Crypto account or wallet hacked? What to do in the first hour, and after

You open your exchange app and the balance is gone. Or your wallet shows a transfer you didn’t make. Or you get an email saying your password was changed. When crypto is involved, minutes matter, because transfers can’t be reversed and stolen funds move quickly.

This guide sets out what to do, in order, for the two main situations: a compromised platform account (an exchange or app that holds your crypto) and a compromised self-custody wallet (where you hold the keys).

Signs you’ve been hacked

The UK’s National Cyber Security Centre (NCSC) lists warning signs to look for:

• you can’t log in to your accounts;
• security settings have changed, such as a new phone number or email for recovery;
• messages or notifications sent from your account that you don’t recognize;
• logins or attempted logins from strange locations or at unusual times;
• unauthorized transfers or purchases.

First: which kind of hack is it?

• Platform account: someone has logged into your exchange or app account, often by stealing your password, a one-time code or your email access. The platform may be able to freeze the account or stop withdrawals.
• Self-custody wallet: someone has your seed phrase or private key, or tricked you into signing a malicious transaction. No company can freeze it, and anyone with the key can move the funds. NIST notes that if a private key is stolen, the attacker has full access to the assets it controls. See public keys, private keys and addresses.

If your exchange or app account is compromised

Work through these steps quickly:

1. Contact the platform through its official website or app, not a number from a search ad or a message. Ask it to freeze the account and any pending withdrawals. The NCSC suggests going to the provider’s website and following its account recovery process.

2. Secure your email first. If your email was hacked, the attacker can reset everything else. The NCSC warns that criminals often set up email forwarding rules so they get a copy of your emails, including password resets. Check and remove any you don’t recognize.

3. Change passwords, starting with your email and the hacked account, then any other account that used the same password.

4. Log out all devices and apps from the account, so anyone still logged in has to enter the new password.

5. Turn on two-step verification, ideally with an authenticator app or security key rather than text messages. See SIM swap attacks and two-factor authentication.

6. Update your devices and apps, and run a security scan if you suspect malware.

7. Check linked accounts: your bank, cards and other platforms, for unusual activity.

8. Warn your contacts. The NCSC suggests telling friends and followers that you were hacked, so they treat recent messages from your account with suspicion.

If you can’t recover the account, the NCSC says you may have to open a new one, and let your contacts know which account is genuine.

The FBI also advises asking your financial institution for a recall or reversal as soon as fraud is recognized, in case money left by bank transfer or card.

If your self-custody wallet is compromised

Changing a password won’t help here: whoever has the seed phrase has the wallet.

1. Move what’s left to a new wallet with a new seed phrase, created on a device you trust. Do it as soon as possible.
2. Revoke token approvals on the old wallet if anything remains. ethereum.org explains how to check and revoke approvals that let contracts spend your tokens. See token approvals and how to revoke them.
3. Never reuse the old seed phrase. Treat it as permanently exposed.
4. Work out how it happened, so it doesn’t happen again: a fake app, a phishing site, a seed phrase stored in photos or cloud notes, malware or a “support” agent who asked for it. See seed phrase security and fake crypto apps and phishing.

If your identity documents were exposed

Exchanges hold copies of your ID and selfies from identity checks. If an attacker got into your account, assume they may have seen them. In the US, the FTC explains two free tools:

IdentityTheft.gov gives a step-by-step recovery plan. Outside the US, ask your bank what protection is available and watch your statements closely.

Report it

Reporting helps investigators and, occasionally, helps freeze funds.

• US: file a complaint at ic3.gov. The FBI suggests including the words “Account Takeover” in the description, and notifying the company that was impersonated about how you were targeted. The FTC also lists ReportFraud.ftc.gov and the exchange you used.
• UK: the NCSC says to tell your bank if you’ve lost money and report it to Report Fraud (in Scotland, Police Scotland on 101).
• Canada: the Canadian Anti-Fraud Centre and your local police.

Collect the evidence: transaction IDs, wallet addresses, dates and times, emails and screenshots. See crypto scams and where to report them.

How account takeovers usually start

In a November 2025 warning, the FBI said it had received more than 5,100 account takeover complaints since January 2025, with losses exceeding $262 million. Criminals typically:

• impersonate a bank’s or platform’s staff, customer support or tech support, by phone, text or email, to get your login details, including MFA or one-time codes; or
• use phishing websites that look like the real login page, sometimes reached through search engine results or ads.

The FBI adds that stolen funds are often moved quickly into accounts linked to crypto wallets, making them hard to trace and recover.

Don’t get hit twice

After a hack, scammers often reach out offering to recover your crypto, posing as investigators, lawyers or even the platform. Don’t pay anyone to recover funds. See crypto recovery scams.

Prevention checklist

• Use unique, complex passwords and a password manager.
• Turn on two-factor authentication everywhere, preferably with an authenticator app or security key.
• Bookmark login pages instead of clicking search results or ads, as the FBI recommends.
• Be suspicious of unexpected calls from “support” staff. Hang up and call the official number.
• Never share a one-time code or your seed phrase with anyone.
• Keep long-term holdings in a wallet that never connects to new apps. See hot vs cold wallets.