My Crypto Was Stolen From My Wallet or My Exchange Account Was Hacked

Work from a device you have reason to trust rather than the one you suspect. Move any remaining assets to a wallet whose keys have never been on a compromised machine, revoke outstanding token approvals, and disable any API keys attached to exchange accounts. Reset the linked email account first.

Do not re-enter an existing seed phrase anywhere to test whether it still works, and never enter one into a website, a form or a support chat. If it may have been exposed, treat that wallet as permanently compromised.

If an exchange or custodial account is involved, report the unauthorised access through the platform’s official channel and put it in writing. Ask expressly for the account to be secured, the withdrawal flagged, and login, device and withdrawal logs preserved.

Speed matters here in a practical rather than a legal sense. Where funds have moved to another account on the same platform, or on to an exchange that cooperates, the window in which anything can be held is short.

Theft of virtual assets is capable of being a criminal matter, and a report to the relevant police cybercrime unit is usually the right early step. It also creates the official record platforms, banks and foreign authorities frequently require.

Take everything with you: wallet addresses, transaction hashes, timestamps, the chain or network involved, screenshots, and a plain chronological account of what happened and when you noticed. A clear timeline is worth more than a long narrative.

Record the sending address, the receiving addresses, every transaction hash, the network each ran on, the amounts and the timestamps, and save all of it outside your wallet and outside the platform. Blockchain records do not vanish, but your access to the account that ties them to you sometimes does.

This trail matters more than people expect, because traceability is treated by regulators as a real property of an asset. In ADGM, the criteria a firm must assess before using a virtual asset expressly include traceability and on-chain monitoring capability.

If a licensed platform sat anywhere in the chain, there may be a regulatory dimension on top of the criminal and civil ones. Licensed firms carry obligations about client virtual assets, custody and their own reporting.

Establish the licensing position rather than assuming it. VARA covers Dubai outside the DIFC, the DFSA the DIFC, the FSRA ADGM, and the CMA onshore UAE and the ordinary free zones. Check the entity named in your terms of service.

People who have lost crypto are targeted again, quickly and deliberately. Unsolicited offers to trace, unfreeze or retrieve stolen assets for an upfront payment are a well-documented second fraud, and so are messages claiming to come from the platform, a regulator or a lawyer.

Verify independently before paying anyone anything, and never through a contact detail supplied by the person approaching you. Be equally wary of anyone suggesting you can make back what you lost through another investment.

Where tracing identifies a real target — an exchange account, a named person, a company — a civil claim becomes possible, and the forum depends on where that target and any platform sit: the DIFC Courts, the ADGM Courts or the onshore courts.

Be honest with yourself about the range of outcomes. Some cases produce an identifiable defendant and a real claim; many do not, particularly where funds moved quickly through routes built to break the trail. Nobody can promise recovery.