Who to Contact After Crypto Theft: Police, Lawyer, or Forensics

Protect the remaining assets, then choose a channel

Two clocks start after theft. The first follows the transaction chain: funds can reach exchange deposits, DEXs, bridges, and mixers within hours. The second is procedural: a police report, requests, and court proceedings. "Who to contact" belongs to the second clock. If the wallet is still being drained, prioritize emergency response: a new address on a clean device, revoked token permissions (approvals), moving the remainder, and preserving outgoing TxIDs. Police and a lawyer will not close that hole for you.

The dogma "run to the police station immediately or everything is lost" is harmful here. Without addresses, hashes, and screenshots, a report amounts to "the money disappeared." Without securing access, you lose the remainder while waiting in a queue. Filing with an authority makes sense when you have exhibits—or when a platform already asks for a registration number. That is not a ban on filing; it is an order of operations: stop the outflow first, then prepare the paperwork.

Do not give a seed phrase to a "lawyer from a chat" or prepay a "recovery guarantor." Victims are often hit a second time after theft. A verified document workflow sits under legal support. DefCrypt does not replace a lawyer and does not promise recovery.

What police, a lawyer, and analytics can actually do

Police work is official recording and a request channel—not a "crypto recovery service." How to assemble exhibits and why the receipt matters is covered in filing a police report for crypto theft. Local units rarely build a full hop map themselves: they need addresses, amounts, UTC times, and a clear scheme. Opening a case, restraining assets, and recovery do not follow from filing alone.

A lawyer becomes useful when the package must be formalized, an exchange or authority requires a structured request, or court action is under discussion. Timing is covered in when to involve a lawyer after crypto theft. Analytics answers where the funds went: that is blockchain analytics, not a promise to find a name. If you sent funds voluntarily in a scam rather than suffering a wallet compromise, start from what to do after a crypto scam.

Checklist: who to contact, and in what order

1. Hours 0–2: secure access, move the remainder, and preserve outgoing TxIDs, addresses, network, and UTC time.
2. Walk one to three further hops in an explorer: a personal address, a likely exchange deposit, a bridge, or a mixer—without endless clicking.
3. If withdrawals are still moving or an exchange deposit is only just appearing, prepare a hold request in parallel; do not wait for a "full investigation."
4. Once the facts are recorded: decide whether you need a report registration number now (exchanges often ask for it) or the package is still incomplete.
5. Involve a lawyer for report wording, requests, and court assessment—not as a substitute for steps 1–3.
6. Do not prepay "guaranteed recovery" or hand keys to third parties.

A practical fork. A small amount and a trail that ends at a mixer: preserving the trail is often more proportionate than heavy proceedings. A large amount and a live exchange deposit: analytics and a platform request should not wait for an investigator's reply. Multiple jurisdictions or a platform that will not act without a court order: a lawyer assesses whether there is an enforceable target—see recovering crypto through court.

Channels do not have to run in a strict queue. Protecting the remainder and collecting TxIDs starts immediately; a police report, a tracing report, and a lawyer start when each has inputs. Waiting for one channel before starting another often burns the exchange window. The outcome still sits with the platform, the authority, and the facts. Anonymized examples are in case studies.

What not to do: a single channel and recovery guarantors

• Do not choose only the police and wait months while funds leave an exchange deposit.
• Do not message platform support "return my crypto" without TxIDs, addresses, and a description of the scheme.
• Do not replace analytics with endless browsing of random addresses.
• Do not pay a "government fee," "FBI contact," or "channel unfreeze" to someone else's wallet.
• Do not give a seed phrase, keys, or remote access to a "forensics expert" or "lawyer" from a messenger chat.

FBI IC3 has published warnings: fictitious law firms and prepaid "we recover everything" services target crypto-scam victims. Law-enforcement agencies do not charge victims to investigate a report. Verify the contract and registration details of a real legal entity, not a chat nickname.

If you are unsure which channel to start with, secure access and collect facts first, then discuss the package. Scope and document preparation sit under legal support. That is not a promise that a case will be opened, assets frozen, or funds recovered.