3.13[Security, Custody & Trust](https://wealtii.com/learn) # Crypto Wallet Hacked? What to Do in the First Hour By [Zayd Ahmed](https://wealtii.com/editorial-policy#zayd-ahmed), Founder & CEO, Wealtii · Published 12 February 2026 · Last reviewed 21 October 2026 If your **crypto wallet is hacked**, move any remaining funds to a brand-new wallet created on a clean device, revoke token approvals, secure your email and exchange accounts, then record transaction hashes and report the theft to the FBI's IC3 or your national cybercrime unit. Ignore anyone offering paid crypto recovery: those offers are usually scams. ## How can you tell what was compromised? The right response depends on how the attacker got in. Check your wallet's transaction history on a block explorer and match it to one of these patterns. | What you see | Likely cause | What the attacker can do | | --- | --- | --- | | Several assets drained, on more than one chain | Recovery phrase or private key leaked | Everything in the wallet, now and in future | | One token or NFT collection taken, after you used a site | Malicious approval or signature | Only the approved assets, until you revoke | | Exchange withdrawal you did not make | Account takeover (password, SIM swap, email breach) | Your exchange balance and settings | | Funds sent to an address you did not enter | Clipboard malware or address poisoning | Redirect future transfers from that device | ## What should you do in the first hour? 1. **Stop using the affected device.** Disconnect it from the internet if you suspect malware; use a different, clean device from here on. 2. **Create a new wallet** on that clean device, ideally a new hardware wallet, with a new recovery phrase that has never been typed anywhere. 3. **Move what is left,** highest value first. If the private key leaked, the attacker may run a "sweeper" bot that grabs any network-fee coins you send in, so do not keep topping up the old wallet. 4. **Revoke approvals** if the loss came from a signature, using a block explorer's token approval checker such as Etherscan's or BscScan's. 5. **Lock down accounts:** change exchange and email passwords, reset 2FA, sign out all other sessions, and check withdrawal address lists and email forwarding rules. 6. **Contact the exchange** through its official app or website if an exchange account was involved, and ask it to freeze withdrawals. ## How do you document and report crypto theft? Before details are lost, record the transaction hashes, the attacker's receiving addresses, dates and times, amounts, and screenshots of any messages, websites or apps involved. Then report: - **United States:** the FBI's Internet Crime Complaint Center (ic3.gov), the FTC (ReportFraud.ftc.gov) and local police. - **Other countries:** your national cybercrime or fraud reporting service. - **Receiving exchanges:** if a block explorer shows the funds reaching a known exchange, send that exchange the transaction hashes and your police or IC3 reference. Large losses are common. In 2025 the IC3 recorded an average reported loss of $62,604 per crypto-related complaint, and 18,589 people reported losing more than $100,000 (FBI IC3 2025 Internet Crime Report). Keep your records for tax purposes too; how theft and scam losses are treated differs by country, so ask a tax professional. ## Can stolen crypto be recovered? Rarely, and never by reversing the transaction. Recovery usually happens only when stolen funds reach a centralised exchange or a stablecoin issuer that can freeze them, or when law enforcement seizes them, sometimes years later. Fast, detailed reporting improves those odds; nothing else does. ## How do you spot a crypto recovery scam? Recovery scams target people who have just lost money. The FBI received 10,516 recovery-scam complaints in 2025, with $1.4 billion in reported losses, a figure that may include the original theft. An FBI alert from August 2025 lists the warning signs: - Unsolicited contact from a "law firm" or "recovery company", often knowing your exact losses. - Claims of partnership with US or foreign government agencies; the FBI says no law firm is an authorised partner. - Requests for fees in cryptocurrency or gift cards; government agencies do not charge for law enforcement services. - Refusal to meet on video or show a licence. The FTC adds that legitimate organisations do not charge to help with refunds and do not ask for account numbers. Recovery scams are one of the [common crypto scam types](https://wealtii.com/learn/common-crypto-scams) worth knowing. ## How do you stop it happening again? - Work through our checklist to [secure your wallet](https://wealtii.com/learn/wallet-security-best-practices), including hardware storage and revoking old approvals. - Replace SMS codes with [phishing-resistant two-factor authentication](https://wealtii.com/learn/two-factor-authentication-crypto). - Learn the lures in [how to spot crypto phishing](https://wealtii.com/learn/recognizing-phishing-attacks). ### If you think someone accessed your Wealtii account Change your password, turn on authenticator-app (TOTP) two-factor authentication, and open a support ticket at support@wealtii.com straight away. Wealtii support is ticket-based, with intake 24/7. The [Wealtii security page](https://wealtii.com/security) explains how account sign-in is protected. ## Frequently Asked Questions ### Can a crypto transaction be reversed? No. Once a blockchain transaction is confirmed, no bank, exchange or authority can reverse it. Stolen funds can sometimes be frozen later, if they reach a centralised exchange or a stablecoin issuer that acts on a law enforcement request, which is why fast reporting with transaction hashes matters. ### Should I pay a crypto recovery service? No. The FBI received 10,516 recovery-scam complaints in 2025, with $1.4 billion in reported losses. Fake recovery firms and fake lawyers ask for upfront fees and claim government links. Legitimate agencies do not charge to help you, and no software can reverse a blockchain transfer. ### Can I keep using a wallet after it was hacked? Not if the recovery phrase or private key leaked: abandon it, because attackers often run bots that take anything sent to it. If the loss came from a single malicious approval and your phrase is safe, revoking that approval may be enough, but moving to a fresh wallet is still the cautious choice. ### Who should I report crypto theft to? In the US, file a complaint with the FBI at ic3.gov and with the FTC at ReportFraud.ftc.gov, and tell local police. Elsewhere, use your national cybercrime or fraud reporting service. Also notify any exchange that received the stolen funds and the platform where the scammer contacted you. ## Sources & References 1. [FBI Internet Crime Complaint Center — 2025 Internet Crime Report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf) (accessed 21 Oct 2026) 2. [FBI IC3 — Fictitious Law Firms Targeting Cryptocurrency Scam Victims (I-081325-PSA, 13 Aug 2025)](https://www.ic3.gov/PSA/2025/PSA250813) (accessed 21 Oct 2026) 3. [FTC — Refund and Recovery Scams](https://consumer.ftc.gov/articles/refund-and-recovery-scams) (accessed 21 Oct 2026) 4. [FBI Internet Crime Complaint Center — File a complaint](https://www.ic3.gov/) (accessed 21 Oct 2026) 5. [FTC — ReportFraud.ftc.gov](https://reportfraud.ftc.gov/) (accessed 21 Oct 2026) Disclaimer: This content is for educational purposes only and does not constitute financial, tax, or legal advice. Digital assets are volatile and carry risk of loss. Wealtii is early-stage and not regulated. ## Further reading from official sources - [CISA: Secure Our World](https://www.cisa.gov/secure-our-world) - [NIST: Digital Identity Guidelines](https://pages.nist.gov/800-63-3/) [Zayd Ahmed](https://wealtii.com/editorial-policy#zayd-ahmed) Founder & CEO, Wealtii Computer Science Engineer | 5+ Years in DeFi & Digital Assets ## Compare Wealtii's three index funds Crypto, tokenized gold and tokenized US stocks from $10, with 0% platform fees during our early-adopter promotion. Wealtii is not regulated and digital assets can lose value — read the [risk disclosure](https://wealtii.com/risk-disclosure) first.