A confirmed crypto transfer usually cannot be reversed by you or your wallet provider. But you may still be able to protect funds that remain, secure a compromised exchange account, or help an exchange or law-enforcement agency trace and hold assets. Act quickly: stop paying, secure what is left, preserve evidence, and report through official channels. Recovery is possible in limited cases, not guaranteed.
First, identify what happened
Your next step depends on whether someone got your recovery phrase, tricked you into approving a transaction, took over an exchange account, or simply received a transfer you authorized. Use this table to choose the urgent action.
| What happened | Act now | What recovery may mean |
|---|---|---|
| You clicked a link but did not connect a wallet, sign, or enter information | Do not revisit the link. Secure the device and any accounts whose credentials you entered, and save the message. | If nothing was disclosed or authorized, funds may not have been exposed. |
| You connected a wallet to a suspicious site | Disconnect it, check and revoke unwanted token approvals, and move remaining assets to a new wallet if you are unsure what you authorized. | You may protect assets not yet taken; a completed theft generally cannot be reversed. |
| You signed an unfamiliar approval or Permit message | Review and revoke the associated approval promptly. If the phrase or private key may also be exposed, treat the wallet as compromised and move remaining assets. | Removing a permission may prevent a later transfer if funds have not already been moved. |
| You entered or shared a recovery phrase or private key | Use a clean device to create a wallet with a newly generated phrase, then transfer any remaining assets. Stop using the old wallet. | Funds already transferred are generally not recoverable through the wallet provider. |
| You sent crypto to a scammer or a wrong address | Save the transaction details and contact the exchange you used, if any. Report promptly. | Recovery is difficult; an exchange or law enforcement may sometimes intervene if funds reach an identifiable, cooperative intermediary. |
| Your exchange account was taken over | Contact the exchange through its official app or manually entered website. Secure your email and phone account, too. | The exchange may be able to lock access or withdrawals and investigate, depending on timing and its policies. |
| You installed a fake wallet or other suspicious software | Stop using that device for wallet recovery. Use a clean device, remove suspicious software, and change exposed passwords. | Securing the device is essential to prevent further access; it does not reverse transactions already confirmed. |
If a scammer is demanding money to release a balance, stop paying. Claims that funds are waiting behind a tax, gas, verification, or unlock fee are a common continuation of the scam.
What to do in the first 10 minutes
Stop contact and payments
- Do not send more crypto or pay an alleged recovery, tax, gas, bond, lawyer, or processing fee.
- Do not click additional links, call numbers in the message, or give anyone a password, one-time code, private key, or recovery phrase.
- Do not install remote-access software at a caller’s request or send crypto to a new address for supposed safekeeping.
The FBI advises victims to stop sending money and warns that recovery offers can be a second scam (IC3 warning on cryptocurrency recovery scams).
#1 Best Overall
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
If your recovery phrase or private key was exposed
Create a new wallet with a newly generated recovery phrase on a clean device, then transfer any assets that remain. Do not import the exposed phrase into another app and mistake that for a new wallet: anyone who has the old phrase can still control its addresses. Stop using the compromised wallet. MetaMask and Phantom both advise treating exposed recovery phrases as a serious compromise (MetaMask compromised-wallet guidance; Phantom scam guidance).
If you only connected a site or signed an approval
Disconnect unfamiliar apps, then separately review and revoke unwanted token approvals using the wallet’s official tools or a reputable approval checker such as Revoke.cash. Disconnecting a site does not necessarily remove permissions it already obtained. Coinbase also distinguishes connected dApps from token approvals in its wallet permissions guidance.
A token approval can allow a contract to move specified tokens. Some signature-phishing attacks, including Permit2-style approvals, may authorize a later transfer without an obvious immediate outgoing transaction; see MetaMask’s signature-phishing guidance. Revoking a permission can reduce future risk, but it does not return assets already transferred and cannot secure a wallet whose phrase or private key was exposed.
If incoming funds disappear as soon as you add gas
That pattern may indicate an automated sweeper controlling the wallet. Do not keep sending gas to the address. Revoke.cash notes that revoking approvals will not solve a compromised-seed problem (Revoke.cash security guidance). Abandon the wallet and keep its address and transaction history for your report.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallRank #2
- Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
Secure your device and accounts
Use a clean device for recovery
If you entered a phrase or password on a suspicious page or installed a fake wallet extension, do not use that device to create a replacement wallet or enter its new phrase. Use a separate trusted device where possible. Remove unfamiliar apps and browser extensions and run a reputable malware scan. Phantom lists malware, malicious extensions, fake wallet extensions, and unsafe phrase storage among common compromise routes (Phantom guidance).
Secure email before other accounts
- From a clean device, change your email password to a unique one.
- Sign out other sessions and remove unfamiliar recovery addresses, phone numbers, forwarding rules, filters, app passwords, and third-party access.
- Turn on two-factor authentication with an authenticator app or hardware security key where available.
- Change any reused passwords on exchange and financial accounts.
Check your mobile account
Contact your carrier if your number may have been targeted. Ask about recent SIM or number-porting changes, add or strengthen an account PIN, and ask whether number transfers can be restricted. If you regain an exchange account that relied on SMS codes, move to a stronger available authentication method.
Contact your exchange and financial institution
Use the official app or type the provider’s known web address yourself. Ask the exchange to secure the account, review recent activity, and freeze or flag withdrawals if possible. Provide the transaction hash, recipient address, asset, amount, time, account details, and scam messages. Do not use a support number or link supplied by the scammer. The FBI warns about fake exchange-support contacts that use urgency and request login information (IC3 exchange-impersonation alert).
Call your bank or card issuer if you bought crypto with a card, sent a bank transfer or wire, paid directly from a bank account, shared account credentials, or gave a scammer banking details. Ask about its fraud process, account protection, and whether a payment can be stopped or recalled. The CFTC’s consumer guidance advises contacting your bank or credit union if you gave banking information to a fraudster. A bank’s options depend on payment type and circumstances; a payment you authorized after deception may be treated differently from an unauthorized transaction.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Rank #3
- Secure element (EAL6+ certified) and passphrase protection for bullet-proof physical security
- Two-button pad device interface, designed for user-friendly operation
- Bright OLED display for easy & secure hands-on verification
- PIN & passphrase enabled for on-device protection
- Fully open-source design for transparent security
Preserve evidence before deleting anything
Save a copy of the evidence in a secure folder. Do not revisit the phishing page just to collect details.
- Messages, emails, phone numbers, usernames, social profiles, ads, and the date and method of first contact.
- The phishing URL and screenshots of the page or account, if already available.
- Wallet addresses involved, transaction IDs or hashes, network, asset, amount, and date and time.
- Exchange emails, support-ticket numbers, and bank, card, wire, or ATM receipts.
- Device, browser, and wallet-app details; keep suspicious files only if doing so is safe.
A wallet address identifies a blockchain account; a transaction hash or ID identifies one particular transfer; the network identifies the blockchain, such as Ethereum, Bitcoin, Solana, Base, Polygon, or BNB Chain. Include all three where possible. The FBI lists transaction details it needs for cryptocurrency complaints in its cryptocurrency investment fraud guidance and describes address and transaction-hash formats in its IC3 cryptocurrency information.
Report the incident to the right places
File with the FBI’s Internet Crime Complaint Center
Submit a complaint at IC3.gov as soon as practical. Include the addresses, transaction hashes, network, asset, amount, timestamps, and how the scammer contacted you. A report creates an investigative record and may support tracing or recovery efforts, but it does not guarantee reimbursement. For an active threat, extortion, or significant loss, you can also find an FBI field office through the official office directory.
Choose other reporting routes based on the facts
- FTC: Report fraud at ReportFraud.ftc.gov. The FTC also recommends reporting crypto scams to IC3 and the exchange used (FTC cryptocurrency scam guidance).
- CFTC: Use the CFTC complaint process when the matter involves commodities, derivatives, trading claims, or a platform presenting itself as a trading service.
- SEC: Use the SEC tip, complaint, and referral system for an investment offering, securities claims, an investment adviser, or suspected securities-related fraud.
- Local police and state authorities: Consider a local report for identity theft, threats, bank fraud, or documentation needs. State securities regulators or an attorney general may be relevant when an investment platform targeted residents of your state.
Not every crypto theft is a securities or commodities case. Report to the agencies that fit what actually happened, as well as the exchange and bank involved.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #4
- UNPARALLELED SECURITY: Protect your assets with Trezor Safe 5's NDA-free EAL 6+ Secure Element, offering robust defense and complete transparency.
- EFFORTLESS NAVIGATION: Experience seamless crypto management with the vibrant color touchscreen, designed for intuitive and user-friendly interactions.
- ENHANCED USER EXPERIENCE: Enjoy tactile confirmation with Trezor Touch Haptic Engine, making each interaction precise and engaging.
- SUPPORTS 1000s OF COINS & TOKENS: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet.
- EASY ASSET MANAGEMENT: Monitor and transact seamlessly with Trezor Suite, our user-friendly desktop and mobile app
If you are 60 or older, IC3 lists the National Elder Fraud Hotline at 833-372-8311 as an additional resource (IC3 cryptocurrency information).
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.When crypto might be recovered
An exchange may be able to hold funds
If stolen assets reach a centralized exchange, its compliance team may be able to identify or restrict an account. This is not automatic. Timing, a clear transaction trail, evidence, the exchange’s procedures, applicable law, and whether the funds are still there all matter. Contact the exchange quickly and provide a report number when you have one.
Law enforcement may trace or seize assets
Public blockchains can show transaction paths, and that visibility may help investigators connect funds to an exchange or service. It does not identify every person behind an address or make the funds recoverable by itself. Bridges, mixers, decentralized services, foreign platforms, and rapid conversion can complicate tracing. The FBI’s Operation Level Up information describes investigative and victim-support work, but no agency can promise a particular victim repayment. A seizure or return may require legal process and can take time or result in only partial recovery.
Bank or issuer action is case-specific
A bank may investigate or attempt to recall a wire, block unauthorized activity, secure an account, or replace a card. Some stablecoin issuers may have compliance or freezing powers in specific circumstances. Neither is a general crypto reversal mechanism: outcomes depend on the payment method, asset, issuer, timing, and legal or operational authority. Contact any relevant provider only through its official channel.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Best Value
- All your digital assets in one place. You can manage thousands of crypto including Bitcoin, Ethereum, Solana, Tether and more.
- Defend your identity against hackers: secure your online accounts with passwordless, hardware backed, 2FA logins for all your favorite apps and websites.
- Connectivity: USB-C cable connection only. No Bluetooth.Compatible with the Ledger Wallet crypto app, both desktop (Windows, macOS, Linux) and mobile (Android only). Not compatible with iOS.
- Protect your digital assets with the industry's best security: keep your private keys offline in your private signer, battle-tested by the Donjon's white hat hackers, CC EAL 6+ certified Secure Element, constantly updated Ledger OS.
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
Recognize a recovery scam
Do not pay anyone who promises guaranteed recovery or asks for a phrase, private key, remote access, or an advance payment. After a theft, scammers may pose as wallet support, an exchange, an investigator, a lawyer, or law enforcement and claim they found your funds. They may ask for a release fee, tax, gas, or another transfer. The FBI says it does not ask victims to pay money to recover funds. Verify any claimed agency contact independently through its official government website; never rely on the number or link provided in a message.
IC3 warns that recovery offers can target previous victims (IC3 recovery-scam alert; IC3 cryptocurrency information). Fake investment dashboards may display profits that cannot actually be withdrawn; do not pay a fee to unlock them.
After the immediate risk is contained
- Retire any wallet whose phrase or private key was exposed; a new wallet must have a new phrase.
- Review browser extensions and connected apps, and limit token approvals to what you need.
- Use unique passwords and stronger available authentication for email, exchanges, and financial accounts.
- Keep long-term holdings separate from wallets used to connect to unfamiliar dApps.
- Review transaction details before signing. A hardware wallet can improve private-key storage but cannot undo a confirmed transfer or stop you from approving a deceptive transaction.
Do not buy a security product as a supposed recovery service. Tools and devices can help reduce future risk, but none guarantees that stolen crypto can be returned.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
