What to Do If Your Crypto Is Stolen in India

First, contain it

Before investigating anything, stop further loss.

Move remaining assets to a wallet generated from a new seed phrase. Not a new address from the same seed — if the seed is compromised, every address it generates is compromised.
Revoke token approvals on the affected wallet if funds remain.
Change passwords on the associated email and every exchange, from a device you believe is clean.
Rotate two-factor to an authenticator app and revoke existing sessions and API keys.

Then document

Every transaction hash involved, and the addresses funds moved to.
Timestamps, and what you were doing when it happened.
Any site, message or contact involved, with screenshots.
Your own holdings before and after, with values.

This documentation is what any subsequent process depends on, and it is much easier to gather now than weeks later.

Where to report in India

National Cyber Crime Reporting Portal — the central channel for cybercrime complaints in India, including financial fraud.
Local police cyber cell — file a written complaint; ask for an acknowledgement.
The exchange, if the theft involved an account or funds moved to a platform. Exchanges can sometimes freeze deposits if contacted quickly.

If stolen funds move to an exchange, speed is the only thing that matters. Exchanges act on documented law-enforcement requests, so the police complaint and the exchange report should happen in parallel rather than in sequence.

An honest assessment of recovery

Recovery is uncommon. Blockchain transactions are irreversible by design, attackers are frequently outside Indian jurisdiction, and funds are typically moved through mixers or across chains quickly.

Where recovery does occur, it is almost always because funds landed at a regulated exchange that froze them following a law-enforcement request, within a short window. That is the scenario worth acting fast for; it is also the minority of cases.

Recovery scams

People who have just lost crypto are actively targeted by a second fraud offering to recover it for an upfront fee. These are always fraudulent. No legitimate service recovers stolen crypto for a fee, and no one can reverse a blockchain transaction.

Treat any unsolicited offer of recovery, particularly one arriving shortly after you posted about the loss publicly, as part of the same attack.

The tax position

Under Section 115BBH, crypto losses cannot be set off against any income or carried forward. There is no statutory relief for theft. If you realised gains elsewhere in the same year, those remain fully taxable regardless of what was stolen.

Keep the documentation anyway. If a matter is ever pursued or a recovery occurs, contemporaneous records are what make the position provable.

Tracing, and what it is actually worth

Blockchain transactions are public, so stolen funds can usually be followed. Block explorers show where funds moved, and several services label addresses belonging to exchanges and known services.

Tracing is useful for one specific purpose: establishing that funds reached a regulated platform, which gives law enforcement somewhere to direct a request. It does not, by itself, recover anything, and paying a private service to produce a trace rarely changes the outcome.

Working with the exchange

If funds landed at an exchange, contact its compliance or law enforcement team with the transaction hashes, the receiving address, and your police complaint reference. Exchanges generally cannot act on a user report alone, but a documented complaint gives them a basis to review.

Time matters enormously. Funds typically move on within hours, and once converted and withdrawn there is nothing to freeze.

What to preserve

Screenshots of wallet state before and after, with timestamps.
Full transaction hashes and destination addresses.
The complete history of any communication with the attacker.
Device logs, and the device itself if malware is suspected — do not wipe it before it is examined.
Your police complaint acknowledgement and any reference number.

The harder question: how did it happen?

Before using any wallet again, establish the cause. If the seed phrase was compromised, every wallet derived from it is compromised, including addresses you have not used. If the device is infected, a new wallet created on that device is compromised immediately.

The common failure after a theft is creating a new wallet on the same machine, restoring habits unchanged, and losing funds a second time. Treat the device as untrusted until you have established otherwise.