You open your wallet and find USDT missing, with a transfer you do not recognize. The immediate temptation is to search for someone who promises recovery. First, limit further exposure and preserve a clear record. A police report, platform request or technical investigation will be much more useful if another person can reconstruct exactly what happened.

Confirm what happened on the correct network

Identify the network, wallet address and token. USDT on TRON and USDT on Ethereum are different records to investigate. Using a verified block explorer, check the relevant transaction, its status, sender, recipient, quantity, time and time zone. Record the token contract where needed. A screenshot of a lower balance alone may not establish how the asset left your control.

An unauthorized transfer calls for investigation of both exposed keys and malicious token approvals. Those are different problems. imToken’s security guidance discusses them separately: changing the wallet app’s local password does not by itself restore control over an on-chain account or revoke an approval. imToken’s stolen-wallet guidance

An imToken tutorial screenshot warning that token approvals can let another party transfer assets
Source: imToken’s stolen-wallet guidance, retrieved September 9, 2026. This is the provider’s genuine tutorial screenshot, not a client’s theft record. The Chinese warning describes the consequences of granting transfer approval.
  1. The warning concerns authority to move tokens. Changing the app password does not revoke an on-chain approval.

Protect what remains without signing blindly

If the recovery phrase or private key may be compromised, importing the same phrase into a different app does not create a safe new wallet. Consider moving assets you still control to a wallet with entirely new keys, after establishing that the device and signing environment are trustworthy. If the problem is a malicious approval, investigate and address that approval; revocation cannot repair a leaked private key. While the cause remains uncertain, avoid repeatedly funding an abnormal wallet for fees or signing instructions from an unverified support contact.

Create a record someone else can follow

Keep two connected records: the on-chain movement of assets, and the events that led to it. For each transaction, retain the network, addresses, amount, time, hash and original explorer link. For the surrounding events, preserve complete messages, relevant web addresses, download sources, payment records and prompts you were shown. Keep originals separately from explanatory copies. Removing inconvenient context can make an otherwise useful record harder to assess.

FBI guidance listing cryptocurrency addresses, amount and type, date and time, and transaction hash
Captured September 9, 2026. Source: FBI guidance dated August 24, 2023. The FBI labels the addresses and transactions as fictional examples. The evidence fields are useful reference points; the US reporting route does not replace procedures in China or another jurisdiction.
  1. Keep these fields together as one transaction record. Add the network, token contract address and original explorer link.

Also explain why the assets were yours in the first place. Depending on the facts, exchange withdrawal records, purchase records or evidence of the underlying business transaction can connect your prior holdings with the unauthorized transfer. Retain receipts, submission dates and case or support references when providing necessary documents to verified recipients. A seed phrase is not a document to send to a stranger as proof of ownership.

Does an exchange label guarantee recovery?

No. A label assigned by a blockchain tool is a lead, not conclusive proof that a particular platform controls the receiving address. Report promptly to the appropriate police authority and contact any relevant platform through verified channels with verifiable transaction records. Ask about preservation requests and its law-enforcement process. Restrictions, disclosure and return of assets depend on the facts, the recipient’s powers and applicable procedures. A wallet software provider, token issuer and custodial exchange do not have interchangeable capabilities.

Treat demands for an advance “tax,” “unfreezing fee” or guaranteed recovery with particular caution. The FBI’s public guidance warns that a person offering to recover lost cryptocurrency may be operating another scam. Check identity, channels, scope of work and claims before relying on screenshots of alleged successes. No screenshot can establish a guaranteed outcome for your case. FBI guidance

← Back to Upwell Insights