How to Recover a Hacked Crypto Account
What to do in the first hour after a crypto account or wallet is hacked: lock things down, move funds, contact the platform, report it and avoid recovery scams.
If you have a hacked crypto account, act in this order: secure your email and phone, ask the exchange to freeze the account, move remaining funds from compromised wallets, revoke approvals, document everything and report the theft. Speed matters, because attackers move funds within minutes and blockchain transfers cannot be reversed.
First, work out what was compromised
Different breaches need different responses. Use whichever rows match what you are seeing.
Figure: The order of actions after a hack.
| What you notice | Likely compromise | Most urgent action |
|---|---|---|
| Password reset emails you did not request; phone shows no service | Email or phone number | Secure email from a trusted device; call your carrier |
| Exchange login alerts, new withdrawal addresses or API keys | Exchange account | Contact the exchange to freeze the account |
| Funds leave a self-custody wallet without your approval | Seed phrase or private key | Move what remains to a new wallet with a new phrase |
| Tokens disappear after you used a website | A malicious approval or signature | Revoke approvals and move remaining tokens |
More than one row can apply. Email compromise often leads to exchange compromise. If you are unsure where to begin, start with your email account: it is the key to almost every other account, and securing it first stops the attacker from resetting the rest while you work. Keep a short note of the time of each step.
Secure email and phone
Most account takeovers run through email resets or SMS codes. From a device you trust, change your email password, sign out all other sessions and check for new forwarding rules or recovery addresses the attacker may have added. Switch two-factor authentication to an authenticator app or security key. If your phone lost service unexpectedly, call your carrier from another phone and ask them to reverse any SIM change and lock the number. See what a SIM swap attack is.
Freeze the exchange account
Use only the exchange’s official website or app to contact support, and ask for the account to be frozen. Exchanges can sometimes stop withdrawals that are still pending or flag the destination addresses if told quickly. Once you regain control, remove any withdrawal addresses, API keys and devices you do not recognize, and turn on a withdrawal whitelist.
Rescue what is left in a self-custody wallet
If your seed phrase may have been seen, the wallet is permanently unsafe. Create a new wallet with a new phrase, ideally on a different device, and move everything that remains. Do not reuse the old phrase or import it anywhere. Attackers sometimes leave small amounts behind and run bots that sweep any new deposit instantly, so do not send funds back into the old wallet to pay fees; move fee money only to the new one.
Revoke approvals after a bad signature
If tokens disappeared after you used a website, the attacker probably holds a token approval or signed permission. Use an approval checker on a block explorer to find and revoke permissions for unknown spenders, then move the remaining tokens to a fresh wallet. Revoking stops future use of a permission; it cannot pull back funds already taken. See what a wallet drainer is.
Document everything
Record transaction hashes, addresses, dates, amounts, the website or message involved and screenshots of anything relevant. A clear record helps exchanges decide whether to freeze funds that reach them, helps investigators connect cases and may be needed for tax or insurance purposes. See what a blockchain explorer is.
Report the theft
Report to your local police and, in the United States, to the FBI’s Internet Crime Complaint Center at ic3.gov. Tell the exchanges where the stolen funds were sent; if the funds are still sitting there, they may be able to freeze them. Reports matter even when recovery is unlikely, because they help authorities follow the same attackers across many victims.
Beware recovery scams
Victims are often contacted within days by “recovery experts,” “blockchain investigators” or people claiming to work with law enforcement. They promise to trace and return funds for an upfront fee, and some fake official documents. Real authorities do not charge victims, and no one can guarantee recovery of crypto sent on a blockchain. Treat every unsolicited offer as a scam, and never share your new seed phrase, passwords or identity documents with anyone who contacts you about the theft. See crypto scam warning signs.
Preparing now makes recovery faster
Most of the time lost after a hack goes into finding things: the exchange’s real support page, backup codes, the list of accounts tied to an email address. A little preparation shortens that scramble. Bookmark the official support pages of the exchanges you use, keep two-factor backup codes offline, write down which accounts use which email address and phone number, and keep your carrier’s fraud contact number somewhere other than your phone. Knowing in advance which accounts to secure first means the first minutes go into action rather than searching.
After the dust settles
Find out how the attacker got in, whether a reused password, an SMS code, a fake website or an exposed seed phrase, and close that specific gap. Then review the rest of your setup: unique passwords in a password manager, strong two-factor authentication, an offline seed phrase backup and a separate wallet for connecting to new apps. For daily habits, read how to build a crypto security routine, and for the beliefs that make attacks easier, see crypto security myths.
Frequently asked questions
Can an exchange reverse a withdrawal the hacker made?
Not once it has been confirmed on the blockchain. An exchange can stop withdrawals that are still pending and may freeze funds that arrive at its own platform. That is why contacting the exchange immediately matters.
Should I pay a ransom or deal with the hacker?
Generally no. Payments rarely lead to returned funds and can expose you to further demands. Report any contact from the attacker to the police and keep a record of it.
This article is educational content and does not constitute financial, investment, legal or tax advice. Digital assets are volatile and you may lose the amount you invest.