Recovering stolen cryptocurrency starts with the next few hours, not the next few weeks. To recover stolen cryptocurrency, you need to secure your remaining accounts, capture the on-chain evidence, report the theft to the FBI’s Internet Crime Complaint Center and local police, push any exchange holding the funds to freeze them, and then use a forensic tracer and an attorney to pursue a court order before the thief cashes out or the civil deadline runs. Most of that work happens in parallel, and every step depends on the one before it.
Lock Down Your Accounts First
Before you file anything, cut the attacker off. Change passwords on your exchange accounts, your email, and any linked financial services. Turn on two-factor authentication if it wasn’t already active. Revoke token approvals on any wallet that interacted with a malicious contract. If a compromised device was involved, stop using it for anything sensitive until it’s been wiped or examined.
This comes first because many thefts are ongoing. A phisher with your credentials rarely drains everything in one transaction. Shutting down access prevents a second wave while you move into documentation mode.
Capture the Evidence Before It Disappears
Every crypto transfer generates a transaction hash, a unique string that identifies the transfer on the blockchain. You can find yours by entering your wallet address into a block explorer such as Etherscan for Ethereum-based tokens or Blockchain.com for Bitcoin. Record the transaction hash, the exact date and time, the sending address, the receiving address, and the amount transferred in both the token quantity and its dollar value at the time of the theft.
Then preserve everything showing how the theft happened: screenshots of phishing emails, fake websites, chat messages, suspicious app interfaces, and your exchange login history including any IP records you can pull. Digital evidence vanishes when devices are wiped or accounts are closed, so copy it all to a safe location right away.
Organize it into one folder. Every agency, attorney, and forensic analyst you deal with will need the same set of facts, and having it ready saves days. The IC3 specifically asks for cryptocurrency addresses, transaction amounts and types, transaction hashes, and dates and times of the transactions.1Internet Crime Complaint Center (IC3). Cryptocurrency
Report the Theft
File With IC3
The IC3 at ic3.gov is the FBI’s central intake point for cyber-enabled crime, including crypto theft. Filing takes about 20 minutes once your evidence is ready. Save or print the confirmation page before you navigate away, because the IC3 will not email you a copy.2Federal Bureau of Investigation (FBI). Frequently Asked Questions
The IC3 reviews complaints and forwards them to relevant law enforcement, but it does not investigate cases itself and will not update you.2Federal Bureau of Investigation (FBI). Frequently Asked Questions Filing still matters. Complaints feed pattern analysis, and when several point to the same wallet cluster or operation, that’s what triggers the investigations behind seizures and returns.
File a Local Police Report
File with your local police department too. A police report is documentation that exchanges often require before cooperating with freeze requests or releasing account data, and it creates an official record for insurance claims and tax filings.
Consider Other Federal Channels
Your local FBI field office is another reporting channel, particularly for losses above $100,000.3Federal Bureau of Investigation. Cryptocurrency Investment Fraud The U.S. Secret Service also investigates digital asset crimes, and the FTC accepts scam reports at ReportFraud.ftc.gov. Different agencies have jurisdiction over different crime types, so reporting to more than one increases the odds someone picks up the case.
Push the Exchange to Freeze the Funds
If your own review or a blockchain trace shows the stolen funds moved to a centralized exchange, contact that exchange’s security or compliance team right away. Send the transaction hash and the receiving wallet address so they can check whether the funds are still with them, and ask for a temporary freeze on the account holding the assets.
Speed is everything here. Once funds hit a centralized exchange, there’s a window before the thief finishes identity verification, converts to fiat, or transfers out again. Exchanges with strong compliance programs will freeze suspicious accounts and work with law enforcement, but they need a reason. Your police report, IC3 filing, and evidence package give them one.
Don’t expect the exchange to hand the funds back to you directly. In most cases, a court order is required before assets are released. The freeze buys time for the legal process to catch up. If the funds move on to a non-custodial wallet where no intermediary holds the keys, freezing becomes impossible, which is why every hour counts.
Trace the Funds on the Blockchain
Public blockchains record every transaction permanently, so stolen funds leave a trail even when the thief tries to hide it. Forensic analysts use specialized software to follow the flow through techniques like chain-hopping (moving assets across different blockchains) and mixing services (pooling funds with other transactions to break the link between source and destination).
The goal is to follow the money to an off-ramp, the point where crypto is converted to traditional currency, usually at a centralized exchange that collects identity information under Know Your Customer rules. Under federal law, the Treasury Department can issue summonses compelling financial institutions, including exchanges, to produce records identifying account holders and their transaction data.4Office of the Law Revision Counsel. 31 U.S. Code 5318 – Compliance, Exemptions, and Summons Authority Once a trace reaches a KYC-compliant exchange, law enforcement has the legal tools to put a name to the wallet.
A professional forensic report documents every hop the stolen funds made, often with visual transaction-flow diagrams that make the data readable to judges and juries. Costs vary with complexity. Simple traces involving a small number of transactions on one blockchain start in the low thousands; cases spanning multiple chains, mixers, or DeFi protocols run significantly higher. The report itself becomes central evidence for both civil litigation and criminal prosecution.
Use the Courts to Freeze and Recover the Assets
Temporary Restraining Orders and Preliminary Injunctions
Once you’ve identified where the stolen funds are sitting, a court can order them frozen. The process starts with an ex parte hearing, where your attorney presents evidence to a judge without the defendant present. If the judge finds the evidence compelling, including forensic tracing showing the stolen funds are held at a specific exchange, they issue a temporary restraining order preventing the account holder from moving or withdrawing the assets.5Federal Trade Commission. Ex Parte Temporary Restraining Order With Asset Freeze
The TRO is temporary by design. A full hearing follows where both sides can present arguments, and the court decides whether to issue a preliminary injunction keeping the freeze in place through the lawsuit. This is where your forensic report and evidence chain do the heavy lifting. Courts want to see clear ownership of the assets and a direct link between the theft and the frozen funds.
John Doe Lawsuits
When you know which wallet holds your stolen crypto but not who controls it, attorneys can file a John Doe lawsuit, a civil action against an unidentified defendant. These filings open the discovery process and let lawyers subpoena exchanges for the account holder information tied to the receiving wallet address.6United States Department of Justice. Court Authorizes Service of John Doe Summons Seeking the Identities of US Taxpayers Who Have Used Cryptocurrency This is often the only way to connect a digital wallet to a real person.
Why Courts Can Do This at All
For any of these tools to work, courts have to treat cryptocurrency as property that can be frozen, seized, and returned. In the U.S., the IRS has classified virtual currency as property since 2014, and general tax principles for property transactions apply.7Internal Revenue Service. Notice 2014-21 That classification is what gives courts the authority to issue freeze orders over digital assets.
Cost Versus Recovery
Legal fees for obtaining a freeze order and pursuing recovery through the courts can be substantial, and they scale with case complexity. A straightforward domestic case involving one exchange and clear tracing costs far less than a multi-jurisdictional pursuit through DeFi protocols and foreign exchanges. Attorneys who specialize in crypto recovery typically bill hourly or under hybrid arrangements. Before you commit, ask for a candid assessment of the likely recovery versus the likely legal spend. In many smaller theft cases, the math simply doesn’t work.
Watch the Two-Year Civil Clock
Statutes of limitations set hard deadlines for both civil and criminal action. For a civil claim under the Computer Fraud and Abuse Act, the main federal law covering unauthorized computer access, you have two years from the date of the theft or the date you discovered the damage, whichever is later.8Office of the Law Revision Counsel. 18 U.S. Code 1030 – Fraud and Related Activity in Connection With Computers
On the criminal side, wire fraud carries a five-year statute of limitations under general federal rules, extended to ten years when the offense affects a financial institution.9Office of the Law Revision Counsel. 18 U.S. Code 3293 – Financial Institution Offenses For you, the two-year civil window is the sharp one. Your ability to sue the thief directly starts its countdown the moment you discover the loss.
Claim the Loss on Your Taxes
Stolen cryptocurrency may be deductible as a theft loss, but the rules depend on why you held it. If you held crypto as an investment, meaning you bought it expecting appreciation or returns, a theft loss is generally deductible as an ordinary loss. The requirements are that the theft qualify as theft under your state’s laws and that you have no reasonable prospect of recovering the funds.10Taxpayer Advocate Service (TAS). TAS Tax Tip: When Can You Deduct Digital Asset Investment Losses on Your Individual Tax Return
The distinction matters because the Tax Cuts and Jobs Act suspended most personal casualty and theft loss deductions through 2025. Theft losses from transactions entered into for profit, which covers most crypto investments, were not part of that suspension. You claim the loss in the tax year you discovered the theft, not the year it occurred.
File Form 4684 (Casualties and Thefts) with your tax return. If the stolen crypto was an investment, use Section B. If a Ponzi-type scheme was involved, Section C applies under a separate set of procedures.11Internal Revenue Service. Instructions for Form 4684 The loss amount is your adjusted cost basis in the stolen crypto minus any amount you’ve recovered or expect to recover. Keep your transaction records, purchase receipts, and theft documentation together; the IRS may ask to see them.
Don’t Get Robbed Twice by Recovery Scams
Fake “recovery services” actively target people who’ve just been robbed, sometimes within days. The FBI has seized websites operated by fraudulent recovery firms that charged significant upfront fees and promised to retrieve stolen cryptocurrency.12Federal Bureau of Investigation (FBI). FBI San Diego Seizes Cryptocurrency Recovery Websites
The FTC’s guidance is blunt: nobody who contacts you unsolicited offering to recover your money is legitimate.13Federal Trade Commission (FTC). Worried About Crypto Exchange Losses? Don’t Pay Money for Help Recovering Money The warning signs:
- A demand for upfront fees. Legitimate forensic firms and attorneys bill for documented work, and law enforcement never charges victims to investigate crimes.
- Guaranteed recovery. No honest professional guarantees they’ll get your crypto back; outcomes depend on where the funds went and how fast you moved.
- Payment in crypto, wire transfers, or gift cards. Any recovery service asking for those payment methods is a scam.
- Unsolicited contact. If someone reaches out on social media, by email, or by phone claiming they can help, they found you because you posted about being a victim.
Before hiring anyone, search the firm’s name along with “complaint” or “scam,” verify the business registration, and confirm any attorney is licensed in the jurisdiction they claim to practice in.
Don’t Count on Your Homeowners Insurance
Standard homeowners and renters insurance policies do not cover cryptocurrency theft. Most include a small sublimit for physical currency and coins kept in the home, but that coverage doesn’t extend to digital assets. Coverage would require a specialized personal cyber policy or dedicated crypto insurance, both still emerging products with limited availability and high premiums for what they cover. Read the exclusions in your policy before assuming anything.