Recovering crypto after an exchange account takeover

An exchange account takeover can drain holdings in minutes. The attacker bypasses authentication, initiates withdrawals, and moves funds on-chain before most victims notice anything is wrong. By the time the password-reset email arrives, the crypto has already left the exchange. The question is not whether the money moved – it is whether enough of the trail remains to act on.

Recovering crypto after an exchange account takeover is possible in many cases, even when funds have moved on-chain and crossed into a second or third wallet. Public blockchains are transparent, and on-chain movement leaves a record that specialist on-chain tracing can follow to a withdrawal or cash-out point. Whether that trail leads to a freezable choke point – a centralised exchange, a virtual-asset service provider (VASP), or a stablecoin issuer – determines whether legal instruments can be used to stop the funds and compel disclosure of the attacker's identity.

This guide sets out the steps from the moment of discovery to the point at which a freezing or disclosure order becomes realistic, and explains where cross-border complexity enters the picture.

What happens to stolen crypto in the first hours?

Attackers move quickly. An account takeover typically triggers an immediate series of on-chain withdrawals to wallets the attacker controls. From there, funds may pass through mixing services, be converted into different assets, or be split across multiple wallets to fragment the trail. The objective is to reach a cash-out point – usually a centralised exchange in a jurisdiction with lighter verification requirements – before anyone acts.

The critical window is short: funds that reach a cash-out point and are converted to fiat become significantly harder to freeze. Funds still on-chain, or sitting in a VASP account awaiting withdrawal, remain within reach of legal instruments. Speed is not a cliché here. Every hour that passes after discovery without action closes options.

We have traced exchange account takeover losses where the attacker moved funds through four wallets in under thirty minutes. The trail was still intact because the cash-out VASP had not yet processed the withdrawal request. Timing made the difference.

As of early 2026, centralised exchanges are increasingly subject to obligations that require them to suspend suspicious withdrawals on formal legal notice. That regulatory shift has meaningfully extended the window in which a freezing application can reach funds still sitting in a VASP account.

Step one: Preserve everything before you touch anything

The first instinct is to lock the account and change credentials. Do that – but document first. Evidence gathered in the first hour is often the cleanest available. Screenshots, transaction IDs, withdrawal addresses, authentication logs, and any phishing or social-engineering communications received in the days before the takeover all become material in subsequent proceedings.

Contact the exchange immediately through its official fraud or law-enforcement liaison channel, not standard customer support. Request a formal account hold and ask for confirmation of the transaction IDs associated with the outgoing transfers. Most reputable exchanges will act on a credible fraud report, at least temporarily, while they assess the request.

Do not engage with any third-party service offering to recover your funds in exchange for an upfront fee. That is a second-stage recovery scam, and it is extraordinarily common in the hours after a crypto theft. We address this directly later in this guide.

Document every communication with the exchange in writing, including timestamps. If proceedings follow, those communications form part of the evidence record.

Step two: On-chain tracing – following the movement to a choke point

Once the withdrawal addresses are known, on-chain tracing maps where the funds went. Public blockchains record every transaction. Specialist blockchain-analytics tools link wallet addresses, identify clustering patterns, and attribute addresses to known entities – exchanges, mixers, known illicit actors. The output is a transaction graph that shows, with varying degrees of confidence, where the stolen crypto is sitting or where it was last seen.

The goal of tracing is to identify a choke point: a point in the movement where the funds must pass through an identifiable, regulated entity. For most crypto asset recovery cases, that choke point is a centralised exchange or VASP where the attacker intends to convert funds. If the attacker deposited into a VASP that operates in a jurisdiction with a functioning legal system, a disclosure order against that VASP can reveal account details – and a freezing application can reach the balance.

Wallet clustering and attribution is not infallible. Some attackers use mixers or privacy coins specifically to obscure attribution. But in our experience, a significant proportion of exchange account takeover losses move through a mainstream VASP at some point, because the attacker needs to convert to fiat. That dependency on the financial system is the recovery practitioner's leverage.

For more on the mechanics of tracing digital assets across wallets and exchanges, see our crypto asset recovery insight hub.

Step three: Which legal instruments can freeze stolen digital assets?

Tracing identifies where funds are. Legal instruments are what freeze them. The primary tools for crypto asset recovery following an account takeover are a freezing order over digital assets, a proprietary injunction, and a disclosure order against a VASP. Each operates differently, and the right combination depends on how far the funds have moved and which jurisdictions are involved.

A freezing order over digital assets prevents the holder of a wallet – or the VASP holding funds on their behalf – from dissipating the balance while proceedings continue. In common-law jurisdictions, such orders can be obtained on an urgent basis and without prior notice to the respondent, precisely to prevent the target from moving funds before the order takes effect. A without-notice application is typically measured in hours to days, not weeks.

A proprietary injunction asserts the claimant's ownership interest in the stolen assets themselves. Unlike a personal freezing order, a proprietary injunction follows the asset rather than the person. Where stolen crypto can be specifically identified on-chain, a proprietary injunction can be a powerful instrument. Courts in several common-law jurisdictions have confirmed that cryptocurrency can be the subject of a proprietary injunction, including orders framed against "persons unknown" where the attacker's identity is not yet established.

A disclosure order against a VASP – analogous to a Norwich Pharmal order or a Bankers Trust order applied to digital assets – compels the exchange to provide account information about the wallet holder. Once the attacker's verified identity is known, the matter shifts from anonymous recovery to a named-defendant claim. That changes both the legal options and the practical pressure on the attacker.

Stablecoin issuers occupy a distinct category. Where stolen funds have been converted into a stablecoin on-chain, the issuer can, on appropriate legal process, freeze the specific token balance at a contract level. This is one of the fastest and most effective interventions available – but it requires acting before the attacker converts out of that stablecoin into another asset or fiat.

To understand the full range of tracing and freezing tools we deploy, visit our asset tracing service page.

How does cross-border complexity affect recovery?

Exchange account takeovers are almost always cross-border events. The victim may be in one country, the exchange may be registered in a second, the attacker may be using infrastructure in a third, and the cash-out VASP may be operating in a fourth. Each jurisdiction presents distinct procedural hurdles. None of them defeats recovery automatically – but ignoring the friction costs time and money.

Where the choke-point VASP is regulated in a jurisdiction that has mutual recognition arrangements or is party to cooperation instruments for financial crime, obtaining a disclosure or freezing order in the victim's home jurisdiction and having it recognised abroad is feasible. The reverse – bringing proceedings directly in the VASP's jurisdiction – is sometimes faster, particularly if local counsel there can act on an urgent basis.

When stolen funds move through multiple jurisdictions before reaching a cash-out point, parallel applications in more than one forum are sometimes necessary. That is a coordination exercise – ensuring that applications do not inadvertently tip off the attacker in one jurisdiction before orders are served in another. We have coordinated such parallel proceedings in matters where funds crossed several jurisdictions within a single day.

The recognition and enforcement of foreign judgments and arbitral awards under the New York Convention provides a basis for enforcing money judgments in many states once a claim has been resolved on the merits. But at the tracing and freezing stage, speed matters more than enforcement architecture. The priority is to stop the funds from moving further while the substantive claim is advanced.

Gagging or no-notification orders are also relevant in cross-border matters. Where notifying the exchange of proceedings would alert the attacker, courts in appropriate cases can restrain the exchange from informing the account holder that a disclosure order has been made. That element of confidentiality can be critical where the attacker monitors their account in real time.

What if the attacker has already cashed out?

Funds that have been converted to fiat and withdrawn from the VASP are harder – but not necessarily impossible – to pursue. The investigation shifts from on-chain tracing to banking-layer analysis. Where the attacker used a verified account at a regulated exchange, the exchange holds KYC records. A disclosure order against the VASP can produce verified identity, bank account details, and IP logs. Those records support a claim in the jurisdiction where the receiving bank is located.

Does this take longer? Yes. Does it require coordination with local counsel in the attacker's jurisdiction? Often. But it has succeeded. We regularly advise clients who discover the takeover days rather than hours after it occurred, and where the on-chain phase of recovery is no longer available. The forensic record of the original theft, the exchange's KYC records, and the blockchain transaction history together form the evidential spine of a civil claim.

In matters involving high-value losses, a worldwide freezing order – which in principle reaches assets outside the forum jurisdiction – may also be available against a named defendant once their identity is confirmed. That instrument can prevent the attacker from dissipating proceeds held outside the original jurisdiction while the substantive claim proceeds.

The key point is this: cashed-out does not mean over. It means the recovery pathway has changed, the timeline has lengthened, and the cost-benefit analysis needs revisiting. For a realistic assessment of where your matter stands, our analysis of fake recovery services and genuine tracing options sets out the distinguishing factors.

Avoiding the recovery scam: why this warning belongs in every guide

The weeks following an exchange account takeover are the period of greatest vulnerability to a second fraud. Recovery scam operators actively monitor social media, forum posts, and complaint databases for people who have reported a crypto theft. They make contact – sometimes within hours – offering to recover stolen funds for an upfront fee or a percentage of the loss.

These services are fraudulent. No recovery specialist can guarantee return of funds. No legitimate firm charges an upfront "access fee" or asks for wallet credentials to "mirror" the blockchain. The myth that stolen crypto can be automatically reversed by a specialist with the right software is precisely the opening these scams exploit.

Real crypto asset recovery involves legal process: tracing, orders of a court, coordination with regulated entities. It takes days to weeks for urgent applications and longer for complex cross-border matters. It involves costs – honest ones, disclosed upfront, not contingent on providing access to your remaining assets.

We are direct about what we do and what we cannot promise. If a service promises recovery before asking any questions about the facts of your matter, that is not due diligence – it is a script.

Related topics in crypto asset recovery

• Crypto Asset Recovery – full insight hub: on-chain tracing, VASP disclosure, digital asset freezing
• Asset Tracing Service – how Axiom Trace reconstructs the movement of funds across wallets and borders
• Fake wallet recovery services – distinguishing a genuine recovery pathway from a second-stage scam

Frequently asked questions

Q: Can stolen crypto really be traced and frozen?

A: Yes – in many cases. Public blockchains record every transaction. Blockchain-analytics tools and wallet attribution techniques can follow stolen funds through multiple wallets to a cash-out point. Where that point is a regulated virtual-asset service provider, a disclosure order can identify the attacker and a freezing order can reach the balance. Success depends on speed, the jurisdiction of the VASP, and whether the attacker has already converted funds to fiat and withdrawn them.

Q: How quickly do I need to act after a crypto theft?

A: As quickly as possible – ideally within hours of discovery. The most effective interventions – freezing orders over digital assets, without-notice applications, stablecoin issuer freezes – all depend on the funds still being in a state where they can be reached. Once an attacker converts crypto to fiat and withdraws from a VASP, recovery becomes more complex and typically slower. Contacting the exchange and a specialist recovery practitioner on the same day as discovery materially improves prospects.

Q: How is a real recovery specialist different from a recovery scam?

A: A legitimate crypto asset recovery specialist uses legal process: on-chain tracing, court orders, coordinated disclosure applications, and formal correspondence with virtual-asset service providers. They do not guarantee outcomes, do not charge upfront "access" or "activation" fees, and do not ask for your wallet credentials or seed phrase. A recovery scam will typically contact you unsolicited, promise a specific recovery figure, and ask for money before doing anything. If you have received such an approach, treat it as a second fraud and report it.

About Axiom Trace

Axiom Trace is an independent boutique focused on cross-border and crypto asset recovery. We trace assets that have moved across borders or on-chain and coordinate their freezing and recovery – working with defrauded principals, insolvency practitioners, and the lawyers and funders who refer them. We work lawfully and within applicable sanctions regimes, alongside local counsel where proceedings must be filed.

In our experience, the most recoverable matters are those where a specialist is engaged within the first twenty-four hours. We have assisted clients who contacted us days or weeks after a loss – recovery remained possible – but earlier engagement consistently produces better outcomes. We assess each matter on its specific facts, including where the funds went, which jurisdictions can act, and what the realistic cost-benefit position is before any commitment is made.

To discuss a matter confidentially, contact info@axiomtracel.com.

Disclaimer: This publication is for general information only and is not legal advice, nor a promise or prediction of recovery. No outcome is guaranteed. Asset recovery depends on the specific facts and on the law and procedure of each relevant jurisdiction, where local admitted counsel must act. Axiom Trace assumes no liability for actions taken or not taken based on this material. For advice on your situation, contact info@axiomtracel.com.