Crypto lost to phishing or a hack: what can still be done?
Date: 23 June 2026 | Week 26 | Reading time: 8 minutes | Updated: Author: 
Tyler Dijst
Paucitas is an independent expert firm in the Netherlands that investigates investment fraud and crypto fraud, establishes the origin and legitimacy of crypto assets and prepares expert reports for legal proceedings and compliance.
In short
Crypto lost to phishing or a hack does not always mean everything is gone. If you have only lost access to your own wallet, the coins are sometimes still at your address. If they have been moved, the route can often still be followed. Which of the two it is makes a big difference.
Paucitas is an independent expert firm in the Netherlands that investigates crypto fraud, in hundreds of cases a year. Sometimes Paucitas helps you regain access to your own wallet, sometimes Paucitas maps where your crypto went.
Get in touch with Paucitas or ring +31 20 244 5774. In a free intake you will hear what is still possible in your situation.
In a nutshell
After phishing or a hack, one question matters most: is your crypto still at your own address, or has it been moved? Paucitas finds out for you and records what happened.
You clicked a link that seemed to come from your wallet or exchange, filled something in, and shortly afterwards your balance had gone. It is a horrible feeling, and often an embarrassing one too. There is no need: these attacks are so well made that careful people fall for them as well.
In this blog you will read what usually happens in a phishing attack, the difference between lost access and moved crypto, and what Paucitas can do for you.
Crypto lost to phishing: what actually happened?
With phishing you are tricked into handing over a key yourself. A message that looks like a notice from your wallet provider or exchange asks you to “verify” your wallet. The link leads to a fake page where you enter your seed phrase. With that, the attacker can access everything. Often the coins are at another address within minutes.
A trustworthy party never asks for your seed phrase or private key: not your wallet provider, not your exchange and not Paucitas. The National Cyber Security Centre explains these tricks in phishing scams: how to spot and report them.
Which 2 situations are most common after a hack?
After phishing or a hack, almost every case falls into one of two groups:
- Access lost. The coins are still at your own address, but you can no longer reach them. For example because of a forgotten password, a damaged backup file or a seed phrase that is no longer complete.
- Crypto moved. The coins have been sent to an address that is not yours. Then the problem is not access, but the destination.
Sometimes it is not immediately clear which group you are in. Paucitas finds that out for you too, often in the first conversation.
Not sure what happened to your crypto? Let Paucitas take a look with you. You can ring at any time, 24/7, on +31 20 244 5774.
Can crypto lost in a hack still be recovered?
Where access is lost, Paucitas looks at whether you can get back into your own wallet, only for a wallet that is lawfully yours. Whether that works depends on what is left: part of the recovery phrase, a file, a note or another lead. Sometimes it works, sometimes it does not. We will tell you honestly.
Where crypto has been moved, nobody can pull the coins back from someone else’s address. What is possible: following the route from your address to the addresses behind it, often to an exchange. That gives the police, the exchange or your solicitor something concrete to work with. Nobody can promise in advance that the money will come back. See also how likely it is that you will see stolen crypto again.
Watch out for parties who contact you after an incident offering “recovery for a fee”. That is often a second scam, a so-called recovery scam.
An example from practice
After a fake email, a man entered his recovery phrase on a copied website. That same evening his wallet was empty. He thought there was nothing left to do.
Paucitas followed the coins from his address. After a few intermediate steps, a large part ended up at an exchange. With the report he could make a well-founded report to the police, and his solicitor could approach the exchange in a targeted way. A similar case is in the stolen bitcoin case study.
Paucitas takes privacy very seriously and never shares clients’ personal details. This is a composite example: names, amounts and details have been changed. The situation is one we see in practice.
What should you do straight after phishing or a hack?
There are a few things you can do straight away, at no cost:
- Do not pay anyone who promises to get your crypto back.
- Keep the message, the link and screenshots, even if you would rather delete them.
- Stop using the affected wallet and recovery phrase.
We will go through exactly which details an investigation needs in the intake. More background is in securing evidence after crypto theft.
What can an exchange do, and what can it not do?
If your crypto ends up at an exchange, there is often a lead there. An exchange knows its customers and can, under certain conditions, cooperate with an investigation or legal request. But an exchange will not freeze or reverse funds simply because you ask. That usually takes a well-founded file, and often a step via the police or your solicitor. How this works is explained in following stolen crypto to an exchange.
What is in the Paucitas report?
- What happened and when, in a clear timeline.
- Which addresses and transactions were followed, step by step.
- Where the crypto ended up, for example at an exchange.
- What is established and where uncertainty remains.
Paucitas does more than trace transactions: we also go through all conversations, documents, emails and other communication, so that a complete picture emerges, with a timeline and where all the money went, step by step. Anyone can follow and understand the report step by step. It shows whether money is still available or where it went, and what the next steps are. In a scam it is a strong attachment to a police report.
Who helps when crypto is lost to phishing or a hack?
Paucitas. In a free intake we map what happened and whether it is lost access or moved crypto. Paucitas does all tracing itself, without tracing tools, and checks every transaction individually. How such an investigation works is explained in wallet investigation after theft or a hack and in hacked wallet: investigating what happened.
- Costs: every investigation is tailored. You receive a bespoke quote in advance, which we go through together, so there are no surprises.
- Turnaround: from the same day to around two weeks.
- Contact: you can ring at any time, 24/7. We answer the form within 1 to 3 hours, and email within 24 hours, usually the same day.
Want to know what happened to your crypto? Get in touch for a no-obligation introduction, or ring +31 20 244 5774.
Sources: National Cyber Security Centre, phishing scams; Report Fraud; Police Scotland, scams and frauds.
Questions about your own situation?
Call us directly, 24/7, or fill in the form below. You will hear from us within 1 to 3 hours. A free intake is without obligation.
Paucitas B.V.
Weesperstraat 107
1018 VN Amsterda
E: paucitas@paucitas.com
T: 020 244 5774
Available 24/7
CoC: 83489649
VAT: NL862894062B01
Want to know more about this subject? Contact us
"*" indicates required fields
Frequently asked questions about crypto lost to phishing
Short answers to the questions we are asked most often.
Will I get my crypto back after phishing or a hack?
Paucitas: that depends on your situation. If you still have access to your own wallet or account holding funds, there may still be options. If everything has been sent to the fraudsters, the picture is different. That cannot be judged from a distance. Paucitas first looks at your situation and tells you honestly what is and is not possible. Be careful with anyone who promises in advance that your money will come back. In doubt? Contact Paucitas and you will know where you stand.
Can Paucitas help me get back into my own wallet?
Paucitas can sometimes help with that. It depends on what you still have, such as part of the recovery phrase or a backup file. In the free intake we discuss whether it stands a chance.
Will Paucitas ask for my seed phrase?
Paucitas never asks for it by chat or email. A trustworthy party does not ask for it and does not promise results. Anyone who does is often not to be trusted.
Is an investigation still worthwhile if the hack was months ago?
Paucitas finds that it often is. Transactions remain visible on the blockchain, so a lot can still be reconstructed later. The sooner you start, the more complete the picture usually is.
What does an investigation after phishing or a hack cost?
Paucitas tailors every investigation. You receive a bespoke quote in advance, which we go through together, so there are no surprises. The intake is free.
Short answers
Is your question not covered here? See short answers to common questions about crypto investigation or the explanations of blockchain and cryptocurrency terms.
Your own situation
If you are reading this, you probably have a question about your own situation. That is exactly what Paucitas does.
The first step is contact by phone. You can book that call by phone or through the contact form, so you do not have to wait. In the call we look together at what can factually be established in your case and what Paucitas can examine for you.