Most of what makes a cryptocurrency case workable is captured or lost in the first few hours after discovery, not weeks later once an investigation formally begins. Session logs expire, device state changes, and memory of exact timestamps fades quickly. Treat the first day as a documentation exercise before it becomes anything else.
Lock down what is left
If any part of the affected wallet, exchange account, or connected application is still accessible, stop interacting with it beyond what is needed to secure it. Do not attempt to move remaining funds through the same device or browser session that may have been compromised, and do not sign any further transactions until you understand how access was lost.
Document before you do anything else
Record the transaction identifier of every unauthorized transfer, the sending and receiving wallet addresses, and the exact time each transaction was confirmed. A screenshot of the transaction as it appears on a block explorer, including the visible timestamp, is usually enough to start from. Save any phishing email, suspicious message, or unexpected account notice exactly as it arrived, rather than summarizing it from memory later.
If a device may have been the point of compromise, avoid resetting or wiping it until it has been reviewed. A factory reset often destroys the exact evidence of how access was obtained in the first place.
Watch for the second scam
A theft frequently draws a second approach within days, someone claiming they can recover the funds quickly if paid an upfront fee first. Legitimate investigative work does not begin with a guaranteed outcome or a payment demanded before any analysis has taken place. Treat any unsolicited contact along these lines as a warning sign rather than a lead.
What to do once the immediate steps are covered
Once the account is secured and the record is captured, the next reasonable step is deciding who reviews it, an investigator, counsel, or both depending on the amount involved and whether a business or an individual is affected. There is no requirement to have every detail perfectly organized before reaching out. A rough but early record is worth more than a polished one assembled a week later.