Immediate (first minutes–hours)

1. Stop further compromise

   • Disconnect the affected device from the internet and power it down if you suspect it’s compromised.

   • Move any remaining funds to a safe cold wallet only if you are 100% sure the receiving wallet and device are secure. If not sure, wait — moving funds can make investigation harder.

2. Change passwords and secure accounts

   • On a separate, clean device: change passwords and enable 2FA (use an authenticator app, not SMS) for your email, exchange accounts, and any other accounts tied to your crypto.

   • Revoke any suspicious wallet approvals (e.g., ERC-20 token allowances) using a reputable site like Etherscan’s token approval checker from a secure device.

3. Preserve evidence

   • Record wallet addresses involved, transaction IDs (txids), times (UTC), amounts, and which assets were stolen.

   • Take screenshots and export any logs, wallet backups, seed phrases (securely), exchange account activity, emails, and messages that show the theft or suspicious access.

Next steps (same day–few days)

4. Trace the funds (what you can do yourself)

   • Use a block explorer (Etherscan, BSCScan, etc.) to follow the txids and note any exchange deposit addresses or mixers used.

   • Create a concise list of all txids and recipient addresses — this is what you’ll give to law enforcement and exchanges.

5. Contact exchanges & platforms

   • If the thief sends funds to a known exchange, contact that exchange immediately with:

     • Your account details, suspicious txids, timestamps, amounts, and the recipient address.

     • Request they freeze funds or block withdrawals if funds reached an account there.

   • Use the exchange’s official support and legal/compliance contact; don’t use links sent in DMs — find contact info on the exchange site.

6. Report to law enforcement

   • File a report with your local police (create a formal incident number).

   • File a cybercrime report with national bodies (examples: IC3 in the U.S., Action Fraud in the UK, or your country’s equivalent). Include all evidence: txids, addresses, screenshots, KYC details if available.

   • Ask for the investigation number and the investigator’s contact info.

7. Report to blockchain analytics / recovery services (carefully)

   • Consider contacting a reputable blockchain tracing/recovery firm. Do your homework — many scammers pose as “recovery services.” Ask for references, legal agreements, and success rates.

   • Avoid anyone who asks for large upfront payments in crypto or refuses a written contract.

8. Notify your bank and credit services

   • If the theft involved fiat conversions, bank transfers, or credit cards, notify your bank and file any necessary disputes.