Filing a Police Report for Crypto Theft

Why the report matters to exchanges and to you

The crypto theft and the police report are separate layers of the same problem. A confirmed blockchain transfer is irreversible; neither the police nor an exchange can roll back a TxID. The report creates an official record of the victim's complaint and a registration number. Without that record, many platforms will not consider a request to freeze assets or disclose information about a deposit in another customer's account.

An exchange may need a formal basis to work through its law-enforcement or risk-review channel: a receipt or other registration number, filing date, authority, short description, and exhibits containing addresses. You need the number to track the report, answer follow-up questions, and distinguish an official complaint from a message sent to exchange support. It does not promise recovery and does not replace emergency response while unauthorized transfers are continuing.

The legal classification—such as theft, fraud, or a related offense—is for the relevant authority and a lawyer in the applicable jurisdiction. In Russia, discussions may refer to Articles 158 and 159 of the Criminal Code, but these are reference points for assessing the circumstances, not a promise that a report will receive that classification or lead to a criminal case. The outcome depends on the facts, jurisdiction, and completeness of the evidence. Anonymized examples are available in case studies.

Checklist: evidence to attach

1. Outgoing TxIDs, networks, amounts, UTC timestamps, and sender and recipient addresses. Keep explorer screenshots and a written list.
2. A timeline of how you discovered the theft, what happened before and after, and which devices and applications were involved.
3. Correspondence, emails, phishing links, and screenshots of supposed support chats, while preserving the original files.
4. If the assets reached an exchange, identify the suspected platform, deposit address if known, and support-ticket numbers.
5. Evidence connecting you to the source address under the platform's or authority's procedure, such as statements or deposit history, but never a seed phrase or private key.
6. Retain the notification receipt or another document containing the registration number immediately after filing.

The minimum package is similar to what specialist crypto-crime reporting channels request: wallet addresses, transaction hashes, amounts, dates, and a description of the scheme. FBI IC3 materials provide a public reference for complaint contents; confirm the local report form with the relevant police office or a lawyer where you are located. Do not attach a seed phrase, 2FA passwords, or a complete wallet backup. These are not safe proof of ownership to share with third parties and may enable another theft.

If the chain branches or you need a coherent transaction map for the police report and an exchange request, first preserve the raw TxIDs, then develop the map through blockchain analytics. An analytics report does not replace a police report or compel an exchange to freeze assets.

Why the registration receipt matters—and what it does not do

In Russia, when a crime report is filed in person at a Ministry of Internal Affairs police station, it is entered in the KUSP incident-report register and the filer receives a notification receipt with the same registration number as the retained counterfoil. The receipt generally identifies the authority, acceptance date and time, and duty officer. It is the initial reference number before any decision to open a criminal case. The acceptance and receipt procedure is governed by Ministry instructions on registering crime reports and notifications.

The receipt number can confirm the fact and date of filing, be cited in exchange and risk-review correspondence, help track the review period, and provide a reference for a lawyer or representative. Without it, you may be left with only an oral statement, which is often insufficient for a platform.

A receipt number does not mean that a criminal case has been opened, assets have been frozen, or recovery is assured. A refusal to open a case, suspension, or a lengthy preliminary review are possible outcomes, especially when the exhibits do not show a clear transaction chain to an exchange. At the same time, avoid any recovery scheme that asks for an upfront payment; a "recovery guarantor" approaching a theft victim may be another scam.

What not to do and the limits of the legal route

• Do not attach a seed phrase, private keys, 2FA passwords, or a complete backup as "proof."
• Do not delete original emails, chats, or screenshots before making copies.
• Do not confuse an exchange support chat with a registered police report; without a receipt number, a formal request may stall.
• Do not prepay a supposed recovery service for a "guaranteed return."

A map based on TxIDs shows where the assets went, not who is definitively responsible. Without a map, the report may contain little more than a missing balance; with one, there may be an identifiable exchange to receive a request. The legal route is relevant when formal registration, assistance with requests, or a coordinated document package for the platform is needed. These tasks fall within legal support. DefCrypt does not replace a lawyer and does not promise an investigation or recovery.

If the theft is still active, with continuing or unknown outgoing transfers, secure access and preserve evidence first through emergency response. Prepare the report from facts that have already been recorded so that you do not lose evidence and remaining assets at the same time.