Your wallet was emptied overnight, or the “trading platform” that showed a fat balance now wants a fee before it lets you withdraw. The honest answer to the question of how to recover stolen crypto is short: most victims never see the money again. Blockchain transfers cannot be cancelled, and nobody holds a master key to reverse them. What you do in the first hours still matters, because it decides whether a freeze, a seizure or a prosecution stays possible later.
The Bybit theft of 21 February 2025 shows the gap between tracing and getting money back. Hackers took nearly $1.5 billion in ether, the largest crypto heist on record according to Chainalysis. Two months later, Bybit’s chief executive Ben Zhou wrote on X that 68.6% of the stolen funds remained traceable, 27.6% had “gone dark” and only 3.8% had been frozen, Cointelegraph reported. Bybit had a bounty program and half the industry watching the addresses, and still under 4% was stopped. A private victim with a few thousand dollars starts with far less.
This lesson is the practical sequel to our guide on fake airdrops, wallet drainers and address poisoning, and to the overview of crypto scams. It does not explain again how the scams work. It covers what a victim can do in the United States, the United Kingdom, France and Italy: secure what is left, keep the evidence, understand what on-chain tracing can and cannot do, reach the few people able to freeze funds, file the right complaint, and refuse the second scam that follows almost every first one.
Three situations, three different remedies
“Stolen” covers cases that the law and the banks treat very differently, so start by placing yours.
In the first, someone took the coins from your own wallet. You typed your seed phrase into a fake site, signed a malicious approval, or malware read your keys. You never agreed to the transfer. In the second, you sent the money yourself to a fake investment site, a romance contact or a fake recovery agent. Banks call that an authorised payment, even if you were tricked. In the third, someone took over your account at an exchange and withdrew the balance.
The difference matters on the fiat side. If euros or dollars left your bank by card or transfer in the last few hours or days, your bank may be able to recall them or dispute the payment. The FBI’s own 2025 Internet Crime Report shows how much speed counts: its Recovery Asset Team handled 3,900 fraudulent transfer cases in 2025, involving about $1.16 billion, and helped banks freeze about $679 million of it, a 58% success rate. That process, the Financial Fraud Kill Chain, works on bank transfers. Once the money has been turned into crypto and moved on a blockchain, no bank can pull it back, and the FTC says plainly that crypto payments are typically not reversible.
In an exchange account takeover, the exchange holds records of logins, devices and withdrawals. It will not refund you by default, but it is the first party to contact, and its security team can block further withdrawals at once.
The first hours: how to recover stolen crypto starts with stopping the losses
These steps come before any complaint. They protect what is left and keep the evidence clean.
- Stop every payment and every contact with the people involved. A request for a “release fee”, a tax or a “verification deposit” before a withdrawal is the scam continuing, not a way out.
- If any funds remain in a wallet that was drained, move them now to a brand-new wallet created on a clean device, with a new seed phrase written on paper. Never reuse the old phrase: our guide to seed phrase security explains why.
- If you signed a token approval on an Ethereum-type network, revoke it with the token approval checker of a block explorer, so the attacker cannot pull more tokens later.
- Change the password and two-factor settings of your email first, then of every exchange account, and sign out of all other sessions. Use an authenticator app, not SMS, where you can.
- If money left your bank by card or transfer, call the bank’s fraud line straight away and ask for a recall or a dispute. Every hour counts on the bank side.
- Contact the support team of the exchange you used, only through its website or app, never through a number found in search results or a message.
- Write down the facts while you still remember them: dates, times with time zone, names and handles used, websites, how first contact happened.
- Do not wipe or reset the device that was used. Investigators may want it as it is.
If the theft came through a fake airdrop or a poisoned address, the same steps apply. The revoke step matters most there, because drainers often keep a standing permission to take more.
Collect the evidence that police and exchanges ask for
A complaint without transaction data is a story. A complaint with transaction hashes is a lead that an analyst can follow in minutes. Gather everything in one folder, with copies stored outside the affected device.
- The transaction hash (also called txid) of every transfer that left your wallet or account, and the network it was on (Bitcoin, Ethereum, Tron, Solana and so on).
- Your own address and every destination address, copied exactly, not typed by hand.
- The token and amount of each transfer, with date and time.
- Screenshots of the chats, the fake website and its full URL, emails with their headers, and any “contract” or “account statement” the scammers sent.
- Bank references for every card payment or transfer that funded the purchase of the crypto.
- Your exchange account ID and the withdrawal records it shows.
A transaction hash is the receipt of a blockchain transfer. Paste it into a public block explorer for that network and you see the sender, the receiver, the amount and the time. If addresses are new to you, our lesson on what a crypto address is shows how to read one. Keep the hashes as text as well as in screenshots: an investigator wants to copy and paste them.
On-chain tracing: following the money is not getting it back
Public blockchains keep every transfer forever. Addresses carry no names, but they are pseudonymous, not anonymous: once one address is linked to a person or a company, much of its history can be read.
What you can see yourself on a block explorer
Start from your outgoing transaction and follow it hop by hop. In most thefts the funds are split into many addresses within minutes, then swapped into another token, sent across a bridge to another chain, or dropped into a mixer. Sometimes the trail ends at a deposit address of a large exchange. Explorers label some of those addresses, and that label is the most useful thing a victim can find, because an exchange is a company with a compliance team and a legal address.
What tracing firms and police add
Firms in the Chainalysis or TRM Labs mould group addresses into clusters that belong to the same service, label thousands of exchange deposit addresses, and follow funds across chains. Police forces and large exchanges use their tools. The output is intelligence: a map of where the money went, which can support a freezing request or a warrant. It is not a refund.
The Colonial Pipeline case shows when tracing ends in a seizure. On 7 June 2021, the US Justice Department announced the seizure of 63.7 bitcoins, then worth about $2.3 million, out of a ransom of about 75 BTC paid to the DarkSide group. Agents had followed the ransom on the public ledger to an address whose private key the FBI held, and a federal magistrate judge in the Northern District of California authorised the seizure warrant. Without that key, the trace alone would have changed nothing.
Where the trail goes cold
Mixers, cross-chain swap services, exchanges that skip identity checks and privacy coins break the link between addresses or move funds out of reach of any court that knows the case. In the Bybit theft, about 84% of the stolen ether was converted to bitcoin through THORChain, according to the same Cointelegraph report, and part of the rest passed through the swap service eXch, which announced it would close on 1 May 2025 after accusations that it had been used to launder the funds. Speed is the attackers’ weapon: a theft that takes ten minutes may need weeks of legal work to answer.
Keep this in mind when anyone shows you a “tracing report” as proof that your money can come back. Knowing where coins went and having the power to take them back are two different things, and only the second returns money.
Exchange freezes and stablecoin freezes: the lever that sometimes works
Funds can be stopped in two places: at a company that holds them for a customer, and at the issuer of a stablecoin that can block an address. Both act on orders from authorities, not on a message from a victim.
Exchanges act on police or court orders
If the stolen coins reached an account at a regulated exchange, that exchange knows who opened the account, because it checked identity documents. Our guide to how centralized exchanges work explains that KYC trail. But the exchange will not freeze a customer’s account because a stranger says so. Binance’s support page on stolen funds says it is “unable to unilaterally freeze any user’s assets” without an official freezing order from law enforcement or a court, will deal directly with the police, and will not share the results with the victim. So the victim’s job is to get a police report filed fast, with the hashes and the exchange’s deposit address in it, so that investigators can send the request.
Timing decides the outcome. A thief who deposits to an exchange usually withdraws or trades within hours. A freezing request that arrives a week later often finds an empty account.
Tether and other stablecoin issuers can blacklist an address
Tether, the issuer of USDT, can freeze tokens at a given address so they can no longer move. On 23 April 2026 it froze more than $344 million in USDT on two Tron addresses in coordination with the US Treasury’s sanctions office (OFAC) and US law enforcement. Tether said at the time that it had frozen more than $4.4 billion in total and worked with more than 340 law enforcement agencies in 65 countries, The Block reported. In January 2026 it froze about $182 million on five Tron addresses after a law enforcement request. Our comparison of USDT and USDC covers how issuer control works.
The pattern behind these freezes is the same: a police force or a regulator asks, the issuer acts. A victim who writes to an issuer directly has no standing to demand a freeze. Stolen funds held in USDT on a public chain are still a better case than bitcoin, because a freeze is possible at all.
Frozen is not returned
The US Scam Center Strike Force, created in 2025 inside the US Attorney’s Office for the District of Columbia with the FBI, the Secret Service and other agencies, shows the scale and the delay. Its official page, updated on 15 October 2026, says its seizure team has restrained about $938 million in cryptocurrency and is focused on returning stolen funds to victims. Restrained means blocked. The money reaches victims only after forfeiture and a remission or restitution process, which takes months or years, and no public figure says how much has been paid back so far.
Where to report stolen crypto: US, UK, France and Italy
A complaint does three things: it gives you a reference number that banks, exchanges and insurers ask for, it lets police link your case to others run by the same group, and it is the legal basis for any freezing order. It will not, by itself, bring the money back. File it even for a small amount: pooled reports are how large operations get dismantled.
United States: IC3 first, then the regulators
The main federal entry point is the FBI’s Internet Crime Complaint Center at ic3.gov. In 2025 it received 181,565 complaints involving cryptocurrency, with losses of about $11.37 billion, more than half of the $20.88 billion reported for all internet crime. Crypto investment fraud alone accounted for about $7.23 billion. The FTC asks victims to report at ReportFraud.ftc.gov as well. If an investment platform was involved, the SEC (sec.gov/tcr) and the CFTC (cftc.gov/complaint) take tips. A report to your local police or your state attorney general’s consumer protection office adds a local record.
IC3 complaints feed real operations. Operation Level Up, launched in January 2024, uses them to warn people who are still being scammed: it has notified more than 8,000 victims since its launch, 3,780 of them in 2025, according to the IC3 report.
United Kingdom: Report Fraud, formerly Action Fraud
In England, Wales and Northern Ireland, Report Fraud replaced Action Fraud on 4 December 2025. The City of London Police runs it, at reportfraud.police.uk or on 0300 123 2040, the same number as before. In Scotland, call Police Scotland on 101. The FCA’s scam reporting page tells victims: “If you’ve lost money to a scam, contact Report Fraud and then report it to us.” The FCA adds that it cannot help you get your money back, and warns that people already scammed are more likely to be targeted again.
On the bank side, UK payment firms must reimburse victims of authorised push payment fraud made by Faster Payments or CHAPS, up to £85,000 per claim, since 7 October 2024. The usual crypto case falls outside it. The Payment Systems Regulator’s policy statement PS23/3 excludes payments that take place across other payment systems, and its own example is a customer who sends money to their account at a crypto exchange and then pays a fraudster in crypto. If the bank transfer went straight to a fraudster’s account, the rule can apply. Ask your bank either way, and take a refusal to the Financial Ombudsman Service if you disagree.
France: plainte, THESEE and Info Escroqueries
A French victim files a plainte at a commissariat or a gendarmerie, or online through THESEE, the service reached via the “arnaque sur Internet” section of service-public.gouv.fr. According to Service-Public, THESEE only covers a closed list of cases: ransomware, a hacked mailbox used to contact your friends, phishing, purchases on a fake shopping site or from a fake seller on a classifieds site, and blackmail. A fake investment platform is not on that list, so most crypto investment victims file in person, by letter to the procureur de la République, or by video complaint where that is offered. THESEE is recommended, never compulsory, and police cannot refuse a complaint in person on the ground that it exists. Info Escroqueries, a free line on 0 805 805 817 open Monday to Friday from 9:00 to 18:30, according to the Banque de France, helps victims choose the right channel. Pharos (internet-signalement.gouv.fr) takes reports of illegal content online. The AMF’s Épargne Info Service answers questions on +33 1 53 45 62 00 and publishes blacklists of unauthorised crypto sites.
Italy: Polizia Postale and Consob
In Italy, the formal denuncia is filed in person at a Polizia di Stato office or with the Carabinieri. The Polizia Postale portal commissariatodips.it offers “Segnala online”, but that is a report, not a complaint: the portal itself says it cannot be used to send denunce or querele. An online pre-denuncia exists on denunceonline.poliziadistato.it and in the IO app, with SPID or CIE, for offences including truffa and frode informatica. The police state that it is still in a trial phase, open only at certain offices in Lazio (the questure of Rieti and Frosinone among them), and that it must be formalised within 48 hours at a Polizia di Stato office, by appointment. Consob takes reports on unauthorised platforms and publishes warnings, and it states that it does not handle the recovery of lost money.
The complaint, step by step
- Prepare the evidence folder described above, with every transaction hash and address as text.
- File with the police of your country: IC3 in the US, Report Fraud in the UK, a plainte in France, a denuncia in Italy. Keep the reference number.
- Send that reference, with the hashes and the deposit address, to the support team of any exchange that received the funds, through its official site.
- Report the platform or the promoter to the market regulator: SEC or CFTC, FCA, AMF or Consob, so it can warn others and block sites.
- Give the police reference to your bank if fiat money was involved, and keep a copy of every exchange of messages.
- Answer police requests for more information quickly, and treat any other contact about your case with suspicion.
Recovery scams: the second hit aimed at people already robbed
The list of victims is a valuable asset for criminals. Soon after a loss, many people receive a message from a “lawyer”, a “blockchain forensics firm” or a “government agency” offering to get the money back for an upfront fee. The FBI counted 10,516 complaints about recovery scams in 2025 with about $1.4 billion in losses, a figure that can include the original loss that led to the contact, the IC3 report notes.
The FBI warned in June 2024 that people posing as law firms had taken over $9.9 million from crypto scam victims between February 2023 and February 2024. Its public service announcement lists the signs: unsolicited contact on social media or messaging apps, a claim that the FBI or another agency passed on your case, a fee to pay first and the rest after recovery, requests for bank details to “verify” you, and demands for back taxes before funds are released. Its central line is simple: “Law enforcement does not charge victims a fee for investigating crimes.”
The same tactic exists in Europe. The French AMF warned on 3 February 2025 that people were calling scam victims while posing as AMF staff, and stated that it never contacts savers by phone on its own initiative and offers no procedure to recover stolen funds. Consob warned on 15 December 2025 about fake emails, most sent from addresses that use its name, that ask for money to recover past losses or release crypto held in foreign wallets. The FCA’s name for the people behind these offers is “recovery room” scammers.
A real lawyer can do real things: apply to a court, send disclosure requests to an exchange, act for a group of victims. A real lawyer does not guarantee a result, does not contact you first after finding your name on a “list”, does not ask for payment in crypto or gift cards, and does not need your seed phrase. No one needs your seed phrase. Victims of pig butchering and romance scams are targeted most, because the scammers already know how much they lost and how to reach them.
Civil routes and the limits of what money comes back
When the sum is large and the money sits at an identifiable exchange, a civil claim can work, at a cost. English courts have shown the way. In Mr Dollar Bill Ltd v Persons Unknown ([2021] EWHC 2718 (Ch)), a company that had put £150,000 into a fake platform obtained an injunction against the unknown fraudsters, permission to serve them by email, and disclosure orders against Binance and Huobi to identify the holders of the receiving accounts, Addleshaw Goddard summarised. US courts allow similar suits against “John Doe” defendants. These cases need lawyers, court fees and, often, a guarantee for damages: for a loss of a few thousand dollars, the cost is usually higher than the sum at stake.
Bankruptcy repayments are a different story, and they are often confused with recovery. Customers of Mt. Gox, the exchange that failed in 2014, are still waiting for the last payouts: the trustee moved the repayment deadline to 31 October 2027, as we reported on 19 October 2026. FTX creditors received distributions from a bankruptcy estate. Those are claims on a failed company that kept customer assets, not a route for scam victims, whose money went to criminals with no estate to share.
No public body publishes a recovery rate for individual crypto scam victims. The numbers that exist describe freezes, not refunds.
| Item | Figure | Date | Source |
|---|---|---|---|
| US crypto-related complaints to IC3 | 181,565; losses about $11.37 billion | Year 2025 | FBI IC3 report, April 2026 |
| US crypto investment fraud losses | about $7.23 billion | Year 2025 | FBI IC3 report |
| US recovery scam complaints | 10,516; about $1.4 billion | Year 2025 | FBI IC3 report |
| Bank fraud funds frozen by IC3’s Recovery Asset Team | about $679 million (58% success rate) | Year 2025 | FBI IC3 report |
| Bybit theft: traceable / gone dark / frozen | 68.6% / 27.6% / 3.8% | 21 April 2025 | Ben Zhou, via Cointelegraph |
| Tether cumulative freezes | more than $4.4 billion | 23 April 2026 | Tether, via The Block |
| US Scam Center Strike Force, crypto restrained | about $938 million | Page updated 15 October 2026 | US Attorney’s Office, D.C. |
| Losses to fake law firms | over $9.9 million | Feb 2023 to Feb 2024 | FBI IC3 PSA, June 2024 |
Read the table from the victim’s side. Losses are counted in billions and freezes in hundreds of millions, but nobody publishes the share that has reached individual people. Taxes on a theft loss are a separate topic, left to a later lesson.
What to expect after you file
Expect silence. Most reports get an acknowledgement and no follow-up, because police smart contract holding reserves of two or more tokens, supplied by users, that a decentralized exchange uses to execute trades automatically at a price set by a formula.">pool cases and work on the networks that receive the largest flows. A call or email months later can mean your case joined a larger one, or that a seizure is going ahead. In the US, forfeited money reaches victims through a remission or restitution process, and victims are contacted as part of it. Check any such message by contacting the agency through its official website before you reply.
Keep your evidence folder for years. The Bitfinex case shows that a trail can pay off long after the theft: about 119,754 bitcoins were stolen from the exchange in 2016, and in February 2022 the US Justice Department seized more than 94,000 of them, after agents found the private keys in files held in a suspect’s online account, The Block reported. Five and a half years passed between the hack and the seizure. Meanwhile, protect what you still own: a hardware wallet, a seed phrase that never touches a screen, and a habit of checking every address before you send. Our page on self-custody sums up what owning your keys means, and what it costs when they leak.
