What to do in the first hour after your crypto is stolen

· 4 min read · KadenaTrace

If your wallet was just drained, the first hour matters more than the first week. Funds that reach an exchange can sometimes be held there, but only if the exchange hears about it before they are withdrawn. This guide walks through the order that works, using a theft KadenaTrace traced on October 26, 2026: about $1.58M taken from one Ethereum wallet in a suspected private-key compromise, now watched as case KT-10.

1. Stop further loss (minutes 0 to 10)

A thief who has your key, or an approval you signed, can usually take more. Before anything else:

  • Move what is left to a fresh wallet with a new seed phrase, made on a device you trust. Do not reuse the old seed anywhere.
  • Revoke token approvals on the old address. A drainer often leaves approvals in place to take tokens that arrive later. Use the revoke tool of your wallet or a reputable approval checker, and pay the gas; it is cheaper than the next loss.
  • Do not send gas to the drained wallet to "rescue" tokens. Automated sweepers watch compromised addresses and take any ETH the moment it lands. If you must, use a specialist who bundles the rescue in one block.

In KT-10 the attacker moved funds out in a single sweep: the trace shows about $1.5M leaving the address and most of it going into Tornado Cash in many transactions within hours. Once funds are in a mixer, the trail is hard to follow; the window for action is before that.

2. Keep the evidence (minutes 10 to 20)

Write down, in one place:

  • the drained address and the network;
  • the transaction hashes of the theft (from the explorer, not from memory);
  • the time, in UTC;
  • what you did just before: a site you connected to, a message you opened, a file you ran, a signature you approved;
  • screenshots of the wallet and of anything you clicked.

Exchanges, the police and investigators will all ask for this, and they will ask for hashes, not stories. Explorer links for the theft transactions are enough; KadenaTrace's case page keeps them for you.

3. Trace the funds (minutes 20 to 30)

Paste the drained address into Trace. The trace follows the money hop by hop, through swaps and bridges, and tells you if any of it reached an exchange deposit address. That is the one place a freeze request can work.

What the trace cannot do: it cannot see through a mixer, it cannot name the person, and it reads a limited number of addresses, largest amounts first. If the page says a figure is "at least" or "so far", that is why. Read how to trace stolen crypto for the details.

4. Tell the exchanges (minutes 30 to 45)

If the trace shows a deposit to an exchange, open that exchange's support or law-enforcement page and file a report with the hashes, the deposit address and the amount. Say plainly that the funds are the proceeds of a theft and ask them to hold the account pending a police report. Exchanges do not freeze on request from a stranger, but a timely report with hashes is what makes a later freeze possible.

A deposit is not a freeze. Nothing on an explorer, and nothing on KadenaTrace, shows that an exchange held the funds; only the exchange can tell you that. Exchange deposits and freezes explains what a deposit address is and what to put in the request.

5. File a police report (within the day)

Most exchanges will not act on an account without a case number from a law-enforcement agency. File with your local police or cybercrime unit the same day, and bring the evidence list from step 2. In many countries there is an online cybercrime portal; use it, and keep the reference number.

6. Get the funds watched (any time)

Registering the theft as a case on KadenaTrace puts the address under watch. Every move of the funds is recorded on Kadena, where nobody can quietly edit it, and you can get an email or Telegram message the moment the funds reach an exchange. Report a theft; the first case is free.

KT-10 was registered this way on October 27, 2026, hours after the alert. Its page shows every recorded move and the current standing of the funds. As of this writing, the sources do not report any freeze or recovery.

What not to do

  • Do not pay a "recovery service" that contacts you first. The people who message victims on X and Telegram offering to recover funds for a fee are the second scam.
  • Do not post your seed phrase or private key anywhere, including to "support" accounts.
  • Do not send more to the thief because a message promises a return.

The case this guide follows

KT-10 on KadenaTrace: about $1.58M reported lost on October 26, 2026 by @realScamSniffer, with CertiK reporting Tornado Cash deposits that traced to the drain. The attacker address is named in the sources; the victims are not identified. Figures on this page are as reported and traced on October 31, 2026; the case page has the current state.

More guides