> ## Content Index > Fetch the complete content index at: https://blog.amlbot.com/llms.txt > Use this file to discover other available public pages before exploring further. # How to Report Stolen Crypto to Police and Law Enforcement - URL: https://blog.amlbot.com/report-stolen-crypto-to-police/ - Published: 2026-11-03T18:35:27.000Z - Updated: 2026-11-03T18:35:27.000Z - Author: Andrew Aleksandrov - Tags: AMLBot Academy You did the right thing first. You saved the transaction hashes, the wallet addresses, the screenshots, the chat history, and whatever you know about the platform or person involved. > Now comes the part nobody explains: *where do I send all of this, and what do I actually tell the police?* “My crypto was stolen” is true, and it gives the person who opens your case almost nothing to work with. What helps is turning the incident into a sequence someone else can follow: what happened → when → how much → from which wallet → where the funds went → who or what platform was involved → what evidence exists → what you have already done. The goal of a stolen-crypto police report is not to explain blockchain technology. It is to give law enforcement a clear, verifiable account of the incident. If you have not yet gathered the underlying material, start with [what information to collect after crypto theft](https://blog.amlbot.com/my-crypto-was-stolen-what-information-to-collect/) and come back. For the wider sequence of steps, see [what to do after cryptocurrency is stolen](https://blog.amlbot.com/how-to-recover-stolen-cryptocurrency-5-practical-steps/). ## A Police Report Is Not a Blockchain Investigation Before anything else, it is worth removing a burden most victims put on themselves. You are not required to identify the scammer, prove criminal intent, trace every transaction, identify every wallet, obtain exchange KYC data, establish full attribution, or recover the funds before you report. Your job is to document the incident clearly and provide the most accurate data you already have. Law enforcement then decides whether there are grounds to investigate, what additional information it needs, whether exchanges or custodians should be approached, whether a lawful request is required, and whether coordination with other jurisdictions is necessary. A victim does not need to complete a blockchain investigation before reporting stolen cryptocurrency to law enforcement. The initial report should clearly document what happened and provide the transaction information and evidence already available. ## Where Should You Report Stolen Crypto? There is no single worldwide organization that receives stolen-crypto reports. The channel depends on where you are and what happened. Depending on the country, the right place may be local police, national police, a dedicated cybercrime unit, a national fraud-reporting portal, a financial-crime unit, or another official law-enforcement reporting system. Some countries route all cyber-enabled fraud through one portal; others expect a report at a local station that is then escalated. In the **United States**, for example, victims are directed to the FBI's Internet Crime Complaint Center (IC3) or a local FBI field office. That is a US-specific channel, not a universal instruction—if you are elsewhere, check the official police or national cybercrime reporting channel for your jurisdiction before filing anything. There is no single global police portal for cryptocurrency theft; the correct reporting channel depends on the victim's jurisdiction and the nature of the incident. ## Should You Report the Theft Before or After Tracing the Funds? Do not treat tracing as a prerequisite for the initial report. If you already have the theft transaction, the recipient address, the amount lost, the communications, and the scam website, that is often enough to file a complaint. If tracing has already been done, include it. If an investigation happens later, its findings can go in as supplementary evidence. The sequence that gets victims into trouble is “first hire an investigator, then go to the police.” The better order is: report what you know, preserve the evidence, and add new findings as the case develops. Where funds are still moving, speed can matter, and waiting for a finished professional report can cost the window entirely. A tracing report can strengthen a law-enforcement complaint, but victims should not delay the initial report solely because tracing is incomplete. ## What Should a Crypto Theft Police Report Contain? This is about structure rather than collection. The seven blocks below are an order that works, whether you are filling in an online form or writing a statement at a counter. ## 1\. Start With a Short Incident Summary The first paragraph should let someone understand the case in under a minute: the date you discovered it, the type of incident, the cryptocurrency, the approximate loss, the wallet or platform involved, and whether the funds were left without your authorization or were sent because you were deceived. For unauthorized transfers, something close to: *On \[date\], I discovered that approximately \[amount\] \[asset\] had been transferred from my wallet without my authorization. The transaction originated from \[wallet or platform\] and was sent to \[address, if known\].* For a fraud: *Between \[dates\], I was instructed by \[person or platform\] to send \[amount\] in cryptocurrency as part of an investment scheme. I later discovered that the platform was fraudulent, and I could not withdraw the funds.* Avoid imitation legal language, and avoid labelling anyone a criminal, hacker, or money launderer unless that has actually been established. Describe facts. A useful crypto theft police report should clearly explain what happened, when it happened, how much was lost, which transactions were involved, and what evidence is available. ## 2\. Build a Clear Incident Timeline A police report should separate the victim's incident timeline from the later blockchain fund flow timeline. The timeline is the human story, not the chain history. For example, for a scam: - **June 2** — Initial contact through a messaging app - **June 4** — Account created on website X - **June 7** — First transfer of 5,000 USDT - **June 9** — Second transfer - **June 10** — Withdrawal blocked - **June 11** — Website stopped responding For a wallet compromise: - **10:04 UTC** — Wallet balance normal - **10:11 UTC** — Unauthorised approval transaction - **10:13 UTC** — Assets transferred out You do not need to turn every blockchain hop into a timeline entry. A fund flow schedule can be a separate attachment. A police report should separate the incident timeline from the later blockchain tracing timeline so that investigators can understand both what happened to the victim and how the funds subsequently moved. ## 3\. Add the Key Cryptocurrency Transactions For each relevant transaction, give the blockchain or network, the cryptocurrency or token, the originating wallet, the recipient address, the transaction hash, the amount, the date and time, and the exchange or wallet used where relevant. Transaction hashes and wallet addresses allow law enforcement or forensic investigators to independently locate the relevant blockchain records. That is what makes them the single most valuable thing in the report—everything else is your account; the hash is verifiable by anyone. > If you are not sure where to find one, here is [how to find a crypto transaction hash](https://blog.amlbot.com/how-to-find-txid-transaction-hash/). For the full evidence checklist, the [information-collection guide](https://blog.amlbot.com/my-crypto-was-stolen-what-information-to-collect/) covers it properly. ## 4\. Explain How the Theft or Scam Happened Mechanism matters, because it tells an investigator what kind of case this is: phishing, a fake investment platform, impersonation, a wallet compromise, a malicious token approval, a hacked account, fake support, a romance, or confidence scam, an OTC scam, or something else. If you do not know how it happened, write that. *The cause of the wallet compromise is unknown* is a stronger line than a guess. Do not state that your seed phrase was stolen if nobody has established that. A victim should distinguish what is known about the incident from what is only suspected. ## 5\. Include Communications and Off-Chain Identifiers Blockchain addresses are only one part of a case. The off-chain identifiers are what connect a transaction to a real-world incident: email addresses, phone numbers, messaging usernames, social profiles, domains, websites, app names, company names, payment instructions, and support tickets. Present them as what they are. A messaging username is a lead for investigators to follow, not proof of anyone's identity. ## 6\. State the Total Loss Clearly Do not make an officer add up a dozen transactions. State the total crypto amount, the asset, the number of transfers, and an approximate fiat value if it helps—with the valuation date if you give one. For example, the total *reported loss is 42,000 USDT across three transactions.* If the asset's price has moved since, do not present today's price as the loss on the date of the theft. Say which date your figure uses and leave the valuation methodology to whoever needs it later. ## 7\. Attach Supporting Evidence Without Rewriting the Entire Case Attachments can include screenshots, exchange statements, wallet history, a transaction table, scam communications, receipts, a tracing report, a professional investigation report, and other relevant documents. The main narrative should still read as a narrative. “See 48 screenshots” is not a report. Supporting files should reinforce a clear incident narrative rather than replace it. One practical point on preservation: keep the original files and do not delete, crop, or overwrite anything that might be requested later. Where a case may end up in legal proceedings, [how blockchain evidence should be preserved for legal proceedings](https://blog.amlbot.com/blockchain-evidence-chain-of-custody/) goes into the standards that apply. ## Should You Include a Crypto Tracing Report? If you have one and it is relevant, yes—but label it for what it is. A tracing report can usefully show the transaction path, intermediate addresses, possible exchange endpoints, and cross-chain movement. What it does not do is replace your statement of what happened, and an automated output should never be presented as an official law enforcement conclusion. A tracing report can strengthen a law-enforcement complaint, but it does not replace the victim's account of what happened. If you want an initial transaction analysis to attach, you can [trace stolen crypto with AI Tracer](https://amlbot.com/ai-autotrace?ref=blog.amlbot.com) and submit the resulting report as exactly that. ## Should You Include a Professional Investigation Report? If an investigator has already worked the case, their report can help law enforcement understand the fund flow, attribution, identified endpoints, methodology, stated limitations, and sensible next steps far faster than raw data would. Its limits are equally important. A private report does not replace a police investigation, does not create subpoena power, does not make attribution legally proven, and does not guarantee a freeze. A professional crypto investigation report can help explain technical findings to law enforcement, but it does not replace an official police investigation. A professional investigation report can help explain blockchain findings to law enforcement, but it does not replace the authority or conclusions of an official investigation. ## What Happens After You File the Police Report? This is the part most victims are unprepared for, and it matters more than the filing itself. Keep everything the filing produces: the complaint confirmation, the case number, the incident, or reference number, the name of the officer or investigator if given, the department or agency, the date filed, the contact method, and copies of everything you submitted. Terminology varies by jurisdiction—what one country calls a crime reference number, another calls a complaint ID. Be realistic about what follows. Not every report is assigned to a detective, and not every case is investigated. After filing, preserve the official case or reference number and the contact details of the agency handling the report, because exchanges, investigators, lawyers, or other authorities may request them later. ## Why the Case or Reference Number Matters The reference number is the one artefact that proves to a third party that the incident was formally reported. You may be asked for it when communicating with an exchange, escalating to a custodian, making an insurance claim, having a lawyer review the case, coordinating with an investigator, or submitting supplementary evidence later. What it is not: a freeze order, a subpoena, a court order, or any guarantee that an exchange will act. A police case or reference number documents that the incident was reported; it is not a subpoena, court order, or asset-freeze instruction. A police case number documents that the incident was reported; it does not itself compel an exchange to disclose information or freeze assets. ## Should You Contact the Exchange Before or After Filing a Police Report? There is no single correct order, and anyone who gives you one is oversimplifying. If the stolen funds may have reached an exchange, service provider, or issuer, time can matter—so notifying the relevant service and filing the police report can sensibly happen in parallel. What usually requires more than an email is anything permanent: disclosure, an extended hold, or seizure. Those may need law enforcement contact, a formal request, a court order, or another legal instrument, depending on the platform and jurisdiction. Tracing stolen crypto to an exchange can identify a potential investigative endpoint without proving that the funds remain there or that the exchange will freeze them. Parallel action is usually appropriate: report the crime, preserve the case number, and notify the relevant service when an actionable endpoint has been identified. On the request itself, see [how to request a freeze after stolen crypto reaches an actionable endpoint](https://blog.amlbot.com/how-to-freeze-stolen-crypto/). ## What If the Police Are Not Familiar With Cryptocurrency? A local officer may simply not specialize in blockchain investigations, which is a reason to write the report well rather than a reason to despair. A crypto theft report should be understandable even to an officer who is not a blockchain specialist. In practice that means starting with a clear summary, stating the total loss, identifying the relevant transactions, providing the hashes and addresses, naming the platform or exchange involved, attaching tracing or investigation findings if you have them, and avoiding unexplained jargon. Two questions are worth asking at the counter: how should supplementary evidence be submitted, and is there a specialized cybercrime or financial-crime unit that handles these cases? Both are more productive than arguing about whether the case should be accepted. ## What If the Scam or Exchange Is in Another Country? Crypto cases cross borders by default. You may be in one country, the suspect unknown, the exchange in a second country, the servers in a third, and the funds on a blockchain with no physical location at all. That is not your problem to solve. Start through the reporting channel available to you and provide complete information about the foreign platforms, people, websites, exchanges, or jurisdictions involved. Onward coordination happens through authorized law-enforcement mechanisms—international police cooperation, direct agency-to-agency contact, lawful information requests, and mutual legal assistance where relevant. The fact that an exchange or suspected offender is located abroad does not mean a victim should try to manage international law enforcement cooperation personally. Do not file the same complaint with every country's police force, and do not approach international bodies directly expecting them to take on an individual case. ## Can Law Enforcement Get KYC Information From an Exchange? Potentially, through the appropriate lawful process. As a private victim, you generally cannot demand a customer's identity, login records, IP data, account activity, or withdrawal details simply because your funds reached that exchange. That information is usually protected, and a platform that handed it over on request would be the problem, not the solution. Tracing funds to an exchange can identify a potential investigative endpoint, but obtaining protected account information usually requires the exchange's cooperation and the appropriate lawful process. Obtaining KYC or other protected exchange account information usually requires cooperation from the platform and the appropriate lawful process—and neither a police report nor a case number makes disclosure automatic. ## Can Police Freeze or Recover Stolen Crypto? Depending on the law and the jurisdiction, law enforcement may be able to investigate, request records, coordinate with exchanges, seek preservation, obtain freeze or seizure authority, and support forfeiture or restitution processes. What a police report does not do by itself: reverse a transaction, freeze a self-custody wallet, guarantee an exchange hold, guarantee seizure, or guarantee recovery. Reporting stolen cryptocurrency creates an official record and can support further investigation, but filing a police report does not guarantee recovery of the assets. Reporting stolen cryptocurrency creates an official record and can enable further investigative or legal steps, but filing a report does not itself recover the assets. ## Should You Keep Updating Law Enforcement if the Funds Move? Yes—when the information is materially new and the agency offers a way to supplement the case. Worth reporting: a new exchange endpoint, movement onto a new blockchain, an additional victim transaction, new scam communications, a professional investigation report, funds that started moving again, a response from an exchange, or newly surfaced identity information. Not worth reporting: every individual blockchain hop. Updates should be meaningful and structured, with the existing reference number attached. A stolen-crypto complaint can evolve as new evidence appears; material tracing or investigation findings should be linked back to the original case or reference number where possible. ## When Should You Involve a Professional Crypto Investigator? Professional help tends to become relevant when several chains or many wallets are involved, attribution is uncertain, funds keep moving, an exchange endpoint needs verification, the evidence package is difficult to explain, continued monitoring is required, the police or a lawyer needs technical findings, or the case calls for OSINT work. An investigator can trace, document, monitor, attribute, explain findings, and support communication. An investigator cannot compel an exchange, subpoena KYC data, seize funds, replace the police, or guarantee recovery. Where that line sits, see [when a stolen-crypto case needs professional investigation](https://blog.amlbot.com/when-crypto-tracing-is-not-enough/). For cases that already need it, AMLBot offers [professional crypto investigation and law-enforcement support](https://amlbot.com/reclaim-crypto?ref=blog.amlbot.com). ## Common Mistakes When Reporting Stolen Crypto ### Mistake 1 — Sending Only Screenshots A screenshot without the transaction hash, address, amount, date, and an explanation of what it shows is difficult for anyone to verify. ### Mistake 2 — Writing a Huge Unstructured Story Summary → Timeline → Transactions → Evidence → Attachments. Twelve pages of chronological narration is not a report. ### Mistake 3 — Mixing Facts and Assumptions “This wallet belongs to John Smith,” when what you actually know is “the funds reached an address attributed to Exchange X,” damages your credibility on everything else in the file. ### Mistake 4 — Waiting for a Perfect Investigation Before Reporting The report can be supplemented later. Nothing is gained by holding it back. ### Mistake 5 — Losing the Case Number Save the official reference somewhere; You will still find it in six months. ### Mistake 6 — Giving Away Seed Phrases or Private Keys A normal theft report never requires them. Do not send your seed phrase, private key, wallet password, or 2FA backup codes to police, an exchange, or an investigator. ### Mistake 7 — Paying Someone Who Claims They Can “Hack the Funds Back” This is the second scam that follows the first. Nobody hacks funds back, and anyone promising it is targeting you—see [how to identify fake crypto recovery services](https://blog.amlbot.com/fake-crypto-recovery-services/). ## Simple Police Report Structure for Stolen Crypto This is a practical format to adapt, not an official template—the form you are given may have its own mandatory fields. ### 1\. Victim / Reporter Information Whatever basic contact details the reporting authority requests. ### 2\. Incident Summary Two to five sentences: what happened, when, how much was lost, which asset. ### 3\. Incident Timeline The chronological sequence of events, as above. ### 4\. Cryptocurrency Transactions One entry per transaction, each giving the date and time, blockchain, asset, amount, sending address, receiving address, and transaction hash. A simple list is easier for a non-specialist to read than a dense table and easier to extend later. ### 5\. Scam / Theft Details The website, person, account, wallet compromise, malicious approval, or other mechanism. ### 6\. Communications and Identifiers Emails, phone numbers, usernames, and URLs. ### 7\. Actions Already Taken For example: contacted the exchange, secured the wallet, reported the website, traced the funds, and engaged an investigator. ### 8\. Attachments Screenshots, transaction records, statements, reports. ### 9\. Requested / Relevant Follow-Up Not “I demand you recover my funds.” Something closer to: *I am reporting this incident and can provide additional blockchain or account information if required.* ## What to Do After Filing the Report ### Step 1 — Save the Reference Number Along with every confirmation, the filing was generated. ### Step 2 — Preserve All Original Evidence Do not delete files, chats, or account records, even once they feel resolved. ### Step 3 — Secure Remaining Accounts and Wallets Assume anything connected to the compromise is exposed until proven otherwise. ### Step 4 — Continue Monitoring if Relevant If the stolen funds are still traceable, their next movement may create the endpoint the case needs. ### Step 5 — Update the Case With Material New Evidence Through the official channel, where one exists. ### Step 6 — Notify an Identified Exchange or Service if Appropriate Once there is a genuine actionable endpoint rather than a guess. ### Step 7 — Consider Professional Investigation if the Case Becomes Complex Particularly where monitoring, attribution, or technical explanation is needed. > The logic through all seven: Report → Reference Number → Supplement evidence → Trace or investigate → Escalate actionable findings. ## Conclusion Reporting stolen crypto is not about proving the entire case yourself. It is about giving law enforcement a clear record of what happened, the transactions involved, the available evidence, and any new findings that can support the investigation. > The order that works: Preserve → Organise → Report → Save the case number → Supplement → Escalate when actionable findings appear. If the case turns out to need technical depth that a complaint cannot carry on its own, that is the point to [request a professional crypto investigation](https://amlbot.com/reclaim-crypto?ref=blog.amlbot.com). ## FAQ ### Where Should I Report Stolen Cryptocurrency? There is no single global police portal for cryptocurrency theft; reporting channels depend on jurisdiction. Depending on where you are, a report may go to local police, national police, a cybercrime unit, an official fraud-reporting portal, or another authorized law-enforcement channel. Check your own country's official channel rather than copying another jurisdiction's process. ### What Information Should I Give Police After a Crypto Theft? A useful crypto theft police report should clearly explain what happened, when it happened, how much was lost, which transactions were involved, and what evidence is available. In practice: the incident summary, dates, amount, cryptocurrency, wallet addresses, transaction hashes, communications, the website, or platform, usernames, screenshots, and relevant account records. ### Do I Need to Trace Stolen Crypto Before Filing a Police Report? No. The initial report can be filed on the facts you already have. A tracing report can strengthen a law enforcement complaint, but it does not replace the victim's account of what happened—and it should never be treated as a precondition for reporting. Tracing findings can be added later as supplementary evidence. ### Do I Need a Transaction Hash to Report Stolen Crypto? A transaction hash is extremely useful, because transaction hashes and wallet addresses allow law enforcement or forensic investigators to independently locate the relevant blockchain records. But not having one does not prevent you reporting. Give the most accurate information you have, and supply the transaction details later if you can find them. ### Should I Contact the Police or the Exchange First? There is no universal order. If an actionable exchange endpoint has been identified, speed can matter, so the police report and the exchange notification can proceed in parallel. What the exchange actually does depends on its internal policy and the applicable legal requirements, not on which contact came first. ### What Is a Police Case or Reference Number Used For in a Crypto Theft? It confirms that the incident was formally reported, and an exchange, investigator, lawyer, insurer, or other authority may ask for it. A police case or reference number documents that the incident was reported; it is not a subpoena, court order, or asset-freeze instruction, and it does not oblige any platform to act. ### Can Police Recover Stolen Cryptocurrency? Law enforcement may investigate, request records, and in some cases pursue a freeze or seizure through lawful process. But reporting stolen cryptocurrency creates an official record and can support further investigation, but filing a police report does not guarantee recovery of the assets. Outcomes depend on where the funds went and which jurisdictions are involved. ### What if the Stolen Crypto Reached a Foreign Exchange? Name the exchange and the relevant transactions in your report. The fact that an exchange or suspected offender is abroad does not mean the victim has to manage international law enforcement cooperation personally. Authorities can use the appropriate cooperation mechanisms where a case actually requires cross-border action. ### Can I Add a Crypto Investigation Report to My Police Report? Yes. A professional crypto investigation report can help explain technical findings to law enforcement, but it does not replace an official police investigation. Label it clearly as a private report, and expect its conclusions to be treated as an analysis to be verified rather than as established findings. ### Should I Update Police if the Stolen Crypto Moves Again? Yes, if the information is material and the reporting authority allows case updates. Quote the existing case or reference number and send a structured update: the new transaction, the new endpoint, the new exchange involved, or new investigation findings. Avoid forwarding every individual blockchain movement as it happens.