Do this now
Record TxIDs, addresses, and transaction times. From a safe device, end unknown sessions, change passwords, and review 2FA settings.
Service · Emergency response
Emergency response after cryptocurrency theft or a hack
We help protect remaining assets, preserve evidence, and prepare requests to freeze funds that have reached an exchange.
Signs of an attack
Situations that may require an emergency response
Choose the closest situation. During the initial assessment, we identify safe actions and possible next steps.
Unauthorized transfers
Funds are moving without your consent. Record the TxIDs and protect the remaining balance.
Email or 2FA compromisedUnknown sessions have appeared. Restrict access and preserve incident data.
Funds are reaching an exchangeWe document fund movements and prepare a freeze request. The exchange makes the decision.
Device compromisedPhishing, malware, or remote access may be involved. Do not use the suspected device.
First actions
What to do after a hack or unauthorized transfer
First secure access and preserve incident data. Further action depends on the type of compromise.
What to do and what to avoid
Do not do this
Do not delete transaction history or correspondence. Do not install software at a stranger's request or continue using a suspected device.
What to share for an emergency assessment
Incident type: unauthorized transfer, unknown sessions, phishing, or transfer to an exchange
TxIDs and recipient addresses, if known
Affected assets, networks, and remaining balance
Device used and actions taken after the incident
Whether you have contacted an exchange support team or other specialists
Process
How the response proceeds
Initial assessment
We receive a description of the situation and any available TxIDs and addresses.
Protect accounts and assets
We review access, unknown sessions, and remaining assets and identify safe actions.
Parallel action
We protect the remaining assets, prepare exchange requests, and begin tracing transactions.
Stabilization
We check whether the transfers and unknown sessions have stopped, then identify possible next steps.
Pricing
Emergency response pricing
Estimated pricefrom $1,000
The initial assessment is free. The price depends on the number of affected accounts, networks, exchanges, and required actions. Terms are agreed before paid work begins.
FAQ
Frequently asked questions about emergency response
Can stolen cryptocurrency be recovered after it has been transferred?
Sometimes recovery may be possible if the assets are still on an exchange or within a traceable chain. We document TxIDs, prepare freeze requests, and help protect the remaining assets. Recovery is not guaranteed.
Is it worth seeking help after funds have passed through several addresses?
Transaction tracing can still establish whether funds reached an exchange. Further work may involve transaction analysis and legal support.
Should I reset the device immediately?
Not always. First preserve transaction history, correspondence, and other available data. Further action depends on the type of compromise.
Telegram or the assessment form?
If the attack is continuing, use Telegram. If chat is unavailable, submit the form and select "Attack still in progress."
Do you guarantee a freeze or recovery?
No. The exchange decides whether to freeze assets, and confirmed blockchain transactions cannot be reversed. We document the evidence and prepare substantiated requests.