How to Report a Malicious Wallet Address

When people ask "can I just report this wallet and get my money back," they are usually thinking of it as a single action — submit a form, get a result. The reality is that reporting is not one step; it is a coordinated set of reports, each aimed at a different outcome. Some reports are about freezing funds today. Some are about triggering a criminal investigation. Some are purely defensive, warning future potential victims. Knowing which report achieves which outcome is the difference between useful action and wasted effort.

This guide walks through the major reporting channels in the order you should use them, starting with the highest-impact actions.

Priority 1 — The Exchange Holding the Funds

If your forensic trace (or even a simple blockchain explorer search) shows that the stolen funds have landed at a known exchange, this is the highest-leverage report you can file. Major exchanges have law enforcement / compliance teams that will freeze funds on receipt of a credible report, often within a few hours. See when stolen crypto can realistically be recovered to understand what happens next.

How to Submit

• Use the exchange's published compliance contact, not general support. Major exchanges (Binance, Coinbase, Kraken, OKX, Bitget, Bitfinex) publish dedicated law enforcement portals.
• Include: your identity, the stolen wallet address, the transaction hash to the exchange's deposit address, the timestamp, and a short narrative of the fraud.
• Attach any forensic evidence — a tracing report, screenshots of the scam platform, or communication with the scammer.
• If a professional investigator is working the case, they should file this report directly through their own compliance channels.

Priority 2 — IC3 (Internet Crime Complaint Center)

IC3 is the FBI's online reporting portal for cybercrime, accessible at ic3.gov. A filed IC3 report is the foundational document for any subsequent federal investigation. Many local law enforcement agencies will not move on a crypto fraud case until an IC3 complaint exists.

What to Include

• Victim contact information, losses (in USD at time of loss), and incident description.
• Every scammer-controlled wallet address known to you.
• Every transaction hash from your wallet to the scammer's wallets.
• Platform URLs, usernames, and contact methods used by the scammer.
• Bank or wire transfer details if fiat movement was involved.
• A PDF of the forensic report, if one exists.

Keep the confirmation number. You will reference it when contacting local law enforcement, banks, and exchanges.

Priority 3 — The FBI and Secret Service

For losses above roughly $100,000 — or smaller losses that are part of a pattern (e.g., pig-butchering linked to known groups) — go beyond IC3 to direct contact with a field office. The FBI's Cyber Division and the Secret Service's Cyber Fraud Task Forces both investigate crypto theft.

The practical path:

• File IC3 first and keep the case number.
• Call the local FBI field office or schedule an appointment. Bring the IC3 confirmation, the forensic report, and any documentation.
• If the loss involves wire transfers, the Secret Service is often the better fit because their mandate includes financial fraud.
• Follow up in writing. Verbal reports evaporate; written correspondence creates a paper trail.

Priority 4 — State-Level Authorities

State financial regulators and attorney general offices have increasingly taken a role in crypto fraud enforcement. California's Department of Financial Protection and Innovation runs the Crypto Scam Tracker database. New York's Department of Financial Services has pursued exchange-level enforcement. Your state attorney general's consumer protection division is typically the right contact.

Priority 5 — Blockchain Analytics and Tagging Services

Reporting to these services does not directly recover funds, but it "taints" the wallet in commercial databases used by exchanges, DeFi protocols, and enforcement. Once tagged, future attempts by the attacker to cash out through a regulated venue are substantially harder.

Public Reporting Channels

• Chainabuse — an open public scam reporting database operated by TRM Labs. Free to use.
• Crypto Scam Tracker — California DFPI's public database.
• Etherscan / BscScan / Tronscan — most explorers accept scam reports that become visible as warning labels on the address.
• ScamSniffer, Forta, and similar community databases.

Private Reporting Channels

Chainalysis, TRM Labs, Elliptic, and Merkle Science all maintain private scam databases. Direct individual reporting is limited; working through a professional forensic firm is the typical path to getting an address tagged in these tools.

Priority 6 — Platform Reports

Report the scam to the platforms used to contact you, which may take down the scammer's accounts and preserve records for future legal process:

• Telegram — @notoscam or in-app report.
• WhatsApp — block and report via chat settings.
• Meta (Instagram, Facebook) — scam impersonation report forms.
• TikTok — in-app report + separate support.tiktok.com fraud form.
• LinkedIn — impersonation report.
• Dating platforms (Tinder, Hinge, Bumble, Match) — most have dedicated romance-scam reporting.

Priority 7 — Your Bank

If any fiat left your checking account, brokerage, or retirement account as part of the scam, report to your bank's fraud department immediately. Even if the crypto portion is unrecoverable, wire transfers can sometimes be clawed back within 24–72 hours under certain conditions. Banks also file their own SARs (Suspicious Activity Reports) that feed into federal enforcement.

What a Complete Reporting Package Looks Like

A well-organized victim or investigator produces a single master report file that gets submitted in slightly modified form to each destination. At minimum it contains:

• One-page executive summary.
• Timeline of the scam from first contact through loss.
• Table of all scammer-controlled addresses and transaction hashes.
• Screenshots of communication with the scammer.
• Copies of any scam platform webpages.
• Identity and contact information for the victim.
• List of reports already filed, with case numbers.

Producing this once and reusing it across channels is faster, more consistent, and more credible than reporting ad hoc. Every destination gets the same story, and each subsequent report can reference prior case numbers to build a coherent cross-agency file.