Crypto Wallet or Exchange Account Hacked? What to Do in the First Hour

Finding your crypto gone is a horrible feeling, and the first hour matters. What you should do depends on one question: was the crypto held on an exchange (like Coinbase, Binance or an Indian exchange), or in a wallet you control yourself (like MetaMask or Phantom)? This guide covers both, in the order that protects what’s left, and explains which “recovery” offers to ignore.

First: Exchange Account or Self-Custody Wallet?

If Your Crypto Exchange Account Was Hacked

1. Contact the exchange immediately through its official app or website — not through links in emails, social media or Telegram. Ask them to freeze or disable your account and withdrawals.
2. Secure your email first. Exchanges send password resets to email, so change your email password and turn on two-factor authentication there.
3. Change your exchange password and reset 2FA. Use an authenticator app or security key rather than SMS — see our Google Authenticator guide.
4. Delete API keys you didn’t create (and ideally all of them). Attackers use API keys to trade or withdraw.
5. Check withdrawal addresses. Remove unknown addresses from your whitelist and enable address whitelisting if available.
6. Check your phone number is still yours. If you’ve lost signal unexpectedly, call your carrier — a SIM swap may have been used to bypass SMS codes.
7. Record everything: transaction IDs, times, amounts and destination addresses. You’ll need them for the exchange and police.

If Your Self-Custody Wallet Was Drained

With a self-custody wallet, nobody can freeze or reverse a blockchain transfer. Your goal is to stop further losses.

1. Create a brand-new wallet with a new seed phrase — ideally on a different, clean device or a hardware wallet. Never reuse the compromised seed phrase.
2. Move any remaining funds (including other tokens and NFTs) to the new wallet as quickly as possible.
3. Revoke token approvals on the old wallet using a reputable approval checker such as revoke.cash or your blockchain’s explorer. This stops malicious contracts from moving more tokens — but it can’t recover what’s already gone.
4. Scan the device for malware. Clipboard hijackers and fake wallet extensions are common. If in doubt, reset the device.
5. Record the transaction hashes and the attacker’s addresses from a block explorer.

Report the Theft

• India: call the national cybercrime helpline 1930 or report at cybercrime.gov.in as soon as possible.
• United States: file a report with the FBI’s Internet Crime Complaint Center at ic3.gov.
• UK: report to Action Fraud.
• The exchanges involved: if stolen funds moved to a known exchange, report the destination address and transaction IDs to that exchange’s official support. Exchanges can sometimes freeze stolen funds that land on their platform.

What to Include in Your Report

Police and exchanges can act faster when your report is complete. Gather this before you file:

• Your wallet address or exchange account ID
• Each transaction hash (TXID) for the stolen funds, with date, time and amount
• The destination addresses the funds were sent to
• Screenshots of phishing messages, fake websites, or chats with fake support accounts
• How you think the compromise happened (link clicked, site connected, code shared)
• Any communication with the exchange, including ticket numbers

Keep a copy of everything and note the reference number you get when you file. If you use a crypto tax tool or keep records for tax purposes, save this documentation there too — rules on reporting stolen crypto differ by country, so check with a tax professional.

How Crypto Accounts and Wallets Get Hacked

• Phishing sites that copy an exchange or wallet login page
• Fake airdrops and mint pages that ask you to connect your wallet and sign a malicious approval
• Seed phrase requests from fake support agents on Telegram, Discord or X — real support never asks for it
• SIM swaps to intercept SMS verification codes
• Malware that swaps copied wallet addresses or steals browser extension data — similar to the tricks in our story about a suspicious terminal command
• Reused passwords leaked from other sites

How to Protect Your Crypto From Now On

• Keep long-term holdings in a hardware wallet, not a browser extension or exchange
• Write your seed phrase on paper or metal and never type it into a website or share it — ever
• Use an authenticator app or security key for exchange 2FA, not SMS
• Enable withdrawal address whitelisting and delays on exchanges
• Use a separate “burner” wallet for connecting to new sites and airdrops
• Review and revoke token approvals every few months
• Use a unique password for every exchange, stored in a password manager

What About Getting the Money Back?

Be realistic. Blockchain transactions are generally final, and stolen crypto is often moved quickly through mixers or across chains. Recovery does happen — usually when funds land on a regulated exchange that can freeze them, or when law enforcement traces a larger case — but it’s the exception. Fast reporting gives you the best chance. For exchange-account thefts, the exchange’s own policies and any insurance they offer matter, so ask their support directly what applies to your case.

• Exchange hack: contact official support to freeze withdrawals, then secure email and 2FA
• Wallet drain: new wallet, new seed, move remaining funds, revoke approvals
• Record transaction IDs and report to 1930/cybercrime.gov.in, IC3 or Action Fraud
• Never share your seed phrase and never pay “recovery” services
• Use a hardware wallet and authenticator-app 2FA going forward

Frequently Asked Questions

Can stolen crypto be recovered?

Sometimes, but rarely. It’s most likely if funds reach a regulated exchange that freezes them after a quick report. Blockchain transfers themselves can’t be reversed.

Does revoking token approvals get my money back?

No. Revoking only stops a contract from moving more tokens in future. It doesn’t return tokens that were already taken.

Should I keep using my old wallet?

No. Treat a drained wallet’s seed phrase as permanently compromised. Create a new wallet with a new seed and move everything.

How do I know if a crypto support account is real?

Only use support reached from the exchange’s official app or the website address you type yourself. Real support staff won’t DM you first on Telegram, Discord or X, and will never ask for your seed phrase, private key or 2FA codes.

Should I use a hardware wallet?

For anything you’d be upset to lose, yes. A hardware wallet keeps your private keys off your computer and phone, so malware and fake sites can’t grab them, and every transaction needs a physical confirmation.

Will my exchange refund stolen funds?

It depends on the exchange, how the account was compromised and the jurisdiction. Contact official support quickly and ask what their policy is for your situation.

The Bottom Line

With crypto, speed and the right order matter: freeze what can be frozen, move what’s left to safety, document everything, and report it. Then rebuild with a hardware wallet and stronger 2FA. And ignore anyone who contacts you promising to get your coins back for a fee. For other account takeovers, see our guides to Google accounts and WhatsApp, and if you’re in India, how UPI scams work.

Last updated: October 17, 2026. This is general security guidance, not legal or financial advice. Sources: Revoke.cash, FBI IC3, National Cyber Crime Reporting Portal (India).