Crypto Stolen? What to Do Right Now (Including Hacked Hardware Wallets)

Deck: If your wallet was drained, your seed phrase leaked, or you're worried your Ledger or Trezor was tampered with, here's a calm, step-by-step plan: protect what's left, write everything down, report it to the right places, and steer clear of the "recovery" scammers who show up next.

Last reviewed: October 23, 2026

If you're here because a balance just went to zero, take a breath. That's a gut punch, and you're not the only one. The FBI's 2025 Internet Crime Report counted 181,565 complaints involving crypto, with more than $11 billion in reported losses (FBI).

We'll be straight with you. Crypto sent on a blockchain usually can't be reversed. The FTC says crypto payments typically aren't reversible and don't carry the protections a credit card does (FTC). But the next hour still matters. You can protect whatever hasn't moved yet, and you can give exchanges and law enforcement what they need to act if they get the chance.

This guide goes one step at a time. You don't have to do it all at once.

Do this right now: the 10-minute checklist

1. Don't use the compromised wallet or seed phrase again. Treat that recovery phrase as burned.
2. Move anything that's still there to a brand-new wallet with a brand-new seed phrase, on a device you trust. (Details below. If it's a hot wallet with a "sweeper bot," read that section first.)
3. Don't send "gas money" into the hacked wallet. It can get swept the second it lands.
4. Screenshot and save everything: wallet addresses, transaction hashes (IDs), dates and times, amounts, and any messages, emails, or websites involved.
5. If funds went to an exchange, contact that exchange's support right away through its official website or app, and ask them to flag or freeze the receiving account.
6. File a report with the FBI's IC3 at ic3.gov and with the FTC at ReportFraud.ftc.gov.
7. File a local police report and keep the report number.
8. Contact the wallet maker's official support (Ledger, Trezor, etc.) if a hardware wallet is involved. Use only their official site.
9. Ignore anyone who offers to "recover" your crypto for a fee. That's the next scam.
10. Never share your seed phrase with anyone. Not support, not police, not a "recovery expert."

Printable version: A one-page "Theft Response Checklist" PDF goes here, covering the steps above plus blank lines for addresses, transaction hashes, case numbers, and who you contacted when. (Proposed free download, built the same way as our Exit Strategy Worksheet.)

First, figure out what kind of theft it was

Your next steps depend on how the thief got in. Most cases fit one of these:

• Your seed phrase (recovery phrase) was exposed. You typed it into a website or app, a "support agent" got it, it was stored in a photo or cloud note, or a tampered device leaked it. Anyone with those words can rebuild your wallet anywhere and move everything.
• You approved a malicious transaction or token approval. You connected to a fake site or signed something that gave a contract permission to spend your tokens. Your seed may still be safe.
• An exchange account was taken over. Someone logged into your Coinbase, Kraken, or other account, often through a phished password, SIM swap, or stolen email.
• You were talked into sending it. Investment, romance, and impersonation scams fall here. It isn't technically a hack, but you report it the same way.

If you're not sure, assume the worst case, that your seed phrase is exposed, and follow those steps. It's the safer move.

How to secure what's left in your wallet

If your seed phrase or hardware wallet is compromised

Revoke.cash, a well-known approvals tool, puts it bluntly: once a seed phrase is compromised, it's "game over" for that wallet. Revoking approvals won't fix it, because the thief holds the master key (Revoke.cash). So the plan is to get out:

1. Set up a new wallet with a fresh seed phrase on a device you trust. If it's a hardware wallet, make it a new one bought straight from the manufacturer (see "How to buy a hardware wallet safely" below). Ledger's own instructions for changing your recovery phrase walk through this: set up as a new device and generate new words (Ledger Support).
2. Move whatever is left from the old wallet to the new addresses. Send a small test amount first and check the receiving address on the device screen.
3. Watch out for sweeper bots. Thieves often run bots that grab anything sent into a compromised wallet, including the small amount you send to cover fees. Revoke.cash and MetaMask both warn about this (Revoke.cash, MetaMask). If you have meaningful value still stuck behind a sweeper, get help from a free, reputable responder (see SEAL 911 below) rather than racing the bot yourself.
4. Retire the old seed for good. Don't restore it on any device again.

If you signed a bad approval but your seed is safe

This is the one case where revoking approvals is the main fix. Check and revoke permissions you don't recognize:

• Revoke.cash works across many EVM chains.
• Etherscan's Token Approval Checker covers Ethereum.
• Ethereum.org has a plain-English walkthrough: How to revoke smart contract access.

Revoking costs a small network fee. If anything about the theft makes you doubt your seed is safe, move to a new wallet anyway.

If an exchange account was taken over

Contact the exchange through its official site or app. Change your email password first, then the exchange password. Turn on app-based or hardware-key two-factor authentication, and remove any API keys or withdrawal addresses you didn't add. The FTC's guide covers taking back hacked accounts and what to do if a scammer had access to your computer (FTC).

Document everything (this is what investigators need)

The FBI says the most important thing you can give them is transaction details (IC3):

• the crypto addresses involved (yours and theirs)
• the amount and type of crypto
• the date and time of each transaction
• the transaction ID, also called the hash

The FBI also asks for how you first came across the scammer, your messages with them, any websites or apps they pointed you to, which exchanges you used, and a timeline. If you don't have transaction details, file anyway (IC3).

Not sure where to find a transaction hash? Our guide on how to read a blockchain explorer walks through it. Save screenshots and copy the links into one document, so you can paste the same facts into every report.

Who do I report crypto theft to? (US)

Report to more than one place. They do different jobs.

The FTC's crypto guidance also lists the CFTC and SEC complaint channels for investment-style fraud (FTC). If you're 60 or older and need help filing an IC3 complaint, the FBI points to the DOJ Elder Justice Hotline (FBI).

Why bother reporting if the money's gone? Sometimes it isn't all gone. In the recent Ledger implant thefts, Tether froze $10 million in USDT tied to the thief, according to blockchain data firm Bitquery (CoinMarketCap). Stablecoin issuers and exchanges can only act on funds they control, and they act faster when there's a report on file. Reports also help investigators connect your case to others.

Outside the US

• UK (England, Wales, Northern Ireland): Report Fraud, the service that replaced Action Fraud, at reportfraud.police.uk. In Scotland, contact Police Scotland.
• Canada: the Canadian Anti-Fraud Centre.
• Elsewhere, start with your national police or cybercrime reporting site.

Can stolen crypto be recovered?

Sometimes, partly, but don't count on it. Here's what can realistically help:

• Freezes. Stablecoins like USDT and USDC can be frozen by their issuers, and exchanges can freeze accounts on their platforms. That only works if the funds land somewhere with a company in control, and it usually takes a report.
• Law enforcement tracing. Blockchains are public, and the FTC notes that transaction and wallet data can sometimes be used to identify people (FTC). Cases take time, and there's no promise of getting anything back.
• Free emergency help. SEAL 911 is a volunteer security group that offers free, confidential help during active crypto incidents. It says it will never ask for payment, seed phrases, or private keys.

What doesn't help is paying a stranger who says they can get it back. That's next.

Crypto recovery scams: the second theft

After a theft, the "helpers" show up. The FTC calls refund and recovery scams "the worst of the absolute worst." These scammers buy lists of people who've already lost money, then pose as a government agency, a consumer group, or a law firm and ask for a "retainer," "processing fee," or your financial information (FTC).

The FBI has warned about the same thing:

• Fake law firms that claim to be "official partners" of government agencies. There are no law firms that are officially authorized partners of US government agencies. They often know the exact amounts and dates of your earlier losses, ask for payment in crypto or gift cards, and pull you into WhatsApp group chats (IC3).
• People pretending to be IC3. The FBI says IC3 will never contact you directly by phone, email, social media, or apps. It won't ask for payment to recover funds, and it won't refer you to a company that charges for recovery (FBI).

A simple rule: if someone contacts you first and the "recovery" involves a fee, a seed phrase, or a new account to "receive" your funds, it's a scam. Our How to Avoid Crypto Scams guide covers the other common setups.

Ledger hacked? What actually happened with the tampered devices in 2026

If you've been seeing "Ledger hacked" all over your feed this month, here's what's documented so far, from Ledger and from reputable reporting. The investigation is still going.

What Ledger has confirmed:

• On October 9, 2026, Ledger said it was investigating reports of drained wallets from people who bought devices through CryptoBilis, a Malaysia-based reseller operating across Southeast Asia, and asked it to stop selling and shipping Ledger devices. On October 10, Ledger confirmed that one affected user's device contained an "unauthorized hardware implant" (BleepingComputer).
• CryptoBilis was a reseller listed as authorized by Ledger in Indonesia, Malaysia, and the Philippines (Cointelegraph).
• Ledger's security team, the Donjon, says the implant sits inside the device case and reads what's on the screen. When the device shows the 24-word recovery phrase during setup, the implant decodes the words and sends them out over a cellular (LTE) connection using an eSIM. Ledger says the implant doesn't change the secure chip, the operating system, or your transactions (CoinDesk).
• Ledger's Genuine Check can't catch this. Ledger says the check "cannot detect unauthorized physical modifications to the hardware—such as spying implants—if the original Secure Element remains intact" (Ledger Support).
• On October 15, Ledger said a "highly organized criminal group" spent months buying genuine devices, opening them, fitting hidden components, and putting them back into distribution through resellers in Southeast Asia. It said there was no flaw in its chip, operating system, or servers. It asked resellers in Southeast Asia and Hong Kong to suspend sales, and told authorized sellers to keep devices off store shelves and never resell returns (Ledger).

What's reported but not confirmed by Ledger:

• How much was stolen. Bitquery estimated $102 million from 324 wallets (CoinMarketCap, heise). Ledger says it hasn't confirmed the total number of victims or the value lost (CoinDesk).
• Devices outside Southeast Asia. A customer in Germany reported finding implants in devices bought at MediaMarkt, and MediaMarkt Saturn paused Ledger sales (CoinDesk, heise). Ledger says it inspected German retail and distributor stock without finding tampering, and that no implant-related losses have been reported in Europe (Casa).
• How long it went on. German tech outlet heise reports the basic method had been publicly known since May (heise).

How other wallet makers responded: Trezor removed CryptoBilis from its reseller list and said it had no reports of tampered Trezor devices from that seller (CoinMarketCap). It then began trimming its reseller network, telling affected partners their authorization ends January 1, 2027 (Decrypt). OneKey also ended CryptoBilis's authorization (OneKey).

Is my Ledger safe?

Ledger says every confirmed loss so far involves devices sold through CryptoBilis, and that its direct sales channel shows no sign of compromise (CoinDesk, Decrypt). Ledger's own advice:

• Bought from CryptoBilis and haven't set it up? Don't set it up. Contact Ledger Support.
• Bought from CryptoBilis and already set it up? Move your funds to a new device with a new recovery phrase, and don't restore any phrase on the CryptoBilis device (CoinDesk, Casa).
• Lost funds? Contact Ledger Support, file a police report, and talk to police before you open or ship the device (Cointelegraph, Casa).
• Bought somewhere else and want to check? Ledger has a hardware integrity guide, but opening a device can damage it and void the warranty, so back up your recovery phrase first.

And because scammers jump on every headline: Ledger says it will never call you, DM you, or ask for your 24-word recovery phrase (Decrypt).

This isn't the first hardware wallet scare

For context, here are earlier incidents, so you can see the patterns:

• 2020–2021: Ledger customer data leak, then fake devices in the mail. A 2020 breach exposed 272,000 Ledger customers' addresses. Scammers later mailed people fake "replacement" Ledgers with an added flash drive wired inside (CoinDesk, BleepingComputer).
• Reported 2023: A fake Trezor bought through a classifieds site. Kaspersky found a counterfeit Trezor Model T with a swapped chip and firmware that used one of 20 pre-generated seed phrases. The thieves knew the keys from day one (Kaspersky).
• December 2023: Ledger Connect Kit exploit. Attackers slipped malicious code into a Ledger software library used by crypto apps, tricking users into signing draining transactions. Ledger shipped a fix within 40 minutes of learning about it. The whole incident took about five hours to resolve (Ledger).
• 2025–2026: Physical phishing letters. Letters with Ledger or Trezor branding told people to scan a QR code and do a "mandatory" check, leading to sites that ask for your recovery phrase (The Block, BleepingComputer).
• Pre-seeded devices. Ledger warns about counterfeit devices that arrive "ready to use" with a printed 24-word phrase in the box. The scammers already know that phrase (Ledger Support).

The common thread is that most of these didn't break the secure chip. They went after the supply chain, the mail, or the moment you type or see your seed phrase. That's where to put your guard up.

How to buy a hardware wallet safely

• Buy direct from the manufacturer when you can, by typing the official site into your browser yourself (ledger.com or trezor.io) rather than clicking ads or search results. After this incident, "authorized reseller" alone isn't the safety net it used to be. Ledger's guidance still lists authorized resellers, and its own red flags include prices well below retail, opened or resealed packaging, and a recovery phrase already in the box (Ledger Support).
• Skip marketplaces, auctions, and "like new" or "tested return" units. Ledger has told its resellers that returned devices can never be resold (Ledger).
• Run the maker's authenticity checks, like Ledger's Genuine Check or Trezor's device authentication in Trezor Suite (Trezor). Trezor says a device that shows up with firmware already installed shouldn't be used (Trezor). Remember that these checks confirm the chip is real. They can't rule out an added implant.
• Never use a seed phrase you didn't generate yourself on the device (Ledger Support).
• Consider a passphrase (sometimes called a "25th word"). Trezor describes it as an extra layer that's never stored on the device (Trezor). Something that only reads the 24 words on screen wouldn't capture a passphrase you never display. That's a reasonable inference, not a guarantee. Our Seed Phrase Best Practices guide explains passphrases.
• For larger amounts, some people spread the risk across multiple keys and brands (multisig). Casa explains the idea in its write-up on this incident (Casa).

Then follow our Hardware Wallet Setup Guide and How to Move Crypto to Cold Storage. If you're comparing devices, see Cold Storage Wallets Compared.

What about taxes on stolen crypto?

We don't give tax advice, and the rules on theft losses are narrow and depend on your situation. Talk to a tax professional. To get familiar first, the IRS has Topic 515: Casualty, disaster, and theft losses and its digital assets page. The Taxpayer Advocate Service has a plain-language post on theft losses for scam victims. Either way, keep your police report, IC3 confirmation, and transaction records. Our Cost Basis Calculator and crypto tax reporting guide can help you organize the numbers.

Once things settle down

This part isn't urgent, but it's worth doing once you've caught your breath:

• Write down what happened while it's fresh, and keep it with your report numbers.
• Look at where your new seed phrase lives. Paper or metal, offline, and never in a photo or cloud note.
• Update your plan. If you keep an exit strategy worksheet or an estate plan for your crypto, update it with the new wallet. Our free Crypto Estate Planning tool helps you leave clear instructions without writing down the seed itself.

FAQ

What should I do first if my crypto is stolen? Stop using the compromised wallet, move anything left to a new wallet with a new seed phrase, and save every transaction hash and address. Then contact any exchange involved and file reports with IC3 (ic3.gov) and the FTC (ReportFraud.ftc.gov).

Who do I report crypto theft to in the US? The FBI's IC3 at ic3.gov, the FTC at ReportFraud.ftc.gov, your local police, your state attorney general, and the exchange that received the funds. If a hardware wallet was involved, contact the maker's official support too.

Can stolen crypto be recovered? Sometimes, partly. Funds that land on an exchange or in a freezable stablecoin can sometimes be frozen, but most blockchain transfers can't be reversed. Anyone who promises recovery for an upfront fee is almost certainly running a scam.

Are crypto recovery services legit? Be very careful. The FTC and FBI both warn that "recovery" companies and fake law firms target people who've already lost money. IC3 never contacts victims directly to offer recovery and never charges for it.

Was Ledger hacked? Ledger says its chip, operating system, and servers weren't breached. It says criminals tampered with genuine devices and sold them through resellers in Southeast Asia, with hidden implants that sent recovery phrases out over a cellular connection. The investigation is ongoing.

Is my Ledger safe if I bought it directly from Ledger? Ledger says all confirmed losses so far involve devices sold through the reseller CryptoBilis, and that its direct sales channel shows no sign of compromise. If anything about your device or packaging seems off, contact Ledger Support.

Does Ledger's Genuine Check detect tampering? Not this kind. Ledger says Genuine Check confirms the secure chip is real but can't detect added physical implants if the original chip is intact.

Should I revoke token approvals after a hack? Yes, if the theft came from a malicious approval and your seed phrase is still safe. If your seed phrase was exposed, revoking won't help. Move to a new wallet with a new seed.

Is stolen crypto tax deductible? That depends on your situation and the current rules, so talk to a tax professional. IRS Topic 515 covers theft losses in general.

Setting Up Fresh, Secure Storage (Optional)

There's no rush on this one. Once you've secured what's left and reported the theft, you might decide to start fresh with a new hardware wallet. If you do, a few safety basics come up again and again:

• Buy direct from the manufacturer. Not a reseller, not a marketplace, not a "like new" listing.
• Set up a brand-new seed phrase yourself on the new device. Never use a phrase that came in the box or that anyone else has seen.
• Follow our Hardware Wallet Setup Guide one step at a time.

Ledger and Trezor are two common options if you decide you want one, and they aren't the only ones. These links go to each maker's official store: Ledger or Trezor. Each product is offered by its own company, which is responsible for it, so review the product and its terms yourself before choosing. Fueled Crypto may earn a commission if you buy through these links, at no extra cost to you. Typing ledger.com or trezor.io into your browser yourself gets you to the same place.

Fueled Crypto publishes news and education, not investment, tax, or legal advice. Crypto assets are volatile and can lose value. Do your own research and consider a licensed professional before making financial decisions. See our full disclaimer and affiliate disclosure.

Want plain-English crypto news once a week? Subscribe to Fueled Crypto.