What to Do Immediately After a Crypto Loss

This cluster answers the first urgent question after fraud, wallet theft or a suspicious authorization: what must be done now, and what should wait.

Contain further loss first

Stop transfers and interaction with the suspicious service. After preserving necessary evidence, review remaining assets, token approvals, permit-style signatures, multisig settings and connected devices. Asset migration should reflect the compromise mechanism so that an unverified action does not destroy evidence or expand risk.

The first 30 minutes, 24 hours and 7 days

1. First 30 minutes: preserve transaction hashes, addresses, pages, chats and device state; isolate the suspected entry point.
2. Within 24 hours: verify the actual loss transaction and organize asset, amount, time and recipient data into a timeline.
3. Within 3 to 7 days: use the fund path to identify exchanges, bridges or other evidence-request targets and prepare reporting materials.

Evidence boundary

On-chain records prove that transactions occurred, but do not alone establish the device controller, chat identity or legal responsibility. Freezing, attribution and recovery judgments require the path, entity evidence and applicable process.