the material is ever used in a proceeding.
Hour 12 to 72: file the reports that unlock cooperation
Exchanges will not act on a private investigator's letter alone. They act on law enforcement referrals and court orders. Filing early creates the reference number that everything else attaches to.
- Your national reporting body: IC3 in the United States, Action Fraud in the United Kingdom, the Canadian Anti-Fraud Centre in Canada, or your local police cybercrime unit.
- Your bank or card issuer, if fiat left a traditional account. Recall and chargeback windows are short and strictly enforced.
- The receiving exchange, if tracing shows funds landed at a compliant venue. A well-formed report with the transaction hash and timestamp is occasionally enough for a compliance team to freeze an account pending legal process.
What honest expectations look like
Tracing is close to deterministic. Public ledgers do not forget, and a competent analyst can usually tell you where funds went and whether they reached a regulated venue.
Recovery is not. It depends on whether the funds stopped somewhere a court can reach, whether the amount justifies the legal cost, and whether a prosecutor or civil counsel will act. A meaningful share of investigations end with a clear picture of where the money went and no realistic path to get it back.
Anyone who promises you recovery before looking at a single transaction hash is selling you the second fraud.