What should I do first after crypto fraud?

Secure your data before you do anything else. Export your transaction history, save the addresses and the messages, and do not close your exchange account.

Can I still do something if it happened weeks ago?

Yes. On-chain data remain visible for years. Speed helps, but a later start does not close off the investigation.

Does Paucitas also help with my police report?

Paucitas delivers the factual file that goes with a report. Filing the report itself remains your own step.

←Back to Questions

What should I do after crypto fraud and who can help?

By R.T. (Tyler) Dijst, blockchain investigator at Paucitas

Paucitas helps you decide what to do after crypto fraud and secures the evidence before it slips out of view. You gather your transaction data and your messages, we establish the chain of payments and record it in a report that can be checked.

What Paucitas does

We secure the evidence first. Addresses, transaction hashes, screenshots and account confirmations lose value once a platform goes offline or an exchange closes your account, so we copy and date them before anything else. Only then do we follow the money.

After that the payments are traced on the blockchain, one by one, and placed in a timeline next to the contact you had. That order matters: it keeps the account of what happened separate from the interpretation of it.

The question what to do after crypto fraud has a practical answer and an order to it: secure, record, report, then investigate. Doing them out of order is the most common and most expensive mistake, because evidence that is not secured first is often gone by the time anyone asks for it.

What you supply

You supply the addresses you paid to, your own transaction history, the bank statements of your deposits and the communication with the provider. If you still have access to the platform, export everything now rather than later.

If the platform is still reachable, download everything today: the full transaction list, the account statements, the support tickets and the profile pages of the people you dealt with. What to do after crypto fraud in the first week is mostly a matter of copying, not of deciding. Screenshots should show the address bar and the date where possible, because a screenshot without context is worth much less to a reviewer than one that shows where it came from.

What you receive

You receive a file you can take to the police, to your bank and if needed to a lawyer, with a summary that can be read in a few minutes. The step most often underestimated is requesting your own support tickets and reports from the exchange: once an account has been closed those are often no longer retrievable, while they are exactly what shows what you reported and when.

For matters in the Netherlands the file is set up so that it fits a Dutch police report and the questions a Dutch bank tends to ask afterwards.

The Dutch context matters here. A report filed with the Dutch police creates a registration, and a bank will often ask for that registration number before it will discuss a blocked payment. A factual file that matches the report makes both conversations shorter.

How to get started

Send a short description of what happened, with the amounts and the dates. We tell you the same day whether an investigation is sensible in your situation and what it would involve. The contact page is the quickest way in, and you do not need to have your documents in order before you write.

There is no charge for the first assessment, and you do not need to know yet whether you want an investigation. Many people write to us to find out what is still possible, and in a fair number of cases the honest answer is that the chain will not lead anywhere. We say so.

Whether a case leads to prosecution is for the authorities involved to decide.

Further reading