Home › Knowledge Hub › The first 10 minutes
The first 10 minutes after suspected crypto theft
In the first ten minutes after suspected crypto theft, you have three jobs: protect any funds still in reach, lock the accounts that control everything else, and avoid the mistakes that make it worse. Which comes first depends on what happened. If a wallet is being drained and you still control it, moving the remaining funds out is the race. If you sent money to a scammer, that payment is likely gone, so securing your accounts matters more. Work out which situation you are in, then act.
This is triage, not the full plan
The first ten minutes are about damage control: save what can still be saved, and do not make it worse. This is deliberately short. Once the urgent moves are done, our guide to the first 48 hours after a crypto scam covers the fuller sequence of evidence, reporting, and recovery.
First, work out which of three situations you are in, because the right first move is different for each.
If your wallet is being drained
This is the one case where speed can directly save money. If you can see funds leaving, or you believe your wallet or its recovery phrase is compromised but you still have access, the move is to get the remaining funds out, to a wallet the attacker does not control.
Send what is left to a safe destination. A brand-new wallet whose recovery phrase has never been typed into anything, or an account on a reputable exchange you control. Move the most valuable and most liquid assets first, because you may only get one or two transactions out before the attacker does.
Assume the compromised recovery phrase is burned. If your seed phrase was exposed, every address derived from it is compromised, now and in future. Do not send the rescued funds back to it, and do not keep using it. Our guide on a compromised wallet and on an exposed seed phrase covers this in full.
Do not reconnect the wallet to any site to "fix" it. The reflex to revoke approvals or interact can cost you the one transaction you needed to rescue funds. Move the assets out first; everything else comes after.
If you sent money to a scammer
If what happened is that you sent cryptocurrency to a scammer, the hard truth is that an on-chain transfer is normally final. There is no button that reverses it. So the first ten minutes shift from chasing the funds to protecting everything around them.
Stop all further payments immediately. If anyone is asking for a fee, a tax, or an unlock payment to release your money, that is the fraud continuing. No further payment brings anything back.
If the payment left a bank or card first, that leg may be recoverable even though the crypto is not. Call the bank's fraud department now and ask for a recall. Speed matters here in the same way.
If your account was taken over
If someone has gained access to your email or exchange account, regaining control is the race, and the order is specific.
Secure your email first. Whoever controls your email can reset the password on everything connected to it, including your exchange. Change the email password to something new and unique, and turn on two-factor authentication, preferably an authenticator app rather than text messages.
Then the exchange. Change the password, enable or re-check two-factor, and if the platform offers it, freeze withdrawals or lock the account while you sort it out.
The do and do-not list for the next ten minutes
Whatever your situation, these hold.
The "do not yet" column matters as much as the "do". Deleting the messages, uninstalling the app, or sending a recovery fee all feel like action, and all make the next 48 hours harder. Preserve first, act second.
Write down the time
Before the adrenaline fades, note the basics: what you noticed, when, and what you did. The exact times you sent anything, the wallet addresses or transaction hashes involved, and how the contact began. This takes a minute and becomes the backbone of every report and recovery attempt that follows. Our evidence checklist covers what to capture.
Then slow down
Once funds are rescued or confirmed gone, accounts are locked, and the basics are written down, the emergency is over. The next steps, full evidence preservation, reporting to IC3 or your national line, contacting the platform, and watching for a recovery scam, are important but not minute-by-minute. Our first 48 hours guide walks through them in order.
Red flags that the theft is ongoing, not over
- Funds still moving out of your wallet in real time
- New devices or sessions logged into your email or exchange
- Password reset emails you did not request
- A "support agent" who appeared the moment you asked for help
- Anyone offering to recover the funds right now, for a fee
What this guide cannot do
It cannot reverse an on-chain transfer, and in most theft cases the stolen crypto itself is not recoverable. What the first ten minutes can do is save funds still within reach, stop the account damage from spreading, and preserve the trail. Those are real and they are time-sensitive, which is why this short window matters so much.
This is general information, not legal or financial advice.
Use Chain Pursuit's free tools to understand your options, preserve evidence, and identify possible recovery scams. Do not share your seed phrase or private keys with anyone.
Sources
Internet Crime Complaint Center, File a Complaint. https://www.ic3.gov/Home/ComplaintChoice, where to report crypto theft and fraud, and guidance on acting quickly.
Federal Trade Commission, What To Know About Cryptocurrency and Scams. https://consumer.ftc.gov/articles/what-know-about-cryptocurrency-and-scams, on the irreversibility of crypto payments and on advance-fee demands.
CISA, Multi-Factor Authentication. https://www.cisa.gov/MFA, on why app-based two-factor is stronger than SMS when securing accounts after a compromise.
The irreversibility of on-chain transfers is a property of public blockchains, not a policy; it is why the rescue-funds window applies only when you still control the wallet. Reviewed quarterly.
Frequently asked questions
My wallet is being drained right now. What do I do in the next minute?
Move the remaining funds to a wallet the attacker does not control, a brand-new wallet whose recovery phrase has never been entered anywhere, or an exchange account you control. Move the most valuable and liquid assets first, because you may only get one transaction out. Do not reconnect the wallet to any site to "fix" it first.
Can I reverse a crypto payment I just sent to a scammer?
Normally no. On-chain transfers are final and there is no reversal button. If the money left a bank or card before becoming crypto, call that bank's fraud department now and ask for a recall, since the bank leg may still be stoppable even though the crypto is not.
My seed phrase was exposed. Is moving funds back to the same wallet safe?
No. If the recovery phrase was exposed, every address from it is compromised, permanently. Move funds to a new wallet with a fresh recovery phrase that has never touched the exposed environment, and stop using the old one entirely.
Someone got into my accounts. Which do I secure first?
Your email, before anything else. Whoever controls your email can reset passwords on everything linked to it, including your exchange. Change the email password and turn on app-based two-factor, then do the same on the exchange.
Should I delete the scam messages or uninstall the app right away?
Not yet. They are evidence. Screenshot and preserve first. Deleting them in the first ten minutes feels like action but makes reporting and any recovery attempt harder later.
Someone offered to recover my funds immediately for a fee. Should I?
No. An offer to recover funds for an upfront fee, especially one that appears right after the theft, is a second scam. Never pay in advance. Secure your accounts and report through official channels first.
What should I write down in the first ten minutes?
What you noticed and when, the exact times of any payments, the wallet addresses or transaction hashes involved, and how the contact started. A minute of notes now becomes the backbone of every report and recovery attempt that follows.
I've done the urgent steps. What next?
The emergency is over once funds are rescued or confirmed gone, accounts are locked, and you have notes. Then move to the fuller sequence: preserve all evidence, report to IC3 or your national line, contact the platform, and watch for a recovery scam. Our first 48 hours guide covers it.
Past the first ten minutes and unsure what's next?
Eleven questions showing which recovery and reporting routes are open in your case.
Check my case