Theft of crypto-assets: hacked wallet, what to do?

The notification arrives at 6:12 a.m.: an outgoing transaction you did not sign, to an address you do not know. By the time the app opens, the wallet is empty. The day before, a “technical support” agent had asked you to confirm your recovery phrase on a page identical to your platform’s. Nobody forced a door. And yet, in law, this may well be theft, with everything that changes for the complaint, for the evidence and for those who will have to answer for the loss.

A theft of crypto-assets is handled as a whole: freezing whatever can still be frozen, preserving the evidence, filing a complaint that opens the right avenues and identifying who must answer for the loss. These steps are taken together, and in the first days.

This article deals with cases where the funds were taken without you handing them over: a stolen key, a compromised device, a hijacked platform account. If you transferred them yourself, misled by a fake platform or a fake adviser, the article to read is the one on crypto-asset fraud.

The first hours: freezing what can still be frozen

A centralised platform can freeze an account in minutes, but nothing obliges it to do so at the request of an individual. A documented report, with the transaction identifiers, the addresses and the timeline, creates no right; framed in terms of the platform’s anti-money-laundering obligations, it nevertheless fixes a date and establishes that the platform was informed. That is its use, and it is not negligible.

What compels the platform is a seizure ordered by the judicial authority. The Court of Cassation has upheld the seizure, by an investigating judge, of bitcoins held on a platform and identified through blockchain analysis¹. That measure belongs to the investigators, and its speed depends on the state of the file they receive. Your role is to make it possible: identify the first regulated link, that is, the platform through which the offender will have to convert the funds back into currency, provide the transaction identifiers and timestamps, and expressly ask for requisitions to be sent without delay.

Two time limits are already running. The data that identify the source of a connection are kept for only one year (Article L. 34-1 of the Postal and Electronic Communications Code): the requisition must go out before then. If the provider holding them is established in another Member State, a European Preservation Order makes it possible to freeze them before they disappear.

Finally, keep the device on which the key was entered, without resetting it, together with the messages and pages used to obtain it. They are what will prove the mechanism.

Theft or fraud: the classification that decides the complaint

The dividing line is the handing over. Fraud requires that you handed over the funds yourself, induced by deceptive manoeuvres. Theft requires that they were taken from you without your consent. In the world of crypto-assets, that line runs through the private key: whoever wires his ethers to a fake manager has handed them over; whoever had his key obtained through a fake page, then used without his knowledge, has been dispossessed.

It is sometimes objected that an intangible thing cannot be stolen. Yet the Criminal Chamber has accepted the taking of informational content since 1989, and has confirmed it for computer data². A crypto-asset lends itself to theft even better than data: copied data remain with their owner, whereas the transfer of a token is irreversible and dispossesses him entirely³.

Depending on the circumstances, four classifications are available: theft, unauthorised access to an automated data processing system, fraud, and breach of trust where the funds are misappropriated by a legitimate intermediary, a platform employee or a custody provider⁴. They are not mutually exclusive. A single operation may combine identity theft to obtain the key, unauthorised access to enter the account and theft to remove the assets. The complaint should cite all of them.

For a company or a professional insured against cyber risk, a further time limit applies: where the theft was committed through an intrusion into a computer system, compensation depends on a complaint filed within seventy-two hours of its discovery (Article L. 12-10-1 of the Insurance Code). This time limit does not apply to private individuals.

The trap of authorised access

A case decided in Paris shows that no classification is self-evident when the funds moved according to the rules of a smart contract. An individual had exploited a flaw in a decentralised finance protocol to withdraw the equivalent of several million dollars. The Paris Court of Appeal upheld his acquittal, rejecting three classifications⁵.

First, unauthorised access: the protocol was open by design, “anyone” being able to connect to it. Second, theft: the funds did not belong to the complaining platform, but to its users. Third, breach of trust: the loan agreement was contained entirely in the smart contract, and the funds had been handed over in full ownership.

The lesson is twofold. A complaint based on computer intrusion alone may leave the offender free. And theft is not saved merely by being invoked: it must be established who owned the funds at the time of withdrawal, and which of the platform or its users must join the proceedings as civil party.

Who answers for the loss: bank, platform, provider

If the funds left a payment account without your order, banking law offers the fastest route: the bank must immediately reimburse an unauthorised transaction, unless it suspects fraud on your part and reports this in writing to the Banque de France (Article L. 133-18 of the Monetary and Financial Code). The report must be made no later than thirteen months after the debit date, failing which the claim is time-barred (Article L. 133-24).

Where the assets were held by a platform, the answer is different. The Versailles Court of Appeal has held that this reimbursement regime does not apply to a digital asset service provider⁶. The platform’s liability is therefore sought in contract, and its defence is well known: it merely executed a transaction signed with its client’s key.

Yet custody of crypto-assets on behalf of third parties “rests on the safekeeping or control of the crypto-assets or of the means of access to those assets, in particular in the form of private keys”⁷, and the custody choices are the platform’s: connected or offline storage, a wallet pooling several clients’ holdings or a wallet specific to each. A platform that lets a client’s entire holdings leave overnight for an unknown address, without alert or delay, will have to explain its arrangements.

The bank through which the funds passed may also have to answer: it must alert its client in the presence of apparent anomalies, easily detectable by a normally diligent professional⁸. A transfer unusual in its amount, its destination or its timing may be one. This route is built on a document showing the anomaly, not on the bank’s general obligations.

Filing a complaint, and following it up

The complaint is filed with the public prosecutor or a judicial police unit, which must accept it and issue a receipt. A useful complaint identifies the providers to be requisitioned, attaches the tracing evidence and sets out the investigative steps requested. If the investigation does not progress, a complaint with civil party petition before the investigating judge becomes admissible three months after the ordinary complaint, provided it was sent to the prosecutor against receipt or by registered letter: that is sent the same day. Where several people have been targeted by the same scheme, joining the complaints is what most reliably moves a case from being dropped to a judicial investigation.

One warning, finally. Offers of “recovery” against an advance fee that follow a theft are, in almost every case, a second scheme; these operators sometimes usurp the names of existing law firms. No private provider can compel a foreign platform to return funds.

What to gather before a first meeting

• the identifiers of the outgoing transactions and the destination addresses;
• the timeline, to the minute if possible, from the first suspicious contact;
• the messages, emails and pages used to obtain the key, and the device concerned, not reset;
• the name of the platform or wallet, and your exchanges with its customer service;
• your bank statements if funds in euros were debited.

Frequently asked questions

Is stealing crypto-assets theft within the meaning of the Criminal Code?

Yes, where the taking is established. The Court of Cassation accepts the theft of intangible things and has confirmed it for computer data. A crypto-asset lends itself to it all the more since its transfer dispossesses its holder entirely.

I gave my recovery phrase to a fake support agent: am I liable?

Handing over a key obtained by deception is not handing over the funds. Depending on the facts, this is theft by phishing or fraud, and the fake page amounts to identity theft. The offence is made out in any event; the question of your vigilance arises only in the debate on the platform’s liability, and it is open to argument.

Must the platform reimburse me?

Its contractual liability is sought on the basis of its custody and vigilance arrangements: how it kept the keys, the absence of any alert on a total and unusual outflow of holdings. The statutory regime for reimbursing unauthorised payment transactions, by contrast, does not apply to a digital asset service provider.

Why not simply file a complaint for hacking?

Because unauthorised access requires access that was forbidden. On an open protocol, the Paris Court of Appeal upheld an acquittal on that ground in 2024. The complaint must also cite theft or breach of trust, and establish who owned the funds.

Can stolen funds be frozen?

Yes, if they have reached an identifiable platform. The report goes out within hours; the complaint then allows the prosecutor to have the crypto-assets seized in their holder’s account.