Crypto wallet drained, what to do

Your crypto wallet is drained when coins left an address you control and you did not send them. The same word fits an exchange account that paid out without you. The FBI’s Internet Crime Complaint Center says a transfer is irrevocable. The private key and an internet connection are enough to send the funds. No bank sits in the middle to reverse it.

That is the part people hear first. It is true for coins that already moved on the chain. It is a different problem if the exchange still holds the account, or if coins are still sitting in the wallet. Do those two jobs before you go looking for a refund.

The longer checklist is Cryptocurrency wallet drained. If a normal bank or card payment went out in the same scam, use Scammed or fraudulent bank charge for that money. The bank path and the chain path are both real.

Write down the transfer before you click around

The FBI’s guidance for cryptocurrency scam victims says the useful part of a report is the transaction detail. Save it before the screen changes.

For each transfer, write:

• The wallet address the coins left, and the address they went to.
• The amount and the coin. “1.02345 ether” is the shape they want, with your real numbers.
• The date and time, with the time zone if you know it.
• The transaction hash. That is the long id of this transfer, not the wallet address.

Also keep how you met the person, the messages, any website or app they told you to open, and the name of any exchange you used. Screenshots help. The FBI says to include a detail even when you are not sure it matters.

If you do not have the hash yet, still file the report later. Their guidance says a report with partial information is still worth sending.

Split the situation

Use the row that matches. If two rows match, do both.

Do not pay anyone who says they can get it back

The hour after a loss is when the next scam starts. The FBI’s August 2023 warning describes companies that promise to trace or recover stolen crypto. They contact people on social media, or they show up in search results and in the comments under news stories. They charge an up-front fee. Then they disappear, or they send a thin report and ask for another fee.

A later FBI alert, from June 2024, describes the same pitch from people posing as lawyers. They say the FBI or the Consumer Financial Protection Bureau sent them your case. They ask for identity documents, bank details, a judgment amount, an up-front fee, or a payment for “back taxes” before the coins can move.

Read those two warnings as one rule.

• A private recovery company cannot issue a seizure order. The FBI says that in the 2023 alert.
• An exchange freezes an account on its own rules, or when it receives legal process. A stranger’s email does not do that.
• Law enforcement does not charge a fee to investigate. If someone claims to be the FBI, check that claim with your local FBI field office.
• Do not send them money, the seed phrase, or photos of your ID.

The FBI also says victims can choose civil litigation. That is a lawyer you hire yourself. It is a different thing from a message that arrives on its own.

If the seed phrase or private key was exposed

A self-custody wallet has no company that can reset the key. MetaMask’s recovery-phrase page calls the Secret Recovery Phrase the master key. Whoever has it controls the wallet. MetaMask uses a 12-word phrase. Some other wallets use 18 or 24 words. The length does not change the rule. A password only unlocks the app on that device. It does not replace the phrase.

MetaMask says they will never ask for the phrase. They have no phone number. Support email about an open ticket comes from metamask.io, and they still will not ask for the phrase. A text, a Discord DM, or a “support” chat that wants the words is the theft, continuing.

If you use MetaMask and you still have funds, their hacked-wallet article says to move what you can, in this order:

1. Install MetaMask in another browser, or another browser profile. On a phone, use a second device. If you delete the app and you have no backup of the phrase, you cannot get that wallet back.
2. Create a new wallet there. If the old one was tied to a Google or Apple account, do not connect that same account to the new wallet. MetaMask says those logins may be compromised too.
3. Write the new Secret Recovery Phrase down, in order, and store it offline. Do not put it in a cloud note, an email, or a photo. MetaMask says online storage, including a password manager, is a bad place for the phrase.
4. From the old wallet, send the remaining funds to the new one. If you think a script is sweeping the account, do not send in extra ETH or other tokens to pay for gas. MetaMask points at their own sweeper guidance for that case. Follow that page rather than topping the wallet up.
5. Stop using the old wallet and every account that came from the old phrase.

MetaMask says they cannot reverse a transaction, restore missing funds, or take control of the account for you. A hardware wallet, such as a Ledger or a Trezor, stores keys offline. MetaMask describes that as a barrier to online theft. It does not repair a phrase you already typed into a website. That phrase is still the master key.

Another wallet app will use its own screens. The shape is the same. New wallet, new phrase, move what is left, retire the old phrase. Use the help page on that wallet’s own site. Do not use a link a stranger sent you after the loss.

If an exchange sent the coins

Open the exchange app you installed yourself, or type the company’s address yourself. A text that arrived after the theft is a common place for a fake support number.

Ask them three things. Lock the account. Tell you whether the withdrawal can still be held. Remove devices, API keys, and sessions you do not recognise.

The FBI’s 2023 alert is the limit on what they can do. Exchanges freeze accounts on internal processes or in response to legal process. A transfer that has already settled on the chain is the irrevocable case the IC3 describes. Hear “no” if that is the answer. Then report the hash anyway.

While you are in the account, change the password to one this login has never used. Turn on the app-based second factor if the exchange offers one. A code by text is a weak second factor once someone can move your phone number. That problem has its own page, SIM swap, what to do.

File the report

In the United States, go to ic3.gov and choose file a complaint. The FBI says not to wait. You can also contact a local FBI field office.

Put the transaction details in the complaint. Add the recovery pitch if someone already asked you for a fee. The IC3 page asks for addresses, amounts, coin types, hashes, dates and times, how you met the person, the platforms you used, any web domain, and any phone numbers.

People 60 or older can call the National Elder Fraud Hotline at 833-372-8311 for help filing that complaint. That number is on the IC3 cryptocurrency page.

Read the IC3 terms before you submit. The page says the IC3 will not contact you. A complaint may be referred to another agency. An investigation starts at that agency’s discretion. Keep your own copy of everything you sent.

Outside the United States, the IC3 form is still a US system. Report the theft to your local police, and to the exchange or wallet company. Give them the same hash, addresses, amounts, and times. Rules for what a bank or an exchange must do vary by country. This page does not list those local deadlines.

MetaMask’s hacked-wallet page also says to report the scam to the relevant authorities. The IC3 report is the US version of that step. It does not put the coins back. It is how the hashes reach an investigator.

Check the accounts that shared a password

If the exchange password was also your email password, the wallet is not the only open door. Secure the mailbox before you rely on a reset link. Use Personal email account hacked when that inbox is no longer yours.

If you also sent a bank transfer, a card payment, or a wire because someone told you to buy the coins, report that payment to the bank or the card issuer. The chain transfer and the bank transfer are separate reports. Scammed or fraudulent bank charge walks through the bank side.

What to change after the dust settles

MetaMask’s do-and-don’t list is the storage rule worth keeping.

• Write the phrase on paper, in the right order, and check the spelling.
• Keep it offline. A cloud doc, an email titled with the phrase, or a photo in your camera roll can be stolen without anyone touching the wallet.
• The only times you type the phrase are when you create the wallet and when you restore it. MetaMask says a website that asks for it is not a legitimate MetaMask site.
• A second paper copy belongs somewhere a fire in your house does not destroy both. The second copy is not a screenshot.

On an exchange, use a password that exists nowhere else. Turn on an app or a security key if they offer one. If they offer a withdrawal allow-list or a delay before a new address can be paid, turn that on. The label is on that company’s own security page.

When the new wallet holds whatever you could save, and the IC3 complaint or the local police report has the hashes, open Cryptocurrency wallet drained and do the prepare list. If a bank payment went out too, finish Scammed or fraudulent bank charge the same day.

Related playbooks

• Cryptocurrency wallet drained. Coins left a wallet or an exchange account you control, or someone has your seed phrase or private key.
• Scammed or fraudulent bank charge. Money left your account that you did not authorise, or you were talked into sending it and have just realised.