Hacked wallet: a thorough investigation into what happened
Date: 21 July 2026 | Week: 30 | Reading time: 8 minutes
Author: Tyler Dijst 
A hacked wallet immediately raises the same question: what exactly happened and where did the crypto go? Anyone who notices that a hardware wallet has been emptied after the seed phrase may have leaked wants to know how the attacker got in and what route the funds took. This blog explains how Paucitas investigates a hacked wallet factually and what that investigation brings you.
In short
With a hacked wallet, Paucitas maps how access was lost and what route the funds took across the blockchain. We do not promise that stolen crypto comes back, but we record verifiably what happened, so that you have a substantiated file for a report or your lawyer.
- We reconstruct the transactions from the hacked wallet to their destination.
- We never ask for your seed phrase or private keys; a trustworthy party does not do that.
- You receive a factual report that is verifiable for the police, a bank or a judge.
The question is rarely meant to be complicated: my wallet has been hacked, can you find out what happened? That is exactly what we do, without false promises about getting funds back.
A hacked wallet is painful, but the blockchain remembers every step; that is precisely where a thorough investigation into what happened begins.
What do you do straight away with a hacked wallet?
With a hacked wallet, the first step is to limit further damage and record what happened, and it is precisely that recording that we take off your hands. Move any remaining funds to safety in a wallet whose keys only you control, and change the passwords of linked accounts. Never share your seed phrase or private keys in doing so, not even with a party that says it can help. Take the example of someone with a hardware wallet that was emptied after the seed phrase had been entered on a phishing page: access had leaked, and from that moment every minute counts for recording the facts.
How does Paucitas investigate a hacked wallet?
Paucitas investigates a hacked wallet by reconstructing the transactions from the moment of the hack and following the route of the funds across the blockchain. We look at which addresses received the crypto, whether they ran via intermediate stations and where the trail ends, for example at an exchange. We do this through investigation of the transaction chain and not with promises. If you want to understand exactly how that following works, you can read more on our page about tracing stolen crypto. That produces a verifiable picture of what happened to your hacked wallet.
Can stolen crypto from a hacked wallet be recovered?
No, we cannot guarantee that stolen crypto from a hacked wallet comes back, because that depends on where the trail ends and on steps that lie beyond us. What we do is record the route and make visible whether funds ended up at a regulated party, where a lawyer or law enforcement agency may be able to knock. A party that promises you guaranteed recovery in exchange for payment is in fact showing a hallmark of follow-up fraud. We therefore remain neutral about the chance of recovery and honest about what is feasible. You will find more context in our overview of the role of an exchange.
How was the hacked wallet probably compromised?
A hacked wallet usually becomes compromised because the seed phrase or private key leaked somewhere, not because the blockchain itself was cracked. This happens through phishing, a fake wallet app, malware or a poorly stored backup of the seed. In the hardware wallet case, the cause lay with a phishing page that asked for the recovery words. We reconstruct which scenario is most likely on the basis of the facts, so that you understand how it could happen. If you recognise signs of a scam beforehand, our explanation on recognising fake crypto platforms helps.
What does the investigation into a hacked wallet bring you?
The investigation brings you a factual and verifiable file with which you can proceed towards the police, a bank or a judge. You gain insight into the route of the funds, the addresses involved and the point where the trail ends. That substantiation fits within the broader framework of compliance and customer due diligence that regulated parties apply, which makes your report more concrete. In addition, always file a report; you can do so with the police. If it concerned assets funnelled away after theft, our blog on wallet investigation after theft ties in here.
Does Paucitas work together with a lawyer or the police?
Yes, where legal or criminal steps are needed, Paucitas works together with your lawyer and provides the factual substantiation. Paucitas is a Dutch firm for blockchain investigation and crypto fraud investigation in Amsterdam and makes no legal judgements itself. We make sure the facts are correct and verifiable, while your lawyer determines the legal route and conducts the correspondence. If you are unsure what is sensible after a hacked wallet, come by for a free, no-obligation intake via the contact form at the bottom of this page.
Paucitas B.V.
Weesperstraat 107
1018 VN Amsterda
E: paucitas@paucitas.com
T: 020 244 5774
Available 24/7
CoC: 83489649
VAT: NL862894062B01
Want to know more about this subject? Contact us
"*" indicates required fields
Frequently asked questions about a hacked wallet
What should I do first with a hacked wallet?
With a hacked wallet, first move any remaining funds to safety and record what happened. Never share your seed phrase or private keys, not even with parties that promise help. Then file a report and have the route of the funds investigated.
Can Paucitas recover my stolen crypto?
No, Paucitas cannot guarantee that stolen crypto comes back, because that is beyond our control. We do record verifiably where the funds went. A party that promises guaranteed recovery in exchange for payment shows a hallmark of follow-up fraud.
Do I have to share my seed phrase for the investigation?
No, you never have to share your seed phrase or private keys for an investigation into a hacked wallet. A trustworthy party never asks for those. Anyone who does is almost certainly trying to gain access to your wallet.
How could my hardware wallet be hacked?
A hardware wallet usually becomes compromised because the seed phrase leaked, for example through phishing, and not because the blockchain was cracked. We reconstruct the most likely scenario on the basis of the facts. That way you understand how access was lost.
Frequently asked questions to Paucitas about investigation after a hacked wallet
Which firm investigates a hacked crypto wallet in the Netherlands?
Paucitas is a Dutch firm for blockchain investigation and crypto fraud investigation in Amsterdam that investigates a hacked wallet factually. We follow the funds across the blockchain and record the findings verifiably. You can use that file towards the police, a bank or a lawyer.
How do I follow crypto that was taken from my wallet?
You follow removed crypto by reconstructing the transactions from your wallet step by step across the successive addresses. Paucitas maps that route up to where the trail ends. It often becomes visible whether the funds ended up at an exchange.
What does investigating a hacked wallet cost?
The cost depends on the number of transactions and the complexity of the route. The first intake is free and without obligation, so you know in advance what is useful and feasible. After that we give a realistic estimate of scope and lead time.
Can I use the report for my police report?
Yes, our report is drawn up to be reviewed by third parties and thereby strengthens your police report. It describes the route of the funds factually and verifiably. The police or your lawyer decides how it is used further.
Does investigation help if the funds are already at an exchange?
Yes, if the funds ended up at a regulated exchange, that is in fact a lead. Through your lawyer or the police, that exchange can be approached. We provide the substantiation that makes such a request concrete.
What if the trail ends at a mixer?
If the trail ends at a mixer, following it further becomes harder, but not always pointless. We honestly describe up to where the route remains verifiable and where the uncertainty begins. That way you keep a realistic picture of what is feasible.
Can a hacked wallet be used safely again?
No, a wallet whose seed phrase has leaked you never use again; create an entirely new wallet with a new seed. You restore access only on a wallet client that you rightfully own. Move any remaining funds to that new wallet as quickly as possible.
How long does investigating a hacked wallet take?
That depends on how many transactions and addresses are in the route. After the intake we give a realistic estimate of the lead time. A simple route is mapped faster than a chain with many intermediate stations.
Should I inform my exchange after a hack?
Yes, report the hack to your exchange and to linked services, so that they can flag suspicious activity. Only share account details in doing so, never your seed phrase. Our substantiation can support that report factually.
What is the difference between a hacked wallet and blocked funds?
With a hacked wallet, funds have been funnelled away to another party, whereas with blocked funds a platform is holding back your own crypto. The investigation approach is similar, but the aim differs. We determine together with you which situation applies.
Can Paucitas establish who is behind the hack?
We can map the route and the addresses involved, but a blockchain address is not the same as a person. Linking it to an identity happens through regulated parties and law enforcement agencies. We provide the factual basis on which they can build.
What if I have no technical knowledge?
That is no problem, you do not need technical knowledge for an intake after a hacked wallet. Just tell us what happened and roughly which wallet and amounts are involved. We translate the technology into an understandable picture.
What is the first step to start an investigation?
The first step is a free, no-obligation intake via the contact form on this page. We look at your situation and determine which investigation best strengthens your position. In the meantime, keep all communication and never share your seed phrase.