Help Someone After Crypto Theft: First Steps for a Relative

What to say—and what not to say

Shame stops people from asking for help more often than the size of the loss. Lines such as "I warned you" or "how could you give away a password" do not reverse a transfer and shut the person down. More useful: "we are not assigning blame now; we are recording facts and closing the hole." Next is a short timeline, not an interrogation.

Do not promise that "everything will be back by tonight": you are not the exchange and not a court. Realistic aims are stopping further losses and building an evidence package. If this was a knowing transfer under deception, use the victim checklist in what to do after a crypto scam. If outgoing transfers happened without their click, see crypto stolen from a wallet.

Your role is structure while they are in shock: a paper list of steps, a second look at a link, a reminder not to send more. Your role is not to become the new holder of their keys "for the crisis."

First steps together: a helper checklist

1. Agree out loud: no new transfers for a "fee," "tax," "unlock," or "to get funds back."
2. Help preserve chats, URLs, account or error screenshots, and usernames while the chat and site still open.
3. Write down outgoing TxIDs, networks, addresses, amounts, and times together; keep a copy with the victim, not only with you.
4. If the device is suspect, do not install "helpers" on it and do not enter a seed phrase; a new wallet only on a clean device, with the owner writing the phrase offline.
5. Change email and exchange passwords from another device; do not read 2FA codes into the same chat the scammer used.
6. A police report is filed by the victim; you can assemble a folder and go along, but you cannot sign for them.

Do not send rescue transfers from your own wallet "to save the rate," and do not sign in to their exchange in your name. If the amount matters to the household, it may be reasonable to involve a crypto theft lawyer—that is the victim's decision, not a relative's ultimatum.

What not to do together

• Do not take the seed phrase "for safekeeping with someone reliable"—that is a new leak and a new conflict.
• Do not install an APK, a "recovery" extension, or remote-access software "for a specialist from search" together.
• Do not message the scammer "we already went to the police" to speed a refund—that often triggers another payment demand or a vanished dashboard.
• Do not post TxIDs and chats in family groups that include people you do not know.

Shared panic produces the same mistakes as solo panic, only faster. If you need a second view of the on-chain route, send the TxID package to blockchain analytics, not a "tech friend with admin tools." The model without an up-front "recovery" fee is on success fee.

Second-scam risk: helpers are targets too

After a theft, messages do not go only to the victim. A relative gets "we are handling your brother's case; pay for an expert review in USDT." That is the same class FBI IC3 warns about: an up-front fee in exchange for a promise to recover crypto. Vet any new contact together before paying or handing over access.

When to involve a specialist: the amount hits the family budget, the route already touches several platforms, or you cannot tell seed compromise from deception. The decision belongs to the victim. A start without a miracle promise is emergency response.