The information provided in this article is for informational purposes only and does not constitute financial advice. Investing in cryptocurrencies carries a high level of risk.
After a theft the pattern is almost always the same: hours spent searching for what can be done, and eventually a police report that leaves out what matters most. The right order is the other way round.
What decides your chances is what you preserve in the first few hours. A transaction on the blockchain is permanently traceable, but only if someone knows which transaction is meant. Without addresses and transaction IDs, even the best cybercrime unit has nothing to work with.
Stolen crypto: the key points at a glance
- Preserve first, report second. Addresses, transaction IDs, timestamps and screenshots are the basis for everything that follows.
- Private individuals file a report with the online police portal of their federal state or at any police station.
- The Central Cybercrime Contact Points are explicitly not responsible for private individuals. They were set up for companies and public authorities. The police refer private individuals in so many words to the online portals of the state police forces.
- Recovery becomes realistic when the destination address leads to a regulated provider: there is a name behind the account, and investigators can reach it.
- If the funds settle on a self-custodied address with no onward route, the trail effectively ends.
- Anyone promising recovery against an upfront fee is the second fraud. These offers seek out their victims among reports of loss.
Stolen crypto: the first hours
Before you report anything, you preserve. Everything here is volatile the moment accounts are locked or sessions are ended.
- The transaction ID of every affected transfer. It is the key to everything that follows.
- Your address and the destination address, each copied in full, never typed out by hand.
- The time including the time zone and the chain involved.
- Screenshots of the wallet, of the history and, where there is one, of the message or page through which it happened. Including the full address of that page.
- For an exchange account: the session overview showing unfamiliar logins, while it is still visible.
Only then: have accounts locked, change passwords, move any remaining holdings to a newly created wallet. Where a seed phrase may have been compromised, moving the funds takes priority over everything else.
Stolen crypto: where the report belongs
Many guides get this wrong, so here it is set out cleanly:
| Affected party | Responsible body |
|---|---|
| Private individual | Online police portal of your own federal state, or any police station |
| Company, association, public authority, research institution | Central Cybercrime Contact Point (ZAC) of the state |
| Critical infrastructure, federal authorities | ZAC at the Federal Criminal Police Office |
The police put it unambiguously on their own overview page: “Private individuals should please contact the online portals of the state police forces.” Such a portal exists in all sixteen federal states, though which offences can be recorded there differs. Any police station will take the report in any case.
The report should carry the five preserved details listed above, in plain order and without interpretation. Not “I was hacked”, but: on this date, at this time, from my address to that address, transaction ID, amount, chain. Anything you suspect yourself belongs at the end and should be marked as a supposition.
Also worth doing: a notification to the exchange where the funds arrived, if the destination address can be attributed to one. Providers respond to tips, but they act only on an official order. The notification mainly ensures that the attribution is still documented at the time of the request.
Stolen crypto: what is realistically possible
Honesty belongs here, because it protects against the second loss.
There is a prospect when the trail leads to a regulated provider. Every account there is identified, and investigators can demand information and have balances frozen. That is exactly why addresses and transaction IDs matter so much: they are the bridge from an anonymous chain to a name.
It is practically hopeless when the funds stay on a self-custodied address or run through mixing services. There is then no body to which an order could be addressed.
With small amounts a report rarely leads to an investigation that produces a result. It still costs little, and it serves a second purpose: only reported cases appear in the statistics, and patterns across many reports are what allows investigation teams to come into being at all.
What happens to the loss for tax purposes is a separate question. A theft is something different from a loss through insolvency, and the two are treated differently. This article is no substitute for legal or tax advice.
Stolen crypto: the damage afterwards
The most common follow-up mistake is clutching at straws. Under every public post about a loss, offers appear within hours to retrieve the coins for an advance fee. There is no technology for it. Anyone able to reverse a confirmed transaction could reverse every other one as well, and the whole system would be worthless.
Two things noticeably lower the risk for next time, and both are dull: storage split by amount instead of everything in one place, and a backup that nobody finds but the right people can reach. What that looks like in practice is set out in our guide to storing your seed phrase safely.
And for the part held on an exchange, the choice of provider decides whether there is a supervisory authority to turn to if the worst happens. The licensed providers are listed in our overview of regulated crypto exchanges.
Stolen crypto: frequently asked questions
Is a police report worth it at all? With small amounts, rarely in the sense of a recovery. But it costs little, and it is the precondition for authorities being allowed to approach an exchange in the first place.
Can the police get my coins back? Not directly. They can demand information and, where the funds are held with a regulated provider, arrange for them to be secured. On a self-custodied address that ends.
Do I need a lawyer? With larger amounts, or where a provider is involved that does not respond, yes. For the report itself, no.
What about private investigation services? Analytics firms can retrace a trail and deliver usable reports. They cannot retrieve anything, though, and any offer promising exactly that against an upfront fee is fraud.
How much time do I have? For the report itself there is no short deadline. For the evidence there is: session logs and account data disappear as soon as accounts are locked or reset.
Be the first to comment