A phishing attack: the first 24 hours toward recovery

A phishing attack ends in seconds. The fund movement begins immediately after. What you do in the hours that follow determines whether on-chain tracing can reach a cash-out point before the trail goes cold.

Stolen crypto is not automatically unrecoverable. Public blockchains are transparent by design – every movement leaves a permanent, auditable record. Acting within the first 24 hours maximises the window for on-chain tracing, exchange notification, and, where legal process can be obtained quickly, a freezing order over digital assets or a disclosure order against a virtual-asset service provider (VASP).

This guide walks through the steps in sequence – from the moment you realise an attack has occurred to the point where specialist recovery action can begin.

Why the First 24 Hours Define Your Recovery Options

The first 24 hours are not a formality. They are the window in which most recoverable matters either succeed or fail. Stolen digital assets move fast – through mixers, cross-chain bridges, and centralised exchange deposit addresses – and each hop adds complexity to the tracing chain.

Dissipation is the primary risk: a stolen balance that sits on a transparent public blockchain for several hours may be swapped, bridged, or cashed out before a freezing order can be served. This is not a reason to panic; it is a reason to prioritise. Speed and precision, not emotion, are what the next 24 hours require.

In our experience, matters where the victim waited 48 hours or more before seeking specialist help present substantially narrower tracing windows than those where contact was made within the first day. The difference is often whether funds can still be located at an identifiable choke point – typically a centralised exchange – where legal process can compel a freeze or disclosure.

What does that window actually look like? It varies by network speed, the sophistication of the attacker, and whether the stolen assets are held in a stablecoin or a volatile token. Stablecoins present a particular opportunity: stablecoin issuers can, on appropriate legal process, freeze specific token balances. That option closes if the attacker converts to a non-freezable asset.

Step One: Stop the Bleeding Before You Do Anything Else

Before you open a spreadsheet or call a lawyer, address the live exposure. If the phishing attack compromised one wallet or set of credentials, assume the attacker is still active on the same vector.

• Revoke all token approvals granted to suspect contracts. Use a reputable approval-management interface (generic – avoid named tools) to identify and cancel outstanding authorisations. This stops ongoing drainage on approval-based phishing attacks.
• Transfer any assets still in the compromised wallet to a clean address, on a device that did not interact with the phishing site.
• Change credentials on all associated accounts: exchange accounts, email, authenticator apps. A phishing kit often harvests credentials beyond the immediate target wallet.
• Do not delete or wipe any device yet. Evidence preservation comes next.

These steps take minutes. Skipping them to focus on reporting first is a common and costly mistake. We have advised clients who lost a second tranche of assets – still in an approved contract – while they were drafting their police report.

Step Two: Preserve Every Piece of Evidence

Recovery in any forum – whether through a freezing order, a disclosure order against a VASP, or a proprietary injunction – depends on evidence. The evidence that matters is created in the first hour and destroyed or corrupted within days.

Take screenshots immediately: the phishing site URL (before it goes offline), the phishing email or message in full headers, any wallet pop-up or transaction approval prompt, and your wallet interface showing the outbound transaction.

Record, in writing, a precise timeline: when did you receive the message, when did you interact with the site or link, when did you notice the outbound transaction, what wallet addresses are involved? This document becomes the foundation of any legal filing.

Also preserve:

• The transaction hash of every outbound movement from your wallet.
• The recipient wallet address or addresses.
• The smart contract address, if an approval-based drain was used.
• Any communications from the attacker – fake support messages, airdrop notifications, social-engineering threads.

Do not forward the phishing link to anyone who might click it. Export the email as a file rather than forwarding. The goal is a clean, authenticated record that holds up to scrutiny in a legal filing.

How Does On-Chain Tracing Actually Work After a Phishing Attack?

On-chain tracing maps the path of stolen funds from the moment they leave the victim's wallet to the point – if one is reachable – where an identifiable actor controls them or where they are presented for conversion to fiat currency. Public blockchains are transparent: every transaction, every contract call, every bridge event is recorded permanently and is accessible without a court order.

The practical tracing sequence runs roughly as follows. The attacker's receiving address is identified from the transaction hash. Blockchain-analytics tools (described generically) cluster associated addresses – identifying wallets that are likely controlled by the same actor, based on behavioural and structural patterns. The analyst follows the funds through any intermediate hops: mixing services, cross-chain bridges, peer-to-peer swaps, or on-chain privacy protocols.

The critical moment in on-chain tracing is deposit into a centralised exchange or VASP, because that is the point at which an anonymous on-chain actor becomes an account holder with a verified identity – the Know Your Customer (KYC) file. At that point, a disclosure order against the VASP can compel production of the account holder's identity, and a freezing order over digital assets – or a direct notice to the exchange – can prevent withdrawal.

Does the trail always lead there? Not always. Sophisticated attackers use privacy coins, cross-chain bridges, and peer-to-peer off-ramps to break the chain. But in a significant proportion of matters we handle, the attacker or a downstream recipient does touch a regulated exchange. That is the choke point on which recovery action pivots.

Timing is the variable. The longer the window between the theft and the tracing instruction, the more hops the attacker can add. Each hop does not make the funds untraceable, but it increases the complexity and cost of the trace – and it narrows the number of jurisdictions where legal process can intercept the flow.

Step Three: Notify the Right Parties – in the Right Order

Notification is not a passive step. It is an active component of recovery strategy, and the sequence matters.

First: if the stolen assets are stablecoins issued by a centrally-managed issuer, notify the issuer directly with the transaction hash and the recipient address. Stablecoin issuers can, on appropriate legal process or through their internal freeze mechanisms, block a specific token balance. Some issuers act without a court order if the theft is recent and the evidence is clear; others require formal process. Either way, early notification preserves the option.

Second: if blockchain-analytics tracing has identified a deposit to a specific centralised exchange, notify that exchange's security or legal team with the transaction hash and the receiving address. Exchanges have internal processes for flagging accounts pending legal process. Early notification does not freeze the account automatically, but it can place an internal hold that gives time for a formal order to follow.

Third: file a report with your domestic financial-intelligence unit or relevant law-enforcement body. This is not primarily for immediate recovery; it creates an official record that supports formal legal process in multiple forums. A report number can be required when approaching a VASP through formal channels or when instructing local counsel to apply for a freezing order.

Fourth: notify your own exchange or custodian if any incoming or outgoing connection with the attacker's cluster might affect your own accounts – flagging the counterparty addresses may protect your own holdings from downstream taint.

What about the receiving jurisdiction? If tracing places the funds at an exchange operating in a specific country, formal recovery action in that country's courts – or a cross-border disclosure request – becomes the next step. We coordinate with local counsel in the relevant jurisdiction to file or serve legal process once the tracing picture is clear.

To assess whether the tracing picture in your matter supports formal legal process, contact info@axiomtracel.com for a confidential case review. The sooner the assessment begins, the more options remain open.

What Legal Instruments Can Freeze Stolen Digital Assets?

Legal process for stolen digital assets has matured considerably. Courts in common-law jurisdictions, in particular, have shown willingness to apply established instruments to novel on-chain fact patterns. Understanding which instruments apply – and in what sequence – is central to any recovery strategy.

A freezing order over digital assets restrains the defendant or the exchange from transferring or dealing with specified assets. In urgent phishing matters, this application is made without notice to the defendant, to avoid tipping off the attacker before the order is served. A without-notice application can, in appropriate cases, be issued within hours of filing.

A proprietary injunction asserts that the claimant retains a proprietary interest in the stolen assets – relevant where the funds can be specifically identified in the hands of a defendant or a third party. Courts have granted proprietary injunctions against "persons unknown" in crypto matters where the attacker's identity has not yet been established.

A Norwich Pharmal order compels a third party – typically a VASP or centralised exchange – to disclose information about an account holder, enabling the claimant to identify the wrongdoer and pursue them directly. A Bankers Trust order operates similarly against financial institutions holding account information.

Where proceedings need to be served on an anonymous attacker, courts have, in appropriate cases, authorised service by NFT airdrop – sending a wallet transaction that embeds the service documents, allowing the court to be satisfied that the defendant has notice.

The cross-border dimension is significant. Stolen crypto rarely stays within one jurisdiction. A worldwide freezing order can, in principle, reach assets held outside the forum jurisdiction, though enforcement depends on which courts will recognise and act on it. For enforcement of judgments or arbitral awards across borders, the New York Convention and bilateral recognition regimes provide the formal route. In practice, we use the on-chain trace to identify the most accessible choke point and focus legal process in the jurisdiction where assets are most reachable.

The steps above describe the general pattern. Your matter turns on the specific assets involved, the jurisdiction where they can be intercepted, and how quickly legal process can be engaged. A confidential case review will tell you which instruments are realistically available in your situation – contact info@axiomtracel.com.

The Recovery Scam Problem: What a Real Specialist Does Differently

After a phishing attack, the victim is targeted a second time. This is not a coincidence. Data about theft victims – drawn from blockchain monitoring or from social media posts describing the loss – circulates among operators of recovery fraud schemes. The approach follows a recognisable pattern: a contact offering guaranteed recovery, requesting an upfront fee, and producing fabricated "reports" or "traced fund locations" to maintain credibility.

These operators exploit the same fear they claim to address: that the money is gone and only a specialist can retrieve it. They rely on the myth that crypto is untraceable. In fact, on-chain tracing is a real discipline with real tools and real legal instruments behind it – but legitimate recovery is conditional, not guaranteed, and it requires legal process, not a fee payment.

How do you distinguish a real recovery specialist from a recovery scam? The markers are consistent. A legitimate firm will not promise a specific recovery outcome or percentage. It will not require a large upfront payment unlinked to any described legal process. It will explain – specifically, not vaguely – which instruments it intends to use, in which forum, and why. It will not claim to have "already located" your funds without performing a verifiable trace.

At Axiom Trace, we do not promise recovery. We trace, we advise on the realistic options, and we coordinate legal process where it has a reasonable prospect of intercepting the funds. If a matter is not viable, we say so.

Building Your 24-Hour Recovery Checklist

Pulling the steps together into a working sequence:

• Hour 0–1: Revoke all open token approvals. Move remaining assets to a clean wallet. Secure all credentials. Do not wipe devices.
• Hour 1–2: Preserve evidence – screenshots, full email headers, transaction hashes, recipient addresses, timeline in writing.
• Hour 2–4: Instruct a specialist for on-chain tracing. The trace needs to begin before the attacker moves funds to a privacy layer or off-ramp. Provide the transaction hash, your wallet address, and the evidence package you have assembled.
• Hour 4–8: Based on tracing output, notify the stablecoin issuer (if applicable) and the identified exchange or VASP. File a domestic law-enforcement report.
• Hour 8–24: If tracing has identified a viable choke point, engage local counsel in the relevant jurisdiction to prepare a without-notice freezing order or disclosure application. The tracing report becomes the evidential backbone of that application.

Not every step will be applicable to every matter. Some phishing attacks involve amounts or jurisdictions where legal process is disproportionate; others involve amounts that clearly justify urgent cross-border action. The assessment of viability – honest, based on the actual trace output – is the function a specialist performs before any legal process is engaged.

For a read on whether your matter has a recoverable path, use the asset tracing service overview to understand what the investigation phase involves, and then contact info@axiomtracel.com for a confidential case review tailored to your specific facts.

Related Resources From Axiom Trace

• Crypto Asset Recovery – Insight Hub: analysis, alerts, and guides on digital asset tracing and recovery across jurisdictions.
• Asset Tracing Service: how we reconstruct payment trails, from blockchain to banking layers.
• What Changed in Belize for Cross-Border Asset Recovery: jurisdiction-specific update on offshore enforcement developments relevant to crypto matters.

Frequently Asked Questions

Q: Can stolen crypto really be traced and frozen?

A: Yes – conditionally. Public blockchains record every transaction permanently. On-chain tracing can follow stolen funds through intermediate wallets to a point where legal process – a freezing order over digital assets, a disclosure order against a virtual-asset service provider, or a stablecoin issuer freeze – can intercept them. The outcome depends on how quickly tracing begins, which jurisdictions the funds pass through, and whether the attacker reaches an identifiable choke point such as a centralised exchange. Recovery is never guaranteed, but the trail is real and the tools to follow it are established.

Q: How quickly do I need to act after a crypto theft?

A: As quickly as possible – measured in hours, not days. Dissipation risk is highest in the first 24 hours, when the attacker is most likely moving funds toward a cash-out point. A stablecoin freeze, an exchange notification, or a without-notice freezing order application must all be initiated before the attacker reaches the next conversion layer. Waiting 48 hours or more does not eliminate options, but it narrows them significantly. In our experience, the first day is the highest-leverage window in most crypto phishing matters.

Q: How is a real recovery specialist different from a recovery scam?

A: A legitimate asset recovery firm does not guarantee outcomes, does not request large upfront payments unlinked to a described legal process, and does not claim to have "already located" funds without performing a verifiable on-chain trace. It explains specifically which instruments – a Norwich Pharmal order, a freezing order over digital assets, a disclosure order against a virtual-asset service provider (VASP) – it intends to pursue, in which forum, and on what evidential basis. Recovery scams exploit the fear that stolen crypto is permanently gone. In reality, recovery is conditional and process-dependent – not the product of a fee payment to an unverifiable operator.

About Axiom Trace

Axiom Trace is an independent boutique focused on cross-border and crypto asset recovery. We trace assets that have moved across borders or on-chain and coordinate their freezing and recovery – working with defrauded principals, insolvency practitioners, and the lawyers and funders who refer them. We handle phishing-attack matters from the initial on-chain trace through to the legal process needed to intercept funds at a VASP or exchange choke point, working alongside local counsel where proceedings must be filed in a specific jurisdiction. Our work is lawful and conducted within applicable sanctions regimes. We do not promise recovery; we assess viability honestly and pursue it where the evidence supports it. To discuss a matter, contact info@axiomtracel.com.

Disclaimer: This publication is for general information only and is not legal advice, nor a promise or prediction of recovery. No outcome is guaranteed. Asset recovery depends on the specific facts and on the law and procedure of each relevant jurisdiction, where local admitted counsel must act. Axiom Trace assumes no liability for actions taken or not taken based on this material. For advice on your situation, contact info@axiomtracel.com.