How to Recover Lost Crypto

How to attempt recovery of lost or stuck crypto: seed-phrase reconstruction, address-poisoning recovery, bridge support, and when to give up.

What you'll need (prerequisites)

• Self-custodial wallet
• A second device for verification
• Block explorer (Etherscan, Solscan, etc.) familiarity

Step-by-step

1. Step 1: Diagnose the type of loss

   Recovery options depend entirely on how the crypto was lost, so identify the exact situation first: a lost or forgotten seed phrase, funds sent to the wrong network or address, tokens stuck in a bridge or contract, or theft from a scam or drainer. Gather transaction hashes, addresses, dates, and screenshots. This diagnosis determines whether any realistic recovery path even exists.

2. Step 2: Accept that a lost seed with no backup is generally unrecoverable

   Self-custodial wallets are built so that no one — not the wallet maker, not any 'recovery expert' — can restore a seed phrase you have truly lost with no backup. If only part of the seed or the password is missing, reputable open-source tools such as BTCRecover can sometimes help. But a fully lost seed with no backup means the funds are permanently inaccessible; set that expectation honestly and avoid wasting money chasing the impossible.

3. Step 3: Work the recoverable cases: wrong network, bridge, or exchange deposit

   Some mistakes are genuinely fixable. Funds sent to the correct address on the wrong EVM network can usually be reached by adding that network in your wallet, because the same key controls the address on every EVM chain. Stuck bridge transfers often resolve through the bridge's official support or a manual claim, and a wrong exchange deposit (missing memo or tag, unsupported asset) may be recoverable via that exchange's support ticket. Use only official channels for these requests.

4. Step 4: Avoid 'crypto recovery services' — nearly all are follow-up scams

   The overwhelming majority of advertised crypto recovery services are follow-up scams that prey on victims a second time. Never pay an upfront fee, never share your seed phrase or private keys, and be especially wary of 'experts' who DM you on Telegram, WhatsApp, or Instagram claiming special tools or insider access. No legitimate party ever needs your seed phrase, and no one can reverse a confirmed on-chain transaction.

5. Step 5: For theft: revoke approvals, trace on-chain, and report

   If funds were stolen by a drainer or scam, immediately revoke any active token approvals (revoke.cash) and move remaining assets to a fresh wallet on a clean device. Trace the stolen funds on a block explorer, and file reports with Chainabuse, the FBI's IC3 (US) or your local equivalent, and the receiving exchange if the funds land on a regulated platform where they might be frozen. Report quickly — freezes are only possible before the attacker cashes out.

6. Step 6: Know when escalation is realistic, and document everything

   Large thefts with a clear trail into a regulated exchange are the cases where law enforcement or a legitimate, contingency-based blockchain-forensics firm can realistically help. For most small, purely on-chain losses no recovery is possible, and the priority shifts to preventing the next one. Either way, keep a full record of hashes, addresses, and timestamps for any police report, insurance claim, or tax loss, and consult a crypto-aware accountant.

Common errors and fixes

• Approval can't be revoked due to insufficient gas. Revoke transactions cost the same gas as a normal token transfer. Top up the wallet with a small amount of native gas token before revoking.
• Funds already drained. On-chain theft is generally irreversible. Document everything, file police / IC3 / Chainalysis Reactor reports, and contact the protocol team if a known exploit. CEX-side funds may be recoverable if the attacker on-ramped to a regulated exchange.
• Suspected key leak but no losses yet. Move all funds immediately to a freshly created wallet. Burn the old seed. Audit every device the seed touched (browser extensions, cloud backups, email).
• Cannot identify the malicious contract. Use Etherscan's "advanced filter" to filter by token approvals and unusual contract calls. Run the suspicious tx through Tenderly to decode the call.
• Phishing email looks real. Always verify by typing the URL manually. Real exchanges and protocols never email asking for seed phrase, password, or 2FA codes — full stop.

FAQ