If someone took crypto from your wallet or your exchange account, the transfer can't be undone. A confirmed blockchain transaction can't be reversed by you, your wallet app, or the exchange it came from.
That doesn't mean the money is beyond reach. Stolen crypto sometimes comes back when it lands somewhere a real company controls, like an exchange or a stablecoin issuer, and that company freezes it on a law-enforcement or court request. Most stolen crypto is never returned, though, and the most valuable thing you can do in the first hour is stop the theft from getting worse.
Crypto Asset Recovery doesn't trace or retrieve stolen funds. We help people get back into wallets they own. If you were tricked into sending the crypto yourself, such as through a fake investment platform or a romance scam, our guide to recovering money from a crypto scam fits your situation better.
First, stop further losses
What you do first depends on how the crypto was taken. Work out which of these fits, then follow that branch.
Your exchange account was taken over
Someone logged in to Coinbase, Kraken, Binance or another exchange and withdrew your funds.
- Lock or disable the account. On Coinbase, go to Account & settings, then Security, then Lock Account. That signs out every device, and after you unlock it, crypto sends stay paused for 24 hours. Binance lets you disable the account under Security, then Account Management. Kraken asks you to submit its Account Security & Sign-in Issues form.
- Secure your email too. Whoever got into the exchange may have your email as well. Change that password, sign out other sessions, and check for forwarding rules you didn't create.
- Move two-factor authentication off text messages. Use an authenticator app or a hardware security key.
- Report the unauthorized withdrawal to the exchange's support team and ask them to note the receiving address.
Don't count on a refund. None of the exchange help pages we checked promises to reimburse losses from a hacked account.
Your phone number was hijacked (SIM swap)
If your phone suddenly lost service and then your accounts were drained, someone probably moved your number to their SIM card. Call your carrier from another phone to get the number back. That's a separate job from exchange recovery, so do both. Coinbase's own guidance is that anything relying on text-message codes is exposed once your number is ported.
Your wallet was drained and you don't know how
If funds left a self-custody wallet (MetaMask, Trust Wallet, Phantom and so on) without you approving a transaction, assume the recovery phrase or a private key is in someone else's hands. A new password won't help, because the thief doesn't need your password. They have the keys.
- Create a brand-new wallet with a new recovery phrase on a different device, or on one you've wiped and reinstalled. If malware caused the theft, a new wallet on the same computer can be drained too. Never restore the old phrase anywhere.
- Move whatever is left to the new wallet as quickly as you can.
- Don't send fresh funds to the compromised address to pay for gas. Thieves often run "sweeper" bots that grab anything that arrives within seconds, so topping up usually fails. If tokens are stuck there with no gas to move them, stop rather than improvise. Losing more money trying to rescue them makes things worse.
You signed something you shouldn't have (approval or drainer scam)
Fake airdrops, mint pages and "claim" sites often trick people into granting a token approval, which lets the scammer's contract spend your tokens later. Check your address in Revoke.cash or Etherscan's token approval checker and revoke anything you don't recognize. Type those addresses in yourself: fake "revoke" sites target people who've just been drained. Each revoke is a small transaction you approve in your wallet.
Revoking only stops future spending. It doesn't bring back tokens that already left, and disconnecting a site from your wallet doesn't cancel its approval. If your recovery phrase itself was exposed, revoking won't help; follow the drained-wallet steps above instead.
Save the evidence while it's fresh
Every later step, from an exchange freeze to a police report to a court order, runs on evidence. Write down:
- the network (Bitcoin, Ethereum, Solana, Tron) and the token, including its contract address if it's a token
- every transaction hash (also called a TxID)
- amounts, with dates and times in UTC
- your own addresses and the addresses the funds went to
- screenshots of messages, websites, emails and anything else connected to the theft
- how you think it happened, written out while you still remember the details
- any support ticket numbers and the police report number once you have one
If the funds went to an Ethereum address, our free scam checker shows whether that address or transaction has been reported for scams and lists recent transfers. It's a quick check rather than a full trace, but the output is worth saving with the rest.
Report the theft
A detective is rarely assigned to an individual report, but the report is the record exchanges and courts rely on later, and it lets agencies connect your case to others.
- United States: file with the FBI's Internet Crime Complaint Center at ic3.gov and with the FTC at reportfraud.ftc.gov. Include the hashes, addresses, amounts and dates.
- United Kingdom: Action Fraud was replaced by Report Fraud on December 4, 2025. Report at reportfraud.police.uk (in Scotland, call Police Scotland on 101).
- Everywhere: file a report with your local police and keep the reference number. Exchanges usually want one.
Scammers run fake reporting sites, so type these addresses in yourself instead of clicking ads or links someone sends you.
Then contact the exchange the stolen funds went to, if you can tell from the trail. Binance, for example, asks theft victims for a description of the incident, proof the funds were yours, the addresses involved, transaction links and a police report. It also says it can't freeze another user's assets without an official law-enforcement or court order. Kraken says the same: it can't recall completed transfers, but it responds to lawful freeze requests for funds it holds. Your report gets the exchange watching. A legal order is what locks the money.
How stolen crypto comes back
When stolen crypto is returned, it goes through a chain of separate steps, and the chain can break at any of them:
- Traced. Someone follows the funds from your address to where they ended up. Our guide on whether crypto can be traced explains how that works and where it fails.
- Reaches a custodian. The trail has to end at a business that can act, such as an exchange or a stablecoin issuer. Funds that stay in self-custody wallets or go through privacy tools are much harder to reach.
- Frozen. The custodian locks the funds, usually after a law-enforcement or court request. Tether says it has helped freeze more than $5 billion in assets, working with more than 340 agencies. Circle can block an address from moving USDC under valid legal orders. A freeze stops the money moving. It doesn't send it back.
- Seized and returned. Prosecutors or a court have to take the funds and send them back to whoever lost them. After the 2023 SafeMoon hack, US authorities seized about $680,000 from exchange accounts linked to the theft. Two years later, in June 2025, the Justice Department announced it was returning the money through civil forfeiture, to SafeMoon's bankruptcy trustee, without anyone having been charged.
Victims with large losses sometimes go to court themselves. In one 2026 US case, a judge partly granted a temporary restraining order and early discovery against unknown defendants after the victim's Bitcoin was traced. An order like that can preserve the funds and identify account holders, but it isn't a refund, and lawyers' fees come on top of the loss.
How often does it work?
Not often. No one publishes a reliable rate for stolen crypto returned to its owners. Among the hacks it tracked in the first quarter of 2025, Immunefi counted $6.5 million recovered out of $1.64 billion stolen, about 0.4% as of its April 2025 report. Those were mostly big platform hacks, not individual wallets, but they show how rarely money comes back.
Your odds are better when the theft was recent, the trail is clear, the funds reached a regulated exchange or a freezable stablecoin, and the amount is large enough that police or a lawyer will pursue it.
Should you pay someone to trace it?
A professional trace can help when the loss is large and the funds may still be on an exchange, but it's a report, not a refund. Private firms can't freeze or seize anything; only exchanges, issuers, police and courts can. Get the price and deliverable in writing first, and read our guide to whether crypto recovery companies are legit before you pay anyone.
Watch out for the second theft
People who have just lost crypto are the main targets for "recovery" scams, including fake law firms posing as government partners. Walk away from anyone who contacts you first, guarantees recovery, asks for an upfront fee, or wants your recovery phrase. Our checklist for the first days after a crypto scam or hack lists the warning signs.
Locked out rather than robbed?
If your crypto wasn't stolen but you can't get to it, because you forgot a wallet password, lost part of a recovery phrase, or have an old wallet file you can't open, that's what we do. The cracking runs on offline, air-gapped machines, and you only pay if we succeed. Tell us about your wallet and we'll give you a straight read on your odds.
Frequently asked questions
Can stolen crypto be recovered?
Sometimes, but most of it isn't. It usually comes back only when the funds reach an exchange or stablecoin issuer that freezes them after a law-enforcement or court request, and then a court or prosecutor returns them. Acting fast and reporting with full evidence improves the odds.
Can police recover stolen crypto?
They can, mainly by tracing funds to an exchange and getting a freeze or seizure order. A clear report with transaction hashes, addresses and amounts makes it far more likely your case gets attention. Not every report leads to an investigation.
Can an exchange reverse a stolen crypto transaction?
No. Exchanges can't reverse a confirmed blockchain transaction. They can lock your account, investigate activity on it, and freeze stolen funds that land in an account they control when they receive a valid legal request.
Does revoking a token approval get my tokens back?
No. Revoking stops the approved contract from taking more tokens in the future. Tokens that already left your wallet stay where they went.
What should I do if my recovery phrase was stolen?
Treat the wallet as permanently compromised. Create a new wallet with a new recovery phrase, move any remaining funds there quickly, and don't send gas money to the old address.
How much does it cost to recover stolen crypto?
Reporting to the police, IC3 and the FTC is free. Private tracing firms usually charge per transaction traced or per case, and lawyers and court action cost extra. Be wary of anyone who wants an upfront "release" or "unlock" fee.
Can someone recover stolen crypto for a fee?
Be very careful. Legitimate tracing firms sell a report, not a guaranteed refund, and they can't freeze or seize funds themselves. Anyone who guarantees recovery or asks for an upfront "release" fee is almost certainly running a scam.
