Wallets & security
After a suspected scam or compromise
Limit further exposure, preserve evidence and establish which authority was lost.
Research articles and reference entries are published in English. Navigation is available in seven languages.
In this article
Stop interacting with the suspicious person or application. Do not send another payment to unlock a withdrawal or prove ownership. If a device may be compromised, use a separate trusted device for account recovery and communication.
Identify the type of exposure
A leaked password, a stolen recovery phrase, an onchain approval and a transfer to the wrong recipient require different responses. A password change cannot revoke a blockchain allowance. Revoking an allowance cannot repair an exposed seed. An already completed transfer may require action by a recipient custodian or law enforcement rather than a wallet setting.
Record the chain, asset, transaction identifiers, addresses, timestamps and the communications that led to the action. Preserve full messages and screenshots, including domains and account identifiers. Avoid publishing personal documents or secrets while asking for help.
Contact the relevant provider through a known channel and report the incident to appropriate authorities. The FBI IC3 resource below is a US reporting route; use your local authorities where applicable. No reporting route guarantees recovery. Be particularly wary of unsolicited recovery offers.
Sources
- FBI IC3: cryptocurrency fraud and reporting
- MASTR: Crypto Survival Guide, four original panels
- SecondFi: official security-incident and impersonation guidance
Research checked 5 September 2026. Historical cases retain the date and legal status of the cited record.