Short answers for people meeting this for the first time.
Most people reading this have just lost something and have never needed to understand a blockchain before. These explainers assume no prior knowledge and do not pretend the subject is simpler than it is.
What should you do first after crypto is stolen?
After crypto is stolen, four things matter and their order matters: stop any further payments, preserve evidence including transaction hashes and screenshots, secure remaining accounts and wallets, then report the theft to IC3 and your local police. Blockchain tracing comes after those steps and works best when they happened quickly.
What a transaction hash is and why we ask for it
The single most useful thing you can bring to an assessment, what it identifies, and where to find it in common wallets and exchanges.
Reading a blockchain explorer for the first time
How to verify for yourself that a transfer happened, what the fields mean, and which ones matter for an investigation.
What 'exposure' means in a risk score
Direct against indirect exposure, why hop distance changes the figure, and how to compare two scores without misreading them.
Why an address is not a person
The gap between an address and an identity, what closes it, and why chain analysis alone never does.
What happens after you submit a case
Triage, assessment, approval and investigation, and what you should expect to see at each stage.
How to preserve evidence after a loss
What to screenshot, what to export and what to write down, in the order that matters most.
Understanding clustering heuristics
What common-input ownership actually proves, where change-address detection breaks, and how much weight a cluster deserves.
Reporting a theft to law enforcement
What a report generally needs to contain, and why reporting still matters when you have also engaged an investigator.
If you have just lost funds, do these four things first.
Stop
Send nothing further, sign nothing further, and do not respond to anyone offering help.
Preserve
Screenshot everything. Copy every address and transaction hash into a plain text file.
Secure
Change passwords, enable multi-factor authentication, and move any remaining assets to a wallet whose keys have never been shared.
Report
File with your national fraud reporting body, and with your bank if a card or transfer was involved.