When you find a transaction you did not make
- Author
- CRYPTO PORT Editorial
- Published
- Updated
- Reading time
- 7 min
In short
If you find a withdrawal or trade you did not make, speed is everything. Protecting what is still there comes first: for an exchange, request a freeze; for a wallet, move the remaining assets to a new, clean wallet. Then preserve the evidence and take it to the official channel and to a police cybercrime consultation desk. There is no guarantee that what is gone comes back.
Key points
- Securing what remains comes first; working out how it happened comes second
- For an exchange, request suspension of the account through the official channel
- If a wallet may be compromised, stop using that seed phrase entirely
- A transfer already on-chain cannot be reversed. Do not act as though it will return
Definition
Finding withdrawals, transfers or trades in your history that you did not authorise — typically the result of leaked credentials, a compromised device, or permissions granted carelessly.
What you do in the first few minutes is containment, not diagnosis. For an exchange account, log in through the official app or your own bookmark and ask support to suspend the account on suspicion of unauthorised access. If you can, also change the password and review and remove registered withdrawal addresses and API keys. If you cannot log in at all, say so when you contact them.
For a self-custodied wallet the logic changes. If the private key or seed phrase may have leaked, that wallet will never be safe again. Create a new wallet — ideally on a different device that could not have been compromised — and move what remains there. If you have a hardware wallet, that is the safer destination. Once moved, never use the old seed phrase again.
In parallel, preserve the evidence: transaction IDs, times, amounts, destination addresses, screenshots of the history, and any notification emails. You will need these to report the incident. Save them before you reinstall any app or clear any history.
Then hunt the cause. Did you enter credentials on a phishing site? Connect your wallet to an unfamiliar one? Are old token approvals still active? Is there malware on the device? Has the email account itself been taken over? 'How to revoke a token approval' covers checking and removing permissions. Moving assets back without closing the hole simply replays the whole thing.
For reporting, start with the official support of the service involved. In Japan, each prefectural police force publishes a cybercrime consultation desk on its website, and consumer affairs centres also take these enquiries; 'Where to get help' sets out how to approach them. The strongest warning here: post about your loss on social media or in a comment thread and people claiming they can trace and recover your funds will appear. All of them are scams, and secondary victimisation of people who have already been hit is extremely common.
Watch out for
- · Every firm or individual offering to 'trace and recover' your funds, and everyone calling themselves an ethical hacker, is a scam. They are after an upfront payment and your seed phrase
- · Do not keep using a seed phrase that may have been exposed; assets you move back will simply be taken again
- · Never grant screen sharing or remote control to someone claiming to be support. Genuine support does not ask
Frequently asked questions
I know the destination address. Can I get the funds back?
Knowing the address does not give you a way to reverse an on-chain transfer. Only if the destination is an address an exchange controls is there any prospect of a freeze being considered through official process, and even that is not guaranteed. Do not try to negotiate yourself — submit your records through the proper channels.