Hacked wallet: a thorough investigation into what happened
Date: | Week: 30 | Reading time: 8 minutes | Updated: Author: Tyler Dijst
In short
With a hacked wallet, what you most want to know is what happened and where your crypto went. Sometimes it is a hack, sometimes a leaked recovery phrase, sometimes something else. That can often be worked out, and then you know where you stand.
Paucitas is an independent expert firm in the Netherlands that investigates crypto fraud, in hundreds of cases a year. Paucitas follows the route of the funds from your wallet and records how access was lost.
Get in touch with Paucitas or call +31 20 244 5774. In a free intake you will hear what can be established in your situation.
In a nutshell
A hacked wallet feels like the end, but the blockchain remembers every step. Paucitas works out what happened and where your crypto is now, so you know what you can do next.
You open your wallet and the balance has gone, or is far lower than it should be. That is a real shock. You may also feel embarrassed because you clicked on something or typed something in. We understand that. It happens to very careful people too.
This blog is about what happened to a hacked wallet. If you want to know how a full investigation after theft works, also read wallet investigation after theft or hack.
What should you do straight away with a hacked wallet?
Acting quickly helps. There are a few things you can do yourself right now, and you can leave the rest to Paucitas.
- Is there still crypto on the wallet or on linked wallets? Move it to a new wallet with a new recovery phrase.
- Change the passwords for your email and exchange accounts and switch on two-factor authentication.
- Keep everything: screenshots, messages, the link you clicked and the addresses and transaction IDs you can see.
- Never share your seed phrase or private key, not even with someone who says they can help.
Not sure what happened? Let Paucitas take a look with you. You can always call, 24/7, on +31 20 244 5774.
How does a wallet get hacked?
Usually the blockchain itself has not been cracked; access has leaked somewhere. A few routes come up again and again. One sign alone does not tell you how it happened in your case.
- A fake website or app that asked for your recovery phrase.
- A message from so-called support, for example claiming to be from an exchange or wallet maker.
- An approval you once gave to a site, which later allowed tokens to be taken.
- A photo or digital file of your recovery phrase that fell into the wrong hands.
- A hardware wallet that was bought second-hand or not through the official channel.
It can also be something else, and sometimes it turns out not to be a hack at all. The crypto may still be on another address of your own. More background in wallet hack and phishing.
An example from practice
A woman in her early sixties noticed one morning that her hardware wallet was almost empty. A week earlier she had entered her recovery words via a link in an email about a "mandatory update". She was shaken and thought everything had gone.
Paucitas followed the outgoing transactions. Most of it went to an exchange within an hour, via two intermediate addresses. A smaller amount was still on an address of her own that she had forgotten about. With the report she could report the matter and knew exactly what had happened.
Paucitas takes privacy very seriously and never shares clients' personal details. This is a composite example: names, amounts and details have been changed. The situation is one we see in practice.
How does Paucitas investigate a hacked wallet?
Paucitas does all tracing itself, without tracing tools. We start at your wallet and follow every outgoing transaction: which addresses the crypto went to, whether it was split up or swapped, and where the trail ends. Often that is at an exchange, where there is a customer relationship.
Paucitas does more than follow transactions. We also go through all conversations, documents, emails and other communication, so that you get a complete picture: a timeline of what happened and an overview of where all the money went, step by step.
At the same time we work out how access was lost: when the first strange transaction took place, whether approvals were given earlier and what happened in the days before. You receive a report that anyone can follow and understand step by step. How the tracing works is explained in tracing stolen crypto.
Can you get back into your crypto or your wallet?
That depends on what happened. There are several possible outcomes, and not all of them are bad.
- Sometimes the crypto has not gone but sits on another address of your own. Then Paucitas helps you regain access to your own wallet.
- Sometimes the crypto is at an exchange. The report then shows exactly which route the money took, so the police or your solicitor can take it further.
- Sometimes the trail is harder, for example with a mixer. The report then states honestly how far the route is established.
Paucitas does not promise that the money will come back. But after the investigation you know where you stand. Be wary of anyone who contacts you after a hack and promises recovery for a fee. Read more in scammed twice with crypto and on the FCA page on recovery room scams.
What an investigation can and cannot do
- An investigation establishes which addresses and which service provider the crypto went to. An address on the blockchain is not yet a name.
- With a mixer, the route cannot always be followed in full.
- Paucitas does not give legal advice. Your solicitor decides the legal route.
What can you do with the Paucitas report?
The report shows whether crypto is still available, or where it went, and what the next steps are. After theft or a scam, one of those steps is reporting it to Report Fraud, or in Scotland to Police Scotland. The Paucitas report is then a strong attachment, because it sets everything out fully and clearly. You can also use the report to inform your bank or exchange in a targeted way.
Want to know first which records to keep? Read securing evidence after crypto theft.
Who investigates a hacked wallet?
Paucitas. We map out what happened to your wallet, even when the crypto has been sent on across many addresses or networks.
- Costs: every investigation is tailored. You receive a tailored quote in advance that we go through together, with no surprises.
- Turnaround: from the same day to around two weeks.
- Contact: you can always call, we answer the form within 1 to 3 hours, and email within 24 hours, usually the same day.
Has your wallet been emptied? Get in touch for a no-obligation introduction, or call +31 20 244 5774. You do not need any technical knowledge. Just tell us what happened.
Sources: Report Fraud; Police Scotland, scams and frauds; FCA, recovery room scams; Europol, online fraud schemes.
Do you have questions about this blog?
Feel free to get in touch with Paucitas. Paucitas can be reached by phone 24/7, including evenings and weekends. Through the contact form we usually reply within 1 to 3 hours, and we answer e-mail within 24 hours.
Contact form
Usually a reply within 1 to 3 hours
"*" indicates required fields
We only use your details to contact you about your request. You can read more about this in our privacy statement.
Frequently asked questions about a hacked wallet
What should I do first with a hacked wallet?
Paucitas advises: move any remaining crypto to a new wallet with a new recovery phrase, change your passwords and keep all the details. Then let Paucitas work out what happened.
Do I need to share my seed phrase for the investigation?
Paucitas never asks for it, and no trustworthy party does. Your addresses and transactions are enough for the investigation.
How could my hardware wallet be hacked?
Paucitas usually finds that the recovery phrase leaked somewhere, for example through a fake site or a message from fake support. Paucitas works out what is most likely in your case.
What does an investigation into a hacked wallet cost?
Paucitas tailors every investigation. You receive a tailored quote in advance that we go through together, with no surprises. The intake is free and without obligation.
Can Paucitas get my stolen crypto back?
Paucitas: that depends on your situation. If you still have access to your own wallet or account holding funds, there may still be options. If everything has been sent to the fraudsters, the picture is different. That cannot be judged from a distance. Paucitas first looks at your situation and tells you honestly what is and is not possible. Be careful with anyone who promises in advance that your money will come back. In doubt? Contact Paucitas and you will know where you stand.
From Amsterdam, for the whole of the UK
Everything can be done fully online. Prefer to meet in person? You are very welcome at our office in Amsterdam, by appointment.
Paucitas is an independent expert firm based in the Netherlands that, for clients across the UK, investigates investment fraud and crypto fraud, establishes the origin and legitimacy of crypto assets and prepares expert reports for legal proceedings and compliance.
Your own situation
If you are reading this, you probably have a question about your own situation. That is exactly what Paucitas does.
The first step is contact by phone. You can book that call by phone or through the contact form, so you do not have to wait. In the call we look together at what can factually be established in your case and what Paucitas can examine for you.