My Crypto Was Stolen: What Information to Collect Before Asking for Help

When crypto is stolen, the first instinct is often to search for someone who can get it back. That is a natural reaction, but before contacting an exchange, investigator, recovery team, law enforcement, or wallet provider, there is a more immediate and useful step: preserving the information you already have.

Think of it this way: if your physical wallet was stolen and you called the police, the first thing they would ask is where it happened, when, what was inside, and whether you saw who took it. A stolen crypto case works the same way. The people who can actually help—whether that is exchange support, a blockchain investigator, a wallet provider, or law enforcement—all need the same basic inputs: transaction IDs, wallet addresses, screenshots, communication history, platform details, and a clear account of what happened. Without these, a review takes longer, costs more, and may reach fewer conclusions. With them, the case can be assessed faster and more accurately.

If you are new to crypto and some of these terms sound unfamiliar, do not worry. Each section below explains what you are looking for in plain language and where to find it. You do not need to be a technical expert to collect this information—most of it is already sitting in your wallet app, exchange account, or phone messages.

This article does not promise to return stolen funds. It explains what information to collect before asking for help, so that when you do reach out, you have a usable case package rather than scattered memories and deleted messages.

First Steps: Do Not Make the Case Worse

In the hours after a crypto theft, panic can lead to actions that make recovery harder. Before doing anything else, stop and do not do the following.

1. Do not send more crypto to “unlock” your funds. If a platform or person tells you that you need to deposit more money to release what you already sent, that is not how legitimate crypto withdrawals work—it is the continuation of the scam. Do not pay any “tax,” “verification fee,” “gas fee,” “recovery fee,” or “withdrawal fee” to the same platform or person. Each extra payment is a new loss, not a step toward recovery.
2. Do not delete chats, emails, screenshots, wallet history, or platform pages, even if they seem embarrassing or unimportant. Evidence you think is irrelevant might be exactly what an investigator needs.
3. Do not share your seed phrase, private key, password, or 2FA code with anyone claiming to help—these are the master keys to your crypto, and no legitimate helper needs them.
4. Do not install remote access apps suggested by “support agents” or “recovery specialists” who reached out to you unsolicited.
5. Do not engage with people in Telegram, Discord, or social media who promise guaranteed recovery—these are almost always secondary scams specifically targeting people who have already lost funds and are desperate for help.

Before asking for help, preserve everything you already have. Even messy, incomplete evidence is far more useful than deleted evidence. The goal right now is not to solve the case yourself—it is to make sure the information still exists when someone qualified can look at it.

Write a Simple Timeline of What Happened

A timeline is not a legal document and it does not need to be written in formal language. It is a short, honest description of events in the order they happened. Think of it as telling a friend what occurred, starting from the beginning. The goal is to give anyone reviewing the case a clear starting point without having to ask a dozen questions first.

Write down: when the incident happened; when you first noticed the loss (these are sometimes different—you may have sent funds days before realizing something was wrong); whether you sent the funds voluntarily thinking it was a legitimate investment, or whether the wallet was drained without you doing anything; what asset was stolen (Bitcoin, USDT, ETH, and so on); the approximate amount in crypto and roughly in your local currency if you know it; which wallet, exchange, website, app, or person was involved; whether you tried to withdraw funds and were blocked or given excuses; and whether anyone asked for extra payments after the first loss.

A simple example of the kind of summary that is useful: “On June 20, I sent 2,000 USDT TRC20 to an address provided by a fake investment platform. The platform showed a growing balance but refused my withdrawal and asked me to pay a tax fee before releasing funds. I never received anything back.”

You do not need to classify the type of scam, use technical terminology, or identify the criminal. Just describe what you experienced, in the order it happened, with as many specifics as you can provide. A plain, honest account is more useful than a polished but vague one.

Collect Transaction IDs for Every Transfer

A transaction ID—also called a TxID or transaction hash—is the unique identifier of a specific blockchain transfer. Every time crypto moves on a blockchain, the transfer gets permanently recorded with its own unique code, similar to how a bank wire transfer has a reference number. This code is what allows an investigator or blockchain tool to find and analyze the exact transfer—not just any transfer you made, but that specific one, at that specific time, for that specific amount.

For each transaction connected to the incident, try to collect: the TxID or transaction hash (it looks like a long string of random letters and numbers, for example: a1075db55d416d3ca199f55b6084e2115b9345e16c5cf302fc80e9d5fbf5d48d); the blockchain network the transaction was on (Bitcoin, Ethereum, Tron, BNB Chain, and so on—this matters because each network has its own separate transaction history); the asset involved (BTC, ETH, USDT, and so on); the amount; the date and time; the sending wallet or exchange; and the receiving address, if visible.

If there were multiple transfers—for example, an initial deposit, then extra payments for “tax” or “fees,” and then perhaps a “recovery payment”—collect the TxID for each one separately. Cases with multiple transactions are harder to review when only one transfer is documented. Without a TxID the case is harder to assess, but it is not impossible.

Save the Wallet Addresses You Can See

A wallet address is a string of letters and numbers that identifies where crypto is sent or received—think of it as the equivalent of a bank account number, but for a specific blockchain. You do not need to know who owns an address or which exchange it belongs to. That analysis is part of a blockchain investigation, not something a victim is expected to do. Your job is simply to save every address that appears anywhere in connection with the incident.

Save: your own wallet address (the address you sent from, or the address that was drained); the recipient address where funds were sent; any address shown in your wallet or exchange transaction history connected to the incident; any address sent to you by the scammer in chat, email, or invoice; deposit addresses from the suspicious platform—whether it was a fake exchange, a fake investment platform, or any other service; links to blockchain explorer pages if you have them (a blockchain explorer is a public website like Etherscan or Blockchain.com where you can look up any transaction by its TxID or wallet address); and any label already shown by your wallet, exchange, or explorer next to an address.

If an address already has a label visible in your wallet or a block explorer—for example, it might say “Binance” or “Unknown Service” next to it—save that label too. If there is no label, do not try to guess what service it belongs to. Just save the address and the associated TxID. Incorrect assumptions about address ownership can complicate a case rather than help it.

Save Screenshots, Chats, Emails, and Platform Details

Messages With the Scammer or Fake Support

Save the complete conversation history from every channel where communication happened: Telegram, WhatsApp, Discord, Signal, email, social media, or any other platform. If you used multiple apps to communicate with the same person or platform, save all of them—sometimes critical details like wallet addresses or payment instructions appear in only one channel.

What to preserve includes: usernames, handles, phone numbers, and email addresses used by the scammer; wallet addresses sent in messages; links sent by the scammer (save the full URL, not just the display text); payment instructions including exact amounts and addresses; promises of profit or guaranteed returns; pressure messages urging urgency or threatening to close your account; and any request for tax, unlock fee, gas fee, verification payment, or recovery fee. Do not edit, summarize, or selectively delete parts of the conversation. The full history, including the parts that feel embarrassing or irrelevant, is more useful than a curated version.

Screenshots From the Website, App, Wallet, or Exchange

Take and save screenshots of everything you can see in the platform or app connected to the incident. If you are not sure whether something is worth saving, save it anyway—it takes seconds and you can always discard it later, but you cannot recover a screenshot you did not take.

Specifically save: the account dashboard showing your balance; the fake or inflated balance display; the deposit page or deposit instructions; any withdrawal rejection message or error; your transaction history on the platform; your wallet history; any support tickets you opened or support conversation history—including the ticket number if one was assigned; error messages; and any payment or withdrawal instructions shown on screen. Fake platforms often disappear quickly, change their domain, or block victim accounts without warning. Screenshots of what the platform looked like before access was lost can be the only record of what existed.

Website, App, and Account Details

Record and save: the exact website URL including full spelling; the domain name; the app name and version if applicable; your account ID or user ID on the platform; the registration email you used; any fake support contacts or helpline numbers provided by the platform; and screenshots of the platform page itself before it disappears.

The exact URL matters more than it might seem. Fake exchanges and fake investment platforms use domain names that differ from legitimate services by just one character, a hyphen, or a different extension—for example, binnance.com instead of binance.com, or coinbase-pro-trading.io instead of coinbase.com. The precise spelling is essential for any investigation or report because it identifies the specific fraudulent platform rather than a legitimate one with a similar name.

Prepare Proof That the Wallet or Account Belongs to You

Exchange support teams, investigators, and law enforcement may ask you to show that the affected wallet or account is actually yours. This can feel like an odd requirement when you are the victim, but it exists because investigators need to verify they are working with the right person on the right case. It is not a complex technical requirement—it is simply evidence that you had access to and controlled the account before the incident.

What can help establish this: a screenshot from your wallet app showing the address and that you are logged in; a screenshot from your exchange account showing your username, email, or account ID; deposit or withdrawal history from the same wallet or account that predates the incident (showing you used it before); email confirmations from the exchange for previous transactions; purchase records for crypto bought through the same account; bank or card records for crypto purchases if relevant—for example, a bank statement showing a purchase to Coinbase or another exchange; your account ID on the exchange; or simply a written explanation of how you used and controlled the wallet or account, in your own words.

Proof of ownership does not mean sharing your seed phrase, private key, password, or 2FA code. None of these are required and none of them should be shared with anyone, ever, regardless of who is asking.

What You Should Never Share

Victims of crypto theft are frequently targeted a second time by people offering recovery services who then ask for sensitive credentials. This is called a recovery scam, and it is one of the most common secondary scams following a crypto loss. The people running these secondary scams specifically search for victims of crypto theft because they know those people are desperate and may lower their guard.

Never share with anyone, regardless of who they claim to be: your seed phrase (the 12 or 24 words that back up your wallet—whoever has these controls your funds completely); your private key (the technical equivalent of your seed phrase); your wallet backup file; your exchange password; your 2FA code (the six-digit code from your authenticator app); remote access to your device via apps like AnyDesk or TeamViewer; full identity documents in unverified chats; or payments to anyone who guarantees recovery, asks for a “tax,” “unlock fee,” “verification fee,” or “recovery fee” as a condition for returning your funds.

A legitimate blockchain investigator does not need your seed phrase or private key to trace a transaction. Blockchain transaction analysis works from publicly available on-chain data—TxIDs, wallet addresses, and fund flow patterns. This information is visible to anyone on the blockchain and requires no special access to your account. Anyone who says they need your seed phrase to help you is not a legitimate investigator. For a broader overview of what to watch for to avoid being targeted again, the guide on how to avoid crypto scams covers the warning signs and prevention steps.

If you already contacted an exchange, wallet provider, or platform about the incident and opened a support ticket, keep a record of the ticket number and any response you received. This is legitimate documentation that is safe to include in your case summary.

What to Send When You Ask for Help

When you contact an investigator, recovery team, exchange support, wallet provider, or law enforcement, a clear and organized case summary saves time for both sides and avoids the back-and-forth of follow-up questions. You do not need to write a formal report or use legal language. A straightforward summary using the format below is enough for most reviewers to start assessing a case. Copy this structure and fill in what you know. If you do not have one of the items yet, note that it is missing rather than leaving it blank:

• What Happened: A short description of the incident in your own words.
• Date and Time: When the incident occurred and when you noticed the loss.
• Asset and Amount Stolen: Which cryptocurrency and how much.
• Blockchain Network: Bitcoin, Ethereum, Tron, BNB Chain, or whichever network was used.
• Transaction ID(s): TxID or transaction hash for each transfer connected to the incident.
• Your Wallet Address: The address that sent the funds or was drained.
• Recipient or Scammer Address: The address that received the funds.
• Website, App, Platform, or Person Involved: Exact URL, app name, username, or contact details.
• Screenshots and Communication History: Attach everything you have saved.
• Whether You Contacted Exchange or Wallet Support: Note what they said and whether a support ticket was opened.
• Whether You Filed a Police Report: If yes, include the reference number if available.
• Anything Urgent: For example, whether the scammer is still actively requesting more payments.

Do not include seed phrases, private keys, passwords, or 2FA codes anywhere in this message.

When a Self-Serve Trace May Help and When to Ask for Professional Help

Not every stolen crypto case has the same complexity, and the right starting point depends on what you have and what you need.

A self-serve trace can be a useful starting point when you have a TxID and want to see where funds moved, when the case involves a small number of transactions, when you need a visual overview of the fund flow before deciding what to do next, or when you want to understand the basics of what happened before escalating. The AI-powered crypto tracing tool built by AMLBot was designed for this—users who are not blockchain analysts can search a wallet or transaction and get a readable trace result.

The process has 3 steps: you paste your transaction ID and select the blockchain your funds were stolen from; AI Tracer then follows the visible transaction path hop by hop and maps where the funds moved across wallets, bridges, and supported blockchains; and at the end you get a PDF report with the traced transaction path that you can use when filing a police report or contacting an exchange if the funds appear to have reached one.

Professional investigation support is more appropriate when the amount is significant; when there are multiple transactions across several wallets or chains; when the case involves a fake investment platform or a complex scam structure; when you need documentation for exchange escalation, law enforcement, or legal proceedings; or when you are not sure what the transaction data means and need an analyst to interpret it. For cases that need full investigation and escalation support, the crypto recovery service covers what that process involves.

Tracing shows where funds moved. It does not guarantee that funds can be returned. Whether recovery is realistic depends on the specific case details—where funds went, whether they reached an exchange, whether the exchange cooperates, and what timeline has passed.

Common Mistakes That Make a Case Harder to Review

These mistakes come up consistently in stolen crypto cases and each one makes the review slower, less complete, or harder to escalate.

1. Sending only screenshots without any transaction IDs gives a reviewer no way to locate the actual blockchain transfer. A screenshot of a number on a screen is not the same as verifiable blockchain data—it can be manipulated, and without the TxID there is no way to independently confirm the transaction existed.
2. Deleting chats or emails removes context that may be the only record of payment instructions, wallet addresses, or scammer communications. Even if the conversation feels embarrassing, do not delete it. Evidence you are ashamed of is still evidence.
3. Losing the exact website URL makes it harder to identify the fake exchange or fake investment platform, check domain registration history, or match the case to known scam infrastructure. “It was some Binance-looking site” is far less useful than the actual URL.
4. Mixing several separate incidents into one confusing message forces the reviewer to spend time untangling what happened before any analysis can begin. If you were scammed more than once, describe each incident separately with its own timeline, TxIDs, and addresses.
5. Sending more crypto after the first loss is a common reaction when someone is told their existing funds will be released after one more payment. It never works and adds new transactions to document, while confirming ongoing contact with the scammer.
6. Trusting guaranteed recovery offers and sharing credentials with unverified “recovery agents” creates a secondary loss. There are no legitimate recovery services that guarantee results upfront or ask for seed phrases and private keys.
7. Waiting too long before saving evidence is a significant risk. Fake platforms disappear within days or hours of victims raising concerns. Chat accounts get deleted. Blockchain explorer data for older transactions is harder to navigate. The sooner evidence is saved, the more complete the case package will be.

Conclusion

After crypto theft, the most useful first action is not contact dozens of services simultaneously. It is preserving the evidence you already have and organizing it into a case package that someone can actually work with.

A usable case package includes a clear timeline, transaction IDs for every transfer, wallet addresses, the blockchain network and asset, the amount, screenshots, communication history, platform details, and proof that the wallet or account was yours. With this information ready, a review can start faster—whether that is with an exchange, an investigator, law enforcement, or a recovery team.

If you already have a transaction ID and want to see where the funds moved before submitting a case, you can use AI AMLBot Tracer to run a self-serve trace. It follows the transaction path hop by hop across wallets and blockchains and produces a PDF report showing the full fund movement map, useful to have in hand before contacting an exchange or filing a report.

FAQ