Crypto Hacking Response Guide: What to Do First After You Discover a Breach
1. What Should You Check First When You Discover You've Been Hacked?
The first thing to determine is exactly how your crypto assets left your control.
Even incidents that look like the same "crypto hacking" can involve very different response strategies and liability structures — a compromised exchange account, a leaked wallet seed phrase, and a fraudulent signature approved on a phishing site are not the same problem.
So as soon as you confirm the loss, the first step is to identify which type of incident you are dealing with.
| Type of Incident | What to Check First | Immediate Response |
| Exchange account compromised | Login history, withdrawal history, whether 2FA settings were changed | Request an account/withdrawal freeze |
| Personal wallet compromised | Whether the seed phrase or private key was exposed | Consider moving remaining assets to a new, secure wallet |
| Phishing site interaction | The URL visited, and any signatures or token approvals granted | Block further approvals/access and preserve evidence |
| Malware/remote access | Installed programs, access and execution logs | Stop using the infected device and preserve evidence |
| Exchange-side breach | The exchange's incident notice, affected assets, and scope of damage | Check the exchange's notice and claims procedure |
Identifying the type of incident first makes it much easier to determine what evidence to gather and who may ultimately be liable.
In particular, if the loss occurred while using an exchange, it is worth checking not only how well you managed your own account, but also whether the exchange was properly safeguarding user assets.
Under Article 7 of the Act on the Protection of Virtual Asset Users, virtual asset business operators are required to keep their own assets separate from user assets and to actually hold the same type and quantity of virtual assets entrusted to them by users.
In addition, the current Regulation on Supervision of Virtual Asset Business requires at least 80% of the economic value of user assets to be kept in an environment separated from the internet (cold storage).
So if the breach occurred at an exchange, rather than concluding simply that "the account was hacked," it is important to work out exactly how authentication was carried out and which account or wallet the withdrawal came from, since this will affect how liability is ultimately determined.
2. What Should You Do Immediately to Stop Further Losses?
Once you confirm the breach, the first priority is to stop any remaining crypto assets from being drained further.
If the breach occurred on an exchange account, the first step is to contact the exchange's customer support or incident report channel to check whether login or withdrawals can be restricted.
At this stage, don't stop at simply changing your exchange password — check whether other authentication methods, such as your email, phone number, or OTP, may also have been compromised.
If the issue originated in a personal wallet, the seed phrase or private key itself may already be exposed.
In that case, rather than continuing to use the same wallet, you should consider creating a new wallet in a verified, secure environment and moving any remaining assets there.
That said, be careful about immediately resetting a compromised phone or computer.
The device may still hold records — phishing site visit history, malware, login logs — that show exactly how the account or wallet was compromised.
What to Check Immediately After a Crypto Hacking Incident
- Request a freeze on further withdrawals from the exchange account
- Check whether your password, OTP, or other authentication methods were compromised
- Review protective measures for any remaining crypto assets
- Avoid resetting the affected device without careful thought
- Preserve withdrawal alert emails, texts, and app notifications
- Save your exchange customer support inquiries and their responses
What matters at this stage is not rushing into every possible action, but balancing preventing further damage with preserving evidence.
At Decent Law Firm, in the initial consultation we first identify the structure of the incident — whether it involves a compromised exchange account, a compromised personal wallet, or phishing/remote access — and based on that, help determine what evidence should be preserved first and what should be requested from the exchange.
3. What Evidence Should You Secure After a Crypto Hacking Incident?
Once you've stopped further losses, the next step is to gather as much evidence as possible showing how the stolen assets moved.
In crypto cases, what matters most is not just a screenshot of the loss, but the transaction records showing exactly when the assets moved, from which address to which address.
Where possible, try to preserve the following information in as close to its original form as possible.
Evidence You Should Secure
- Date and time of the incident
- Type and quantity of the stolen crypto assets
- Value of the assets in Korean won at the time of the loss
- The withdrawal (sending) wallet address
- The receiving wallet address
- The TXID or transaction hash
- The exchange or wallet service used
- Login and access notifications
- OTP, phone, and email authentication records
- Password change notifications
- Records of exchange customer support inquiries
- The phishing site URL
- Related text messages, emails, and messenger conversations
- Information on any suspicious programs or apps
Of these, the TXID and wallet addresses are the core evidence for tracing how the assets moved afterward.
On public blockchains, a block explorer can be used to trace how assets moved from the initially compromised address to other addresses.
Records kept internally by the exchange also matter.
Under Article 9 of the Act on the Protection of Virtual Asset Users, virtual asset business operators are required to retain transaction records — sufficient to trace, search, and verify transactions — for 15 years from the end of the transactional relationship.
However, the fact that an operator retains transaction records is a separate question from whether a victim can immediately obtain all of the internal data they want.
Login IP addresses, authentication data, withdrawal approval processes, and other internal system records may not be voluntarily disclosed by the exchange, and may need to be obtained through the proper legal process during an investigation.
So before filing a report, it helps to separate what you can gather yourself now from what will need to be obtained later through the investigating authorities.
At Decent Law Firm, based on the transaction history, TXIDs, wallet addresses, and exchange responses a victim has secured, we organize a chronological timeline of how the assets moved from the moment of the loss, and structure the facts and evidence so they can be used effectively in a police report or criminal complaint.
4. Can Crypto Assets Already Moved to Another Wallet Still Be Traced or Frozen?
Even after crypto assets have moved to another wallet, it is sometimes still possible to trace the transaction path on the blockchain.
However, being traceable and being actually recoverable are two different questions.
On public blockchains, the transfer from the originally compromised wallet to another wallet remains on the record.
So it is possible to check where the stolen assets moved afterward, and whether they show signs of having flowed into a domestic or overseas centralized exchange.
In particular, if the assets are confirmed to have moved into a deposit address at an identity-verified centralized exchange, the account information and transaction records held by that exchange can become important evidence for an investigation.
Factors to Check When Assessing Recovery Potential
| Factor | What It Means |
| Current custody wallet | Whether the stolen assets still remain at that address |
| Inflow to a centralized exchange | Whether identity verification may be possible through an exchange account |
| Further movement of assets | Whether the assets were quickly split across multiple addresses |
| Change of chain | Whether the assets were moved to another network via a bridge |
| Asset conversion | Whether the assets were converted into a different crypto asset |
| Use of an overseas operator | Whether cooperation from a foreign exchange or international cooperation is needed |
That said, confirming that assets moved on the blockchain does not mean those assets can be immediately frozen.
Reporting and freezing procedures differ from exchange to exchange, and actually freezing assets or obtaining account information may require legal process, such as a request from investigating authorities or a warrant.
In addition, if assets have been split across multiple wallets, moved to a different chain, or converted into a different crypto asset, tracing and recovery become considerably more complex.
So you should not assume either that "there is a blockchain record, so recovery is guaranteed" or, conversely, that "the assets already moved to another wallet, so recovery is impossible."
At Decent Law Firm, based on the secured TXIDs and wallet addresses, we map out how the assets moved, and where there are signs that assets flowed into a specific exchange, we organize the material so that fact is clearly communicated to the investigating authorities.
Where an overseas exchange is involved, we also consider that exchange's own damage-reporting and evidence-preservation procedures, along with whether international cooperation through Korean investigating authorities is needed.
5. What Is the Right Order for Filing a Police Report and Seeking Recovery?
Once you have organized the facts of the loss and the basic transaction data, the next step is to consider filing a report with the investigating authorities.
You can report hacking and other cybercrime damage through the Korean National Police Agency's Cybercrime Reporting System (ECRM), which asks you to specify the date and details of the loss and describe how the crime occurred.
In crypto cases, rather than simply stating "my coins were hacked," it is important to organize and submit materials that let investigators immediately understand the structure of the incident.
What to Organize Before Filing a Report
1) How the Incident Occurred
Note the last time you used the account normally, and when you first noticed the unusual withdrawal.
2) The Assets Affected
Summarize the type and quantity of crypto assets involved, and the total loss.
3) The Fraudulent Transaction
Confirm the TXID and the sending/receiving wallet addresses.
4) Signs of Account Compromise
Note any confirmed signs such as foreign IP access, password changes, OTP changes, or a compromised email account.
5) Movement of the Assets After the Theft
If you can confirm the assets moved to another wallet or exchange, include that information as well.
Organizing this information in advance helps investigators determine which exchange or business operator to seek records from, and what specifically to request.
At Decent Law Firm, after organizing the facts of the incident and the asset movement history, we help specify the exchange accounts, access logs, authentication records, and wallet addresses that investigators will need to confirm during a criminal complaint or report.
Even after an investigation begins, if new wallet addresses or signs of exchange inflow are identified, they should be organized as additional evidence and submitted.
6. Frequently Asked Questions (FAQ)
Q1. My coins were moved to another wallet through hacking — can the transaction be reversed?
Once a transfer is recorded on the blockchain, it is generally very difficult to reverse it the way you might cancel a bank transfer.
So rather than trying to cancel the transaction itself, it is more important to identify the current location of the stolen assets and their transaction path, and check whether they have since flowed into an exchange.
Q2. If the stolen coins moved to an overseas exchange, does that mean recovery is impossible?
The mere fact that the assets moved to an overseas exchange does not mean recovery is impossible.
That said, the required procedure and its difficulty can vary depending on the exchange's home country and policies, whether it holds user identity information, the current status of the assets, and the likelihood of cooperation with Korean investigating authorities.
Q3. Should I immediately reset a phone or computer that was hacked?
Taking steps to prevent further damage is necessary, but resetting the device unconditionally before all the case evidence has been secured requires caution.
The affected device may still contain access logs, phishing URLs, malware, and other data showing how the breach occurred, so it is worth preserving the necessary evidence first before proceeding with safety measures.
7. Summary and Key Points
If you experience a crypto hacking incident, the first priority is to stop any further withdrawals and secure evidence — TXIDs, wallet addresses, login and authentication records — that can help establish what happened.
If the crypto assets have already moved to an external wallet, you should trace the path from the original fraudulent transaction onward, and where there are signs the assets flowed into a specific exchange, consider pursuing evidence preservation and a potential freeze through the investigating authorities.
If the cause of the loss appears related to the exchange's own authentication or custody systems, it is also worth examining the exchange's legal obligations and the possibility of a damages claim.
At Decent Law Firm, we review the transaction history, TXIDs, wallet addresses, and exchange usage records to reconstruct how the incident occurred and how the assets moved, and help build out the facts and evidence needed for a police report or criminal complaint.
Where the stolen assets show signs of moving through domestic or overseas exchanges, we also look at the possibility of requesting evidence preservation or a freeze from the exchange, along with further steps through the investigating authorities, and where the incident relates to the exchange's security or custody obligations, we consider the full path toward recovery, including a damages claim.
Because crypto assets can move through multiple wallets and exchanges in a very short time, once you confirm a loss, the priority is to organize whatever evidence you can secure right now, and to get help from a professional as soon as possible so you have the best chance of recovering your lost funds.
