Contain the incident first
If assets left without your consent, stop connecting the compromised wallet to new sites and do not sign more transactions. Prepare a new wallet on a clean device for any remaining assets, after reviewing outstanding permissions.
- Never share a seed phrase, private key, or password.
- Do not pay unknown “recovery agents” to unlock funds.
- Preserve the wallet address and first suspicious transaction hash.
Preserve blockchain evidence
Public blockchain records cannot be deleted, but an attacker may rapidly move assets through several addresses. Save the original hash, time, amount, asset, network, and destination. Screenshots provide context; on-chain records remain the core evidence.
Trace the route
A short scan confirms what happened in the first transaction. Full tracing follows later transfers, intermediate wallets, and possible destinations. If funds reach a centralized service, a clear timeline and direct transaction links may support a report.
Prepare official reports
Exchanges usually require the registered account holder to contact support from the verified email address. An analyst can prepare the message and evidence, but the customer submits it. A law-enforcement report may need the timeline, addresses, hashes, amounts, and the circumstances of the theft.