What to Do If Your Crypto Assets May Have Been Stolen

If you believe your crypto assets (also known as virtual currencies) have been stolen — or suspect they may have been — it's essential not to get your initial response wrong. Continuing to operate your account in a panic, or replying to a suspicious contact, can not only make it harder to understand what actually happened but also expose you to further, secondary harm.

Start by checking your transaction history for any transfers you don't recognize. If you find an unauthorized transfer, save the date and time, the destination address, the amount, and the transaction ID, and then contact the support team of the exchange (order-book marketplace) or wallet you use, as well as the police and a consumer affairs center.

On the other hand, if your balance simply isn't showing, an app won't open, or you can't log into your wallet, this may not be theft at all — it could instead be a recovery or display-settings issue.

This article explains what to do if your crypto assets are stolen, actions you should avoid, cases that may not actually be theft, and management practices worth reviewing to prevent a recurrence. If you can't tell on your own whether this is theft or simply a loss of access, don't keep operating your account — please consult Clabo instead.

What to Do If Your Crypto Assets Are Stolen

If your crypto assets may have been stolen, continuing to operate your account in a panic can cause you to lose evidence or expose you to further harm. That's why it's important to first calm down, organize the situation, and take steps to prevent the damage from spreading.

This section explains what to check and what steps to take promptly when you feel your crypto assets have been, or may have been, stolen.

Check Your Transaction History for Unrecognized Transfers

First, check the transaction history on the exchange or wallet you use. If you find a transfer you don't recognize, your crypto assets may have been moved to an external address.

The items you should check are as follows.

• Date and time of the transfer
• Type of crypto asset transferred
• Destination address
• Amount
• Transaction ID

A transaction ID is a number used to identify a transaction on the blockchain. It's similar to a transfer record for a bank transfer, and it becomes important information when you need to verify what happened later.

It's a good idea to save your transaction history as a screenshot or PDF. When you consult the police or an exchange, explaining the situation verbally alone often isn't enough to convey what happened, so it's important to keep verifiable records.

Incidentally, jumping to the conclusion that your assets have been stolen just because your balance isn't showing can sometimes be premature. In some cases, the assets are simply not visible due to selecting the wrong network, a token not being displayed, or a change in the wallet app's specifications.

Contact the Support Team of the Exchange or Wallet You Use

If crypto assets may have been fraudulently transferred out of your exchange account, contact the exchange's support team immediately. Exchanges can often check login and withdrawal history on their end for accounts held with them. So if you suspect unauthorized login or withdrawal, don't rely on your own judgment alone — ask the exchange to verify the situation as well.

When you contact support, it helps to organize the details — when, which crypto asset, and to which address it was transferred — before explaining. If you have screenshots of the transfer history, the transaction ID, or emails notifying you of a suspicious login, save those too. Having this information makes it easier to explain the situation to the exchange.

On the other hand, if crypto assets have been moved out of a wallet, contacting support won't necessarily stop it the way it might with an exchange. A wallet is a mechanism for accessing your assets using a private key or recovery phrase (seed phrase). If a third party knows this information, continuing to use the same wallet is itself a risk.

When looking into a wallet issue, be careful about where you inquire. Search results and social media can display fake websites or fake accounts posing as legitimate support. Under the pretext of "recovery" or "verification," you may be asked to enter your private key or recovery phrase. So before reaching out, always confirm that the URL is official.

Review Passwords and Two-Factor Authentication on Related Accounts

If you suspect unauthorized login to an exchange, change your exchange password first. If you use the same password on other services, you need to change those as well. If one set of login credentials has been leaked, the same credentials could be used to log into other services without authorization.

At the same time, check the security of the email address registered with your exchange. If your email account is compromised, it could be used to reset your exchange password or intercept withdrawal notifications. So don't just review the exchange itself — also change the password on your registered email and check its login history.

If you haven't set up two-factor authentication, do so immediately. Two-factor authentication is a mechanism that verifies your identity through an authenticator app or SMS in addition to your password. With this in place, even if your password becomes known, it becomes harder for a third party to log in right away.

Even if you've already set up two-factor authentication, that doesn't guarantee safety. Check whether the device with your authenticator app has been accessed by a third party, and whether your backup codes are stored somewhere others could see. If you find a login from an unfamiliar device, you also need to log it out and revoke its access.

Stop Entering Your Private Key or Recovery Phrase Anywhere Else

If your crypto assets may have been stolen, it's essential to stop entering your private key or recovery phrase anywhere from this point on. Your private key and recovery phrase are the most critical pieces of information for accessing the assets in your wallet.

Entering these into a fraudulent site or fake app allows a third party to restore your wallet and move your assets. If you've already entered them once, that wallet may no longer be safe, so it's risky to keep leaving assets in it.

Be especially wary of messages like "Enter your recovery phrase to recover your assets" or "Send your private key to sync your wallet." Legitimate services never ask users to send their private key or recovery phrase.

Searching in a panic after being victimized can lead you to fraudulent sites disguised as recovery services. First, check information from official websites and public agencies, and avoid casually entering personal or wallet information.

Contact the Police, a Consumer Affairs Center, or Other Support Channels

If your crypto assets may have been stolen or you may have fallen victim to fraud, contact the police, a consumer affairs center, or another support channel. If the amount involved is large, or if you've been in contact with the perpetrator, it's important to consult these channels early.

When you consult with them, it helps to organize your transfer history, transaction ID, messages with the other party, the website URL, the transfer destination details, and the other party's social media account. This information will serve as evidence for explaining what happened.

Support channels in Japan include the police consultation hotline, the Consumer Hotline, and the Financial Services Agency (FSA)'s Financial Services User Consultation Office. If the matter is urgent, or if you're likely already the victim of a crime, also consult your nearest police station.

With crypto asset theft, the longer time passes, the more the stolen assets tend to move through additional destinations, making the situation harder to trace. Don't rely on your own judgment alone — it's important to contact a support channel early.

Actions to Avoid If You Suspect Your Crypto Assets Have Been Stolen

When your crypto assets may have been stolen, what you don't do matters just as much as what you do. Right after being victimized, panic and anxiety can run high, causing you to react to guidance you'd normally be suspicious of.

You should be especially careful of services posing as recovery agents and additional demands from the scammer. If your desire to recover your assets is exploited and you end up handing over more crypto or personal information, the damage can spread further.

Don't Casually Trust Services That Claim They Can Recover Your Assets

Be wary of services that advertise "We can recover your stolen crypto assets" or "You will definitely get them back."

Some services can investigate the destination address or transaction, but that alone doesn't guarantee the assets can be recovered. If the funds have already been moved on to yet another address, or routed through an overseas service, recovery by the victim alone becomes difficult.

For that reason, be cautious of services that guarantee recovery or that demand large upfront fees. In particular, if you're asked to submit your private key or recovery phrase at the consultation stage, this could lead to further, secondary harm.

When choosing where to seek help, it's important to check whether they clearly explain what they can and cannot investigate. If a service uses language that guarantees recovery, it's best not to trust it too readily.

Don't Reply to or Negotiate with the Scammer

If you sent crypto assets to someone you met on social media, a dating app, or an investment group, and those assets were stolen, avoid continuing to reply to or negotiate with that person. They may cite reasons such as taxes, fees, security deposits, or identity verification costs to get you to send even more.

A woman I met on social media told me, "Crypto assets are the way to go if you're investing right now," and I downloaded the crypto trading app she recommended. As we traded, I was told things like "a security deposit is required" and "this procedure requires a tax payment of ●%," and I ended up transferring money to a designated account multiple times, losing more than ¥100 million (roughly USD 650,000–700,000 at illustrative exchange rates) in total.

Source: National Police Agency — Special Fraud Prevention page (in Japanese)

Contacting the scammer to ask for your assets back doesn't guarantee you'll get them. In fact, letting them know how anxious you are or how much damage you've suffered may only invite further demands.

You should also not comply if the other party explains that "an additional transfer is required to withdraw" or "you can withdraw once you pay a fee." Legitimate exchanges and financial services do not normally ask you to send additional funds to a personal wallet in order to withdraw.

Rather than continuing the exchange, it's more realistic to save the message history and the other party's account details and consult the police or a consumer affairs center.

Don't Share Your Private Key or Recovery Phrase with a Third Party

Never share your private key or recovery phrase with a third party, regardless of the reason. Anyone who knows this information could restore your wallet and move your assets.

For example, you should not comply even if you're told "send your recovery phrase so we can check the extent of the damage" or "we need your private key to repair your wallet." Even legitimate support staff or specialists have no need to ask for your private key or recovery phrase itself.

Screen sharing also requires caution. If someone claiming to be support asks you to share your screen and sees your recovery phrase or authentication code, it can amount to the same thing as handing over the information directly.

When it comes to managing crypto assets, never showing your private key or recovery phrase to anyone else is the basic rule. This principle doesn't change even after you've already been victimized.

Don't Comply If Asked for ID Documents or Additional Transfers

Don't comply if a scammer or a suspicious service asks you for identification documents or additional transfers. Handing over images of your driver's license, My Number Card, or passport could see them used in a separate scam or fraudulent activity.

There are also cases where you're asked for additional transfers under pretexts like "to unfreeze your assets," "to pay taxes," or "to pass withdrawal review." If you've already sent money to a suspicious party, sending more won't necessarily get your assets back.

At legitimate Crypto Asset Exchange Service Providers, identity verification is handled through the official website or official app. If you're asked to send identification documents via a social media DM or a personal chat, you should suspect fraud.

If you're uneasy, consult a consumer affairs center or the police before responding to the other party. Judging the situation on your own risks being swayed by the other party's explanations.

Cases That May Look Like Theft But Aren't

Even if your crypto assets aren't showing up, that doesn't necessarily mean they've been stolen. In some cases, the assets simply aren't visible because you can't log into the wallet, the app has been discontinued, or the display settings aren't configured correctly.

Making this distinction matters. If you panic and enter your private key or recovery phrase into a suspicious site even though your assets weren't actually stolen, you could end up causing a genuine theft.

You Can't Log Into Your Wallet

Rather than being stolen, your crypto assets may simply be inaccessible because you can't log into the wallet. In this case, even if you can't log in, as long as you still have the recovery phrase or private key, you can restore your old wallet's asset status using a different wallet.

However, not every wallet can be restored the same way. The correct recovery method depends on the type of crypto asset, the wallet standard, and the address format. So first check the information you still have on hand and the type of wallet you were using, then try recovering it with a compatible alternative wallet.

Assets Not Visible Because an App Was Discontinued or Its Specifications Changed

The wallet app you previously used may have been discontinued, or its interface may have changed. In this case, the assets themselves haven't disappeared — you may simply no longer be able to access them the same way as before.

Even for a wallet whose service has ended, if you still have the recovery phrase or private key, you may be able to restore it using a compatible alternative wallet. However, for a wallet whose official support has ended, it becomes harder to find accurate information.

Clabo has previously handled cases involving the recovery of assets held in a wallet whose service had ended (related article: How to Recover an "Infinito Wallet" — Explained Using a Case Where Assets Were Recovered After the Service Ended (in Japanese)). If you're facing a similar issue, please don't hesitate to consult us.

Assets Not Visible Due to Network or Display Setting Differences

Differences in network or display settings are another reason crypto assets may not appear. For example, even when using the same wallet, if you have a different network selected, the assets you hold may not show up.

A network refers to the specific blockchain on which a crypto asset's transaction records are managed. Multiple networks exist, including Ethereum, BNB Smart Chain, and Polygon. If the network you sent the funds on differs from the network your wallet is currently displaying, the assets may not be visible.

Some wallets also don't display tokens automatically. A token is a crypto asset issued on a specific blockchain. Unless you manually add the token for display in your wallet, the balance may not appear.

You may need to add the token as a custom token in MetaMask for it to display.

Source: MetaMask FAQ (in Japanese)

In cases like these, the issue may be one of display rather than theft. It's important to check your transaction history and on-chain information to determine which network your assets are actually on.

Management Practices to Review to Prevent Crypto Asset Theft

Preventing crypto asset theft requires reviewing your everyday management practices. In particular, how you store your private key and recovery phrase, and which sites you connect your wallet to, are both important.

Unlike a bank account, crypto assets can't necessarily be frozen just by contacting a service desk. With a self-custody wallet, you're responsible for protecting your own access information.

Never Tell a Third Party Your Recovery Phrase or Private Key

As emphasized throughout this article, you must never, as a rule, tell a third party your recovery phrase or private key.

As for how to store your recovery phrase or private key, it's best to avoid saving them in an online notes app, email, or cloud storage. If that account is ever taken over, the information you stored there could be exposed as well.

It's important to store them using a method disconnected from the internet, such as on paper or a metal plate, and to keep it somewhere a third party can't see.

Don't Connect Your Wallet on Anything Other Than the Official Site

When connecting your wallet, always confirm that you're on the official site. A site you reached through a search ad or a social media link may be a fake site posing as the official one.

Connecting your wallet to a fake site can result in being asked for a fraudulent signature or approval. An approval grants a specific service permission to operate the crypto assets in your wallet. Granting this permission to a malicious site carries the risk of having your assets moved out.

Repeatedly clicking the approve button without checking what's being displayed when connecting your wallet is dangerous. In particular, avoid connecting or approving anything on a service you don't recognize, or a site that pressures you to act quickly.

It's a good idea to bookmark the official sites of the exchanges and wallets you use often. This lowers the risk of landing on a fake site compared with accessing them from search results each time.

Set Up Two-Factor Authentication on Exchanges

If you use a crypto asset exchange, set up two-factor authentication. Without it, the risk of unauthorized login rises significantly if your email address and password are ever leaked.

Methods for two-factor authentication include authenticator apps and SMS. If possible, use an authenticator app, and keep your backup codes stored somewhere safe as well.

It's also important not to reuse the same password for your exchange and your email address. If a password leaks from one service, it could be used to log into other services without authorization.

Some exchanges offer features such as withdrawal confirmation emails and restrictions on registering withdrawal addresses. Enable whatever security features are available to you.

Don't Trust Suspicious DMs or Investment Pitches

If someone you met on social media or a dating app recommends a crypto asset investment, judge the offer carefully. Investment pitches from people you don't actually know can lead to fraud.

Be especially careful if you're told things like "guaranteed profits," "you can only join right now," or "an additional fee is required to withdraw." As a financial product, no investment can guarantee a profit.

You should also confirm whether the exchange or investment site the other party is directing you to is a real, legitimate business. Any business operating a Crypto Asset Exchange Business is required to register with the FSA and the (Local) Finance Bureau, and the FSA publishes a list of registered providers on its official site (source: List of Registered Crypto Asset Exchange Service Providers (in Japanese)).

If you feel even the slightest bit suspicious, consult a consumer affairs center or the police before sending any funds. Recovering assets after a transfer is often difficult, so stopping it beforehand is what matters most.

If You Can't Judge the Situation Yourself, Consult a Specialist

Even if you think your crypto assets have been stolen, they may in fact simply be inaccessible rather than actually stolen. On the other hand, if your transaction history shows a transfer you don't recognize, you need to respond promptly as a case of unauthorized transfer or fraud.

Making this determination on your own isn't easy. With crypto assets, you need to sort out the situation by checking the type of wallet, whether you still have the private key or recovery phrase, the network, and the transaction history.

In particular, if you still have your recovery phrase or private key on hand, it may not be theft at all — recovery may be possible using the right method. However, getting the recovery method wrong carries the risk of assets still not showing up, or of entering critical information into a suspicious site.

Clabo offers situation assessments for cases where crypto assets may have been stolen or a wallet has become inaccessible. If you can't tell on your own whether it's theft or simply a loss of access, first organize your current situation and then consult us.

Summary

If your crypto assets may have been stolen, it's important to first check your transaction history for any transfers you don't recognize. If you confirm an unauthorized transfer, save the destination address and transaction ID, and consult the exchange, the police, or a consumer affairs center.

On the other hand, situations where your balance isn't showing, you can't log into your wallet, or an app is unusable may reflect a loss of access rather than theft. If you still have your recovery phrase or private key, you may in some cases be able to access your assets through another method.

Immediately after being victimized, be careful of services that claim they can recover your assets and of additional demands from the scammer. Handing your private key, recovery phrase, or identification documents to a third party risks leading to further, secondary harm.

The right response to crypto asset theft or a loss of access depends on the situation. If you can't judge it yourself, don't keep operating your account — consider consulting a specialist instead. Clabo also offers situation assessments regarding possible theft and the feasibility of recovery, so please don't hesitate to consult us if you're facing this issue.

This article is for informational purposes only and does not constitute financial or investment advice. Please consult a qualified professional before making investment decisions.