Crypto Stolen or Scammed: What to Do Now and Where to Report It

Updated on October 22, 2026: completely revised and expanded into a guide for both theft and scams, with the reporting routes to the financial regulator, exchanges and banks, freezes by stablecoin issuers, recovery scams and the tax position in Germany. The earlier statement that theft and insolvency are treated differently for tax purposes was not supported by any source and has been replaced.

If your crypto has been stolen or you have fallen for a crypto scam, the order of steps matters. First, preserve transaction IDs, addresses and chat histories, and move any remaining coins to a new wallet. Then file a police report, notify the exchange where the coins ended up and report unlicensed providers to the financial regulator. Money mostly comes back when the trail ends at a regulated exchange or in a stablecoin that can be frozen, such as USDT or USDC. Bitcoin sitting in someone else's wallet cannot be frozen by anyone.

This guide walks through every step, from the first screenshot to the tax return, using the procedure in Germany as the example, and shows with recent cases where investigators succeed and where they do not. Why a confirmed transfer cannot simply be called back is explained in our guide on crypto sent to the wrong address.

Stolen or scammed crypto: the key points at a glance

• Preserve five details first: transaction ID, your address, the destination address, the time including time zone, and the blockchain involved. Without them no investigator can follow the trail.
• Police report: in Germany the police, the public prosecutor and the local courts accept it under Section 158 of the Code of Criminal Procedure. Online, it goes through the joint portal of the state police online stations; for offences on the internet, through the state where you live.
• BaFin: Germany's financial regulator accepts complaints and tips about unlicensed providers, and its consumer hotline 0800 2 100 500 is free. According to its warning of May 4, 2026, recovering lost money is not part of its job.
• Freezes work for stablecoins: by its own account, Tether had frozen more than 5 billion dollars as of September 11, 2026, working with over 340 agencies in 67 countries. No issuer can freeze bitcoin, ether or XRP.
• Recovery scams are the second trap: the FBI counted 10,516 complaints about supposed recovery services in the US in 2025, with 1.4 billion dollars in losses.
• Tax: the German Finance Ministry's circular of March 6, 2025 contains no rule for stolen coins. Under paragraph 89, data lost in a hacker attack counts against the taxpayer.

Stolen crypto: the first hours after the theft

Before you report anything, preserve the evidence. Much of it is volatile: login records disappear once an account is locked, scam sites go offline, and perpetrators delete chat histories on their side. Secure the following in this order:

1. The transaction ID (also called transaction hash or TxID) of every affected transfer, copied from the wallet or the block explorer.
2. Your address and the destination address, each copied in full, never typed out by hand.
3. The time with time zone, amount, token and blockchain, for example “USDT on Tron” or “ETH on Ethereum”.
4. Screenshots of the wallet, the history and the page through which it happened, each with the full web address.
5. The communication: WhatsApp or Telegram chats as an export, emails, phone numbers, names of supposed contacts and bank statements showing payments to the platform.
6. For an exchange account: the list of logins and devices, while unfamiliar access is still visible.

Then stop the damage. What that takes depends on how it happened:

• Seed phrase or private key in the wrong hands: move any remaining funds immediately to a newly created wallet with a new seed phrase. This takes priority over everything else, because the attacker can come back for the rest at any time.
• Wallet connected to a scam site: revoke the token approvals you granted. On Ethereum, the Token Approval Checker of the Etherscan block explorer shows which contracts can still access your tokens; many wallets have a built-in function for this.
• Exchange account taken over: contact support and have the account locked, reset your password and two-factor authentication, including on the linked email account.
• Remote access allowed: remove programs such as AnyDesk or TeamViewer and have the device checked before you use it for banking again.
• Paid by bank transfer or card: call your bank right away. In Germany, cards can be blocked around the clock through the 116 116 blocking hotline.
• Contact with the perpetrators: cut it off and pay nothing more, not even a supposed fee for a payout.

Reporting crypto fraud: police, online station or prosecutor

In Germany, Section 158(1) of the Code of Criminal Procedure lets you file a report with the police, the public prosecutor or a local court. The same provision gives you the right to a written acknowledgement of receipt, with a short summary of the time, place and nature of the offence. Ask for it, because exchanges, banks and lawyers will later want the case number.

The fastest route is online. The joint portal of the state police online stations first asks where the offence took place: in Germany, or abroad, on the internet or at an unknown location. For the second case, which covers almost every crypto scam, it takes you to the online station of the state where you live. The Central Cybercrime Contact Points (ZAC) of the police, by contrast, serve businesses: according to the federal administration portal, a company that has fallen victim to cybercrime turns to them. As a private individual, you use the online station or any police station.

Outside Germany the logic is the same. In the United States, victims report to the FBI's Internet Crime Complaint Center (IC3); in other countries, the national police take the report.

The report should contain the evidence you preserved, plainly and in chronological order. Not “I was hacked”, but: on this date, at this time, from my address to that address, transaction ID, amount, blockchain. Suspicions go at the end and are marked as such. This checklist helps you put it together (as of October 22, 2026):

You do not have to decide the legal classification yourself, and with crypto it is not straightforward. Under German law coins are not physical property, so classic theft does not apply. The main offences in question are fraud under Section 263 and computer fraud under Section 263a of the Criminal Code. How narrow this can get is shown by a 2024 decision of the Higher Regional Court of Braunschweig (case 1 Ws 185/24): an acquaintance had kept the seed phrase while setting up a wallet and later withdrew coins worth around 2.5 million euros, and the court found no sufficient initial suspicion of a criminal offence, as t-online reported. So describe exactly how the perpetrators gained access: deception, malware, a phishing site or a person with access to your seed phrase.

Large cases are handled by specialised units. Operation Herakles, in which 13,888 phone numbers used by investment fraudsters had been shut down by September 2026, involved for example the cybercrime centre of the Karlsruhe Prosecutor General's Office; details are in our report on Operation Herakles. Such investigations grow out of many individual reports. Germany's federal cybercrime report for 2025 registered around 334,000 cases, and the authorities assume a large number of unreported ones. Every offence that goes unreported is missing from that picture.

Reporting crypto fraud to the regulator, the exchange and the bank

Besides the police report, three notifications are worthwhile, because each secures a trail of its own.

BaFin. Germany's financial regulator accepts complaints about supervised companies through an online form, for example about a licensed exchange that does not respond to your report. If a provider appears to operate without a licence, you send your documents to BaFin by letter, fax or email; whether a company holds a licence is shown in its company database. Questions are answered by the free consumer hotline on 0800 2 100 500. BaFin does not decide individual disputes, and according to its warning of May 4, 2026, returning money lost to fraud is expressly not one of its tasks. Its warnings still help: on October 14, 2026 it warned about 23 almost identically built investment websites without a licence. If your platform is on such a list, that supports your report.

Exchange. If the destination address leads to a known exchange, write to its support or compliance team with the transaction ID, destination address and case number. Since December 30, 2024, crypto service providers in the EU have had to collect and keep information on the originator and beneficiary of transfers under the Transfer of Funds Regulation (EU) 2023/1113. A deposit at a regulated exchange therefore has a name behind it. Such an exchange usually freezes an account only when an authority asks; your notification makes sure the exchange already knows about the case when that request arrives.

Bank. If you paid a scam platform by bank transfer or card, report it to your bank immediately, with the recipient account and case number. The recipient account is a second trail that investigators can follow independently of the blockchain.

Recovering stolen crypto: when freezes and investigations work

A confirmed transaction cannot be reversed on the blockchain. Money only comes back through a party that has access to the funds: a stablecoin issuer, an exchange or a court that orders assets to be secured. The table shows where that is possible (as of October 22, 2026).

Tether shows how this works in practice. In November 2023, following investigations together with the exchange OKX, the issuer froze around 225 million USDT linked to a network behind romance and investment scams (Tether announcement). By its own account, Tether had frozen more than 5 billion dollars by September 2026 and worked on over 2,800 cases with more than 340 agencies in 67 countries (Tether, September 11, 2026). In its USDC terms, Circle reserves the right to block addresses and freezes funds on an order from a competent authority.

For coins without a freeze function, the only option is to follow them to the next exchange. How tight that limit is became clear in September 2026, when an attacker moved around 83 million dollars in XRP without Ripple being able to step in; the background is in our article on why stolen coins often cannot be frozen. Investigators trace the route across the blockchain with analysis tools. How much scam money becomes visible this way is shown by an analysis from the US Treasury's FinCEN covering 33,904 suspicious activity filings and 12.7 billion dollars of activity linked to investment fraud between September 2023 and the end of 2025.

With small amounts a police report rarely leads to repayment. It is still worth filing, because investigators only spot patterns across many reports and because exchanges rarely freeze anything without a request from an authority. For larger sums, or when an exchange does not respond, a law firm specialising in banking and capital markets law or criminal law can look at civil-law options.

Recovery scams: the second trap after a crypto scam

Anyone who has lost money once ends up on the perpetrators' lists. Weeks or months later, supposed law firms, investigators or recovery services get in touch and promise to get the money back, in exchange for an upfront fee, a tax or a release payment. In the 2025 annual report of its Internet Crime Complaint Center, the FBI counted 10,516 complaints about such offers with 1.4 billion dollars in losses, a figure that can also include losses from the original scam. BaFin regularly warns about such sites, for example on September 14, 2026 about finanzforensik(.)com. How the same perpetrators first defraud and then come back as a recovery service is shown by the network of 241 websites that US authorities shut down on October 14, 2026; the details are in our article on recovery scams and their warning signs.

These are the signs that give the scheme away:

• The contact comes unsolicited, by phone, email or message, and knows details of your loss.
• A fee, tax or deposit has to be paid before the payout, often in crypto.
• You are asked to install a remote access program such as AnyDesk, or to create a new wallet and share access to it.
• The provider invokes BaFin, the police or Interpol. By its own statement, BaFin does not commission third parties to recover funds and does not approach individuals on its own initiative.
• There is a guarantee of success or time pressure.

Whether a German law firm exists can be checked in the official nationwide register of lawyers kept by the Federal Bar: name, address and phone number there must match the website. Reputable law firms do not demand upfront payment in crypto to release supposedly seized money.

Crypto losses from fraud: what German tax authorities recognise

Whether the German tax office recognises a theft or scam as a loss is not expressly regulated. Crypto assets held privately fall under private sales transactions in Section 23 of the Income Tax Act, as the Federal Fiscal Court confirmed in its ruling of February 14, 2023 (IX R 3/22). A loss there arises from a sale: the Finance Ministry circular of March 6, 2025 calculates it in paragraph 57 from the sale proceeds, acquisition costs and income-related expenses. It contains no specific rule for stolen or defrauded coins. If you want to claim such a loss, clarify the route with a tax adviser first.

The burden of proof, on the other hand, is clear. Anyone trading on platforms run by foreign operators has an extended duty to cooperate under paragraph 89 of the circular, and missing records or data losses, for example due to a hacker attack, count against the taxpayer. Export your transaction histories regularly and keep the police report and its case number with your tax records. When a worthless holding counts for tax purposes is explained in our guide to writing off a total crypto loss; gains and losses from actual sales can be worked out with the CryptoTicker tax calculator.

Preventing crypto theft: custody, choice of exchange and seed phrase

In DeFi, stolen private keys were for the first time a more common attack route than flaws in program code in 2026, as our analysis of crypto hacks shows. Larger holdings therefore belong on a hardware wallet bought directly from the manufacturer or an authorised retailer; which devices offer what is shown in our hardware wallet comparison. How much the source matters became clear in October 2026 with tampered Ledger devices from a reseller. Keep your seed phrase offline and separate from the device; steel plates, passphrases and multisig are explained in our guide to storing your seed phrase safely.

For the part held on an exchange, your choice of provider decides whether there is a supervisor to turn to if something goes wrong. Exchanges licensed under the EU's MiCA regulation verify their customers' identity and respond to requests from authorities; which providers hold such a licence is shown in our overview of regulated crypto exchanges. Before you connect a wallet to a website, also check the address: fake verification sites such as the supposed AML check for wallets obtain exactly the approvals attackers need.

Stolen crypto: the first hour matters more than the report

If you secure transaction IDs, addresses and chat histories within the first hour after a theft or scam and move any remaining coins, you have everything the police, exchanges and stablecoin issuers need. A police report costs nothing and is the precondition for authorities to send requests to exchanges and issuers. Money mostly comes back with USDT, USDC and balances at regulated exchanges. Anyone who then promises recovery against upfront payment should be reported too.

(As of October 22, 2026. This article is not legal, tax or investment advice. Responsibilities, forms and the law can change; for larger losses, a lawyer can help.)