1. Home
2. Services
3. Emergency response

Emergency response after cryptocurrency theft or a hack

We help protect remaining assets, preserve evidence, and prepare requests to freeze funds that have reached an exchange.

Situations that may require an emergency response

Choose the closest situation. During the initial assessment, we identify safe actions and possible next steps.

Funds are moving without your consent. Record the TxIDs and protect the remaining balance.

Unknown sessions have appeared. Restrict access and preserve incident data.

We document fund movements and prepare a freeze request. The exchange makes the decision.

Phishing, malware, or remote access may be involved. Do not use the suspected device.

What to do after a hack or unauthorized transfer

First secure access and preserve incident data. Further action depends on the type of compromise.

Do this now

Record TxIDs, addresses, and transaction times. From a safe device, end unknown sessions, change passwords, and review 2FA settings.

Do not do this

Do not delete transaction history or correspondence. Do not install software at a stranger's request or continue using a suspected device.

What to share for an emergency assessment

• ?

  Incident type: unauthorized transfer, unknown sessions, phishing, or transfer to an exchange

• ?

  TxIDs and recipient addresses, if known

• ?

  Affected assets, networks, and remaining balance

• ?

  Device used and actions taken after the incident

• ?

  Whether you have contacted an exchange support team or other specialists

How the response proceeds

Initial assessment

We receive a description of the situation and any available TxIDs and addresses.

Protect accounts and assets

We review access, unknown sessions, and remaining assets and identify safe actions.

Parallel action

We protect the remaining assets, prepare exchange requests, and begin tracing transactions.

Stabilization

We check whether the transfers and unknown sessions have stopped, then identify possible next steps.

Emergency response pricing

Frequently asked questions about emergency response

Sometimes recovery may be possible if the assets are still on an exchange or within a traceable chain. We document TxIDs, prepare freeze requests, and help protect the remaining assets. Recovery is not guaranteed.

Transaction tracing can still establish whether funds reached an exchange. Further work may involve transaction analysis and legal support.

Not always. First preserve transaction history, correspondence, and other available data. Further action depends on the type of compromise.

If the attack is continuing, use Telegram. If chat is unavailable, submit the form and select "Attack still in progress."

No. The exchange decides whether to freeze assets, and confirmed blockchain transactions cannot be reversed. We document the evidence and prepare substantiated requests.

Next steps after stabilization

Crypto transaction analysis

To trace fund movements, identify exchanges, and prepare evidence.

Resolving exchange account restrictions

For account or withdrawal restrictions, or an AML or KYC review.

Wallet access recovery

To assess options for restoring access after a wallet compromise.

Legal support

To prepare a statement and supporting documents after the facts have been recorded.

Describe what happened

Answer a few questions so we can assess the situation and suggest the next steps.

Crypto investigations, support with exchange restrictions, and asset access recovery.