Cryptocurrency wallet drained

What this means

Crypto does not have the card-network refund you are used to. The US Federal Trade Commission says that once you pay with cryptocurrency, you can usually get it back only if the person you paid sends it back. The FBI’s Internet Crime Complaint Center says a transfer is irrevocable. No bank sits in the middle to reverse it.

That sounds final. It is final for coins that already moved on the chain. It is not the end of the job if anything is still sitting in the wallet, or if an exchange still holds the account. Those are different problems, and people mix them up while they are panicking.

There is a second scam that starts the hour you post about the loss. The FBI has warned about companies and strangers who promise to recover stolen crypto for an up-front fee. They cannot issue a seizure order. Exchanges freeze accounts on their own rules or when they receive legal process, not because a private “recovery agent” asked nicely.

If someone talked you into sending the coins, also use Scammed or fraudulent bank charge for any normal bank transfer that went with it. The bank path and the chain path are both real, and they do not replace each other.

Warning signs

• The balance dropped, or a transaction you do not recognise is in the wallet history.
• You typed a seed phrase or private key into a website, a “support” chat, or a form.
• A token approval or a signature pop-up appeared on a site you do not trust, and assets moved afterwards.
• An exchange emails you about a new device, a withdrawal, or an API key.
• A stranger offers to get the coins back if you pay them first, or if you install their remote-access software.

Recover now

First 15 minutes

1. Stop sending more coins, including to anyone who says they can reverse the first transfer. The FTC says only the recipient can send crypto back. The FBI says to be wary of recovery services that charge up front, and that law enforcement does not charge a fee to investigate.
2. Write down what you still have. Transaction hashes, amounts, asset names, wallet addresses, the time, and where you sent from. The IC3 says those details are the useful part of a report. Screenshots help. Do this before you click around and lose the screen.
3. Split the situation. Use the row that matches. If two rows match, do the exchange call and the wallet move.

4. If the seed or private key was exposed, do not keep using that wallet. The IC3 describes the private key as the thing that lets someone transmit funds from an address, with an internet connection and no bank in between. A hardware wallet does not fix a seed you already typed into a webpage.
5. If you are not sure the computer is clean, do not create the new wallet on it. Use another phone or computer. Malware that stole the first key will steal the second.

Today

1. Call the exchange, if you used one, from the number or chat inside the app you installed yourself, not from a text that arrived after the theft. Ask whether the withdrawal can be held. Ask them to lock the account, reset the password, and remove API keys and devices you do not recognise.
2. Move any remaining coins from a compromised self-custody wallet to a new wallet whose seed you have never typed into a site. Write the new seed on paper, offline. Do not photograph it.
3. Report it. In the United States, the FTC lists ReportFraud.ftc.gov and the IC3 complaint site. The IC3 also points investment-related cases at the SEC tip form and the CFTC complaint form, depending on what the scheme was. Say plainly if someone promised recovery for a fee. Outside the United States, report it to your local police and to the exchange. A report helps investigations. The FTC says it does not resolve your individual case.
4. Keep the scam conversation. Usernames, wallet addresses they gave you, and the domain of any site you connected the wallet to. Do not keep talking to them.
5. Check whether the same password opened your email. If it did, the exchange is not your only problem. Use Personal email account hacked.

Verify recovery

• The exchange shows the withdrawal as frozen, reversed, or explicitly refused. “We are looking” is not verification.
• Remaining funds are in a new wallet whose seed never touched the old device or the site you connected.
• The old wallet is empty on purpose, or you accept that dust left behind is not worth the risk of touching it again.
• You have the transaction hashes stored outside the wallet app.

After recovery

If the loss is large, talk to a lawyer before you hire anyone private. The FBI’s warning is specific: private recovery companies cannot seize funds, and some of them are the next fraud. A real investigator will not ask you to pay in crypto to “release” your coins.

Prepare now

Keys

• The seed phrase is on paper or metal, not in a photo, a cloud note, or an email draft.
• You have never typed that seed into a website. The wallet’s own app is the only place it belongs, and only when you are restoring.
• A second copy of the seed is somewhere a fire in your house does not destroy both. The second copy is not in the same cloud account as everything else.

Exchanges

• The exchange account has its own password and an app-based second factor, not a code by SMS if the exchange offers an app.
• Withdrawal allow-lists or a delay are on, if the exchange provides them, so a new address cannot be paid instantly.
• The email on the exchange is one you do not use to sign up for random sites.

Practice

• You have restored a small test wallet from a seed once, on a device you control, so the backup is not a theory.
• You know the exchange’s official help URL without using a search ad. Search ads are a common place for fake support.

Common mistakes

• Paying a recovery agent. The FBI says up-front-fee recovery schemes target people who already lost coins. Law enforcement does not charge you to look.
• Creating the replacement wallet on the same infected computer. The new seed leaves the same way the old one did.
• Posting the seed “so someone can check what happened.” The seed is the key. Anyone who has it can finish the job.
• Assuming the exchange can claw a completed on-chain transfer back. Ask them. Also hear “no” if that is the answer. The FTC’s line is that the recipient has to send it back.
• Ignoring a token approval because the big balance already moved. Anything still in that wallet can move next. Get the remainder out to a new wallet rather than hoping the approval expires.

Sources

• FTC: What to know about cryptocurrency and scams
• FTC: What to do if you were scammed (cryptocurrency payments)
• FBI IC3: Cryptocurrency
• FBI IC3: Companies falsely claiming they can recover cryptocurrency
• ReportFraud.ftc.gov