Emergency contacts

Funds moving right now → SEAL 911 first. Everything else → file official reports in your jurisdiction. All of these are free. None of them will ever ask for your recovery phrase or private key — anyone who does is the scam.

Active drain in progress — minutes matter

SEAL 911 — crypto incident emergency hotline. The Security Alliance's free emergency channel for live thefts; they coordinate with exchanges and issuers on freezes. Reach them only via seal.org (type it — do not follow DMed links). No fee, no phrase, ever. Even if funds are already gone, report anyway — their triage feeds the freeze process that recovered ~$10M in this incident (reported).

Move remaining funds — only to a fresh seed. Generate a new recovery phrase on a device with clean provenance (ledger.com direct, or a reputable software wallet on a clean machine) and move what's left. Never reuse or re-enter the burned phrase — including into "migration tools" sent to you.

Note the thief's addresses and txids. Copy them from your wallet history or a public block explorer and hand them to police and SEAL 911. Addresses and txids are public data — safe to share. Your phrase is not.

Vendor channel

Ledger official support — support.ledger.com. Open a ticket yourself by typing the address. Ledger's genuine support will never ask for your 24 words, your PIN, remote access, or payment. Report your device channel and serial range concerns there — vendor records are what drive official recall/replacement programs.

Report by jurisdiction

United States — FBI IC3 (ic3.gov). File under cyber-enabled fraud/theft. Lead with your loss and the drain txids; name the purchase channel. Save your complaint ID — cite it in every other filing. Also report to the FTC (reportfraud.ftc.gov) and your state AG's consumer-protection office.

Malaysia — CCID (Royal Malaysia Police Commercial Crime Investigation Department) + KPDN. Police report to CCID (via any police station or the CCID channels) for the theft; consumer complaint to KPDN (Kementerian Perdagangan Dalam Negeri dan Kos Sara Hidup) for the retailer angle — CryptoBilis is a Malaysian company. Bring purchase proof, device photos, drain txids.

Japan — National Police Agency cybercrime / your prefectural police cyber division. File at your local police station or via the NPA cybercrime consultation channels (9098 advisory line; #9110 for urgent). Metapod/Amazon JP/Yahoo Auctions purchasers: note the seller entity from your invoice. Consumer affairs: your local shohi-seikatsu center (消費生活センター) hotline 188.

Singapore — Singapore Police Force + CASE. Police report online (eservices.police.gov.sg) or at a Neighborhood Police Centre — Metapod Changi purchases fall under SPF jurisdiction. Consumer issues to CASE. IMDA/CSA for the supply-chain dimension.

Germany — Landeskriminalamt (LKA) of your state. Online-Wache (online police report portal) of your Bundesland, or in person — supply-chain hardware tampering is a criminal matter; mention the MediaMarkt Saturn purchase channel. Consumer: Verbraucherzentrale. EU-wide: report via Europol channels where applicable.

Philippines — PNP Anti-Cybercrime Group / NBI Cybercrime. File with PNP-ACG (acg.pnp.gov.ph) or NBI. Bring purchase proof and txids.

Indonesia — Bareskrim Polri cyber / patroli siber. Report via patrolisiber.id or a POLRES cyber unit.

France / other EU — your national cyber portal. France: PHAROS (internet-signalement.gouv.fr) and a gendarmerie/police plainte. Other EU states: your national cybercrime portal + consumer-protection agency.

Elsewhere — your national cybercrime reporting body. Every affected buyer's report matters: cross-jurisdiction volume is what escalates this to coordinated enforcement.

Consumer / refund channels

Your payment method may reverse the purchase. Card purchases: chargeback/dispute with your issuer — cite "goods not as described / compromised product." Marketplace purchases: Shopee/Lazada/Amazon/Yahoo buyer-protection claims have their own windows — file promptly. Keep the retailer statement date (~Oct 19, 2026, reported) in mind — a formal recall strengthens every claim.

What you'll need for most reports

Purchase channel + date + seller entity (from invoice/order page)
Device model and serial range (first/last characters)
Drain txids / thief destination addresses
Approximate loss per chain, in your local currency and USD
Photos of packaging/device (packaging only — never recovery cards)

Never include: recovery phrase, private keys, PIN, full serial number, passwords, or ID documents unless an official form explicitly requires ID.