Recover from hacked virtual currency (crypto assets)
Cryptocurrencies are a high-priority target for cyber criminals. Whether they target your wallet directly or hack the exchange or service provider you use, you should act as quickly as possible.
If your virtual currency has not been hacked from your wallet but you have instead been tricked into sending funds as part of a scam, refer to the Dealing with Virtual Currency (Crypto Asset) Scams guide.
We want to better understand the impact of you experiencing this issue, can you share your experience by filling in this online form? This will help us better protect future victims.
Hacked virtual currency account - Do this now!
Contact the police -
Report the crime to the South African Police Service (SAPS) as soon as possible. Visit your nearest police station and obtain a case number.
Take as much evidence as possible, including:
Wallet addresses
Transaction hashes
Screenshots
Emails
SMS or WhatsApp messages
Exchange account details
Any communication with the offender
If the matter involves organised crime, significant financial losses or cross-border offending, SAPS may refer or escalate the matter to the appropriate specialist unit.
Change your login details -If you are still able to access your account:
Change your password immediately.
Update any other recovery or security information.
Enable multi-factor authentication (MFA), preferably using an authenticator app rather than SMS where available.
These steps may prevent further unauthorised access.
Move any remaining crypto assets - If you still have access to your wallet or exchange account and believe it has been compromised, transfer any remaining crypto assets to a new wallet that you control. Do this only after securing your account and recovery information.
Notify the exchange/provider - Notify your exchange, wallet provider or crypto asset service provider immediately.
Ask them to:
Secure or freeze your account where possible.
Preserve logs and transaction information.
Confirm what information they can provide to SAPS.
Advise whether any additional security measures are available.
If the provider operates in South Africa, check whether they are authorised by the Financial Sector Conduct Authority (FSCA) to provide crypto asset services.
Revoke compromised access - If you use API keys, browser wallet extensions or third-party trading tools, revoke their access immediately. Create new credentials only after your account has been secured.
Will you get your money back?
Once crypto assets have been stolen, recovery is unfortunately very unlikely.
Although blockchain transactions can often be traced, crypto assets can quickly be transferred through multiple wallets or exchanges, making recovery difficult. In some cases, investigators may be able to use blockchain records as evidence, but you should not expect that stolen funds will be recovered.
Approaches to dealing with stolen money
Check your devices for malware - A malware infection may have allowed someone to access your wallet or exchange account.
Scan every device you use to access your crypto assets and remove any malicious software before using those devices again. Follow our guide on checking for and removing malware if required.
Contact your bank - If a linked bank account, payment card, EFT, debit order or other payment method has been used without your permission, contact your bank immediately.
Ask the bank to:
Secure your account.
Block affected cards if necessary.
Investigate unauthorised transactions.
Explain whether any dispute or chargeback options may be available.
Follow the money - Blockchain explorers may allow you to identify:
Transaction hashes
Wallet addresses
Subsequent transfers
Save this information as evidence and provide it to SAPS and the relevant exchange or crypto asset service provider.
If you believe the funds have been transferred to a known exchange, notify that exchange and request that they preserve any relevant information.
Do not contact the offender or attempt to recover the funds yourself.
Be cautious of using recovery services- Many people who lose crypto assets are targeted again by individuals or companies claiming they can recover stolen funds in exchange for an upfront fee.
Recovery cannot be guaranteed, and many so-called recovery services are scams.
Never pay anyone without carrying out careful checks and seeking independent advice.
How do I avoid my virtual currency being stolen in future?
Avoid publicly discussing your crypto assets - If criminals can easily determine that you own cryptocurrency through social media or other public information, you may become a target.
Use multi-factor authentication (MFA) - Enable MFA wherever available.
Where possible:
Use an authenticator app rather than SMS.
Disable SMS authentication if an alternative is available.
Use a dedicated email address and a strong password - Consider using a separate email address exclusively for your crypto accounts together with a strong, unique password.
Consider using a ‘cold-wallet’ - Store larger holdings in a cold wallet (offline storage) where practical. Keeping crypto assets offline reduces exposure to online attacks.
Spread your investments across exchanges - Avoid storing all your crypto assets on a single exchange or platform. Diversifying storage can reduce the impact if one provider is compromised.
Improve your overall cyber security - Maintain good cyber hygiene by:
Keeping devices and software up to date.
Using reputable anti-malware software.
Regularly reviewing account security settings.
Using strong, unique passwords for all important accounts.
Donate
Your generosity makes our free support possible. Please consider giving today.
Without donations, we cannot keep our service free or provide help to the most vulnerable victims of cybercrime when they need it most. As a not-for-profit organisation, every donation goes directly towards keeping The Cyber Helpline up and running. Donate now and help us support victims of cybercrime.