What to Do in the First 24 Hours After a Crypto Scam

If you’ve just been scammed through cryptocurrency, the first 24 hours are the most important. Acting quickly can help secure whatever assets you have left, preserve the evidence investigators will need, alert exchanges before funds move further down the chain, and improve the odds of a successful investigation. This guide gives you that sequence: what to do first, what to do next, and what not to do, in the order that actually protects you.

Key takeaways:

• Stop all contact with the scammer and never send another “release” or “tax” payment, that request is the scam
• Move remaining funds to a new wallet and revoke token approvals within the first hour
• Save every transaction hash, wallet address, and screenshot before the evidence disappears
• Report to IC3 (ic3.gov), the FTC, and any exchange the funds passed through within 24 hours
• Never pay an upfront fee to a “recovery expert” who contacts you out of nowhere

What to Do in the First 24 Hours

Time	Action
First 15 minutes	Stop all contact with the scammer
30 minutes	Move remaining crypto to a new wallet
1 hour	Revoke wallet approvals and disconnect connected apps
2 hours	Save transaction hashes, screenshots, and chat logs
6 hours	Contact the exchange the funds moved through
Within 24 hours	Report to your national fraud authority and your bank

The general flow looks like this: scam detected, stop payments, secure your wallet, save evidence, report the scam, trace the funds, then bring in a professional investigation if needed. Each stage builds on the one before it, which is why order matters as much as speed.

If you want the bigger picture on how these scams work before diving into the checklist, start with our Cryptocurrency Scam Guide, which explains how to spot, report, and recover from cryptocurrency scams in depth. For now, here’s exactly what to do. 

Who This Guide Is For

This page is written for one specific moment: you sent crypto, or gave someone access to it, and you now believe it was a scam. That covers a wide range of setups, and the first-24-hours playbook is largely the same across all of them:

• Investment and trading platform scams, where a fake broker or “prop firm” blocks withdrawals behind fees
• Pig butchering scams, where a long-running relationship, romantic or otherwise, leads into a fake trading platform
• Romance scams, where someone you met online asks you to invest together or send crypto for an emergency
• Fake or cloned exchanges, built to look like a real platform you already trust
• Telegram and Discord scams, including fake trading signals, giveaways, and admin impersonation
• NFT and airdrop scams, including fake mint sites and malicious claim links
• Wallet drainer scams, where a malicious site or contract gets you to sign a transaction that empties your wallet

In 2025, an estimated $17 billion was stolen globally through cryptocurrency scams and fraud, with the average scam payment climbing 253% year over year to $2,764 per victim, according to the Chainalysis 2026 Crypto Crime Report. 

In the US alone, the FBI’s Internet Crime Complaint Center logged more than $11.3 billion in cryptocurrency-related losses across over 180,000 complaints in 2025, per the IC3 Annual Report. If you’re in this situation, you’re not careless and you’re not alone. You’re dealing with an increasingly industrialized criminal operation built specifically to catch smart, careful people off guard.

Whatever the setup was, if you’re asking what to do right now, in the next few hours, this checklist is built for that exact question. It’s not a general explainer on how crypto scams work. It’s the action plan for someone already inside one.

Before Anything Else: Stop Contact and Stop Sending Money

Two rules come before every other step, because getting these wrong undoes everything else you do today.

Cut off all contact with the scammer immediately. No explanations, no accusations, no “let me just ask one more question.” Every message you send gives them more time and more information.

Never send another payment, no matter what they call it. Release fees, taxes, verification charges, insurance deposits. These are all the same trick: convincing you that one more payment will unlock the money you already lost. It won’t. If someone connected to your original loss is asking for more money to “release” your funds, that request is a scam, not a way out of it.

This exact pattern shows up so often that it has its own name in the industry. If you’re dealing with frozen funds or being asked to pay additional fees before accessing your money, our withdrawal scam recovery guide explains what these scams look like and the steps you can take. If the scam involves demands for fake tax payments or “tax clearance” fees, our crypto tax scam recovery guide covers that scenario in more detail.

Your 24-Hour Action Plan: Step-by-Step Recovery Checklist

The first 24 hours after discovering a crypto scam can make a significant difference. Acting quickly helps protect any remaining assets, preserves evidence before it disappears, and gives exchanges and law enforcement the best chance to trace or freeze stolen funds. The steps below walk through what to do during the first hour, the next few hours, and before the first day ends, so you can respond methodically instead of making rushed decisions.

Hour 1: Lock Down What’s Left

Move Remaining Crypto to a New Wallet

If the scammer ever saw your seed phrase, watched you enter it, or got you to connect your wallet to a malicious site, assume anything left in that wallet is exposed. Set up a brand new wallet with a freshly generated seed phrase, one that the scammer has never seen, and move whatever funds you still control there right away. 

Never type your recovery phrase into a website, chat window, or “wallet support” form. No legitimate service will ever ask for it, and typing it anywhere is functionally the same as handing over your funds.

Revoke Wallet Permissions and Token Approvals

Many scams work through a “drainer” script that gets your approval once and then keeps pulling funds later, sometimes days after the initial interaction. A token approval you granted weeks ago can still be used against you today. Tools built for exactly this let you see and cancel every approval tied to your wallet:

• Revoke.cash for Ethereum and most EVM-compatible chains
• Approved.zone as an alternative approval checker
• Rabby Wallet’s built-in approval manager, if you use Rabby

Go through the list and revoke anything you don’t recognize or no longer actively use.

Disconnect Your Wallet From Every Site

Open your wallet app, whether that’s MetaMask, Phantom, Trust Wallet, or Coinbase Wallet, and check the list of connected sites or dApps. Disconnect anything unfamiliar, and disconnect the scam platform itself if it’s still listed. A connection left active is a standing door the scammer, or the code they deployed, can walk back through.

Check for Unauthorized Access

If the scammer had you install anything, share your screen, or “help” you troubleshoot, check for signs they got further than your wallet:

• Unknown browser extensions you don’t remember installing
• Remote desktop or screen-sharing software (AnyDesk, TeamViewer, and similar tools are common in scams that involve “tech support”)
• Devices logged into your email or exchange accounts that you don’t recognize
• Session or login history on your email and exchange accounts showing unfamiliar locations or times

Run a Malware Scan

If there’s any chance malicious software made it onto your device, whether through a fake wallet app, a cracked “trading bot,” or a suspicious link, run a full scan before you do anything else sensitive on that machine. Microsoft Defender (built into Windows), Malwarebytes, and Bitdefender are all reasonable options for a first pass.

Call Your Bank or Card Issuer

If any part of the payment touches a bank transfer, wire, or card charge, this is the one action in the entire process with a real shot at stopping money before it fully clears. Don’t wait until tomorrow. Call today.

Change Your Passwords and Enable Two-Factor Authentication

Start with your email, since it’s the recovery key to almost every other account you own. Then move to exchange accounts, then banking. Use a password you’ve never used anywhere else.

Hours 2 to 6: Preserve Every Piece of Evidence

Here’s the part people skip when they’re panicking, and it’s the part that matters most for any chance of tracing or recovering funds later. No evidence means no case, whether that case is with law enforcement, an exchange, or a professional investigator. Save as much of the following as you can:

Save this	Why it matters
Transaction hashes (TXIDs)	Proves each transfer happened and lets anyone trace where it went
Wallet addresses, yours and theirs	Shows the path the money took
Blockchain network used (Ethereum, Tron, BNB Chain, Solana, etc.)	Tells investigators which explorer and tools to use
Screenshots of the platform	Documents the fake balance, blocked withdrawals, or fake support chat before the site vanishes
Chat logs, usernames, and Telegram or Discord IDs	Establishes how the deception happened and who was involved
Emails and phone numbers used to contact you	Adds another identity thread investigators can work with
Website URL and domain registration details, if available	Helps identify who’s behind the scam site
QR codes used for payment, if any	Can reveal additional wallet addresses
Bank or exchange statements	Confirms amounts and dates from an independent source

One important caution: save your own seed phrase somewhere offline and private if you haven’t already. Never share it with anyone, including someone claiming to be a recovery agent, and never post it anywhere, even redacted, while documenting your case.

Do this now, not later. Apps get deleted, scam websites go dark once they’ve squeezed what they can out of a victim, and chat histories disappear the moment the scammer realizes you’re catching on. A folder of screenshots taken today is worth more than a perfect memory next week.

If your scam started through a dating app, Telegram, WhatsApp, or Instagram, which is how most of these cases begin, our social media scam recovery page covers that specific pattern.

Check Where Your Crypto Went

You don’t need special tools for the first look. Public blockchain explorers let anyone follow a transaction hash to see where funds moved next:

• Etherscan for Ethereum and most ERC-20 tokens
• BscScan for BNB Chain
• Tronscan for Tron, common in USDT scams
• Solscan for Solana
• Blockchair as a multi-chain option covering Bitcoin and several others

Paste your TXID into the matching explorer and you’ll usually see the receiving address, and sometimes the next hop after that. This is useful groundwork, and it’s exactly the kind of detail that speeds up a professional trace later, but don’t expect to follow funds all the way through a mixer or cross-chain bridge on your own. That’s where the trail usually needs specialized tools.

Hours 6 to 24: Report It to the Right People

Knowing how to report a crypto scam quickly is just as important as the earlier steps, since reports feed directly into the investigations that can lead to a freeze.

File With Your National Fraud Authority

Reporting isn’t just paperwork. In 2025, IC3 received over one million complaints, and cyber-enabled fraud made up roughly 85% of all reported losses that year. That data is exactly what law enforcement uses to identify patterns, build cases, and freeze funds tied to larger operations. Where to file depends on where you are:

Country	Where to Report
United States	FBI IC3 and FTC
United Kingdom	Action Fraud, 0300 123 2040
Canada	Canadian Anti-Fraud Centre via reportcyberandfraud.canada.ca
Australia	Scamwatch and ReportCyber

Notify the Exchange the Funds Moved Through

If you identified an exchange through the blockchain explorer step above, contact them directly and immediately, with your TXIDs and wallet addresses ready. Exchanges are often the only realistic point where a freeze is possible, and that window closes fast once funds get cashed out or moved again.

Exchange	How to Report Fraud
Binance	Support ticket, Fraud/Scam category
Coinbase	“Report Fraud” form in the Help Center
Kraken	Contact Support and request the security team
OKX	Support ticket routed to Compliance
Bybit	Support ticket routed to the Risk team

Exact processes change over time, so confirm the current reporting path on each exchange’s own support site before you file.

Tell Your Bank in Writing

A phone call is a start, but follow it with something in writing so there’s a paper trail. Ask specifically about dispute rights or reimbursement options tied to fraud.

Consider a Professional Blockchain Tracing

While blockchain explorers can help you identify the first few transactions, tracing stolen cryptocurrency becomes much more difficult once funds move across multiple wallets, blockchains, or mixing services. Professional blockchain investigators use advanced forensic tools to follow these complex transaction paths and prepare evidence that can support reports to exchanges and law enforcement.

At Capx Recovery, blockchain experts analyze transaction histories, trace the movement of stolen assets, identify potential points where funds may be frozen, and help victims navigate the reporting process. Although no legitimate recovery company can guarantee the return of stolen cryptocurrency, acting quickly with professional assistance can improve the quality of evidence and strengthen your case.

What Happens After the First 24 Hours

Once the immediate steps are done, the process shifts from urgent to methodical. You’ll typically have a report reference number from IC3 or your local equivalent, possibly a bank dispute in motion, and if you’ve engaged a recovery team, a case review is already underway. 

From here, investigators trace the blockchain path your funds took, identify any exchange accounts they passed through, and determine whether a freeze or a formal claim is realistically possible. It’s rarely instant, but it is a real process with real steps, not a black box. 

If you want to see what that looks like with our team specifically, our page on how the Capx Recovery process works breaks it down.

FAQs