The Cryptocurrency Asset Recovery Blueprint

If an unauthorized party obtained your 12 or 24-word recovery phrase:

1. Immediately evacuate remaining capital: Generate a fresh seed phrase on an uncompromised hardware wallet (Ledger, Trezor) and transfer remaining tokens and native coins immediately.
2. Decommission the compromised address: The address must never receive future deposits. Automated attacker sweepers will permanently monitor the key.
3. Engage professional tracing for evacuated sums: If substantial funds were swept, CLUE traces the exfiltration transaction to identify the perpetrator’s primary collection wallet.

Phishing schemes exploit `approve` or `setApprovalForAll` functions to grant external contracts unlimited permission to pull your ERC-20 tokens or NFTs.

1. Evacuate unaffected tokens first: Do not waste valuable minutes trying to revoke permissions if high-value assets remain in the wallet. Move unaffected tokens to cold storage first.
2. Revoke allowances via verified interfaces: Use established tools like Revoke.cash or the official block explorer's approval checker to revoke open allowances.

The vast majority of stolen cryptocurrency terminates at centralized exchanges (Binance, Coinbase, Kraken, OKX) where perpetrators cash out into fiat currency.

1. Exchanges require accredited legal standing: Exchanges will not freeze funds on informal messages from victims. They require certified forensic packages and law enforcement preservation letters.
2. CLUE coordinates directly with counsel and prosecutors: We produce court-admissible forensic accounting packages and liaise directly with investigating detectives and exchange compliance departments to freeze accounts before withdrawal.